Thank you Ruud, you have an amazing array of recipes. I set these up for initial trials: # Experimenting :0 c *$ ^^From[^:].*\/$S.* { H_From_ = "$MATCH" } :0 c *$ ^From:.*\/$S.* { H_From = "$MATCH" } LOG="TESTING: $H_From_ .. $H_From $NL" The envelope-from ($H_From_) extracted things from the top "From " line, and the header-from ($H_From) extracted that in the "From: " line. In about the half of the times the envelope-from ($H_From_) caught nothing (empty). Spam mails we receive are something like From extusr@water.ne.jp Tue Nov 24 14:17:58 2020 From: "joe@mysite.org" <extusr@water.ne.jp> To: joe@mysite.org so I am afraid the envelope-from/header-from catches won't help here. Zhiliang On Wed, 18 Nov 2020, Ruud H.G. van Tol wrote:

Date: Wed, 18 Nov 2020 09:25:58 +0100 From: Ruud H.G. van Tol <rvtol@isolution.nl> To: procmail@lists.rwth-aachen.de Subject: Re: filter based on "From: " content

On 2020-11-18 00:33, Zhiliang Hu wrote:

...

To catch mail to self could be an overkill as someone could copy mail to self (multiple addresses in "To:") when people tend not to manage "Sent" box these days.

I was thinking a recipe to parse out the 2 parts in "From:" line: ?"joe@mysite.org" <extusr@water.ne.jp> which obviously is not legitimate. That's why I mentioned using 'formail'..

See (for example) H_vars.inc in https://rvtol.home.xs4all.nl/procmail/basic/pm/ on how to match and capture parts of the message into variables.

In there, $H_From_ and $H_From are separate captures: the envelope-from and the header-from.

In https://rvtol.home.xs4all.nl/procmail/basic/ there is a gl_demo.rc that shows some usage.

-- Ruud