<p>Thanks that explains it !! </p><p>I had copied this rule and changed the match. </p><p>H, "*.*", BSN, "554" So this rule drops anything with out a '.'</p><p>Thanks :) </p>

<P>Hi</P> <P>I added this to my transaction filters: R, "*viagra*", BSN, "'Viagra' - connection dropped."</P> <P>But this has resulted in genuine email being dropped.</P> <P>Here a copy of the log from MercuryS:</P> <P>19:40:45.296: Connection from 69.63.178.165, Mon Aug 17 19:40:45 2009<lf> 19:40:45.296: << 220-DOMAIN.COM ESMTP server ready.<cr><lf>220-220-DOMAIN.COM Mercury/32 v4.52 ESMTP server ready.<cr><lf>220-220-Use of this server for unauthorised relaying of mail is forbidden.<cr><lf>220 220 Unsolicited Commercial E-mail ("spam") is NOT WELCOME HERE.<cr><lf> 19:40:45.531: >> EHLO mx-out.facebook.com<cr><lf> 19:40:45.531: << 250-DOMAIN.COM Hello mx-out.facebook.com; ESMTPs are:<cr><lf>250-TIME<cr><lf> 19:40:45.546: << 250-SIZE 0<cr><lf> 19:40:45.546: << 250-AUTH CRAM-MD5 LOGIN<cr><lf> 19:40:45.546: << 250-AUTH=LOGIN<cr><lf> 19:40:45.546: << 250 HELP<cr><lf> 19:40:46.015: >> MAIL FROM:<<A href="mailto:notification+pdi~vh1d@facebookmail.com%3E%3Ccr%3E%3Clf">notification+pdi~vh1d@facebookmail.com><cr><lf</A>> 19:40:47.781: << 250 Sender OK - send RCPTs.<cr><lf> 19:40:47.000: >> RCPT TO:<<A href="mailto:USER@%3E%3Ccr%3E%3Clf">USER@<FONT color=#000000>DOMAIN.COM</FONT>><cr><lf</A>> 19:40:47.000: << 'Viagra' - connection dropped.<cr><lf> 19:40:47.000: --- Connection closed normally at Mon Aug 17 19:40:47 2009. --- 19:40:47.000: </P> <P>why would this get blocked ??</P>

[quote user="tomt"]R, "*viagra*", BSN, "'Viagra' - connection dropped." <P>But this has resulted in genuine email being dropped.[/quote]</P> <P>That should be just BS - the N inverts the meaning and triggers if the rcpt doesn't match.</P> <P mce_keep="true"> </P>