I'm having trouble googling this one, I can't seem to find the right google search terms to get the question asked properly. Maybe because the words "and" and "or" are part of my search terms. I'm hoping that the Empeg Braintrust will know this one.

I have created a very basic Outlook rule which looks like this (this text is transcribed directly from the outlook rule description screen):
- Apply this rule after the message arrives
- from <source> or <source> or <source>
- and sent to <dest> or <dest> or <dest>
- move it to the "System Automated Messages" folder
- except if my name is in the To or CC box
- stop processing more rules

In this case, each <source> address is the email address of one of several different automated systems which spam the employees with automated messages related to the server performance, or the test systems, or the the build system, or the version control system, or whatnot. And each of the <dest> addresses is a group, like Developers, or Sales, or Managers, or somesuch.

Pretty straightforward rule, very simple, which SHOULD, if it did like it said, work fine to keep my mailbox focused on stuff that was sent to me directly, and fish through the automated spam in the "System Automated Messages" (aka spambin) folder later.

Only it's not working like it said. On the third line there's something specific that it's not doing. The "AND SENT TO" part is not working right. Despite the fact that the rule description says "AND" there, it's not really an AND, it's behaving like an OR.

So it works fine most of the time, taking messages from "buildsystem@mycompany.com" and sent to "developers@mycompany.com" and spambins them just fine, BUT... If an individual person (say, "joeuser@mycompany.com", who is not one of the designated <source> or <source> or <source> addresses) sends something to Developers, it also goes into my spambin. That's not how AND is supposed to work!

I want it so that the message has to have BOTH come from a spammer's source address AND sent to one of the designated group addresses, to be considered worthy of the spambin. According to the rule description, it should work that way, but it's not working that way.

What I can't figure out, is, using Outlook, how to force that to work how I want. The screen that lets me edit the rule sets doesn't seem to let me control that. There's just a tickybox for the senders and recipients.

Anyone know?

Is Outlook in this situation talking to Exchange or an IMAP server? If Exchange, what version? (also what version of Outlook?) Rules handling and the quirks Outlook has varies based on this.

My initial guess is that this is an Exchange environment. If it's new enough, try logging on to the web version of Outlook and check the rule there, make sure it's actually saved on the server the way your client sees it.

If you can't find rules in OWA, there is a good chance the Exchange server is pretty old.

This is Outlook 2013 talking to an Exchange server. Though I think that is irrelevant, I think that this is Just The Way Outlook Handles Rules Period.

The OWA screen lists the exact same text as the Outlook client screen does for that rule. See attached screenshot (with internal company information removed).

Aha, the problem was a different one from what I thought.

It wasn't the "To"s that were the problem.

The problem was that one of the "From" addresses in the list is both a return address from a spam server, and it's also a group list, and so any joeuser member of that group list counts as being from that group list, and thus gets included in the filter.

In other words, we get messages from the build server with a return address of "build@mycompany.com". But there is also a group list, named "mycompany build mail" with the same return address "build@mycompany.com" and which has dozens of members.

I want to spambin messages from the build server, but not spambin messages from that group list.

Should be easy, right? I just make sure that, in outlook, when creating the rule, I make sure the filter is for "build@mycompany.com" instead of the group list "mycompany build mail". Right?

Doesn't work. No matter how carefully I type it into Outlook or OWA, it always always always converts it to the group list. I can't NOT convert it into a group list when I enter it. Sigh.

Outlook doesn't process rules in an Exchange setup, the Exchange server does, at least in default configurations and rules setups Period. Only when you check something to make it a client side rule, or go beyond the limits of Exchange rules does it truly turn into an Outlook rule and run through Outlook's rule parser.

The distinction bit me quite often when dealing with Exchange on a Mac. It's taken until Exchange 2010 SP1 for them to really start cleaning this mess up and enabling their Mac Office products to deal with Exchange rules.


Yep, this is again due to Exchange handling the rule. It's been a while since I've poked at the internals of Exchange, but in the past it used it's own proprietary messaging format. Part of this is due to the age of the product, and existing in eras when not even TCP/IP was seen as the way forward, much less IMAP/POP/SMTP standards. Internet e-mail addresses are translated into whatever internal objects Exchange uses to represent destinations for the message. It sounds like in this case it's being fed "build@mycompany.com" and seeing an Exchange or Active Directory group with that set as it's internet e-mail address, and mapping to that group object.

*edit* I think I remember a weird workaround to avoid it turning the address into a group. But in searching for it, I found a cleaner workaround that may work. Look for the filter option of "with specific words in the senders address" instead of "from". Put the e-mail address in there instead.


Start looking at the raw headers for something else to filter off of. Most build systems I've used insert some sort of header into the e-mail that could be used in filters. To do this in Outlook 2013, you have to open the message in a new window (not the reading pane), go to File, Info, Properties, and look for the text area titled Internet Headers.

Bingo. That took care of it perfectly. THANK YOU!!!