Home Forums Networks & Cross-Platform Networking Junk mail not in Contacts, but recognized as such

With the Junk that accumulates in the Junk folder I just add a rule "If not in my Contacts, Delete" and, usually, everything just disappears. Lately I've had Junk that remains in the Junk folder after executing that rule, even though it's not in my Contacts.

I've reviewed my Contacts app and have cleared out all the people/organizations I no longer correspond with and I also looked for Contacts that wouldn't have been added by me. I'm pretty sure the app is "clean". And yet, today I had another straggler so I just deleted it.

Anyone having a similar experience and is there a solution?

Update: Just did another review of Contacts and, at the very end past the zeds, I found five cards called No Name, without any other details. They've been deleted.

It's possible that Mail looks at recent email addresses, even if they have been removed from Contacts. In Mail, go to Window > Previous Recipients and delete anything that you no longer use.

There are literally hundreds, if not thousands of techniques to prevent simple spam blockers such as the one one in Mail from working, and although your rule would appear foolproof in its elegant simplicity it is easily spoofed. Two places to look are…

1. MAIL > Window > Previous recipients: If the sender is listed there, it is treated as if it were in the Contacts list
2. select one of the undeleted messages then press ⇧⌘H and examine all the headers to see who the message is really from

Thank you Jon and joemike. Will do.

Following is what's in the header. FYI, I did a "From contains "My email address" and that got rid of the persistent junk. So, now I'll review my Contacts and remove my email address.

To: <My Email Address>
Arc-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of dqaajfp@alba.daniloo.onmicrosoft.com designates 136.243.247.83 as permitted sender) smtp.mailfrom=dqaajfp@alba.daniloo.onmicrosoft.com; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=telus.net
Authentication-Results: mx.google.com; spf=pass (google.com: domain of dqaajfp@alba.daniloo.onmicrosoft.com designates 136.243.247.83 as permitted sender) smtp.mailfrom=dqaajfp@alba.daniloo.onmicrosoft.com; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=telus.net
Mime-Version: 1.0
Content-Type: multipart/report; boundary="IKM3IsEAz0pnHmeO5SL3xS9c9vz7SbmEhLv"; report-type=delivery-status
Arc-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:message-id:date:to:subject:from; bh=l1XVN8bbLhYMCysCXMty+VEm6VekDhWp8ZiD/0EeArk=; fh=76Nzylqf0qaYqT+iGObW9z01RTEwKHub4SR8ToJLR6E=; b=uMq9iceVVJscXVT/GN/VqLLLx0/1xpJ2h+fG/klqN0ewxIGpfLTA2LURe9DjHmov/Z p0wTFLCtomrp0KH3wjp5FR5ElLXTI8EePJHCsTtEBnd927NKY5rNPD8855Bb5vxCj+wY sc09b02dujMrFpU0LeM7wy6aV79YutfoHkkOaEBRb32TcBUmxBvomEebbTJsacADvT+o wXj7O2DG04YGETlU7VYltz7qAqv3NFbHyqAwithT4HNJKdO+i4wrupDPH127VU+H3h2B PQaT1ZYdJWF/+HVOwRfcmRop1UPVO1OYjERYLiSdyYJDfi6NNdXrZzb3eREeQFAOE7rY kaug==
Arc-Seal: i=1; a=rsa-sha256; t=1699545834; cv=none; d=google.com; s=arc-20160816; b=CUjBL3AquU19Q/AcUzorY6qw9eYYXTMv3B3JSWujpw0t9BgwgHw5e5tjjvbrRwQtXZ 34wfLHAV+w/bNCMx+IJxFl5fIcJnLLWaUPuRfuIbSLJ6vc/Rs0Cgp0veKa+StLuME0WC jMc0smHyUJFd5asILpzQkWDQvRCh+pwnVFzsRdK7C1Q6LblzPPorDq5b4V+DUXCcGQeE zFkZWIVJLRsYuZFDZcm4OUyiT4tiyPU70X3g5DgazmmogOx5GEUSeCJZrkphJD9b/b0O QS0mj9JxowvM4mNmGxvahhkmegGLx0E9MnFEAdKplsjZHs9+ppo8MLp9GZEW2iczhEC5 nXHA==
Return-Path: <dqaajfp@alba.daniloo.onmicrosoft.com>
X-Received: by 2002:a2e:8343:0:b0:2c5:4a0:f3cb with SMTP id l3-20020a2e8343000000b002c504a0f3cbmr4524058ljh.11.1699545834271; Thu, 09 Nov 2023 08:03:54 -0800 (PST)
Received: by 2002:ab3:b40c:0:b0:521:6f06:78e with SMTP id o12csp453322qnc; Thu, 9 Nov 2023 08:03:55 -0800 (PST)
Received: from wp.me (static.83.247.243.136.clients.your-server.de. [136.243.247.83]) by mx.google.com with ESMTPS id f8-20020a7bcd08000000b004084017d06fsi1500237wmj.104.2023.11.09.08.03.53 for < My Email Address > (version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128); Thu, 09 Nov 2023 08:03:54 -0800 (PST)
Received: from pdr8-services-05v.prod.PYY28AGM.org (ip6-localhost ) by pdr8-services-05v (Postfix) with ESMTP id PYY28AGM for < My Email Address >; Sat, 27 May 2023 17:51:57 -0400
Received-Spf: pass (google.com: domain of dqaajfp@alba.daniloo.onmicrosoft.com designates 136.243.247.83 as permitted sender) client-ip=136.243.247.83;
Delivered-To: My Email Address
<jkeme.yugtt.javamail.tomcat@pdr8-services-05v.prod.v4tsjato.org>
X-Google-Smtp-Source: AGHT+IG5hBOpbXqXEGNMtHDrbK+Uzb3TvsBeuTaZHqQ3OHg6ZziM5ovJTOcY8q5Cez/M44nAafnL

I found one entry with my email and, since it wasn't necessary, I removed it. Then I cleared out all junk mail with the "Not in my Contacts" rule. Not one persisted.