"Tom" wrote in message
...
The only rule I have is:

Apply this rule after the message arrives
with 'undelivered' or
'Mail delivery failed' or
'Mail delivery failure' or
"FAILURE NOTICE' or
'Returned mail' or
'Undelivered:' or
'(Failure)' or
'Returned to Sender' or
'Undeliverable:' or
'undeliverable' or
'warning:' or
'Your message did not reach some or all of the intended recipients'
or
'Undeliverable'
move it to the Spoofed folder


Wrong rule. Use the following which detects if it is a *valid* NDR
(non-delivery report) by checking for the header.

Apply this rule after the message arrives
with "report-type=delivery-status" in the message header
and move it to the Junk folder (or wherever you want)
and stop processing more rules

You neglected to include the stop-clause. You are also attempting to
trigger on the various comments that a mail server *might* insert in
the body to denote the cause of the NDR. Trigger on the header.