What about "Headers contains 'jqpublic'" and is Spam (>0 = TRUE) is equal to '0'? That would give me a full listing of anything that even mentioned jqpublic in the header, except for obvious spam. On Jun 23, 2010, at 12:25 PM, Eduardo Casarero wrote: > select id,hostname from maillog_table WHERE quarantined='1' limit 1; >