# Spam flag not working? **URL:** \ **Category:** In My Humble Opinion\ **Created:** [May 27, 2019, 7:44pm UTC](https://boards.straightdope.com/t/spam-flag-not-working/834605 "2019-05-27T19:44:21Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Roderick\_Femm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/roderick_femm/32/14875_2.png) [@Roderick\_Femm](https://boards.straightdope.com/u/Roderick_Femm)\ **Post date:** [May 27, 2019, 7:44pm UTC](https://boards.straightdope.com/t/spam-flag-not-working/834605/1 "2019-05-27T19:44:21Z")
I get my email through comcast using their native application. I have a sort of technical question about this situation. Yesterday I started getting spam emails from this address: [no-reply@is.email.nextdoor.com](mailto:no-reply@is.email.nextdoor.com). This is what shows as the “actual” email address; each email had a different “name” on the From line. Anyway, I flagged the first one as spam, but since then I have gotten three more from the same address (different “names”). I have continued to mark each email with the spam flag. That flag is supposed to automatically route future emails from that address into the spam folder, but it does not appear to be working in this case. It has always worked for me before. Since they have my correct name and my correct email address, and since nextdoor is cited as part of the sending email address, I assume someone has hacked nextdoor and gotten this information. I also assume that these emails are not actually coming from anyone at nextdoor, and that possibly someone is spoofing that address (if that is possible). I am interested to know what the senders are doing to evade or override or render ineffective the spam flag. If that From email address is in fact spoofed, does that mean that the spam flag is working on the behind-the-scenes address, rather than the visible one? That would mean they are sending from different addresses but using the same spoofed address. Is that likely, or possible? ---
**Author:** ![markn\_1](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@markn\_1](https://boards.straightdope.com/u/markn_1)\ **Post date:** [May 27, 2019, 9:23pm UTC](https://boards.straightdope.com/t/spam-flag-not-working/834605/2 "2019-05-27T21:23:44Z")
You should look at the headers in the raw email for more information. Note that there are several headers that fit the vague idea of “who is this from”: Sender, From, Return-Path among others. I don’t know which one(s) Comcast uses to filter future emails out when you flag one. If you study the headers it may become clear that something is changing among those various messages. ---
**Author:** ![Roderick\_Femm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/roderick_femm/32/14875_2.png) [@Roderick\_Femm](https://boards.straightdope.com/u/Roderick_Femm)\ **Post date:** [May 28, 2019, 12:29am UTC](https://boards.straightdope.com/t/spam-flag-not-working/834605/3 "2019-05-28T00:29:53Z")
> [@markn\_1](#): > > You should look at the headers in the raw email for more information. Note that there are several headers that fit the vague idea of “who is this from”: Sender, From, Return-Path among others. I don’t know which one(s) Comcast uses to filter future emails out when you flag one. If you study the headers it may become clear that something is changing among those various messages. Thanks for the suggestion. Here’s that info from a couple of them (two more since I posted): > [@](#): > > Return-Path: \ > Received: from [dovdir3-hoc-06o.email.comcast.net](http://dovdir3-hoc-06o.email.comcast.net) ([69.252.207.11]) > by [dovback3-hoc-02o.email.comcast.net](http://dovback3-hoc-02o.email.comcast.net) with LMTP id UHIzGSF17Fz2PQAAcQIWtQ > for (my email); Mon, 27 May 2019 23:39:13 +0000 > Received: from [dovpxy-hob-18o.email.comcast.net](http://dovpxy-hob-18o.email.comcast.net) ([69.252.207.11]) > by [dovdir3-hoc-06o.email.comcast.net](http://dovdir3-hoc-06o.email.comcast.net) with LMTP id yCknGSF17FyEBQAAalB+qQ > ; Mon, 27 May 2019 23:39:13 +0000 > Received: from [resimta-ch2-11v.sys.comcast.net](http://resimta-ch2-11v.sys.comcast.net) ([69.252.207.11]) > (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) > by [dovpxy-hob-18o.email.comcast.net](http://dovpxy-hob-18o.email.comcast.net) with LMTP id +E7ECB917FzWLgAA0JG2vA > ; Mon, 27 May 2019 23:39:13 +0000 > Received: from [coacts.miazcost.com](http://coacts.miazcost.com) ([IPv6:2a06:ba86:9015:2115:4412:9267:7490:1441]) > by [resimta-ch2-11v.sys.comcast.net](http://resimta-ch2-11v.sys.comcast.net) with ESMTP > id VPCwhlHhRBfGQVPCyhSxHB; Mon, 27 May 2019 23:39:13 +0000 > X-CAA-SPAM: N00000 > > Return-Path: \ > Received: from [dovdir3-hoc-07o.email.comcast.net](http://dovdir3-hoc-07o.email.comcast.net) ([69.252.207.50]) > by [dovback3-hoc-02o.email.comcast.net](http://dovback3-hoc-02o.email.comcast.net) with LMTP id mIXMENJa7FwDaAAAcQIWtQ > for (my email); Mon, 27 May 2019 21:46:58 +0000 > Received: from [dovpxy-hoc-02o.email.comcast.net](http://dovpxy-hoc-02o.email.comcast.net) ([69.252.207.50]) > by [dovdir3-hoc-07o.email.comcast.net](http://dovdir3-hoc-07o.email.comcast.net) with LMTP id KBecENJa7Fw9FAAAVFXmXQ > ; Mon, 27 May 2019 21:46:58 +0000 > Received: from [resimta-ch2-31v.sys.comcast.net](http://resimta-ch2-31v.sys.comcast.net) ([69.252.207.50]) > (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) > by [dovpxy-hoc-02o.email.comcast.net](http://dovpxy-hoc-02o.email.comcast.net) with LMTP id KLIqN8ta7FyfFAAAGt7W/A > ; Mon, 27 May 2019 21:46:58 +0000 > Received: from [coacts.miazcost.com](http://coacts.miazcost.com) ([IPv6:2a06:ba86:3524:9976:5679:7663:6530:7410]) > by [resimta-ch2-31v.sys.comcast.net](http://resimta-ch2-31v.sys.comcast.net) with ESMTP > id VNSKh4xZMaSCmVNSLhNlQX; Mon, 27 May 2019 21:46:58 +0000 > X-CAA-SPAM: N00000 So there are clearly differences between these two; can you parse this a bit for me? What does it mean that there are so many different “Received from” addresses? Is there anything else interesting that strikes your eye? Also, now I’m wondering about the last line. Is that some sort of setting they can use to evade spam filters?