try enabling the from heading in your list. It is populating? What about the from in the header at the top of the message display?

Is there more than one From: header in the actual message source? (Ctrl+U to display) Note the first line will be From -and a date. I do not count that as it had no colon

Thanks for your suggestions! When I added the "From" column to the list of messages I see when I open Thunderbird, the From column was blank for this message. In the message display, the "From:" field is also missing. But the message display is odd since the "From:" line I see from the message source shows up in the message body. In case this helps, I've attached a screen shot of the message source as well as a screen shot of the message display.

Experiment time.

Save the email as an eml file on your desktop. Open it in Notepad to edit Remove the space above the From: Save changes and double click to open in Thunderbird.

I think what is happening is Thunderbird thinks the header is complete because of that space. ie the email is malformed.

Bingo! Thanks so much. This puts the From information in the From field and the filter works like a charm.

While it is not ongoing help, it does explain the failure. Perhaps you need to look at the provider and see if they do spam filtering, but it would not surprise me to learn the spammer deliberately malformed the mail to defeat filters on the from field and the subject given so many apparently try and use them as spam tools.