"Does not contain .com" and "does not contain .net" could be a tricky filter to set up. Are you familiar with [https://en.wikipedia.org/wiki/De_Morgan's_laws De Morgan's Laws]? I'd have used "ends with", not "contains". So, if it ends with .net or ends with .com, it's OK? (from, ends with, .net) OR (from, ends with, .com) = NOT spam OR means "Match any" in the way Thunderbird's filters do it. So it's quite easy to set up two rules (in one filter) to identify good messages. But how to identify bad messages? Negate both sides: NOT ( .net OR .com) = spam Apply De Morgan's rule: (NOT .net) AND (NOT .com) = spam so, Match All rule #1: From, doesn't end with, .net rule #2: From, doesn't end with, .com Action mark and treat as spam But you can't do that. There is no "doesn't end with" option. You could try with "contains" or more accurately, "doesn't contain" but I'm not at all sure it will recognize the dot character, and looking for occurrences of "net" or "com" is just too imprecise. My solution would be the FiltaQuilla add-on and its regular expression capability. That would give me the ability to set up: Match All rule #1: From (regex), doesn't match, /\.net$/i rule #2: From (regex), doesn't match, /\.com$/i Action mark and treat as spam This is not an approach that would work for me. I don't see any obvious correlation in my incoming email messages between the TLD in the email address and its spamminess. Have you tried running Thunderbird offline to avoid your filters doing any more damage? If you're feeling brave, you could edit the ''msgFilterRules.dat'' file in the relevant account in your profile. You should be able to find the lines containing your duff filter and delete them. You should be able to edit this file in Notepad.