filter f_mail {
  facility(mail)
  and not match("imap" value("MESSAGE"))
  and not match("pop3" value("MESSAGE"));
};