Backtrack through the headers in the email Bob3160, always wise to do that first with any suspicious email. I’d guess (without seeing the entire email) that Rocker has got it right.