diff --git a/app/models/channel/filter/monitoring_base.rb b/app/models/channel/filter/monitoring_base.rb
index 27c8282b7..a96bbb86e 100644
--- a/app/models/channel/filter/monitoring_base.rb
+++ b/app/models/channel/filter/monitoring_base.rb
@@ -20,17 +20,17 @@ class Channel::Filter::MonitoringBase
     auto_close_state_id = Setting.get("#{integration}_auto_close_state_id")
     state_recovery_match = '(OK|UP)'
 
-    return if !mail[:from]
-    return if !mail[:body]
+    return if mail[:from].blank?
+    return if mail[:body].blank?
     session_user_id = mail[ 'x-zammad-session-user-id'.to_sym ]
     return if !session_user_id
 
     # check if sender is monitoring
-    return if !mail[:from].match(/#{sender}/i)
+    return if !mail[:from].match(/#{Regexp.quote(sender)}/i)
 
     # get mail attibutes like host and state
     result = {}
-    mail[:body].gsub(%r{(Service|Host|State|Address|Date/Time|Additional\sInfo):(.+?)\n}i) { |_match|
+    mail[:body].gsub(%r{(Service|Host|State|Address|Date/Time|Additional\sInfo|Info):(.+?)\n}i) { |_match|
       key = $1
       if key
         key = key.downcase
@@ -42,6 +42,9 @@ class Channel::Filter::MonitoringBase
       result[key] = value
     }
 
+    # check min. params
+    return if result['host'].blank?
+
     # check if ticket with host is open
     customer = User.lookup(id: session_user_id)
 
@@ -63,7 +66,7 @@ class Channel::Filter::MonitoringBase
       mail[ 'x-zammad-ticket-id'.to_sym ] = ticket.id
 
       # check if service is recovered
-      if auto_close && result['state'].match(/#{state_recovery_match}/i)
+      if auto_close && result['state'].present? && result['state'].match(/#{state_recovery_match}/i)
         state = Ticket::State.lookup(id: auto_close_state_id)
         if state
           mail[ 'x-zammad-ticket-followup-state'.to_sym ] = state.name
diff --git a/test/unit/integration_icinga_test.rb b/test/unit/integration_icinga_test.rb
index 55a5f7273..2798189a8 100644
--- a/test/unit/integration_icinga_test.rb
+++ b/test/unit/integration_icinga_test.rb
@@ -19,7 +19,7 @@ User-Agent: Heirloom mailx 12.5 7/5/10
 MIME-Version: 1.0
 Content-Type: text/plain; charset=us-ascii
 Content-Transfer-Encoding: quoted-printable
-Message-Id: <20160131094621.29ECD400F29C-icinga-1@monitoring.znuny.com>
+Message-Id: <20160131094621.29ECD400F29C-icinga-1-0@monitoring.znuny.com>
 From: icinga_not_matching@monitoring.example.com (icinga)
 
 ***** Icinga  *****
@@ -44,6 +44,73 @@ Comment: [] =
     assert_not(ticket_p.preferences['integration'])
     assert_not(ticket_p.preferences['icinga'])
 
+    # RBL check
+    email_raw_string = "To: support@example.com
+Subject: [PROBLEM] RBL check on apn4711.dc.example.com is CRITICAL!
+User-Agent: Heirloom mailx 12.5 7/5/10
+MIME-Version: 1.0
+Content-Type: text/plain; charset=us-ascii
+Content-Transfer-Encoding: quoted-printable
+Message-Id: <20160131094621.29ECD400F29C-icinga-1-1@monitoring.znuny.com>
+From: icinga@monitoring.example.com (icinga)
+
+***** Icinga 2 Service Monitoring on apn4711.dc.example.com *****
+
+=3D=3D> RBL check on apn4711.dc.example.com is CRITICAL! <=3D=3D
+
+Info:    CHECK_RBL CRITICAL - apn4711.dc.example.com BLACKLISTED on 1 server of=
+ 38 (ix.dnsbl.example.com)=20
+
+When:    2017-08-06 22:18:43 +0200
+Service: RBL check (Display Name: \"RBL check\")
+Host:    apn4711.dc.example.com (Display Name: \"apn4711.dc.example.com\")
+IPv4:    127.0.0.1="
+
+    ticket_0, article_p, user_p, mail = Channel::EmailParser.new.process({}, email_raw_string)
+    assert_equal('new', ticket_0.state.name)
+    assert(ticket_0.preferences)
+    assert(ticket_0.preferences['integration'])
+    assert_equal('icinga', ticket_0.preferences['integration'])
+    assert(ticket_0.preferences['icinga'])
+    assert_equal('apn4711.dc.example.com (Display Name: "apn4711.dc.example.com")', ticket_0.preferences['icinga']['host'])
+    assert_equal('CHECK_RBL CRITICAL - apn4711.dc.example.com BLACKLISTED on 1 server of 38 (ix.dnsbl.example.com)', ticket_0.preferences['icinga']['info'])
+    assert_equal('RBL check (Display Name: "RBL check")', ticket_0.preferences['icinga']['service'])
+    assert_nil(ticket_0.preferences['icinga']['state'])
+
+    # RBL check II
+    email_raw_string = "To: support@example.com
+Subject: [PROBLEM] RBL check on apn4711.dc.example.com is CRITICAL!
+User-Agent: Heirloom mailx 12.5 7/5/10
+MIME-Version: 1.0
+Content-Type: text/plain; charset=us-ascii
+Content-Transfer-Encoding: quoted-printable
+Message-Id: <20160131094621.29ECD400F29C-icinga-1-2@monitoring.znuny.com>
+From: icinga@monitoring.example.com (icinga)
+
+***** Icinga 2 Service Monitoring on apn4711.dc.example.com *****
+
+=3D=3D> RBL check on apn4711.dc.example.com is CRITICAL! <=3D=3D
+
+Info:    CHECK_RBL CRITICAL - apn4711.dc.example.com BLACKLISTED on 1 server of=
+ 38 (ix.dnsbl.example.com)=20
+
+When:    2017-08-06 22:18:43 +0200
+Service: RBL check (Display Name: \"RBL check\")
+Host:    apn4711.dc.example.com (Display Name: \"apn4711.dc.example.com\")
+IPv4:    127.0.0.1="
+
+    ticket_0_1, article_p, user_p, mail = Channel::EmailParser.new.process({}, email_raw_string)
+    assert_equal('new', ticket_0_1.state.name)
+    assert(ticket_0_1.preferences)
+    assert(ticket_0_1.preferences['integration'])
+    assert_equal('icinga', ticket_0_1.preferences['integration'])
+    assert(ticket_0_1.preferences['icinga'])
+    assert_equal('apn4711.dc.example.com (Display Name: "apn4711.dc.example.com")', ticket_0_1.preferences['icinga']['host'])
+    assert_equal('CHECK_RBL CRITICAL - apn4711.dc.example.com BLACKLISTED on 1 server of 38 (ix.dnsbl.example.com)', ticket_0_1.preferences['icinga']['info'])
+    assert_equal('RBL check (Display Name: "RBL check")', ticket_0_1.preferences['icinga']['service'])
+    assert_nil(ticket_0_1.preferences['icinga']['state'])
+    assert_equal(ticket_0_1.id, ticket_0.id)
+
     # matching sender - CPU Load/host.internal.loc
     email_raw_string = "To: support@example.com
 Subject: PROBLEM - host.internal.loc - CPU Load is WARNING