diff --git a/manifests/params.pp b/manifests/params.pp
index 031388d..6b76d8c 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -157,7 +157,8 @@ $fn_banaction               = 'iptables-multiport',
 $fn_banaction_allports      = 'iptables-allports',
 $fn_action_                 = '%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]',
 $fn_action_mw               = @(EOT) '%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
-                              "%(mta)s-whois[name=%(__name__)s,  sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]' | EOT,
+                              "%(mta)s-whois[name=%(__name__)s,  sender=\"%(sender)s\", dest=\"%(destemail)s\", protocol=\"%(protocol)s\", chain=\"%(chain)s\"]'
+                              | EOT,
 $fn_action_mwl              = '%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]',
 $fn_action_xarf             = '%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"]',
 $fn_action_cf_mwl           = 'cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"] %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]',