Alerts problems

I am having a bit of trouble with the alerts. I have the following rule:

HOST=% MAIL kevin at domain.com COLOR=red EXSERVICE=http RECOVERED

My understanding is that this should work as follows:

For ALL hosts: Mail kevin at domain.com if, the alert is RED only and if the service is other than http and mail when it recovers

What actually happens is:

I get ALL alerts, for ALL colors, and ALL services

What did I do wrong?

Please advise.

Thank you

Kevin