On 1/18/2018 6:52 AM, Pedro David Marco wrote: > David, > > This rule can do the full job... i have tested it with good results.. > (Can be tested here: https://regex101.com/r/Vpmhjz/3 ) > > It checks if the level domain next to the TLD in the From:name matches > the domain next to the TLD in From:email > > header FROM_DOMAINS_MISMATCHFrom > !~/(?:[^<].+?)\@(?:.+?\.)*?(.+?\.)(?:.+?).*?<.+?(\@\1|\@.*?\.\1)/ > describe FROM_DOMAINS_MISMATCHDomain name mismatch in From header Did this ever get considered for a sandbox.
Alan Hodgson also had a good posted on one but not tested. Regards, KAM
