type.inbound
and (
strings.icontains(sender.display_name, 'godaddy')
or strings.ilevenshtein(sender.display_name, 'godaddy') <= 1
or strings.icontains(sender.email.domain.domain, 'godaddy')
)
and not (
sender.email.domain.root_domain in (
"godaddy.com",
"registry.godaddy",
"sucuri.net"
)
and headers.auth_summary.dmarc.pass
)
and not profile.by_sender().solicited
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
sender.email.domain.root_domain in $high_trust_sender_root_domains
and coalesce(headers.auth_summary.dmarc.pass, false)
)
Playground
Test against your own EMLs or sample data.