type.inbound
// Check for emoji in sender display name using Unicode ranges
and regex.contains(sender.display_name,
'[\x{1F600}-\x{1F64F}]|[\x{1F300}-\x{1F5FF}]|[\x{1F680}-\x{1F6FF}]|[\x{1F1E0}-\x{1F1FF}]|[\x{2600}-\x{26FF}]|[\x{2700}-\x{27BF}]'
)
// Check for financial symbols in subject
and regex.contains(subject.subject, '[\$£€¥₿]')
and (
headers.auth_summary.dmarc.pass is null
or headers.auth_summary.dmarc.pass == false
)
and sender.email.domain.root_domain not in $alexa_1m
Playground
Test against your own EMLs or sample data.