type.inbound
and sender.email.domain.root_domain in ("intuit.com")
// email auth fails
and (
not headers.auth_summary.spf.pass
or not coalesce(headers.auth_summary.dmarc.pass, false)
)
// the subject or display_name includes docusign
and (
strings.icontains(subject.subject, "docusign")
or strings.icontains(sender.display_name, "docusign")
)
Playground
Test against your own EMLs or sample data.