type.inbound
and sender.email.email in (
'drive-shares-dm-noreply@google.com',
'drive-shares-noreply@google.com',
)
and not any(headers.reply_to, .email.domain.domain in $org_domains)
// the message needs to have a reply-to address
and length(headers.reply_to) > 0
// new reply-to
and any(headers.reply_to, network.whois(.email.domain).days_old < 30)
Playground
Test against your own EMLs or sample data.