type.inbound
and regex.imatch(sender.email.email, 'communications[a-z]{4,}@.+')
and any(headers.hops, any(.fields, strings.ilike(.name, "x-campaignid")))
and any(headers.domains, strings.contains(.domain, "blackbaud.com"))
and regex.imatch(subject.subject, 'RE\s?:.*')
and (
length(headers.references) == 0
or not any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To")))
)
and any(body.links, .display_text is null)
Playground
Test against your own EMLs or sample data.