type.inbound
and strings.istarts_with(headers.mailer, 'Microsoft Outlook')
and regex.icontains(body.current_thread.text,
'unsubscribe here[\s\S]{0,120}?reference\s?id:\s*[a-z0-9]{6,}'
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
sender.email.domain.root_domain in $high_trust_sender_root_domains
and coalesce(headers.auth_summary.dmarc.pass, false)
)
Playground
Test against your own EMLs or sample data.