Email filter should pick up "From: .*(somemailaddress).* but also picks up those with "X-Envelope-From: .*(somemailaddress).*"

My expression is like this:

From: .*(skolresan@stromma.se@stromma.se|goteborg@stromma.se|bookings@gotacanal.se|info@kastellet.se|arrangemang@stromma.se).*

the email header property "X-Envelope-From" is found before "From" so the filter picks up emails with X-Envelope-From as well, which I do not want.

Below are an example.

Any idea how to solve this?

X-Mailgun-Incoming: Yes
X-Envelope-From: <goteborg@stromma.se>
Received: from eu-smtp-delivery-153.mimecast.com (eu-smtp-delivery-153.mimecast.com [207.82.80.153])
by mxa.mailgun.org with ESMTP id 5e736b6c.7f338786f390-smtp-in-n01;
Thu, 19 Mar 2020 12:54:04 -0000 (UTC)
Received: from EUR02-AM5-obe.outbound.protection.outlook.com
(mail-am5eur02lp2055.outbound.protection.outlook.com [104.47.4.55]) (Using
TLS) by relay.mimecast.com with ESMTP id
uk-mta-94-HEzQIdfCOZqwtNnw59fHtQ-1; Thu, 19 Mar 2020 12:54:03 +0000
X-MC-Unique: HEzQIdfCOZqwtNnw59fHtQ-1
Resent-From: <goteborg@stromma.se>
Received: from AM4PR07CA0019.eurprd07.prod.outlook.com (2603:10a6:205:1::32)
by AM5PR03MB3121.eurprd03.prod.outlook.com (2603:10a6:206:1a::10) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2814.21; Thu, 19 Mar
2020 12:54:01 +0000
Received: from HE1EUR04FT048.eop-eur04.prod.protection.outlook.com
(2603:10a6:205:1:cafe::93) by AM4PR07CA0019.outlook.office365.com
(2603:10a6:205:1::32) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2835.12 via Frontend
Transport; Thu, 19 Mar 2020 12:54:01 +0000
Received: from eu-smtp-1.mimecast.com (91.220.42.227) by
HE1EUR04FT048.mail.protection.outlook.com (10.152.26.64) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.2814.13 via Frontend Transport; Thu, 19 Mar 2020 12:54:00 +0000
Received: from rs-139.mta.anpdm.com (rs-139.mta.anpdm.com [91.227.208.139])
(Using TLS) by relay.mimecast.com with ESMTP id
uk-mta-197-NxHRtAPtN4CHcdPZZKbBVw-1; Thu, 19 Mar 2020 12:53:58 +0000
X-MC-Unique: NxHRtAPtN4CHcdPZZKbBVw-1
X-CSA-Complaints: whitelist-complaints@eco.de
Precedence: bulk
List-Unsubscribe: <https://www.anpdm.com/oa-auto/26318559/43445D467946415E47714345584271>,<mailto:delist@apsis.com?subject=UnReg:26318559::43445D467946415E47714345584271::2>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
X-Destination-ID: marknad@lundgrenssverige.se
Reply-To: marknad@lundgrenssverige.se
X-MailingID: 2::1::26318559::1499724843
Feedback-ID: 26318559:4642514379404B5D4171:2-1:apsis
From: "Lundgrens Sverige AB" <marknad@lundgrenssverige.se>
To: "=?utf-8?B?U3Ryw7ZtbWEgVHVyaXNtICYgU2rDtmZhcnQgQUIgWzMxXQ==?=" <goteborg@stromma.se>
Message-ID: <C47BE92FB23E4E5E9C6EA977A10108E9@lundgrenssverige.se>
Date: Thu, 19 Mar 2020 13:53:57 +0100
Subject: =?utf-8?B?RW4gaMOkbHNuaW5nIGZyw6VuIEx1bmRncmVucyA=?=
MIME-Version: 1.0
Authentication-Results-Original: relay.mimecast.com; spf=pass
(relay.mimecast.com: domain of
3fd.c.1499724843.j21671046-26318559@lundgrenssverige.anpdm.com designates
91.227.208.139 as permitted sender)
smtp.mailfrom=3fd.c.1499724843.j21671046-26318559@lundgrenssverige.anpdm.com
Return-Path: 3fd.c.1499724843.j21671046-26318559@lundgrenssverige.anpdm.com
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 9a6127d7-b9b8-43ee-ac84-3ccf382f96d2:0
X-Forefront-Antispam-Report:
CIP:91.220.42.227;IPV:CAL;SCL:-1;CTRY:GB;EFV:NLI;SFV:NSPM;SFS:(10009020)(4636009)(136003)(346002)(396003)(376002)(39850400004)(1110001)(339900001)(199004)(224303003)(16670700002)(7636002)(26005)(246002)(2616005)(26826003)(3450700001)(956004)(356004)(19627405001)(966005)(44726023)(36756003)(70586007)­(68406010)(8426002)(33656002)(316002)(6862004)(66574012)(498600001)(42882007)(5660300002)(76236002)(33964004)(336012)(2906002)(4743002)(37786003)(44706002);DIR:OUT;SFP:1101;SCL:1;SRVR:AM5PR03MB3121;H:eu-smtp-1.mimecast.com;FPR:;SPF:Fail;LANG:sv;PTR:eu-smtp-delivery-1.mimecast.com;A:1;
X-MS-Public­TrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 2e122026-06ce-4315-06cc-08d7cc0498c8
X-MS-TrafficTypeDiagnostic: AM5PR03MB3121:|AM5PR03MB3121:
X-LD-Processed: 9a6127d7-b9b8-43ee-ac84-3ccf382f96d2,ExtFwd
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS:
<AM5PR03MB312157F45AE9C4396B707FC1DCF40@AM5PR03MB3121.eurprd03.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:7691;
X-Forefront-PRVS: 0347410860
X-MS-Exchange-SenderADCheck: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
7IwsialgdtL2BfyG8+/YmsWghpjsQztxBi62Kk518DwKXUJOyXBAsraa6Ue/CEOYDiNQwz0OQLsR2QZC0QfRW+7Jk+QV+OW6VttyVDqy17Ox+Hrxbf5W8vohpCoxJoycoRoNBN9t4eKYLIvhiPZS0Xg1PtubOLkzS3fFnliN4SfyEECAFYptQqbs4fiXnGh4K7U2/Z1Ag8IMYP3QcI7fJI7sVLMXtnH4F5h4FD9Wc1WrUZD7xIupLTBoeD5oQWjt7CEslPgrH2xJ2krL9sKgiThlT0NTwcr/mw3JTUqiegk3­HoUXe+4mz/928E6TdOBLSfgIN9ZkSv0te3IpUOEfTvFTnjIcTEpvCmTGc6hR/BNMm95XL1VYKQGxaUfhFPzL6I9avlKSSd6kzWSB7X30iXJJeQmrG2+cRe8Y9GmY1cQsL9Nun5Mmo5mDECifXNq/LdGfE/u2MbWio0bTuYdUcdNCWK6HiaxZtCKPalc+N+R3O+U1S61EcFlcDMIHPR7i1KzhQqEjF0Q9cODhXZG0joVko6Xvp8odbivt/usfezaKsqUY77BusTozNIKrDmQ0
X-OriginatorOrg: stromma.se
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Mar 2020 12:54:00.9854
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 2e122026-06ce-4315-06cc-08d7cc0498c8
X-MS-Exchange-CrossTenant-Id: 9a6127d7-b9b8-43ee-ac84-3ccf382f96d2
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR03MB3121
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: stromma.se
Content-Type: multipart/alternative;
boundary="----91AF66686E1E4039984D078ED36EA9F0"
Content-type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Content-type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

RE: Email filter should pick up "From: .*(somemailaddress).* but also picks up those with "X-Envelope-From: .*(somemailaddress).*"

Hi Gustaf,

 

If you add the following symbol in front of your expression, you should be fine! 

^From: .*(somemailaddress).*

 

Adding the ^ in front of your expression means that it will only trigger if the line begins with From. Your expression also triggers if the string is found inside a line.

See also:

https://docs.microsoft.com/en-us/dotnet/standard/base-types/anchors-in-regular-expressions

 

Von: Bas Kreijveld 19. Mrz 2020

RE: Email filter should pick up "From: .*(somemailaddress).* but also picks up those with "X-Envelope-From: .*(somemailaddress).*"

Try changing it to : ^From:.*(somemailaddress).*

 

Von: Michel Krohn-Dale 19. Mrz 2020

RE: Email filter should pick up "From: .*(somemailaddress).* but also picks up those with "X-Envelope-From: .*(somemailaddress).*"

Thanks, Yes this seemes to work!! (:

 

Von: Gustaf Cullin 24. Mrz 2020