Rule that looks for sender with "onmicrosoft.com" in the domain

[Taipan]

I am getting a lot of spam where the sender’s domain contains the text “.onmicrosoft.com” - for example “[email protected]”. The sender’s domain is different every time, except for the last bit - “.onmicrosoft.com”.

How do I create a rule that will put those emails straight into the Junk folder?

I have tried a lot of ways, but without success, so far …

[sunriseal]

[jnichols]

Version 9.2.1735, Windows & gmail. I cannot find a “found in header” rules option.
Only words found in subject or words found in body or subject.
Where is the words found in header?
Thank you

[sunriseal]

MENU
Select RULES
Select NEW
Select APPLY CUSTOM RULE ON MESSAGES I RECEIVE
NEXT
Select WITH WORDS FOUND IN HEADER

Refer to my post above for the rest…

[jnichols]

After closely following your steps. My “Select conditions for the rule” choices are:

with words found in subject
from people
sent to people
with words found in body or subject
has attachment

I get the same behavior on EM on my home PC.

[sunriseal]

v9.2.1735

Are you using Local Rules?

[jnichols]

That was it. Didn’t even think to click that down arrow and select local.

Thanks much!

[Taipan]

An alternate solution that I found that works for me was to add the item (.onmicrosoft.com) to the “Blacklist” addresses list using “Ends with”, as shown here: