/^/ WARN HEADER_AUDIT: $0

# Block header From domains listed in policy/blocked_header_from_domains.txt
# except specific allowed external senders (policy/allowed_external_senders).
# - Allow exact addresses from allowed_external_senders (example: kenichiro.nogi@nexthd.jp)
# - Reject other From: headers containing the blocked domain (example: nexthd.jp)
# NOTE: This check runs at the cleanup/DATA phase (header_checks), so RCPT-phase
# restrictions remain envelope-based.

# Allowlisted exact sender (adjust if you add more allowed senders)
/^From: (?i).*\bkenichiro\.nogi@nexthd\.jp\b/    OK

# Reject other headers from nexthd.jp
/^From: (?i).*\b@nexthd\.jp\b/    REJECT 554 5.7.1 Header From domain blocked