Actually it works.

Here is piece of rule

$header_from: ends 

So, as you can see, it handles entire header but not just email address as you probably expected.

If you want to handle messages which ending with ".work", so this is not what are you looking for.

You need to use "contains" instead of "ends with"

And to prevent false positivies use quotes as the following;

.work>)

.work>

This is what header contains

Similar Posts:

• How to forward messages without keeping copy on the server