Changes to Docusign rule to reduce false positives.

[aslefhewqiwbepqwefbpqsciwueh]

Hi,

This rule was causing false positives with docusign marketing emails. I suggest two changes.

Check all the links for docusign domain instead of any:

and all(body.links,
          not strings.ilike(.href_url.domain.root_domain, "docusign.*")
  )

Check the sender is not Docusign itself:

and not strings.like(sender.email.domain.root_domain, "docusign.com")

Many thanks!

[morriscode]

Thanks @aslefhewqiwbepqwefbpqsciwueh
Looks great, much appreciated!

[aslefhewqiwbepqwefbpqsciwueh]

Many thanks! 🙏