You can test an email with this Apple Script from VikingOS. I compiled it as an application in Script Editor and run it from the Dock when I select a suspect email:
****************************************************************
-- return-path.applescript
-- Select a given message item in Apple Mail, and then run this script. It will produce a dialog
-- showing the sender's From and Return-Path addresses. Copy the entire Return-Path
-- string into the right-window of an Apple Mail rule.
-- This script *does not* alter, or remove individual email messages.
-- VikingOSX, 2019-10-23, Apple Support Communities, No warranties of any kind
use framework "Foundation"
use AppleScript version "2.4" -- Yosemite or later
use scripting additions
property NSString : a reference to current application's NSString
property NSRegularExpression : a reference to current application's NSRegularExpression
property NSRegularExpressionCaseInsensitive : a reference to current application's NSRegularExpressionCaseInsensitive
tell application "Mail"
if not it is running then activate
if not (get selection) is {} then
set theMsg to item 1 of (get selection)
else
return
end if
tell theMsg
set theSender to its sender
set theHDR to its all headers
end tell
end tell
set rtnpath to my return_address(theHDR) as text
set fmsg to "Sender Address:" & return & theSender & return & return & ¬
"Return-Path:" & return & rtnpath
display dialog fmsg with title "Current Mail Item Addresses"
return
on return_address(atxt)
set hstr to NSString's alloc()'s initWithString:atxt
set pattern to "(?<=Return-Path:|Return-path:)\\s+<(.*?)>.*"
set regex to NSRegularExpression's regularExpressionWithPattern:pattern options:NSRegularExpressionCaseInsensitive |error|:0
set hrange to current application's NSMakeRange(0, hstr's |length|())
set matches to (regex's firstMatchInString:hstr options:0 range:hrange)
if matches = "" then return "Not Found"
set matchrange to matches's rangeAtIndex:1
return (hstr's substringWithRange:matchrange) as text
end return_address
**************************************************************
