If you are receiving emails from an xfinity.com domain, then only the single rule should be to test if the From address contains @xfinity.com, not the To address. That should be sufficient.
There is also the notion of a header Return-Path that is the actual last server sending the email. It does not need to be associated with xfinity.com and could be an entirely different named domain mail server acting as a forwarding hub. I currently receive emails that appear to be from different entities, domain names, and all pass through the same or closely related Return-Path servers. Block the Return-Path server and greatly reduce the SPAM flow. Apple should, but does not include Return-Path in the list of header fields, but one can add it from the bottom of the list that you select From and To header fields from.