Filter rule not working properly

Hi! A client of mine has the following global e-mail filter rule: ---- filtername: domain deny rules: - match: ends opt: or part: "$header_from:" val: .co unescaped: 1 - actions: - action: save dest: $home/mail/.spam enabled: 1 ---- Now for some reason he still receives some mail from ".co" ending e-mail from addresses (about 3-5 from 30 per day). This shouldn't be happening... Any ideas? Thanks in advance! ---- Here is the header of the mail, just in case: Return-Path: Delivered-To: peter@ourdomain.tld Received: from cpanel.ourdomain.tld by cpanel.ourdomain.tld with LMTP id sMb5ERstiGFdVQAAUXkrYg (envelope-from ) for ; Sun, 07 Nov 2021 20:46:35 +0100 Return-path: Envelope-to: peter@ourdomain.tld Delivery-date: Sun, 07 Nov 2021 20:46:35 +0100 Received: from discobreathe.co ([163.123.142.71]:23187) by cpanel.ourdomain.tld with esmtp (Exim 4.94.2) (envelope-from ) id 1mjo7d-0005jK-4F for peter@ourdomain.tld; Sun, 07 Nov 2021 20:46:35 +0100 Date: Sun, 07 Nov 2021 14:40:26 -0500 From: "WT2 Smart Watch" MIME-Version: 1.0 Precedence: bulk To: Subject: It's like having a 24-hour doctor on your wrist Message-ID: Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit