You need to target the Return-Path address (just once) for the originator(s) of that spam. Apple does not include Return-Path in its list of available header fields that you construct Mail rules. However, you can add custom headers.
In any Mail rule, click a From header selector and a large secondary list will appear. At the very bottom is the Edit header list…, and here is my entry for Return-Path. Click the + button and add it exactly as shown below:
For the given SPAM message, you will want the following rule setting:
The right-most content is the actual Return-Path address of the particular spam message, and represents the Mail server address that they are using to send the spam to you. The content of the To:, From:, and Reply-To: header fields can be contrived, but they cannot spoof the Return-Path address.
There are alternative ways to get at that Return-Path content.
- Select the SPAM email message item
- Select Mail's View menu : Message : Raw Source — a window will apppear showing the message's headers
- The Return-Path header item may be conveniently the first line, or further down in the header fields that are shown. You want to copy/paste the entire Return-Path address enclosed within, and including the < and > characters into the third text field of your specific Mail rule for this spam. That field is partially shown in the example image above.
- Save the Rule, and a message will appear if you want to apply the rule. Agree, and the selected mail item will be handled. I send mine to Trash on my Mac, but you may initially want to send them to your Junk mail folder.
- I have an AppleScript that based on a selected message item, will display the From: and Return-Path addresses, for a very simple copy and paste from an AppleScript dialog that looks like the following using nonsense addresses:
If I did nothing, I would get about 30 spams per day from the same organization with almost as many different From: header addresses. They all use the same Return-Path server, and I control all of these visually different spam messages with one mail rule using the Return-Path.