Blocking based on From, not Sender

[ScottLoveland8675309]

We're getting phishing messages with Envelope From as strings-of-numbers@amazonses.com with the From being a phony smtp address. We can't filter on the strings-of-numbers (next message will be from another string) or @amazonses.com (there are valid users that send to is from that domain). I need to filter on the From.

I was thinking about setting up an Other Header filter using "Header value contains term in content dictionary" and then putting the phony domains that are used for the From in there. 

Any better suggestions for Cloud Email Security?

[Ken Stieers]

You don't have to create a separate filter, you can use mail policies (assuming you have a blacklist policy)
You do need to go to Mail Policies/Mail Policy Settings and enable/re-order the headers you want it to check against.