Maybe try the Just report it addon : it transfers the email to the abuse report address for the domain registrar.

Filters can definitely work on incoming email though.

It's the actual DOMAIN not the email. The email is different every time except for the DOMAIN of .de.

How about posting a screen shot showing the actual filter you claim does not work?

Does your filter include contains in the test on the sending email address? or ends with?

There is NO filter on just the domain or part of it, only on the whole email address. I would suggest one of the following, preferably the latter as it is less prone to false positives, but you best hope you never get a legitimate email from Germany https://en.wikipedia.org/wiki/.de that is a pool of some 83million people you are automatically excluding, along with some rather large multinational companies.

More than one way to get the end result.

And you may want to vote for https://connect.mozilla.org/t5/ideas/message-filter-to-filter-entire-domain-domain/idi-p/85017

.de is a country code top-level domain, probably used by millions of people and thousands of legimitate organizations in Germany. Maybe it doesn't matter to you if you block or filter all of them. Maybe you want to block domains at the next level of specificity.

I get 100's of spam fake sales emails a week from the poor foreign domains of .de, .at etc They are used for scammers/spammers telling me I need to give my info to complete may sales that I haven't done. 100's!!

I get 100's of spam fake sales emails a week from the poor foreign domains of .de, .at etc They are used for scammers/spammers telling me I need to give my info to complete may sales that I haven't done. 100's!!

It is also possible the scammer is not actually using that email address/domain. They have just entered it into the 'from' - in other words they are pretending to send from that email address. So, it's almost a fultile case to block an email address that is perfectly ok. No real scammer is going to use their real email address.

I had an email which was alledgedly sent by the company who hosts my website as that was in the 'From' but in email 'View Source' I found this which was the original sender and not the 'From' address.

Received: by vps112560.serveur-vps.net (Postfix, from userid 33) id CB7161E1EEB; Sun, 1 Jun 2025 18:08:03 +0200 (CEST)

So nothing to do with the 'From' email address and seems like they are using an email service hosted on a virtual private server, which offers users the ability to manage and customize their email systems, independent of their website host or ISP. Basically they can use it to hide their IP address making it harder to locate them. Scammers like using the vps.net server - although VPS.Net is a legit server - it does not mean some of it's users are using it for legit purposes.

If you select the email and then clickon 'More' and 'View Source' Look at the 'Received by' headers. The one at the top is the last server - the one where you have your mail account, so scroll down the first 'Received by' which should be just above the 'FROM', TO, Subject Date section.

Post an image which shows all that section.