Just use something like: ^From:[^<]+<(?!user1@example\.com)(?!user2@example\.org)(?!user3@example\.net).*?^X-Spam-Level:\s*(\S*) with singleline (s) and multiline (m) modifiers (so the dot matches newlines and ^ matches the beginning of each line).