[exim] Custom ACL to block TLD

Having trouble with a custom ACL to block certain spammy TLDs.

The following works fine:



if first_delivery

and ("$h_to:" contains ".link")

or ("$h_from:" contains ".link")

then

headers add "SpamRule: EXIM FILTER Blocked CONTAINS LINK (was: $h_subject:)"

deliver "Global Spam <alerts@???>"

seen finish

endif



but this doesn't do anything:



if first_delivery

and ("$h_to:" ends ".link")

or ("$h_from:" ends ".link")

then

headers add "SpamRule: EXIM FILTER Blocked ENDS WITH LINK (was:
$h_subject:)"

deliver "Global Spam < alerts@??? >"

seen finish

endif



With the first, I get false positives when sending to, say,
something.linkedin.com and other similar domains. It's not a big problem
for .link, but is a big issue for others (.in, .co, etc.).



Any hints would be appreciated!