This inbound-email rule detects messages that spoof the Microsoft Outlook mailer header and include an unsubscribe link followed by a reference ID footer, a common phishing tactic to appear legitimate. It triggers when the message appears to originate from a header flag indicating Microsoft Outlook and the body contains a pattern where "unsubscribe here" is followed (within up to 120 characters) by a footer containing "reference id:" and a 6+ character lowercase alphanumeric value. The rule uses content analysis of the body and header analysis of the mailer header to identify this pattern. A negative exception is applied: if the sender's root domain is in a list of highly trusted domains and DMARC authentication passes, the rule does not fire for that message. This helps reduce false positives on trusted senders while still catching spoofed or suspicious messages that fail DMARC or come from less trusted domains. The rule classifies detected instances as Spam and associates them with social engineering and spoofing techniques. It is intended for inbound mail screening and relies on DMARC status, header fields, and body text patterns. The rule is stored under a path indicating its location within the detection rule set and is labeled with low severity, aligning with typical spam-like phishing indicators that are not necessarily high-risk on their own but warrant review and potential quarantine or further verification when encountered.