Detects inbound emails where the Message-ID header includes a reserved or placeholder domain (e.g., example.com, example.net, example.org) or a subdomain ending in .test, .invalid, .example, or .localhost. These domains are reserved for documentation/testing per RFCs and should not appear in production mail headers. A Message-ID containing such domains is a strong indicator of spoofing or synthetically generated mail used in phishing/BEC attempts. The rule uses a case-insensitive regex against headers.message_id to identify patterns like @(?:example\.(?:com|net|org)|[^@]*\.(?:test|invalid|example))>?$ and triggers during inbound processing. Detection method is header analysis. Attack types include Spam and BEC/Fraud; techniques include Spoofing and Evasion.