Jan - would you send me the mime file from the message? - Thanks Pam

SPF isn't for this.  SPF testing is done during the SMTP transaction phase of receiving a message, which is before the MIME message has been received.  If the node in the scanner is used (rather than SPF in the SMTP interface), it is done later, but still with the information from the SMTP protocol.  As such, SPF is used to compare the senders domain from the SMTP transaction with their designated sender IP address, if defined.

Generic address field comparison for blocking will always end up with problems.  The various 'sender' fields deliberately exist in the MIME specification and are intended specifically to allow alternative addresses for different reasons.  Bulk mail systems, notification systems and automated mail output systems utilize this service frequently.  Although less common these days, it's also used by individuals sending 'on behalf' of other people.  The most common occurrence of these mismatched addresses are found in 3rd party newsletters.  The 'from' address will be from the mailer that created the message, but the reply-to will be the person that needs to be contacted.

Identifying specific domains that you are sure will never have a mismatch could be achieved fairly easily with a chain of filters that require all addresses to be a specific domain.  However the fact that you've used yahoo as your example suggests that you're thinking this could be done generically.

TLDR; comparing sender addresses doesn't help like you think it might.

Hello Pam,

I do not have an example now. This was a while ago when I had a lot of these messages. When I have a new one, I will send it to you.

Jan - as Josh has already answered this one, I no longer need the file.  Thanks!  Pam