Revision history [back]

Since the specific content is in the SMTP payload, you should look into the Internet Message Format (IMF). The dissector has settings for custom headers, maybe that can already do what you need.