Ho to set up Sieve "Redirect to" for mails where the destination e-mail address is in the BCC?

I have set-up domain forwarding to my mailbox.org account. In this context, I will call that example.org

Mails for *@example.org correctly arrive in my mailbox.org account, but for some names @example.org that can receive BCC from the same email address, I want to redirect them to the final recipient.

I have tried to redirect using a rule match "To=user1@example.org" with action "Redirect-to=userX@example.com" but that one fails to match.

What sieve filter strategy should I follow taking into account that in the future I also want to create a similar rule for "user2@example.org" to be redirect to "userY@example.com"?

For example, mails from github notifications have headers like these (basically a BCC e-mail):

``` text

Return-Path: <noreply@github.com>

Delivered-To: user1@example.org

Received: from director-03.heinlein-hosting.de ([2001:67c:2050:104:0:1:25:1])

(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))

by dobby44b.heinlein-hosting.de with LMTPS

id wBxzAGsmHmr9bAAAlScrYA:P1

(envelope-from <noreply@github.com>)

for <user1@example.org>; Tue, 02 Jun 2026 02:40:11 +0200

Received: from mx1.mailbox.org ([2001:67c:2050:104:0:1:25:1])

(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))

by director-03.heinlein-hosting.de with LMTPS

id wBxzAGsmHmr9bAAAlScrYA

(envelope-from <noreply@github.com>)

for <user1@example.org>; Tue, 02 Jun 2026 02:40:11 +0200

Received: from out-20.smtp.github.com (out-20.smtp.github.com [192.30.252.203])

(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)

key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)

(No client certificate requested)

by mx1.mailbox.org (Postfix) with ESMTPS id F03D12E0574

for <user1@example.org>; Tue, 2 Jun 2026 02:39:59 +0200 (CEST)

Authentication-Results: incoming_mbo;

dkim=pass header.d=github.com header.s=pf2023 header.b=ed+aon0H;

dmarc=pass (policy=quarantine) header.from=github.com;

spf=pass (incoming_mbo: domain of noreply@github.com designates 192.30.252.203 as permitted sender) smtp.mailfrom=noreply@github.com

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com;

s=pf2023; t=1780360798;

bh=wWBiZKzDBRBlDukAGp5d4C+I0kbIGtpH6sO+tM+zhsc=;

h=Date:From:Reply-To:To:Cc:Subject:List-ID:List-Archive:List-Post:

From;

b=ed+aon0H0nmTSypD4sI4g1tTJD5CBcz3EQDwxskkmoLCDOAE+h4WRqTdcUqRECa4N

ldb6JLcUdl6uqUSg8hyPSiotOStYZTrU0P8K2dy0daXwUQcQA2XFjlP1ZKhznV8Ekn

sfm3NOhtmAfWZHawgVuEhx1cGz6+Vj54EjYbsqIA=

Received: from github.com (hubbernetes-node-ca41cfb.va3-iad.github.net [10.48.175.35])

by smtp.github.com (Postfix) with ESMTPA id D23BC800FDF

for <user1@example.org>; Mon, 1 Jun 2026 17:39:58 -0700 (PDT)

Date: Mon, 01 Jun 2026 17:39:58 -0700

From: Ruffle Build <notifications@github.com>

Reply-To: ruffle-rs/ruffle <noreply@github.com>

To: ruffle-rs/ruffle <ruffle@noreply.github.com>

Cc: Subscribed <subscribed@noreply.github.com>

Message-ID: <ruffle-rs/ruffle/releases/332839361@github.com>

Subject: [ruffle-rs/ruffle] Pre-release nightly-2026-06-02 - Nightly

2026-06-02

Mime-Version: 1.0

Content-Type: multipart/alternative;

boundary="--==_mimepart_6a1e265ecf853_ab110883445";

charset=UTF-8

Content-Transfer-Encoding: 7bit

Precedence: list

X-GitHub-Sender: RuffleBuild

X-GitHub-Recipient: user1handle

X-GitHub-Reason: subscribed

List-ID: ruffle-rs/ruffle <ruffle.ruffle-rs.github.com>

List-Archive: https://github.com/ruffle-rs/ruffle

List-Post: <mailto:noreply@github.com>

X-GitHub-Notify-Platform: newsies

X-Auto-Response-Suppress: All

destinations: user1@example.org

X-GitHub-Recipient-Address: user1@example.org

X-Rspamd-Queue-Id: F03D12E0574

X-MBO-SPAM-Probability:

X-Rspamd-Score: -24.11 / 15.00 / 15.00

```

Thanks in advance,

--jeroen