How to extract the original sender's email from a multi-forwarded email in Inbound Email Action?

[Mohan Mallapu]

Hi Community,

I'm working on an Inbound Email Action in ServiceNow and need help with extracting the original sender's email address from an email that may have been forwarded multiple times before reaching our monitored inbox (e.g., gto@mycompany.com).

💡 Scenario:

• An external user like abc@gmail.com sends an email to xyz@mycompany.com.
• xyz forwards the email to def@mycompany.com.
• def then forwards it to gto@mycompany.com, where an Inbound Email Action creates a case or incident.

When the email reaches ServiceNow:

• email.from shows the last forwarder (e.g., def@mycompany.com), not the original sender (abc@gmail.com).

✅ What I’ve Tried:

• Parsing email.body_html and email.body_text for:
• From: someone <abc@gmail.com> using regex.
• mailto: links in Gmail-style forwarded messages.

These work in some cases, but the position of the original sender varies (sometimes first, sometimes last in the chain), and I want a reliable way to extract the true origin, especially when the email has gone through multiple forwards.

❓ My Ask:

• Is there a recommended way or best practice to extract the first external email (e.g., non-@mycompany.com) from a forwarded email chain?
• Should I rely on regex for mailto: or From:?
• Are there built-in utilities or safer alternatives in ServiceNow for this kind of parsing?

Any tips, patterns, or examples would be greatly appreciated!

Thanks in advance!

[GlideFather]

Hi @Mohan Mallapu,

this would strongly depend on how the email chain will look like.

If it is forwarding here and there, then I guess it will never have unified form thus it might be very difficult to take this for parsing. 

Will the original sender be always from some domain or it can be anything? If you know that it will always be name@thisdomain.org then it might be easy but if it will be name1@thisdomain1.org  and surname@thatdomain3.net  

Only if one of the resenders will manually add (example) "Point of contact: this@email.com" and then it could be parsed based on the "point of contact", however it would be very fragile and in case that somebody forgets it will not work...

[Chai Maddula]

Hi @Mohan Mallapu 

There’s no OOTB utility in ServiceNow to extract this automatically. regex is the only option

Try if this works to extract First External Email Address

(function getOriginalSender(emailBody) {
var emailRegex = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
var matches = emailBody.match(emailRegex);

if (!matches) return null;

for (var i = 0; i < matches.length; i++) {
var email = matches[i].toLowerCase();
if (!email.endsWith('@mycompany.com')) {
return email;
}
}

return null; // No external email found
})(email.body_text || email.body_html);

If my response solves your query, please marked helpful by selecting Accept as Solution and Helpful

[GlideFather]

I see the challenge in how to differentiate the original sender from the following resenders.... 😕