Is there a way to search for a specific pattern in an email header and block it server-wide across ALL domains??

I've tried the following in the Exim Editor via WHM, but exim throws errors on restart:

# Spamtrap
if
$message_headers contains "XXX"
or $message_headers contains "XX"
then
fail text "Your mail is not welcome on this server."
seen finish
endif

Any insight would be appreciated.