One reason your header_checks aren't working could be that the name is encoded (e.g. Base64). You would have to look at the raw email to determine whether this is the case. To try different expressions, you can save the email headers to a file and use postmap -q to make queries against it.