diff --git a/mail2misp/mail2misp.py b/mail2misp/mail2misp.py
index a6b941e..c5958b0 100644
--- a/mail2misp/mail2misp.py
+++ b/mail2misp/mail2misp.py
@@ -284,7 +284,7 @@ def process_body_iocs(self, email_object=None):
                                                           to_ids=False, enforceWarninglist=False)
                 if email_object:
                     email_object.add_reference(attribute.uuid, 'contains')
-            elif domainname in self.config.externallist or self.urlsonly is False:  # External analysis
+            elif domainname in self.config.externallist and self.urlsonly is False:  # External analysis
                 attribute = self.misp_event.add_attribute('link', entry, category='External analysis',
                                                           to_ids=False, enforceWarninglist=False)
                 if email_object: