Você pode testar o final do cabeçalho "De", por exemplo,
$header_from: does not end <whitelisted domain>
Levando a algo como:
if
# Excluded domains
$header_from: does not end "example.com"
and $header_from: does not end "example.org"
...
and (
# Header Spam
$header_subject: contains "Pharmaceutical"
or ...
# Body Spam
or ...
)
then
fail text "This message has been rejected by spam filter\n\
WARNING! THIS MESSAGE HAS NOT BEEN delivered."
seen finish
endif
Mais informações: link