> Am I correct? Sorry if I'm being dense. I'm just a sysadmin, not a developer, > so I'm not super clear on how macros and expansions work in perl.
You have the concepts right. I'd try the rules you posted and see if they seem to be producing correct results. You can run a spam thru SA with the -t switch and see which rules hit, and hopefully the NOT_FROM_ rule will hit. Send yourself a test mail and see that it doesn't hit. If that all works it is time to add the rules for the family. If it doesn't work, look at how the From header is formatted in the mail you sent to yourself. Loren