The rule should actually be From: IP and to:*@domain.com. I do not think we can do this in the rules right now. Could be looked at as a feature enhancement. Current we have FromTo(meaning