Forged FROM address in my domain

[Raymond Dijkxhoorn]

Hi!

> I am getting quite a lot of Spam getting through which has a forged FROM
> address using a spurious user name in our own domain. Is there any easy way
> to say
> If From is *@my.domain and IP address is not my IP subnet then message 'Is
> Definitely Spam'?

You never have users mailing from home or users mailing from a webcafe
somewhere ? In most situations there is also legit mail comming in.

Bye,
Raymond.