Forged FROM address in my domain

[Jan-Peter Koopmann]

> I am getting quite a lot of Spam getting through which has a 
> forged FROM address using a spurious user name in our own 
> domain. Is there any easy way to say If From is *@my.domain 
> and IP address is not my IP subnet then message 'Is Definitely Spam'?

You could do this in your MTA probably and therefore block it completly.
The question remains: Do you really want to do this? I would start
looking why the spam is coming through MailScanner and SpamAssassin in
the first place and try to optimize things there.

Regards,
  JP