Jim Hribnak asked,
| How can I use procmail to detect if the From: field has a domain name
| associated with it? I have a spam that did not get trapped and I am
| trying to think of a way to trap this one in the future..
* ^From:(_dot_)*[(_at_)!][a-z]
makes sure that there is a From: line and that it has some sort of addressing
syntax (bang or at) in it, though it could be fooled by an exclamation point
or an at-sign in a comment. The [a-z] is to reduce false positives by
ignoring exclamation points followed by spaces or parentheses (or other
exclamation points) in a comment.
The more serious problem is that you might get mail within your own site that
reasonably has an unqualified From: address.