> Am I correct? Sorry if I'm being dense. I'm just a sysadmin, not a developer,
> so I'm not super clear on how macros and expansions work in perl.
You have the concepts right. I'd try the rules you posted and see if they seem
to be producing correct results. You can run a spam thru SA with the -t switch
and see which rules hit, and hopefully the NOT_FROM_ rule will hit. Send
yourself a test mail and see that it doesn't hit. If that all works it is time
to add the rules for the family. If it doesn't work, look at how the From
header is formatted in the mail you sent to yourself.
Loren