FSE can be configured to filter e-mail from specific senders and domains. This is a good way to prevent mail from known spammers if you are not using a DNS blocklist or if you want to block mail from specific senders for other reasons.
Wildcard characters can be used to enable such filters as *@domain.com to filter all mail from a certain domain.
Note: Sender-domains filtering only applies to the From field in a message. It cannot be used for the To field.
To configure sender domains filtering:
1.     In the Shuttle Navigator, click FILTERING.
2.     Select the Content icon. The Content Filtering pane appears.
3.     In the upper work pane, select the Realtime Scan Job or the Manual Scan Job. (Content filtering is not available for the Transport scan job.)
4.     In the Content Fields pane, select Sender-Domains, and then click the Add button in the Content Filters pane.
5.     A text box appears. Type the sender or domain that you would like to filter. If you want to use a generic domain name filter, you must use an * (wildcard character) before the domain name.
Examples:   
6.     Press ENTER after you have typed the sender or domain. You may add as many entries as you like.
7.     Enable the filter with the Filter field.
8.     In the Action field, indicate the action to take if there is a filter match.
9.     Indicate whether to Send Notifications if there is a filter match. The Content Administrators set up in the Notification work pane, located under REPORT in the Shuttle Navigator, will be sent a notification that a message was filtered. In addition, you must also configure the notifications.
10.  Indicate whether to Quarantine the item if there is a filter match. Enabling quarantine causes deleted attachments and purged messages to be stored, permitting you to recover them. However, worm-purged messages are not recoverable.
11.  Click Save.
The scan job looks at both the display name and the e-mail address of the sender to match against sender-domains filters. It applies the filter against the display name of the mailbox first.
If the display name and sender e-mail address are different, Forefront Security for Exchange Server also applies the filter against the sender e-mail address.

If either matches, the filter action is taken. If you do not want to filter against sender email addresses, set the registry value ContentFilterSMTPAddress to zero (0).

For more information about sender/domain filtering, refer to the Content Filtering topic on TechNet.