User level filtering: "From" plus "ends with": What part of "From" header gets hit?

[fjpoblam]

In a user-level filter I am considering the use of a condition "From" plus "ends with" to target emails from a certain domain (e.g., "From" "ends with" "@foo.com"

 

However, it occurs to me that "From" contains not only an email address but also text describing the email address (e.g., "John Doe" "jd@foo.com"or is it, "jd@foo.com" "John Doe"?I dunno).

 

Will "From" "ends with" "@foo.com" work reliably? Where in the "From" header does it hit?

[Tim]

It should block everything@foo.com, as the From rule checks the sending address. Please note that it is possible for Spammers to spoof this information .

[fjpoblam]

It should block everything@foo.com, as the From rule checks the sending address. Please note that it is possible for Spammers to spoof this information .

Oh, uneducated me: how might a spammer spoof this? For example, is the rule case sensitive? (I certainly have no formal training in regex: self-taught.)