you could create a rule under "Compliance > Envelope Analysis > Manage Rules"
Correct, the easiest way is to create an envelope analysis rule to drop/quarantine messages from a specific domain.
I would suggest:
- Create a group called "spam domains" (Compliance/Advanced/Manage Groups)
- Add the spam-domain to this group. (You can add other domains as needed.)
- Create an Envelope analysis rule (as the others recommended)
- Apply this rule to the group you created, "spam domains"