Example 1

A domain administrator for foo.com wants no emails delivered except from bar.com.

+-------------+---------------+----------------+----------------------+--------------+--------+
| sender_name | sender_domain | src            | mta_fqdn             | dest_address | policy |
+-------------+---------------+----------------+----------------------+--------------+--------+
| *           | *             | *              | *                    | *@foo.com    |      2 |
| *           | bar.com       | *              | *                    | *@foo.com    |      1 |
+-------------+---------------+----------------+----------------------+--------------+--------+

The top rule masks all incoming emails as rejected email for foo.com. The second rule is the exception to the first rule; where all bar.com incoming email is allowed.