We keep seeing spammers who are changing their sub domain slightly (Ex:

@marinjoesrestaurant.onmicrosoft.com and @marinlaborers.onmicrosoft.com) The biggest culprit is those exploiting the "onmicrosoft.com" domain.  We can and have been adding the custom filters to combat these, but would like to reject it at the SMTP level before the message enters our server. 

We found that using the SMTP Blocks under settings-->security works well, but don't see any info on wildcard use in the documentation for the setting. Has anyone done that before or know if it is possible to do at the SMTP level for SM? Or have found a more effective way to combat this?

-CB