Question 1. I assume you are using the example here:
Improving Anti-spam system - Zimbra :: Wiki - if that's the case you use the format of the domain name shown in this example and give it a positive score.
Question 2. I would strongly advise against writing your own rules, the slightest slip in your rule will allow spam through. You should make sure that the spamassassin rules are updated regularly and that you add some test for backscatter spam. Search the forums for details on both of those subjects, some links below for starters.
Spam Links - backscatter SareChannels - Spamassassin Wiki http://daryl.dostech.ca/sa-update/sa...date-howto.txt