Here is some background on email notifications and confirmations in Cognito Forms:
If you are collecting the email address of the person submitting the form, you can have the From address be their email address by selecting this field as the From address.
If the From address is Cognito Forms, the email while have a reply to address of
email@example.com. You could try adding this to your filter to see if this helps.
All emails from Cognito Forms are sent by Mandrill, and enterprise transactional email service run by MailChimp. All emails send by Cognito Forms are transactional in nature (not marketing/sales) since they should be sent to people who have opted in and are expecting to receive these informative emails (assuming our users are using the service properly). These emails will all be sent from servers where the domain ends with
mandrillapp.com. It should be safe to whitelist this sender as emails from this domain should not be spam (or even legitimate marketing emails).
Finally, the From address you specify for both email notifications and confirmations is really just the Reply To address. It is not legal/acceptable to spoof sender addresses, so we cannot actually send the email from someone else's email address. This is standard practice and the reason Reply To is part of the email specifications. Most email clients will show the Reply To as the From address.
Here is what this looks like in Outlook, which provides a lot more detail than most email clients:
ThomasFamily <firstname.lastname@example.org>; on behalf of; ThomasFamily <email@example.com>
Also, we just released a major update for notifications and confirmations, so you can now configure multiple emails of each type and conditionally control when they are sent, even as a result of changes when managing entries!
As you can see, you can send emails both when entries are submitted and when they are updated through administration. You can also now specify the From Name, in cases where you want this to be different than your organization name.