Specify a different shell when you need more control over what programs can be run from e.g. .forward files.
"sendmail's restricted shell" smrsh is what most people will use (smrsh is part of recent sendmail distributions)
Note: when a shell is specified, it is invoked even when the command contains no shell built-in commands or meta characters.
Example: /some/where/smrsh -c