I do now run spamassassin in the data acl, running as the recipients
user (I only allow one recipient at a time, that's okay for my traffic).
It denies spam over a certain threshold, and marks the rest as spam if
it's over another threshold. If it's marked as spam, it is later sent
through spamassassin again in a transport_filter. This is to let the
users have their "familiar" spam, with the original mail as an
attachment. All this works very good, and I'm really happy with it.
The thing is, very often (but not always) the spam gets a way higher
score when it's run through the transport_filter. So high that it would
have been blocked at the acl if the score had been the same there.
It _might_ look like SA doesn't decode the mail if run from an acl? So
that it can mostly check the headers, not the content? Because it seems
that the url blocklists aren't being tested when run from an acl.
