This is a really nice setup, and after reviewing it, I htink I want to implement it, but I think I only want to do part of it.

I am thinking about having exim reject all messages with a 15 or higher score and that is it. I will add the dcc and vipuls, but let the normal SA handle anything below a fifteen score.

Is that possible?

I was thinking I would do step 1 to get the extra spam software installed and then skip down to step 4 and only put this in:

##
# Reject spam messages with score over 15.
# Keep in mind that $spam_score_int is the messages score multiplied by ten.
##
deny message = Spam score too high ($spam_score)
spam = mailnull:true
condition = ${if >{$spam_score_int}{150}{1}{0}}

But I am curious as to what I need to put into the antivirusandspam.exim file. Would this be sufficient:

if
$h_X-Exiscan-SA-Spam: contains "Yes"
Then
seen
logfile /var/log/exim_mainlog
logwrite "$tod_log $message_id ** F=${lc:$sender_address} [$sender_host_address] discarded: Spam score too high ($1)"
finish
endif

Thanks for any help you might be able to give!

If you do only this, nothing need to put in the Exim System Filter file.

This seems to be working great ATM.

There are few update in the document. Mainly add /defer_ok to protect exim stop relaying email if spamd die. And limit the file size to scan by spamd.

Thanks for letting us know.