@lbutlr:
How does amavis know if you removed the spammer headers and added your own?
It has to trust the administrator does a good job :-) Each A-R header include an AuthServID (a hostname generating the A-R header)Any A-R header consumer must know these "TrustedAuthServIDs" and trust these are generated localy.
Andreas
