Through a global procmail rule: :0fw * < 256000 | spamc
And there is no need to feed the message back to postfix, as it is delivered immediatly. This concerns only incoming message.
procmail is a very limited solution, it does have difficulties in dealing with maildirs, and does not speak to cyrus, besides doing that would fork spamc per recipient of each message, and this is *bad*.
My reasoning is that a solution that is scalable to thousands of user and is also simple to implement for just one is better than one that is easier for one user but does not scale, so please do not think single user.
regards, L.
