Sam, is it possible that Courier behaves differently depending on the return code of the filter?
I don't know what should be the preferred return code when a virus is found in a message. I currently use 554, can't remember why. The idea is to reserve one of the 5xx codes to bear the additional internal meaning that the bounce will contain no attachment. (A more generic approach would be to use return codes not used by SMTP, e.g. "850".)
This is not easy to do. Bounce handling is done separately. If a filter rejects the message the message is only marked as rejected. When message processing begins, since all recipients are marked as nondeliverable, the message gets processed by the courierdsn module, which generates the bounce, and removes the original message from the queue.
Additionally, the sender may request whether or not include the contents of the original message in the bounce, and courierdsn may or may not follow the request, depending on the message.
pgp00000.pgp
Description: PGP signature
