Well, the best thing is to follow the unix philosophy of "one tool does one thing only and does it well'. Write a intrusion detection "core" in such a way, that you should be able to write "adapters" for any sanely designed MTA.
You can also design an intrusion detection which itself will act as an MTA, but will only do the intrusion detection, and once the mail or "communication payload" has passed the test, hand it over to the actual MTA. I am not much of an expert in this, but my prediction is you will take at least 3 good attempts before ending up writing a good IDS core : 1 : Learning about different MTAs: where you will write an IDS for each type you get. 2 : Abstracting the different MTAs: learning about their inputs, outputs, and modifiers(enviroment vars, config, etc), recognizing which parts are in the core and which ones are to be left out to the "adapters" 3 : working on optimizing as the abstraction process might have introduced large amount of unnecassary code. After writing the core, you will identify popularly used MTAs and write adapters for that , and test it on different configurations. HTH -- -- Laxminarayan Kamath Ammembal (+91) 9945036093
