just a suggestion, but if you pulled the scanner onto a seprate gateway/filter box you can then have that as the MX record for the domain(s)
you want to check and then relay it to the real mail server and for those you do not want to check just have the real mail server the MX record
just a thought - a late night one at that...
i second the recommendation, and modify it even a bit further:
MX1 ------+
|
+---antispam/antivirus proxy server---->final delivery server
|
MX2 ------+
use qmail's smtproutes to direct the traffic from the MX's to the proxy server, then from the proxy to the final delivery server. that gives you the finer-grained control you want, *and* it gives you a very easy way to bypass the proxy during upgrades, or joe-jobs or whatever.
http://www.anastrophe.com
