> second pb: in some of them, there is a big attachment (> 500k) so it doesn't > go throw spamassassin. How to resolv that pb?
This brings up an interesing idea for an enhancement request to SA. If the mail is > the cutoff limit, (which possibly could be a lot smaller than it is now) somehow just pipe the first 2K or 10K or so of the message to SA and have it rule on that. Indeed, perhaps just the headers would be sufficient in many cases. I think right now (if I remember correctly, and I may not) that Bayes has a cutoff limit on learning from a message, since anything over a few K proved to not be useful. Thinking about spam in general, it may be that the message can be reliably classified from a fairly short part of the message. Loren