@lbutlr: > How does amavis know if you removed the spammer headers and added your own? It has to trust the administrator does a good job :-) Each A-R header include an AuthServID (a hostname generating the A-R header) Any A-R header consumer must know these "TrustedAuthServIDs" and trust these are generated localy. Andreas