[AMaViS-user] Bypassing or graylisting remote users X4

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

I'd start with a disclaimer that I wish I could just make policy changes
or change our current infrastructure.  I can however make any necessary
configuration changes.

We have an issue with 'remote' users that send email directly thru us
from their homes.  Here's a brief description of what happens with a
message.

* User sends email using authenticated submission port to mail server
(465 or 587 - Zimbra/postfix/amavisd-new)
* Message goes to an internal MTA server (sendmail-dual/amavisd-new)
* Message goes around internal mailing list server for approval and
comes back to internal MTA (sendmail-dual/amavisd-new)
* Message goes to mail server (zimbra/postfix/amavid-new)

So I need to figure out how to graylist the message since the user
authenticated to begin with, however I also need to propagate this to
the internal MTA server and back to the mail server, to let it know that
the message was authenticated.

The submission port is used internally as well as externally.  No
problems when messages are originated internally as everything falls
within MYNETWORKS.  The problem is with these authenticated users.  I
know I could configure postfix to point to a different policy bank and
add a lower score, right?  Someone suggested me to add a custom header
and then add an SA rule later on.  But this would be very easy to fake. 
I would have to make sure this custom rule is different if it's not
authenticated (and/or get's removed if there are multiple of them)...

Any ideas? As you can see, the final score is very high, with a very
high score due to the DYNAMIC_IPADDR rule.  The other amavis checks done
earlier on have been as high as well.  Thank you very much in advance. 
Here are some sample headers...

Approved-By: nn...@ri...