FWIW this took me days to get right, and still needs tinkering, but it might make for a good starting point for anyone else needing something similar (ie; I don't use or need the overhead of spamassassin or rspamd). https://gist.github.com/markc/eeeb66ce30ea805af62631656cf86c4d Any comments or corrections on that page would be appreciated.