If you use SpamAssassin with CGP, see SA bug #7277

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7277 includes a patch 
(against SA 3.4.1) that you may find useful.

It fixes the problem of SA not recognizing mail submission via Pronto or 
IMAP XMIT on authenticated sessions as authenticated submission and so 
checking the submitting IP against various DNSBLs which are unsuited for 
authenticated submission.

Note that with the default configuration of SA, authenticated local 
submission hits the "ALL_TRUSTED" rule, which usually has a strong 
negative (i.e. NOT spam) score and sometimes (but not by default) is set 
to "shortcircuit" and skip checking most other SA rules. This can be 
risky for sites with substantial account hijacking problems, but since 
account hijacking spammers mostly use SMTP and/or webmail, fixing this 
bug probably won't worsen the risk.

#############################################################
This message is sent to you because you are subscribed to
  the mailing list <[email protected]>.
To unsubscribe, E-mail to: <[email protected]>
To switch to the DIGEST mode, E-mail to <[email protected]>
To switch to the INDEX mode, E-mail to <[email protected]>
Send administrative queries to  <[email protected]>