RE: X-SA-Do-Not-Rej

> What about a mail that already comes with an header
> X-SA-Do-Not-Rej: Yes

This easiest way to solve this problem is to get X-SA-Do-Not-Rej to some
unique value for your site, and then check if it's set to that value.  For
example, my ACL in Exim could look like this...

  # Don't reject messages for postmaster
  warn message     = X-SA-Do-Not-Rej: Beeblebrox
       local_parts = postmaster

I would then check for that in the condition in sa-exim.conf

  SAEximRejCond: $(if !eq ($h_X-SA-Do-Not-Rej:}{Beeblebrox} {1}{0}}

Just remember to strip these headers for any messages leaving your site.
You can do this in a remote_smtp transport like so...

  # This line strips the SA-Exim headers from outgoing messages,
  #  so that clever spammers can't figure out how to get around
  #  SpamAssassin.
    headers_remove = "X-SA-Do-Not-Rej:X-SA-Do-Not-Run:X-SA-Exim-Scanned"

HTH,
Steven
---
Steven Dickenson <[email protected]>
Network Administrator
The Key School, Annapolis Maryland