exim 3

In the transports section of your exim.conf create a transport for delivering the message back to exim after tagging it with SA. You should already be aware that the order transports are specified is not irrelevant.

# SpamAssassin
spamcheck:
    driver = pipe

    command = /usr/sbin/exim -oMr spam-scanned -bS
    transport_filter = /usr/bin/spamc

    bsmtp = all

    home_directory = "/tmp"
    current_directory = "/tmp"

    # must use a privileged user to set $received_protocol
    # in the second exim process!
    user = mail
    group = mail

    return_path_add = false

    log_output = true
    return_fail_output = true

    prefix =
    suffix =

Now add a director that will direct all messages that haven't been scanned to be delivered using the transport you defined above. You should already be aware that the order directors occur is significant. You will most likely want to place this director above all of the others, but you may have the need or desire for slightly different behavior.

# SpamAssassin
spamcheck_director:

    # do not use this director when verifying a local-part at SMTP-time
    no_verify

    # When to scan a message :
    #   -   it isn't already flagged as spam
    #   -   it isn't already scanned
    #   -   it didn't originate locally (as long as I don't harbor spammers :-))
    condition = "${if and { {!def:h_X-Spam-Flag:} {!eq {$received_protocol}{spam-scanned}} {!eq {$received_protocol}{local}} } {1}{0}}"
    driver = smartuser
    transport = spamcheck