I use fedora core 2 + cyrus + imap + fetchmail. Local mail and outgoing mail is scanned - but incoming mail via POP3 (fetchmail) isn't. I have the impression cyrus delivers directly via lmtp and bypasses mimedefang - I don't have a clue where to start searching - is it procmail, sendmail or else. Erik