> btw -- are those two something we should ban actually? it looks like a server misconfiguration to me, not the sender's misbehavior 

They are in the same form as every other local_scan rejection and it was the best examples I could find in limited time.

> -- should we create matching ignoreregex?

More keen on a negative look-ahead assertion.

> or even better just reject when "local_scan(): Rejected...."?

I could remove the "(temporary )? but the local_scan plugin could I think return a temp failure too.

> Also then it would help to avoid having .{0,256}. Better too strict than too loose ;)

This is exactly what exim limits its output to in that field.