Layered filtering

I'm still trying to get a good conceptual feel for a strong e-mail
filtering approach. At the moment, I've based our solution around two
Postfix (of course!) servers - one internal and one external. All the
internal clients connect to the internal server. The internal server
forwards internet-bound e-mail to the external server, which performs
direct delivery. For inbound, the external server receives the mail and
passes it to the internal server, which stores it for IMAP retrieval.

First of all - any issues with this configuration?

My question here is where should I implement spam checks? Of course I
want Postfix to reject what it can initially at the external server -
but does it matter where the spamassassin, clamav, etc. implementations go?

--
Daniel Miller
VP - Engineering
AM Fire & Electronic Services, Inc. (AMFES)
4655 Quality Court, Suite E
Las Vegas, NV 89103
www.amfes.com
(702) 312-5276
(702) 312-5279 fax
dmiller@amfes.com