Daryl writes:
> Make sure your milter is providing a return path header field so that SA
> gets the correct envelope-from address. I believe old versions of
> amavisd-new don't do this. If the milter fails to do this SA will end
> up using the From: header field value and, yeah, you'll get SPF fail.

amavisd-new inserts envelope sender address into mail header
since amavisd-new-20030616 (i.e. June 2003).

Initially it was inserted as X-Envelope-From, nowadays
the Return-Path header field is used for the purpose.

To make it explicit to SA, the following lines
are recommended in local.cf:
always_trust_envelope_sender 1
envelope_sender_header Return-Path
(although with some luck SA may guess correctly by itself)

The change from X-Envelope-From into Return-Path
came with a amavisd-new-2.0 (=20040701) release
(actually already in a pre-release amavisd-new-20040301).

The last version of amavisd that didn't insert envelope sender
information into a mail header in any form was 20030314-p2.