Marrab,

What version of SpamFilter are you using? Versions prior to build 2.6.3.487 had a problem in that not always we were able to output an error code to the sender if the email was over the max size limit. The same problem could occur with the attachment filter. The release note for the latest build is:

// New to VersionNumber = '2.6.3.487';
{TODO -cFix : Again still, when emails were over the MaxMsgSize limit, the sender was sometimes disconnected without outputting a numeric error code, causing them to retry }

As far as the NDR, I'm not sure about the question. SpamFilter only sends an NDR email to the sender if the email passes all the filtering rules, is forwarded to your destination SMTP server, but your destination SMTP server rejects is for some reason (mailbox full, user does not exist, for example). If the email is rejected by SpamFilter's filters, we simply output an error code to the sender, and this causes the *remote server* to send an NDR email to the sender. If the email is quarantined, the error code is always sent *after* the complete email is received.
For the other filters, it depends. In general, if the filter acts on the email's content, like keywords, virus, attachments, SURBL, of Bayesian, the whole email is received first before the test can be performed. For tests that check the sender's IP, domain, email, country, DNS, then usually they are disconnected before they have a chance to send the whole email.

I hope this helps!

Correct, that should also have been fixed in 487. We'll be updating the release notes shortly to include these details as well. We were not aware of those other problems prior to this thread, but luckily the 487 build does fix them as well.