I see. Hence the "BeforeSA" in the option name. Looking at the source
more closely, the second check is under the "exit:" label which is
jumped to after the SA scan is performed.

I did see that comment block in the config file, but I didn't give
enough importance to the "before SA scans the message", and didn't
understand that disabling the option still adds the headers, just after
the scan.

FWIW I did try adding 'headers_remove =3D X-SA-Exim-Connect-IP' (the
specific header I wanted to suppress) to the remote_smtp transport, and
when that didn't work, I added it to all of the transports, and I still
get this header. I'll look into this further to find out why the
transports don't seem to be doing what I want. (Disabling
SAaddSAEheaderBeforeSA was the first thing I tried, so all of my
experiments with the transports were done with it disabled.)
It does, but when the occasional sa-exim update comes along, I'd rather
not have to continue hacking it just to suppress the headers. I'll look
into why the transports aren't working as expected and do the right fix.

Thanks for your help,

Daniel

--=-DEZ3MfCihhJfO6eONfm3
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEABECAAYFAk3VGCgACgkQObn9Ub+O3tPzpgCeIV66IS6fEBtpRrPAAW+cn1XF
90sAoLiooNVD0r/zJS8EU5hJsdNIpqek
=Hv+8
-----END PGP SIGNATURE-----

--=-DEZ3MfCihhJfO6eONfm3--