I would like to write an external filter (at Mail|Rules or Antivirus).

Can you add a simple source code sample ?

Is it possible to catch failed message responses like

"09:20:12 *** <> <> 0 0 00:00:00 INCOMPLETE-SESSION"

with an external filter ?