Postfix: content-filter vs. milter

The main difference is that Milter happens pre-queue, i.e. before Postfix accepts the mail. Content filtering happens post-queue.

It depends on the circumstances and the resources you have available. In general, post-queue content filtering in my experience is less resource intensive. Postfix handles the SMTP transactions, queue's the mail and this can happen relatively quickly and painlessly. Postfix is very efficient in this regard and then the content filter can appear (in your case amavis) and take over scanning the email.

The downside to the post-queue approach is that Postfix cannot reject the mail in real-time. It is preferable to reject as much email as possible within the SMTP transaction itself, to avoid bouncing mail. Why? Because lots of spam, viruses and other emails you want to block/reject are sent from non-existent or bogus email addresses. When this occurs, you have a double-bounce effect and these mails tend to fill your queue. Another alternative is that your mailserver is bouncing email to an unintended recipient (i.e. an email that exists that was used for spamming.)

I would always suggest using lightweight stuff via the milter or SMTPD proxy readme and leave the heavy processing until the content-filter stage. So it would depend what amavis is using and what resources you have available to you. It is preferable to be able to run amavis as a milter during the SMTP transaction phase, but it may not be practical.

My advice would be to try this if you are unsure and to benchmark the before and after. Noone is really going to be able to advise you definitively on your situation, as your mail volume, profile and hardware will differ from most people.

It's also nice having amavis post-queue (as a content filter) as it makes it easier to clean up a mess if amavis breaks - postfix will just spool the mail.