Secure Delivery between MTA and MDA

[Simon Buchanan <nmc@orcon.net.nz>]

We are setting up mail services to service a small ISP (-2000 Mail 
boxes) using postfix and DBmail, which we have configured and working 
well. The MTA (postfix with spam/virus) sits on a pairing exchange 
(along with a web server)... we are connected to the Internet from the 
pairing exchange via a 100Mbit connection. From the exchange to our NOC 
is a 5Mbit pipe. The MDA (postfix/DBMail) sits in off our NOC.

What i want to do is setup some sort of secure transfer between the MTA 
and MDA. In theory the only traffic that is comming into the MDA is 
correctly filtered mail.. Outgoing is a different story and not an issue 
here.

The MDA is sitting in its own DMZ behind a Borderware firewall.

Suggesions for/against/other are welcome (please!)....

Regards,

Simon