Vernon Schryver
vjs@calcite.rhyolite.com
Tue, 16 Apr 2002 08:48:53 -0600 (MDT)
> From: Tim Wicinski <tim@meer.net> > ... > DCC Rejects 73786 55.643 % > RBL Block 25674 19.361 % > Banned messages 24232 18.274 % > Msg-ID rejects 4777 3.602 % > Miscellaneous 3857 2.909 % > Relay Attempts 233 0.176 % > Unresolvables 46 0.035 % I hope the 54% not caught by the DCC is being feed to the DCC as "many" for the benefit of others, as well as your own. A message that comes from a blacklisted source in the morning will often come from some other source in the afternoon. Messages blocked by the sendmail access_db, the RBL and relay attempts can be reported as "many" by adjusting sendmail.cf with the misc/hackmc. For best DCC rejections, it is best to install version 1.0.53 of the DCC client code because of bug fixes in the fuzzy checksums listed in http://www.rhyolite.com/anti-spam/dcc/dcc-tree/CHANGES > ... > Question is, does anyone else figure what is getting rejected on > average? My rough guess from the spam (as opposed to obvious non-spam) offered to http://www.rhyolite.com/cgi-bin/dccproc-demo is that the DCC eventually knows about more than 80% of all spam. You can guess what other sites are rejecting by comparing the "reports" and "answers" lines from `cdcc "host dcc.domain.com; stats all"` There are 4 A records for dcc.rhyolite.com for one sample. From such observations, it has seemed to me for the last 2 or 3 months that 20-40% of all mail has been spam. Judging by those numbers as well as the number of flooded checksums (i.e. size of dcc_db files), the last two weeks have been extremely spammy, with last week about 30% higher than the preceding average. (Note that the sizes of dcc_db files indicated by `cdcc stats` also vary by the amount of local traffic and DCC version, with more recent versions as much as 75% smaller 1.0.43.) Vernon Schryver vjs@rhyolite.com