dccm, dccifd, dccproc comparison - comments?

> From: "Frank Bures" <fbures@chem.toronto.edu>

> For my own understanding I wrote a little dccm, dccifd and dccproc 
> functionality comparison that follows.  Am I right in my assumptions?
>
> dccproc:
>
> Mail is piped to dccproc from procmail.  Dccproc adds X-DCC headers to mail 
> and if '-c' criteria are met, exits with exit code 67.  Procmail recipes can 
> be subsequently used to process such mail giving sysadmin full control over 
> the filtering.  Greylisting does not work in dccproc.

SpamAssassin uses dccproc if dccifd is not available.
Various other packages also use dccproc.


> dccifd is fed mail by Mail::SpamAssassin::Plugin::DCC plugin to 
> Spamassassin.
> dccifd does not add any headers to the mail, but if '-t' criteria are met, 
> the mail is flagged as spam by Spamassassin.  Outside of DCC's own controls 
> (whitelist, blacklist etc.) user has no control over what is flagged as 
> spam.  What I mean by this is that once the mail is flagged it cannot be 
> unflagged without external tools.  Greylisting does not work in dccifd.

No, please read lib/Mail/SpamAssassin/Plugin/DCC.pm
SpamAssassin first notices X-DCC headers already present that contain
the string "bulk" and skips asking dccproc or dccifd.

if dccifd is available, SpamAssassin send the message there.
dccifd adds an X-DCC header that SpamAssassin uses.
SpamAssassin converts the DCC count "many" to 999999.  It then
compares the DCC counts for the BODY, FUZ1, and FUZ2 with SpamAssassin's
DCC count thresholds to decide if there was a DCC hit.

Few SpamAssassin users fiddle with DCC thresholds.

I don't know what you mean by "unflagged."

DCC greylisting does not work with SpamAssassin.  One reason is
that SpamAssassin is often run after the end of the SMTP transaction.

Dccifd is also used with other packages including Postfix.  Dccifd
supports DCC greylisting, but greylisting cannot work unless dccifd
is listened to during the SMTP transaction.



> dccm:
>
> Dccm is plugs into sendmail by milters.  It works at MTA level.  
> Consequently any mail that meets '-t' criteria is rejected by sendmail 
> directly 

yes, unless dccm has been told to only flag the message with an X-DCC
header.

>                                             uses has no way of accepting 
> such mail.  Rejected mail cannot be "unrejected" at all.  Greylisting works 
> in dccm.

I don't understand unrejecting rejected mail.
The first 32 KBytes of bulk messages (or optionally less or more up to
the messages of MBytes) are logged by dccm, dccifd, and (optionally) by 
dccproc.  This lets users to see what they're missing.  See the demo
of the CGI scripts at
https://cgi-demo:cgi-demo@www.rhyolite.com/DCC-demo-cgi-bin/edit-whiteclnt
and especially the log of mail rejected for that fake (user) at
https://www.rhyolite.com/DCC-demo-cgi-bin/list-log


Vernon Schryver    vjs@rhyolite.com