Anyone counting their dcc rejctions?

Vernon Schryver vjs@calcite.rhyolite.com
Tue Apr 16 14:48:53 UTC 2002


> From: Tim Wicinski <tim@meer.net>

> ...
> DCC Rejects     73786   55.643 %
> RBL Block       25674   19.361 %
> Banned messages 24232   18.274 %
> Msg-ID rejects  4777    3.602 %
> Miscellaneous   3857    2.909 %
> Relay Attempts  233     0.176 %
> Unresolvables   46      0.035 %

I hope the 54% not caught by the DCC is being feed to the DCC as "many"
for the benefit of others, as well as your own.  A message that comes
from a blacklisted source in the morning will often come from some
other source in the afternoon.  Messages blocked by the sendmail
access_db, the RBL and relay attempts can be reported as "many" by
adjusting sendmail.cf with the misc/hackmc.

For best DCC rejections, it is best to install version 1.0.53 of the
DCC client code because of bug fixes in the fuzzy checksums listed in
http://www.rhyolite.com/anti-spam/dcc/dcc-tree/CHANGES

> ...
> Question is, does anyone else figure what is getting rejected on
> average?

My rough guess from the spam (as opposed to obvious non-spam)
offered to http://www.rhyolite.com/cgi-bin/dccproc-demo is that
the DCC eventually knows about more than 80% of all spam.

You can guess what other sites are rejecting by comparing the "reports"
and "answers" lines from `cdcc "host dcc.domain.com; stats all"`
There are 4 A records for dcc.rhyolite.com for one sample.
 From such observations, it has seemed to me for the last 2 or 3
months that 20-40% of all mail has been spam.  

Judging by those numbers as well as the number of flooded checksums
(i.e. size of dcc_db files), the last two weeks have been extremely
spammy, with last week about 30% higher than the preceding average.
(Note that the sizes of dcc_db files indicated by `cdcc stats` also vary
by the amount of local traffic and DCC version, with more recent
versions as much as 75% smaller 1.0.43.)


Vernon Schryver    vjs@rhyolite.com



More information about the DCC mailing list

Contact vjs@rhyolite.com by mail or use the form.