Looking for critique of idea for local integration of DCC and SA

Dale_Whiteaker-Lewis@Dell.com Dale_Whiteaker-Lewis@Dell.com
Thu Aug 29 15:32:57 UTC 2002


	I've been using DCC off and on with SpamAssassin for a project and
ran up against the requirement to quarantine all mail that would otherwise
be blocked by both tools.  I've used a combination of recipient re-writing
and procmail to log and quarantine the messages on a reiserfs file system.
The method of centrally storing one copy of binary attachments described in
the documentation led me to an idea I'd like to broach.  
	If, upon classifying a message as "bulk", DCC (through dccm) were to
mark the headers with the acutal hash that exceeded the threshold (not sure
that's feasible), the hash itself could be used as the filename in
quarantine.  This would have the advantage of continually overwriting a
single copy of the bulk message, rather than quarantining thousands of
near-identical copies.  Why would I go to these lenghts?  If a message were
seen as bulk, yet was business critical, a single copy of it would exist in
the quarantine and could be searched for and retrieved using data in the
procmaillog file.  This occurs to me as one way to provide most of the
benefit of DCC to my network infrastructure with the assurance that no data
would be lost.  Messages that did not exceed any threshold would be stored
individually. 
	Thoughts, anyone?  




More information about the DCC mailing list

Contact vjs@rhyolite.com by mail or use the form.