dccproc scores

Vernon Schryver vjs@calcite.rhyolite.com
Fri Jul 2 15:02:45 UTC 2004


> From: "Divyanand M S" 

> 1. I ran a test run and found certain mails have high scores (for instance
> dilbert newsletter has X-DCC-MessageCare-Metrics: root 1108; Body=0
> Fuz1=4421 Fuz2=5478). My dilemma is that I've to decide trigger scores for
> all my users. I can use whitelist common newsletters but I don't think I can
> cover all users' newsletters.
> I would like to know the score at which I can safely tell if its spam.

The DCC detects bulk mail.  Whether a given copy of a bulk message is
spam can only be decided locally by or on behalf of the recipient that
copy of the message.

You need to put add the Dilbert newsletter to your site whitelist
or the per-user whitelists of subscribers.

The cgi-bin directory in the DCC tarball includes proof-of-concept
CGI scripts that let individual end-users manipulate their per-user
whitelists.


> 2. When I run dccproc with options -R -H, I get the basic elements like
> Body, Fuz1 & Fuz2. What is the option to display all elements (IP, env_From,
> From, Message-ID, Received & substitute).

I frequently use `dccproc -QC` 
`dccproc -El logdir` might also be useful.

However, the default and almost universal configuration of DCC servers
is to not count any except the Body, Fuz1, and Fuz2 checksums of message
bodies.  As a result, there are no flooded checksums except body checksums.
See `dccd -K` to change that for your own DCC servers.


Vernon Schryver    vjs@rhyolite.com



More information about the DCC mailing list

Contact vjs@rhyolite.com by mail or use the form.