false positives

Jeff Mincy mincy@rcn.com
Thu Oct 20 13:37:51 UTC 2005


On Thu, 20 Oct 2005, pavel.urban@imaginet.cz wrote:

> Hello,
> 
> it seems like we're getting increased number of false positives from 
> DCC. For example, some customers were complaining that newsletters from 
> MSD2D (www.msd2d.com), ComponentSource News, Borland and even Microsoft 
> were marked by DCC as bulk. Has anybody else seen this recently?
> 
> Thanks!

Yes.  I'm seeing lots of false positives.  I'm using DCC through
Spamassassin.  Using my rule statistics, so far this month, DCC_CHECK
has hit on 271 spam messages or 53% of the spam mail, and has hit 107
ham messages or 44% of ham messages.  Yuck.

The problem is that the newsletters are not being whitelisted.
This all makes sense.   DCC is just counting the number of times that
the message has been reported.

However, I am having trouble getting anything whitelisted.

In SpamAssassin user_prefs I have
   dcc_path /usr/local/bin/dccproc
   dcc_options -Q -S mail_host -S Sender -S List-ID -S From -l /home/jeff/.dcc -w /var/dcc/whiteclnt -R

Spamassassin calls DCC using the command line  [dcc_path] -H [dcc_options] < [tmpfile]
I added -Q to keep from reporting messages until I get to the bottom
of this.

Here are the headers for a sample Barron's Online newsletter message
that I can't seem to get whitelisted.  Can somebody who understands
the DCC whitelist more than I do suggest what rule should be added to
whitelist this message.

Thanks

-jeff


   From owner-nolist-WEEKDAYTRADERLIST-051019AS-p70w0se3*MINCY**RCN*-COM@RETURNS.DOWJONES.COM  Wed Oct 19 19:20:26 2005
   Return-Path: <owner-nolist-WEEKDAYTRADERLIST-051019AS-p70w0se3*MINCY**RCN*-COM@RETURNS.DOWJONES.COM>
   Received: from mr10.mrf.mail.rcn.net (EHLO mr10.mrf.mail.rcn.net) (207.172.4.29)
   	by ms02.mrf.mail.rcn.net (MOS 3.5.6-GR FastPath queued)
   	with ESMTP id KTW69590;
   	Wed, 19 Oct 2005 19:11:56 -0400 (EDT)
   Received: from mx01.mrf.mail.rcn.net (mx01.mrf.mail.rcn.net [207.172.4.50])
   	by mr10.mrf.mail.rcn.net (MOS 3.5.7-GR)
   	with ESMTP id CXI33667;
   	Wed, 19 Oct 2005 19:11:53 -0400 (EDT)
   Received: from unknown (HELO mx01.mrf.mail.rcn.net) ([10.255.5.50])
     by mx01.mrf.mail.rcn.net with ESMTP; 19 Oct 2005 19:11:52 -0400
   Received: from returns.dowjones.com ([208.144.115.183])
     by mx01.mrf.mail.rcn.net with ESMTP; 19 Oct 2005 19:11:52 -0400
   Received: from sbkprdlistserv1 (172.26.150.177) by RETURNS.DOWJONES.COM (LSMTP for Windows NT v1.1b) with SMTP id <2.00146E5D@RETURNS.DOWJONES.COM>; Wed, 19 Oct 2005 19:10:12 -0400
   To: MINCY@RCN.COM
   Message-ID: <13597638.1129763397088.JavaMail.SYSTEM@SBKPRDMAESTRO1>
   Date: Wed, 19 Oct 2005 19:09:56 -0400 (EDT)
   From: "Barron's Online" <access@interactive.wsj.com>
   Subject: Barron's Online Daily Features -- October 19, 2005
   Mime-Version: 1.0
   Content-Type: text/plain; charset=ISO-8859-1
   Content-Transfer-Encoding: quoted-printable



More information about the DCC mailing list

Contact vjs@rhyolite.com by mail or use the form.