DCC and SpamAssassin

Vernon Schryver vjs@rhyolite.com
Thu Jan 12 15:29:56 UTC 2012


> From: Matus UHLAR - fantomas <uhlar@fantomas.sk>

> >For the last 18 months, the DCC source has included a new version of
> >the SpamAssassin DCC plugin. ...

> >a mechanism that reports message detected as spam by SpamAssassin to DCC
> >with target counts of 'many'.
>
> So, is DCC no more a system for detecting bulkiness, but a 
> spamminess of a message?

DCC is still what it has always been, a mechanism for detecting and
somewhat quantifying the 'bulkness' mail.  Mail messages that have
hit some sort of a spam trap including the DCC.pm dcc_learn_score
mechanism has DCC target counts of "many" and should be considered
"very bulky."  The DCC target count of "many" is in fact 16777200
or the largest target count possible the DCC server databases,
client-server protocol, and server-to-server flooding protocol,
(It's not a coincidence that 16777200 is is approximately 0xffffff.)

The messages that contribute the pink areas in
http://www.rhyolite.com/dcc/graphs/?BIG=1
have target counts of "many" because they have hit some sort of
spam trap.


> ...
> >it has noticable effects on the majority of other DCC installatios
> >that use the DCC.pm default synonym of 9999999 for 'many'.
>
> I was wondering, if I can change the MANY value for reporting and 
> threshold for checking, outside of a DCC client (e.g. DCC.pm)

I recommend running dccifd (or dccm), setting the DCC thresholds
in /var/dcc/dcc_conf, and letting SpamAssassin (if you use SpamAssassin)
look for the string "bulk" in X-DCC headers that SpamAssassin gets
from dccifd or finds already present.

However, DCC.pm has always used the values of dcc_body_max,
dcc_fuz1_max, and dcc_fuz2_max to decide the threshold of DCC target
counts qualify as bad.  Michael Scheidell added dcc_rep_percent for
DCC Reputations.  The SpamAssasin dcc_{body,fuz1,fuz2}_max knobs
date from before dccifd when dccproc was the only way to for
SpamAssassin to invoke DCC.

See the "USER OPTIONS" section of the SpamAssass DCC.pm documentation
by running `perldoc lib/Mail/SpamAssassin/Plugin/DCC.pm`
after expanding your copy of the SpamAssassin tarball.
Or use `perldoc misc/DCC.pm` in your DCC build directory after
expanding a DCC tarball.
Or something like `perldoc /var/dcc/build/dcc/misc/DCC.pm`
after running /var/dcc/updatedcc to get the current DCC version.


Vernon Schryver    vjs@rhyolite.com



More information about the DCC mailing list

Contact vjs@rhyolite.com by mail or use the form.