> -----Messaggio originale----- > Da: Matt Kettler [mailto:[EMAIL PROTECTED] > > Giampaolo Tomassoni wrote: > > > > Oh, really? > > > > So why I get a DCC_CHECK only after manually reporting (with > spamassassin > > -r) a spam? > > > I have no idea. > > Are you running a check *immediately* before calling spammassassin -r? > If not, the difference is probably due to passage of time more than > anything else. > > Certainly your one report is nowhere enough to cause listing in DCC. By > default it takes approximately 1 million reports to get listed.
Ok, I gave a look at the DCC plugin in my SA 3.1.8. When reporting, DCC allows the user to specify how many copies of a message have to be reported. If you say "MANY", it is like if you say "I've seen 999,999 copies of this message", which is the "million reports" you spoke about. When performing a lookup, the DCC plugin triggers the DCC_CHECK tag when DCC says that at least 999,999 copies of that message had been reported. This would mean that DCC_CHECK in SA is triggered on bulk mail. BUT, when SA reports a message, the DCC plugin uses "MANY" (i.e.: 999,999) as the report count, thereby this sounds like "this is spam, so assume it bulk also". Please note that the DCC site says that: "Spam traps involving dccproc -tMANY are useful to DCC reputation servers" (http://www.rhyolite.com/anti-spam/dcc/reputations.html), which sounds like "if you see something which is spam, report as if you have seen 999,999 copies of it. By the way, SA doesn't report every and each message it sees: it does only "look it up". I don't know if, when doing a DCC lookup, the DCC engine also assumes the lookup as the report of a single message, but browsing the DCC site it seems to me that a more active action than a simple lookup is needed in order to report a message. In summary, DCC_CHECK is triggered at the 999,999th copy of a message. Reporting a message to DCC is like saying you saw 999,999 copies of that message. That said, my tool is not a spamtrap, thereby it could probably report one copy of each message having score above the given threshold. However, the DCC plugin has no settings by which you can configure the count of copies to report of a messages (the word "many" is built-in in the report code). Since my tool is going to use SA to report its things, I will probably have to avoid reporting to DCC at all. Otherwise, since only DCC and SA are going to be possible destinations of the reports, I should probably not rely on SA for reporting, but instead build my own reporting code. Thanks Matt for "triggering" my curiosity about the DCC reporting system. Giampaolo
