DCC implementation questions

[Matias Lopez Bergero <ml...@udesa.edu.ar>]

Hi,
Maybe this is wrong list to post, but I read here very interesting posts 
about the subjet.

Using SA 3.0.2 on Linux, with milter-spamc.

I have read trough the list that DCC it's working fine with SA. Please 
correct me if I'm wrong, but look a nice think to enable togueter with 
the SA network tests.

I have read the DCC docs, and now I have a couple of questions.

It's dccm a better implementation rater than dccproc for those who are 
using Sendmail? And if this is yes, how do I need to configure SA to 
work with dccm? I couldn't find anything about dccm and SA.


BR,
Matías.

Re: DCC implementation questions

[Matias Lopez Bergero <ml...@udesa.edu.ar>]

Matt Kettler wrote:
> At 09:50 AM 2/10/2005, Matias Lopez Bergero wrote:
> 
>> Thanks for the info Matt.
>>
>> It would be better(faster/reliable) to use DCC apart from SA(dccm), or 
>> using SA with dccifd is a better choice?
> 
> It's not going to be faster or more reliable.. It's really a matter of 
> what you want DCC to do.
> 
> If you call DCC outside of SA, you're going to have to filter on it's 
> results independent of what SA thinks.
> 
> If you call DCC from inside SA, it's results are going to be mixed in 
> with other SA rules. Sometimes SA will think a message is nonspam when 
> DCC thinks it's spam, and vice versa.
> 
> Personally, I tend to not trust DCC as a sole indicator of spam. But it 
> is a very worthwhile tool to use in SA. But that's *my* opinion.

That's what I thought ;)
Thanks Matt!

BR,
Matías.

Re: DCC implementation questions

[Matt Kettler <mk...@evi-inc.com>]

At 09:50 AM 2/10/2005, Matias Lopez Bergero wrote:
>Thanks for the info Matt.
>
>It would be better(faster/reliable) to use DCC apart from SA(dccm), or 
>using SA with dccifd is a better choice?

It's not going to be faster or more reliable.. It's really a matter of what 
you want DCC to do.

If you call DCC outside of SA, you're going to have to filter on it's 
results independent of what SA thinks.

If you call DCC from inside SA, it's results are going to be mixed in with 
other SA rules. Sometimes SA will think a message is nonspam when DCC 
thinks it's spam, and vice versa.

Personally, I tend to not trust DCC as a sole indicator of spam. But it is 
a very worthwhile tool to use in SA. But that's *my* opinion.

Re: DCC implementation questions

[Matias Lopez Bergero <ml...@udesa.edu.ar>]

Matt Kettler wrote:
> At 04:12 PM 2/9/2005, Matias Lopez Bergero wrote:
> 
>> It's dccm a better implementation rater than dccproc for those who are 
>> using Sendmail? And if this is yes, how do I need to configure SA to 
>> work with dccm? I couldn't find anything about dccm and SA.
> 
> 
> You can't configure SA to use dccm, because dccm is a milter, and is 
> intended to be called directly by sendmail, not by another milter such 
> as milter-spamc.

Thanks for the info Matt.

It would be better(faster/reliable) to use DCC apart from SA(dccm), or 
using SA with dccifd is a better choice?

BR,
Matías

Re: DCC implementation questions

[Matt Kettler <mk...@evi-inc.com>]

At 04:12 PM 2/9/2005, Matias Lopez Bergero wrote:
>It's dccm a better implementation rater than dccproc for those who are 
>using Sendmail? And if this is yes, how do I need to configure SA to work 
>with dccm? I couldn't find anything about dccm and SA.

You can't configure SA to use dccm, because dccm is a milter, and is 
intended to be called directly by sendmail, not by another milter such as 
milter-spamc.

However, SA does support two interfaces to dcc.

If dccifd is running and the socket is available, SA will use that. This is 
the faster method, but it only gets used if dccifd is running.

Otherwise, SA will spawn dccproc, slower.

There's no extra configuration to SA needed at all, SA automatically 
detects the presence of either tool and uses the fastest one. All you need 
to do is start dccifd and SA will find it.

If you want to check what method SA is using, run spamassassin --lint -D.