Mercurial > notdcc

comparison FAQ.html.in @ 0:c7f6b056b673

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
First import of vendor version
author Peter Gervai <grin@grin.hu>
date Tue, 10 Mar 2009 13:49:58 +0100
parents
children
comparison
equal deleted inserted replaced
-1:000000000000 0:c7f6b056b673
1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
2 <HTML>
3 <HEAD>
4 <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
5 <TITLE>DCC FAQ</TITLE>
6 <META http-equiv="Content-Style-Type" content="text/css">
7 <STYLE type="text/css">
8 <!--
9 BODY {background-color:white; color:black}
10 UL.FAQlist {margin-left:10%; margin-right:10%}
11 DL.FAQbody {margin-left:5%}
12 DT {font-weight:bolder}
13 .small {font-size:smaller}
14 IMG.logo {width:6em; vertical-align:middle}
15 -->
16 </STYLE>
17 </HEAD>
18
19 <BODY>
20 <H1>Distributed Checksum Clearinghouse (DCC) Frequently Answered Questions</H1>
21
22 <P>
23 <A HREF="http://www.rhyolite.com/dcc/FAQ.html">Current versions</A>
24 of this list can be found among the
25 <A HREF="http://www.rhyolite.com/dcc/">http://www.rhyolite.com/dcc/</A>
26 web pages and their <A HREF="http://www.dcc-servers.net/dcc/FAQ.html">mirror</A>
27 at
28 <A HREF="http://www.dcc-servers.net/dcc/">http://www.dcc-servers.net/dcc/</A>.
29
30
31 <UL class="FAQlist">
32
33 <LI><A HREF="#what-is-it">
34 What is the Distributed Checksum Clearinghouse or DCC?</A>
35 <LI><A HREF="#license">
36 Is the DCC source free?</A>
37 <LI><A HREF="#source">
38 Where can I get DCC source?</A>
39 <LI><A HREF="#binary">
40 Where can I get DCC RPMs, packages or other binary forms?</A>
41 <LI><A HREF="#fuzzy-personalize">
42 Do the fuzzy checksums ignore <Q lang="en-us">personalizations</Q>?</A>
43 <LI><A HREF="#system-load">
44 How much bandwidth, disk space, and computing does the DCC require?</A>
45 <LI><A HREF="#need-server">
46 Do I need to run a DCC server?</A>
47 <LI><A HREF="#crash">
48 What happens to my mail if the DCC break?</A>
49 <LI><a HREF="#mark-only">
50 How do I mark spam without rejecting it?</A>
51 <LI><A HREF="#bad-man">
52 Why doesn't the man command find the man pages?</A>
53 <LI><A HREF="#sendmail-only">
54 Must sendmail be used with DCC?</A>
55 <LI><A HREF="#smtpd">
56 Can the DCC be used with smtpd?</A>
57 <LI><A HREF="#exim">
58 Can the DCC be used with Exim?</A>
59 <LI><A HREF="#other-MUAs">
60 How can the DCC be used with mail user agents?</A>
61 <LI><A HREF="#spamass">
62 Can the DCC be used with SpamAssassin or other spam filters?</A>
63 <LI><A HREF="#dcc-delay">
64 How long must SpamAssassin or an MTA wait for DCC results?</A>
65 <LI><A HREF="#root-needed">
66 Must I have the root password to use DCC?</A>
67 <LI><A HREF="#firewall-ports2">
68 Why don't the public DCC servers work? Do I need a client-ID?</A>
69 <LI><A HREF="#firewall-ports">
70 Which ports do I need to open in my firewall?</A>
71 <LI><A HREF="#cleaning1">
72 Why does the dccd database grow without bound?</A>
73 <LI><A HREF="#cleaning2">
74 The dccd database is corrupt. What should I do?</A>
75 <LI><A HREF="#cleaning3">
76 How can I stop the log directories from overflowing?</A>
77 <LI><A HREF="#bad-locks">
78 Why do my DCC clients including cdcc and dccproc
79 complain about <Q lang="en-us">Resource temporarily unavailable</Q>?</A>
80 <LI><A HREF="#maxprocs">
81 Why does dccifd or dccm complain about
82 <Q lang="en-us">thread_create() failed: 11, try again</Q>? or
83 <Q lang="en-us">pthread_create(): Cannot allocate memory</Q>?</A>
84 <LI><A HREF="#max-work">
85 Why does dccm or dccifd complain about
86 <Q lang="en-us">too many simultaneous mail messages</Q>?</A>
87 <LI><A HREF="#server-pick">
88 Why doesn't my DCC client pick my local DCC server?</A>
89 <LI><A HREF="#IDs1">
90 If I have a server-ID, do I need a DCC client-ID, or vice versa?</A>
91 <LI><A HREF="#IDs2">Why does my DCC server complain about
92 "rejected server-IDs" among flooded checksum reports?</A>
93 <LI><A HREF="#server-rate-limits">
94 Why does my DCC server refuse to accept more than 50 operations per second?</A>
95 <LI><A HREF="#private-server">
96 How do I keep strangers from using my DCC server?</A>
97 <LI><A HREF="#dccm-log1">
98 How can I determine why dccm reported
99 a message as spam or with a recipient count of "MANY"?</A>
100 <LI><A HREF="#dblist1">
101 How can I see what checksums my server has heard from its clients?</A>
102 <LI><A HREF="#whitelist13">
103 How do I stop DCC false positives?</A>
104 <LI><A HREF="#whitelist1">
105 Why is mail from my favorite mailing list marked with an
106 <I>X-DCC</I> header line that says it is spam?</A>
107 <LI><A HREF="#whitelist11">
108 Why are acknowledgments of spam reports mistakenly
109 marked as spam by DCC?</A>
110 <LI><A HREF="#x-dcc-header1">
111 Why are some checksums missing from my <I>X-DCC</I> header lines?</A>
112 <LI><A HREF="#whitelist9">
113 How do I maintain client whitelists?</A>
114 <LI><A HREF="#whitelist2">
115 Do I need both server and client whitelists?</A>
116 <LI><A HREF="#whitelist3">
117 When the whitelist file used by dccd, dccm or dccifd is changed,
118 what must be done to tell the software about the change?</A>
119 <LI><A HREF="#whitelist14">
120 How do I test a whiteclnt file?</A>
121 <LI><A HREF="#reg-exps1">
122 Can I use wild cards or regular expressions in DCC whitelists?</A>
123 <LI><A HREF="#whitelist10">
124 How do I whitelist mail from a legitimate
125 bulk mailer using its name or SMTP headers such as Mailing-List or the
126 Habeas SWE headers?</A>
127 <LI><A HREF="#incompat-whitelists">
128 Why does dccm or dccifd complain about "incompatible whitelists"?</A>
129 <LI><A HREF="#whitelist4">
130 Why do legitimate mail messages have
131 <I>X-DCC</I> header lines that say they are "bulk", "many", or spam?</A>
132 <LI><A HREF="#whitelist5">
133 Are IP address blocks in whitelists used by dccproc?</A>
134 <LI><A HREF="#whitelist6">
135 Why is dccproc is ignoring <I>env_from</I> whitelist entries?</A>
136 <LI><A HREF="#delck">
137 What if I make a mistake with
138 dccproc&nbsp;-t&nbsp;many and report legitimate mail as spam?</A>
139 <LI><A HREF="#whitelist8">
140 Can the sendmail "spamfriend" mechanism tell
141 dccm to not check mail sent to some addresses?</A>
142 <LI><A HREF="#whitelist12">
143 How do I tell dccm to not check mail for an entire domain?</A>
144 <LI><A HREF="#false-positives">
145 How can I avoid polluting the databases of DCC servers with
146 checksums of my mail that is not spam?</A>
147 <LI><A HREF="#spamtrap">
148 Can DCC be fed with <Q lang="en-us">spam traps</Q>?</A>
149 <LI><A HREF="#flood3">
150 How many flooding peers does my DCC server need?</A>
151 <LI><A HREF="#flood1">
152 Do I need to tell the operators of other DCC servers
153 the password for controlling my server to turn on flooding?</A>
154 <LI><A HREF="#flood2">
155 How can I figure out why flooding is not working?</A>
156 <LI><A HREF="#rtt">
157 Why didn't the RTT reported by
158 the cdcc&nbsp;info
159 operation change when my network topology changed?</A>
160 <LI><A HREF="#socks1">
161 When my clients are configured to use SOCKS, they do not
162 realize immediately when a server is down.</A>
163 </UL>
164
165 <P>
166 <HR>
167
168 <DL class="FAQbody">
169
170 <DT><A NAME="what-is-it">
171 What is the Distributed Checksum Clearinghouse or DCC?</A>
172 <DD>
173 The DCC or Distributed Checksum Clearinghouse is an anti-spam content filter
174 that runs on a variety of
175 <A HREF="INSTALL.html#Compatibility">operating systems</A>.
176 The idea of the DCC is that if mail recipients could compare
177 the mail they receive, they could recognize unsolicited bulk mail.
178 A DCC server totals reports of "fuzzy" checksums of
179 messages from clients and answers queries about the total counts
180 for checksums of mail messages.
181 <P>
182 See the main <A HREF="dcc.html">DCC man page</A> as well as the
183 <A HREF="http://www.rhyolite.com/dcc/#overview">DCC web page</A>
184 and its <A HREF="http://www.dcc-servers.net/dcc/#overview">mirror</A>.
185
186
187 <P><DT><A NAME="license">
188 Is the DCC source free</A>
189 <DD>
190 The non-commercial Distributed Checksum Clearinghouse source carries a
191 <A HREF="LICENSE">license</A>
192 that is free only to organizations that do not sell filtering devices or
193 services except to their own users and that participate in the global
194 DCC network.
195 ISPs that use DCC to filter mail for their
196 own users are intended to be covered by the free license.
197 You can redistribute unchanged copies of the free source, but you <B>may not</B>
198 redistribute modified, "fixed," or "improved" versions of the source
199 or binaries.
200 You also can't call it your own or blame anyone for the results of using it.
201 <P>
202 Organizations that do not qualify for the free license are welcome to
203 inquire about licenses for the commercial version by email to
204 <A HREF="mailto:sales@rhyolite.com">sales@rhyolite.com</A>
205 or via the
206 <A HREF="http://www.rhyolite.com/cgi-bin/ct.cgi?sb=Commercial+DCC+License">form</A>.
207 The commercial version supports
208 <A HREF="http://www.rhyolite.com/dcc/reputations.html">DCC
209 Reputations</A>.
210 <P>
211 Please note that organizations that do not qualify for the free DCC license
212 have never been allowed to use the public DCC servers.
213
214
215 <P><DT><A NAME="source">
216 Where can I get DCC source?</A>
217 <DD>
218 The official DCC source repositories are at
219 <A HREF="http://www.rhyolite.com/dcc/source/dcc.tar.Z">www.rhyolite.com/dcc/</A>
220 and
221 <A HREF="http://www.dcc-servers.net/dcc/source/dcc.tar.Z">http://www.dcc-servers.net/dcc/</A>.
222 <P>
223 Please do not try to use ancient versions of DCC software dating from early
224 2005 and redistributed by third parties including some Linux packagers.
225 Those versions do not detect bulk mail as well as more recent versions.
226 Installations using those old versions also have problems using the
227 public DCC servers that often make it necessary to add their IP addresses
228 to the blacklist that protects the public DCC servers.
229 Even worse, all known Linux redistributions of DCC software have been
230 changed in ways that break things, including the
231 <A HREF="misc/updatedcc.in">libexec/updatedcc</A> shell script that could
232 otherwise be used to fetch, configure, compile, install, and restart
233 a current version.
234 <P>
235 When installing DCC software, please consider the installation instructions
236 in the
237 <A HREF="INSTALL.html">INSTALL.html</A> file included with
238 the source or in the
239 <A HREF="http://www.dcc-servers.net/dcc/INSTALL.html">on line source trees</A>.
240
241
242 <P><DT><A NAME="binary">
243 Where can I get DCC RPMs, packages or other binary forms?</A>
244 <DD>
245 There are no official distributions of DCC binaries,
246 whether simple a.out files, RPM Package Manager (RPM) packages,
247 or BSD style ports or packages (pkg).
248 There are many unofficial sources of DCC binaries, including
249 Linux RPMs and BSD style packages.
250 <P>
251 As of 2008, the FreeBSD packages are not too far out of date and
252 include a working version of the
253 <A HREF="misc/updatedcc.in">libexec/updatedcc</A> shell script that
254 fetches, configures, compiles, installs, and restarts
255 a current version.
256 <P>
257 As far as known in 2008, all DCC RPMs offered by Linux distributors
258 are based on DCC software from 2005 and <STRONG>should not</STRONG> be used.
259
260
261 <P><DT><A NAME="fuzzy-personalize">
262 Do the fuzzy checksums ignore <Q lang="en-us">personalizations</Q>?</A>
263 <DD>
264 Yes, they ignore many <Q lang="en-us">personalizations</Q> and
265 <Q lang="en-us">hash busters</Q>.
266
267
268 <P><DT><A NAME="system-load">
269 How much bandwidth, disk space, and computing does the DCC require?</A>
270 <DD>
271 The UDP packets used by a DCC client to obtain the checksum totals
272 from a DCC server for a mail message generally use less bandwidth than
273 the DNS queries required to receive the same message.
274 A DCC client needs very little disk space.
275 <P>
276 Bulk messages are usually logged by DCC clients.
277 On systems receiving a lot of mail, the mechanisms for automatically
278 creating new log directories every minute, day, or hour
279 can keep any single log directory from becoming too large.
280 See the <A HREF="dccm.html#OPTION-l">dccm</A>
281 and
282 <A HREF="dccproc.html#OPTION-l">dccproc</A>
283 man pages.
284 <P>
285 About 1.4 GBytes/day are exchanged between each pair of DCC servers.
286 Each server has 3 or 4 peers.
287 The resulting database is about 3 GBytes with the default expiration
288 parameters..
289 However, while <A HREF="dbclean.html">dbclean</A> is deleting old checksums,
290 there are three copies of the database.
291 The DCC clients and server do not need many CPU cycles,
292 but the daily executions of <A HREF="dbclean.html">dbclean</A>
293 on a system with a DCC server
294 require a computer with at least 2 or 3 GBytes of RAM.
295 In 2006,
296 a DCC server prefers 4 GBytes of RAM and can use 6 GBytes.
297 12 to 18 GBytes of disk space are also needed.
298 <P>
299 DCC servers used by clients handling 100,000 or more messages per day
300 need to be larger.
301 Each additional 100,000 messages/day need about 100 MBytes of disk space
302 and system memory, given the default expiration used by
303 <A HREF="dbclean.html#OPTION-e">dbclean</A>.
304
305
306 <P><DT><A NAME="need-server">Do I need to run a DCC server?</A>
307 <DD>
308 A mail system that processes fewer than 100,000 mail messages per day
309 uses less of its own bandwidth and the bandwidth of other DCC servers
310 by using the <A HREF="http://www.dcc-servers.net/dcc/#public-servers">public
311 DCC servers</A>.
312 Each mail message needs a DCC transaction that requires
313 about 100 bytes, and so 100,000 mail messages/day imply about 10
314 MBytes/day of DCC client-server traffic. Each DCC server needs to
315 exchange "floods" or streams of checksms with 4 other servers. Each
316 flood is currently about 1.4 GBytes/day for a current total of about
317 3 GBytes/day.
318 <P>
319 When normally installed by the included Makefiles, DCC clients are
320 configured to use the
321 <A HREF="http://www.dcc-servers.net/dcc/#public-servers">public DCC servers</A>
322 without any additional configuration except opening firewalls to port UDP 6277.
323 <P>
324 Mail systems that process more than 100,000 mail messages per day
325 need local DCC servers connected to the global network of DCC servers.
326 The public DCC servers include denial of service defenses which
327 ignore requests in excess of about 240,000 per day per client.
328 <P>
329 It is wrong to resell the CPU cycles, network bandwidth,
330 disk space, and, most important, human system administration work of the
331 public DCC servers.
332 Vendors of "anti-spam appliances" or similar
333 that do not steal from the operators
334 of the public DCC servers have always run their own DCC servers.
335
336
337 <P><DT><A NAME="crash">
338 What happens to my mail if the DCC break?</A>
339 <DD>
340 When in doubt or trouble, the DCC clients including
341 <A HREF="dccproc.html">dccproc</A> and <A HREF="dccm.html">dccm</A>
342 deliver mail. They wait only a little while for a DCC server
343 to answer before giving up. They then avoid asking a server for a while
344 to avoid slowing down mail.
345 <P>
346 If the DCC sendmail interface or milter program, dccm, crashes,
347 the default parameters in <A HREF="misc/dcc.m4">misc/dcc.m4</A>
348 for the sendmail.cf Xdcc line
349 tell sendmail to wait only about 30 seconds before
350 giving up and delivering the mail.
351 <P>
352 The DCC client code keeps track of the speeds of the
353 servers it knows about, and uses the fastest or closest.
354 Every hour or so it re-resolves A records
355 and checks the speeds of the servers it
356 is not using. When the current server stops working or gets significantly
357 slower, the client code switches to a better server.
358
359
360 <P><DT><A NAME="mark-only">
361 How do I mark spam without rejecting it?</A>
362 <DD>
363 Unless given thresholds at which to reject mail,
364 <A HREF="dccm.html#OPTION-t">dccm</A>
365 and
366 <A HREF="dccproc.html#OPTION-c">dccproc</A> do not reject mail.
367 When dccm is given a threshold by setting DCCM_REJECT_AT in
368 <A HREF="homedir/dcc_conf.in">dcc_conf</A> in the DCC home directory,
369 DCCM_ARGS can also be set to <A HREF="dccm.html#OPTION-a">"-a&nbsp;IGNORE</A>
370 so that spam is marked but not rejected.
371
372
373 <P><DT><A NAME="bad-man">
374 Why doesn't the man command find the man pages?</A>
375 <DD>
376 The nroff source, formated nroff output, and HTML versions of the
377 man pages are in the top-level source directory.
378 Formatted or nroff source is installed by default somewhere in /usr/local/man
379 depending on the target system.
380 It may be necessary to add /usr/local/man to the MANPATH environment variable.
381 Even with that, SunOS 5.7 sometimes has trouble finding them unless
382 <B>man&nbsp;-F</B> is used.
383
384
385 <P><DT><A NAME="sendmail-only">
386 Must sendmail be used with DCC?</A>
387 <DD>
388 While the sendmail milter interface, <A HREF="dccm.html">dccm</A>
389 and the DCC program interface or <A HREF="dccifd.html">dccifd</A>
390 are the most efficient ways to report and check DCC checksums,
391 <A HREF="dccproc.html">dccproc</A> is also commonly used.
392
393
394 <P><DT><A NAME="smtpd">
395 Can the DCC be used with smtpd?</A>
396 <DD>
397 Yes, <A HREF="dccproc.html">dccproc</A> can be used with Obtuse's smtpd.
398 Dave Lugo has contributed a shell script to the
399 <A HREF="http://sd.inodes.org/">smtpd-sd project</A>
400 which can be used to do DCC checking prior to the end of the SMTP
401 DATA command.
402
403
404 <P><DT><A NAME="exim">
405 Can the DCC be used with Exim?</A>
406 <DD>
407 There are comments about using <A HREF="dccproc.html">Dccproc</A> with
408 <A HREF="http://www.exim.org/">Exim</A>
409 in the
410 <A HREF="http://www.rhyolite.com/pipermail/dcc/">DCC mailing list archives</A>
411 including these messages:
412 <UL>
413 <LI><A HREF="http://www.rhyolite.com/pipermail/dcc/2002/000203.html">
414 2002/000203</A>
415 <LI><A HREF="http://www.rhyolite.com/pipermail/dcc/2002/000254.html">
416 2002/000254</A>
417 </UL>
418 <P>
419 <STRONG>However</STRONG>, those mailing list messages talked about using
420 <A HREF="dccproc.html">dccproc</A> before
421 <A HREF="dccifd.html">dccifd</A> was available.
422 Dccproc is suitable only for low mail volumes.
423
424
425 <P><DT><A NAME="spamass">
426 Can the DCC be used with SpamAssassin or other spam filters?</A>
427 <DD>
428 The DCC can be used with
429 <A HREF="http://spamassassin.apache.org/">SpamAssassin</A> as
430 well as other spam and virus filters.
431 Note that it is more efficient to arrange to use a DCC client daemon
432 such as <A HREF="dccm.html">dccm</A> to mark passing mail and check
433 <I>X-DCC</I> header lines in the filter than to start and run
434 <A HREF="dccproc.html">dccproc</A> on each message.
435 <P>
436 Some commercial virus and spam filters include DCC clients that
437 query public DCC servers or DCC servers operated by the filter vendor
438 and that "flood" or exchange bulk mail checksums with public servers.
439 Reputable manufacturers of such devices operate their own DCC servers
440 connected to global network of DCC servers instead of stealing and then
441 selling the CPU cycles, network bandwidth, disk space, and, most important,
442 human system administration efforts of the public DCC servers.
443
444 <P><DT><A NAME="dcc-delay">
445 How long must SpamAssassin or an MTA wait for DCC results?</A>
446 <DD>
447 DCC clients including dccproc, dccifd, and dccm can wait as long as
448 about 16 seconds for an answer from a DCC server.
449 Except when an anonymous client triggers the progressive delays that are
450 among the defenses against denial of service attacks in the public DCC servers,
451 delays are almost always less than 10 seconds.
452 Delays for DNS blacklists
453 (see <A HREF="dccifd.html#OPTION-B">dccifd&nbsp;-B</A>)
454 are additional.
455
456
457 <P><DT><A NAME="other-MUAs">
458 How can the DCC be used with mail user agents?</A>
459 <DD><A HREF="dccproc.html">Dccproc</A> can be used with any mail user
460 agent that can check mail headers.
461 For example, WD Baseley sent a
462 <A HREF="http://www.rhyolite.com/pipermail/dcc/2002/000212.html">note</A>
463 to the <A HREF="http://www.rhyolite.com/mailman/listinfo/dcc">DCC
464 mailing list</A>
465 on how to configure <A HREF="http://www.eudora.com/">Eudora</A> to
466 act on X-DCC header lines.
467 <P>
468 Bharat Mediratta has developed DeepSix for people using mail user agents
469 on UNIX boxes connected remote servers such as corporate Exchange servers.
470 See his
471 project on <A HREF="http://www.sourceforge.net/projects/deepsix">Sourceforge</A>
472 as well as his
473 <A HREF="http://www.rhyolite.com/pipermail/dcc/2001/000042.html">announcement</A>
474 in the DCC mailing list.
475
476
477 <P><DT><A NAME="root-needed">
478 Must I have the root password to use DCC?</A>
479 <DD>
480 No, the procmail or sendmail .forward DCC user program,
481 <A HREF="dccproc.html">dccproc</A>
482 can be installed in an individual ~/bin directory.
483 Then <A HREF="cdcc.html">cdcc</A>
484 can create a private map file used with
485 <A HREF="dccproc.html#OPTION-h">dccproc&nbsp;-h&nbsp;dir</A>
486 or
487 <A HREF="dccproc.html#OPTION-m">dccproc&nbsp;-m&nbsp;dir/map</A>.
488 <P>
489 Also see the <A HREF="INSTALL.html#individual-user">DCC installation
490 instructions</A>.
491
492
493 <P><DT><A NAME="firewall-ports2">
494 Why don't the public DCC servers work? Do I need a client-ID?</A>
495 <DD>
496 The public DCC servers accept requests from clients using the
497 anonymous client-ID.
498 Incorrectly configured firewalls often cause problems.
499 Traceroute can be used to send UDP packets to test for interfering firewalls.
500 See the answer to the <A HREF="#firewall-ports">firewall question</A>.
501 <P>
502 After firewalls, the most common cause of problems while trying to
503 use the public DCC servers is sending too many requests.
504 The DCC server daemon, <A HREF="dccd.html">dccd</A>, includes
505 defenses against denial of service or DoS attacks.
506 Those defenses include progressively delaying responses
507 and eventually ignoring requests.
508 The ancient version of the DCC client software included in some
509 Linux redistributions tries so hard to reach the fastest server
510 that it can trigger those DoS defenses.
511
512 <P><DT><A NAME="firewall-ports">
513 Which ports do I need to open in my firewall?</A>
514 <DD>
515 DCC traffic is like DNS traffic. You should treat port 6277
516 like port 53.
517 Allow outgoing packets to distant UDP port 6277 and incoming packets
518 from distant UDP port 6277.
519 <P>
520 If the command `cdcc info` says no DCC servers are answering,
521 you may need to adjust your firewall.
522 Also consider the other reasons why the
523 <A HREF="#firewall-ports2">public DCC servers can ignore requests</A>.
524 <P>
525 If you run a DCC server, open incoming connections to local TCP port 6277
526 from your flooding peers,
527 and outgoing connections to TCP port 6277 on your flooding peers.
528 Also open UDP port 6277 to IP address 192.188.61.3 for the DCC server status
529 web page.
530 <P>
531 See also the discussion of Cisco ACLs at
532 <A HREF="http://www.dcc-servers.net/dcc/firewall.html">http://www.dcc-servers.net/dcc/firewall.html</A>.
533
534 <P><DT><A NAME="cleaning1">
535 Why does the</A> <A HREF="dccd.html#FILE-dcc_db">dccd database</A>
536 grow without bound?
537 <DD><A HREF="dbclean.html">Dbclean</A> should be run every night when the
538 system is least busy
539 with the <A HREF="misc/cron-dccd.in">misc/cron-dccd</A> script.
540 An entry like <A HREF="misc/crontab.in">misc/crontab</A> should be put into
541 the crontab file for the user that runs <A HREF="dccd.html">dccd</A>.
542
543
544 <P><DT><A NAME="cleaning2">
545 The dccd database is corrupt. What should I do?</A>
546 <DD><A HREF="dbclean.html#OPTION-R">Dbclean&nbsp;-R</A>
547 will usually repair a broken
548 DCC server database.
549 However,
550 if your server is "flooding" or exchanging checksums with other servers,
551 it is often quicker to stop the DCC server,
552 delete the
553 <A HREF="dccd.html#FILE-dcc_db">@prefix@/dcc_db</A> and
554 <A HREF="dccd.html#FILE-dcc_db.hash">@prefix@/dcc_db.hash</A> files
555 and restart <A HREF="dccd.html">dccd</A> with the
556 <A HREF="misc/start-dccd.in">libexec/start-dccd</A> script.
557 When dccd starts, it will notice that the database has been purged
558 and ask its flooding peers to rewind and retransmit their checksums of
559 bulk mail.
560
561
562 <P><DT><A NAME="cleaning3">
563 How can I stop the log directories from overflowing?</A>
564 <DD>
565 Global <A HREF="dccm.html#OPTION-l">dccm</A>
566 or <A HREF="dccifd.html#OPTION-l">dccifd</A>
567 logging can be entirely
568 disabled by setting DCCM_LOGDIR="" or DCCIFD_LOGDIR="" in the
569 <A HREF="homedir/dcc_conf.in">dcc_conf</A> file in the DCC home directory.
570 Logging for individual users can be disabled by not creating or deleting
571 thir log directories.
572 However, this not only disables logging of rejected mail, but also logging
573 of mail that suffered system failures.
574 <P>
575 To delete old log files, run the
576 <A HREF="misc/cron-dccd.in">misc/cron-dccd</A> script
577 daily with an entry like <A HREF="misc/crontab.in">misc/crontab</A>
578 in the crontab file for the user that runs <A HREF="dccd.html">dccd</A>
579 or <A HREF="dccd.html">dccd</A>.
580 The DBCLEAN_LOGDAYS parameter in the
581 <A HREF="homedir/dcc_conf.in">dcc_conf</A> file in the DCC home directory
582 specifies the age of old log files.
583
584
585 <P><DT><A NAME="bad-locks">
586 Why do my DCC clients including</A>
587 <A HREF="cdcc.html">cdcc</A> and <A HREF="dccproc.html">dccproc</A>
588 complain about "Resource temporarily unavailable"?
589 <DD>
590 Perhaps your operating system has bugs in its implementation of
591 <CODE>fcntl</CODE> file locking, particularly for the
592 DCC client <A HREF="cdcc.html#FILE-map">map</A> file when it is on
593 an NFS file system.
594 <P>
595 Another common case is using an editor such as some versions of <EM>vi</EM>
596 that locks files on the main or a per-user
597 <A HREF="homedir/whiteclnt">whiteclnt</A> file,
598
599
600 <P><DT><A NAME="maxprocs">
601 Why does dccifd or dccm complain about
602 <Q lang="en-us">thread_create() failed: 11, try again</Q>?
603 or <Q lang="en-us">pthread_create(): Cannot allocate memory</Q>?</A>
604 <DD>
605 The most common cause of
606 <Q lang="en-us">thread_create() failed: 11, try again</Q>
607 or <Q lang="en-us">pthread_create(): Cannot allocate memory</Q>
608 error messages from <A HREF="dccm.html">dccm</A>
609 and <A HREF="dccifd.html">dccifd</A>
610 is a too small limit on the maximum number of processes allowed
611 the UID running the dccm or dccifd process.
612 The "maxproc" limit seen with the `limit` or `limits` shell command
613 should be a dozen or so larger than the sum of
614 the queue sizes of dccm or dccifd (or both if both are running).
615 <P>
616 See also the common question and answer about
617 <A HREF="#max-work">too many simultaneous mail messages</A>.
618
619
620 <P><DT><A NAME="max-work">
621 Why does dccm or dccifd complain about
622 <Q lang="en-us">too many simultaneous mail messages</Q>?</A>
623 <DD>
624 Dccm or dccifd can fail to create a thread to deal with an incoming
625 mail message if there are no available file descriptors or
626 other resources.
627 Adding <EM>-d</EM> to DCCD_ARGS or DCCIFD_ARGS in
628 <A HREF="homedir/dcc_conf.in">dcc_conf</A> in the DCC home directory
629 sends a message to the system log that includes the limit on simultaneous mail
630 messages and its source, such as a process resource limit on the
631 number of file descriptors.
632 <P>
633 Another common limit is the maximum number of file descriptors
634 allowed by the <EM>select</EM> system call.
635 This limit can be escaped by building the sendmail milter library to
636 use the <EM>poll</EM> system call.
637
638
639
640
641 <P><DT><A NAME="server-pick">
642 Why doesn't my DCC client pick my local DCC server?</A>
643 <DD>
644 The DCC clients including <A HREF="dccm.html">dccm</A>
645 and <A HREF="dccproc.html">dccproc</A> pick the nearest and fastest
646 server in the list kept in the <A HREF="cdcc.html#FILE-map">@prefix@/map</A>
647 file.
648 DCC servers not in that list will not be used.
649 That list can be viewed with the
650 <A HREF="cdcc.html#OPERATION-info">cdcc&nbsp;info</A>
651 or
652 <A HREF="cdcc.html#OPERATION-RTT">cdcc&nbsp;RTT</A> operations.
653 Add to the list with
654 <A HREF="cdcc.html#OPERATION-add">cdcc&nbsp;add</A>
655 or <A HREF="cdcc.html#OPERATION-load">cdcc&nbsp;load</A>.
656 <P>
657 A nearby server that seems slower than a more distant server will
658 not be chosen.
659 The anonymous user delay set with <A HREF="dccd.html#OPTION-u">dccd&nbsp;-u</A>
660 is intended to make a server appear slow to "freeloaders."
661 The "RTT +/-" value that can be used with
662 the <A HREF="cdcc.html#OPERATION-add">cdcc&nbsp;add</A>
663 and <A HREF="cdcc.html#OPERATION-load">cdcc&nbsp;load</A>
664 operations can be used to force DCC clients to prefer or avoid servers
665 except when absolutely necessary.
666
667
668
669 <P><DT><A NAME="IDs1">
670 If I have a server-ID, do I need a DCC client-ID, or vice versa?</A>
671 <DD>
672 DCC <A HREF="dcc.html#Client-and-Server-IDs">server and client-IDs</A>
673 serve distinct purposes.
674 Servers require server-IDs to identify each other in the floods of checksums
675 they exchange and to recognize authorized users of powerful
676 cdcc operations such as <A HREF="cdcc.html#OPERATION-stop">stop</A>.
677 DCC servers require client-IDs to identify paying clients that should
678 be given quicker service that anonymous clients, to refuse reports from
679 anonymous clients, or to refuse even to answer queries from anonymous
680 clients.
681
682
683 <P><DT><A NAME="IDs2">
684 Why does my DCC server complain about
685 "rejected server-IDs" among flooded checksum reports?</A>
686 <DD>
687 You have turned on IDS tracing, but do not have a
688 <A HREF="dccd.html#FILE-ids">@prefix@/ids</A> file that is complete.
689 You don't need and probably will not have a complete file unless you
690 are assigning DCC server-IDs.
691 <P>Redundant paths among DCC servers exchanging
692 or flooding reports of checksums would cause duplicate entries in
693 each server's database without the mechanism that depends on every DCC server
694 having a unique server-ID.
695 With IDS tracing enabled, <A HREF="dccd.html#OPTION-T">dccd</A> complains
696 about server-IDs that are not listed in the local
697 <A HREF="dccd.html#FILE-ids">@prefix@/ids</A> file.
698
699 <P><DT><A NAME="server-rate-limits">
700 Why does my DCC server refuse to accept more than
701 50 operations per second?</A>
702 <DD>
703 A common cause of such problems is one of the DCC server's
704 defenses against denial of service attacks.
705 A DCC server cannot know anything about anonymous clients,
706 or clients using client-ID 1 or without a client-ID and matching password
707 from the <A HREF="dccd.html#FILE-ids">@prefix@/ids</A> file.
708 As far as your server can know, an anonymous client sending many
709 operations is run by an unhappy sender of unsolicited bulk mail trying
710 to flood your server with a denial of service attack.
711 It is easy to tell your client its ID with the
712 <A HREF="cdcc.html#OPERATION-add">cdcc add</A>
713 or <A HREF="cdcc.html#OPERATION-load">load</A> operations.
714 <P>
715 The default limits can changed by
716 adding an <A HREF="dccd.html#OPTION-R">dccd&nbsp;-R</A> argument
717 can be added to DCCD_ARGS in the
718 <A HREF="homedir/dcc_conf.in">dcc_conf</A> file in the DCC home directory,
719
720
721 <P><DT><A NAME="private-server">
722 How do I keep strangers from using my DCC server?</A>
723 <DD>
724 See the <A HREF="dccd.html#OPTION-u">dccd&nbsp;-u</A> option.
725
726
727 <P><DT><A NAME="dccm-log1">
728 How can I determine why</A> <A HREF="dccm.html">dccm</A> reported
729 a message as spam or with a recipient count of "MANY"?
730 <DD>
731 Dccm is usually configured to log mail with recipient counts greater
732 than the <A HREF="dccm.html#OPTION-t">-t&nbsp;,log-thold,</A>
733 as well as mail with some conflicts among
734 <A HREF="dcc.html#White-and-Blacklists">whitelist</A> entries.
735 Each log file contains a single message, its checksums, its disposition,
736 and other information as described in the
737 <A HREF="dccm.html#FILE-logdir">dccm man page</A>.
738 <P>
739 See also the <A HREF="dblist.html#OPTION-C">dblist&nbsp;-C</A> command.
740
741
742 <P><DT><A NAME="dblist1">
743 How can I see what checksums my server has heard from its clients?</A>
744 <DD>
745 The <A HREF="dblist.html#OPTION-v">dblist&nbsp;-Hv</A>
746 command displays the contents of the database.
747 Look for records with your
748 <A HREF="dcc.html#Client-and-Server-IDs">server-ID</A>
749 with <A HREF="dblist.html#OPTION-I">dblist&nbsp;-I</A>.
750
751
752 <P><DT><A NAME="whitelist13">
753 How do I stop DCC false positives?</A>
754 <DD>
755 You are probably not seeing false positives.
756 The Distributed Checksum Clearing Houses detect both solicited
757 and unsolicited bulk mail, while spam is only unsolicited bulk email.
758 For your DCC client, <A HREF="dccm.html">dccm</A>,
759 <A HREF="dccifd.html">dccifd</A>, or
760 <A HREF="dccproc.html">dccproc</A>, to know to ignore bulk mail messages
761 that are solicited, it must be told by entries the main or a per-user
762 whitelist or <A HREF="homedir/whiteclnt">whiteclnt</A> file.
763
764
765
766 <P><DT><A NAME="whitelist1">
767 Why is mail from my favorite mailing list marked with an
768 <I>X-DCC</I> header line that says it is spam?</A>
769 <DD>
770 Sources of solicited bulk mail including mailing lists to which
771 you have subscribed should usually be in your DCC client
772 <A HREF="dcc.html#White-and-Blacklists">whitelist</A>
773 so that they receive no <I>X-DCC</I> header lines.
774
775
776 <P><DT><A NAME="whitelist11">
777 Why are acknowledgments of spam reports mistakenly marked as spam by DCC?</A>
778 <DD>
779 There is probably no mistake.
780 DCC detect bulk mail and not only unsolicited bulk mail.
781 Whether a bulk message is spam depends on whether you solicited or asked for it.
782 Some INTERNET service providers have sent literally millions of
783 acknowledgments of spam reports, which makes them bulk mail.
784 Bulk mail you want to receive should be
785 <A HREF="dcc.html#White-and-Blacklists">whitelisted</A>
786 in your master or per-user
787 <A HREF="homedir/whiteclnt">whiteclnt</A> file.
788
789
790 <P><DT><A NAME="x-dcc-header1">
791 Why are some checksums missing from my <I>X-DCC</I> header lines?</A>
792 <DD>
793 If the DCC client was not able to compute a checksum for a message,
794 it will not ask the server about that checksum and the checksum will
795 not appear in the <I>X-DCC</I> header.
796 For example, if <A HREF="dccproc.html">dccproc</A> is not told and
797 cannot figure out the IP address of the source of the message,
798 that checksum will be missing.
799 The <I>Fuz1</I> and <I>Fuz2</I> checksums cannot be computed for
800 messages that are too small, and so will be missing for them.
801 A checksum will also be missing if the DCC server is configured to not count
802 it.
803
804
805 <P><DT>Do I need both server and client
806 <A NAME="whitelist2" HREF="dcc.html#White-and-Blacklists">
807 whitelists</A>?
808 <DD>
809 The <A HREF="homedir/whitelist">server whitelist file</A>
810 used explicitly by <A HREF="dbclean.html#FILE-whitelist">dbclean</A>
811 and implicitly by <A HREF="dccd.html#FILE-whitelist">dccd</A>
812 is not very useful and probably a bad idea.
813 <P>
814 The <A HREF="homedir/whiteclnt">client whitelist files</A>
815 used by
816 <A HREF="dccproc.html#FILE-whiteclnt">dccproc</A>,
817 <A HREF="dccm.html#FILE-whiteclnt">dccm</A>,
818 and
819 <A HREF="dccifd.html#FILE-whiteclnt">dccifd</A>
820 are generally required.
821 Client whitelists apply only to the stream of mail handled by the
822 DCC client,
823 while server whitelists apply to reports of mail from all DCC clients
824 of the DCC server.
825 <P>
826 <A HREF="dccproc.html">Dccproc</A> is intended for use by individual users
827 with programs such as
828 <A HREF="http://www.procmail.org/">procmail</A>.
829 Because the global whiteclnt file usually found in the DCC home directory
830 is as likely to be used as a private file,
831 the file name must be explicitly specified with
832 <A HREF="dccproc.html#OPTION-w">dccproc&nbsp;-w&nbsp;whiteclnt</A>.
833 A perhaps inconvenient implication is programs such as
834 <A HREF="http://spamassassin.apache.org/">SpamAssassin</A> that
835 switch unpredictably between dccproc and <A HREF=dccifd.html>dccifd</A>
836 might get inconsistent results unless they invoke dccproc with the global
837 whiteclnt file.
838
839
840 <P><DT><A NAME="whitelist9"></A>
841 How do I maintain client
842 <A HREF="dcc.html#White-and-Blacklists">whitelists</A>?
843 <DD>
844 Start by monitoring bulk mail in the
845 global log directories specified with
846 <A HREF="dccproc.html#OPTION-l">dccproc&nbsp;-l</A>
847 and with DCCM_LOGDIR and DCCM_USERDIRS in the
848 <A HREF="homedir/dcc_conf.in">@prefix@/dcc_conf</A> file
849 for <A HREF="dccm.html#OPTION-l">dccm</A>,
850 and
851 <A HREF="dccifd.html#OPTION-U">dccifd</A>.
852 Then add entries to whitelist files.
853 <P>
854 The global
855 <A HREF="homedir/whiteclnt">@prefix@/whiteclnt</A> file
856 and the whitelists specified with
857 <A HREF="dccproc.html#OPTION-w">dccproc&nbsp;-w</A> are maintained
858 with ordinary text editors.
859 <P>
860 Per-user whitelists in whiteclnt files
861 specified with DCCM_USERDIRS in the
862 <A HREF="homedir/dcc_conf.in">@prefix@/dcc_conf</A> file
863 are easily maintained with ordinary text editors by the system administrator.
864 However, it is often better to let individual users deal with their
865 own whitelists.
866 The DCC source includes sample CGI scripts
867 in the <A HREF="cgi-bin/">cgi-bin directory</A> in the DCC source
868 to let individual end-users monitor their private logs of bulk mail
869 and their individual whitelists.
870 See the <A HREF="cgi-bin/README">README</A> file for those scripts.
871 There is also a
872 <A HREF="http://www.rhyolite.com/dcc/#cgi-demo">demonstration</A>
873 of the cgi scripts.
874
875
876 <P><DT><A NAME="whitelist3"></A>
877 When the <A HREF="homedir/whiteclnt">whitelist file</A>
878 used by <A HREF="dccm.html#FILE-whiteclnt">dccm</A>,
879 <A HREF="dccd.html#FILE-whitelist">dccd</A>,
880 or <A HREF="dccifd.html#FILE-whiteclnt">dccifd</A>
881 is changed,
882 what must be done to tell the software about the change?
883 <DD>
884 The DCC clients notice when their whiteclnt files
885 as well as included files change and automatically rebuild the corresponding
886 <A HREF="dccm.html#FILE-whiteclnt.dccw">.dccw hash table</A> files.
887 <P>
888 Changes to the DCC server or dccd
889 <A HREF="dccd.html#FILE-whitelist">whitelist</A>
890 are not effective until after <A HREF="dbclean.html">dbclean</A> is run.
891 <P>
892 Some text editors including versions of <EM>vi</EM> lock their files.
893 <A HREF="dccm.html#FILE-whiteclnt">Dccm</A>,
894 <A HREF="dccproc.html#FILE-whiteclnt">dccproc</A>,
895 and <A HREF="dccifd.html#FILE-whiteclnt">dccifd</A>
896 are unable to read whitelist files while they are locked.
897
898
899 <P><DT><A NAME="whitelist14">
900 How do I test a whiteclnt file?</A>
901 <DD>
902 An easy way to test a DCC client whitelist or
903 <A HREF="homedir/whiteclnt">whiteclnt</A> file
904 is to feed dccproc with a test message.
905 For example, the following shell script would test whether the IP address
906 127.0.0.1
907 and the SMPT envelope Mail_From value postmaster@example.com are in the
908 <EM>whiteclnt</EM> file in the DCC home directory:
909 <PRE>
910 #!/bin/sh
911 /usr/local/bin/dccproc -QCw whiteclnt \
912 -a 127.0.0.1 -f postmaster@example.com &lt;&lt;EOF
913 Message-ID: <1234@example.com>
914
915 text
916 EOF
917 </PRE>
918 If the script produces something like
919 <PRE>
920 X-DCC--Metrics: calcite.rhyolite.com; whitelist
921 reported: 0 checksum wlist
922 IP: e475b896 492c60fc efecb432 6e29e3c5 ok
923 env_From: bef98dc1 cc6ea4d7 b8daf07c a2bfbc9e
924 Message-ID: 26573398 2ab927cd 681a89fa e502496d
925 </PRE>
926 then you know that SMTP client IP (mail sender) IP address 127.0.0.1
927 is whitelisted, but the SMTP envelope Mail_From value is not.
928
929
930 <P><DT>
931 Can I use wild cards or regular expressions in DCC
932 <A NAME="reg-exps1" HREF="dcc.html#White-and-Blacklists">
933 whitelists</A>?
934 <DD>
935 No, regular expressions cannot be used,
936 because DCC client and server whitelists are converted to lists of checksums.
937 The same basic idea is used for DCC client whitelists
938 as for the DCC protocol.
939 A DCC client computes the checksums for a message, and then looks
940 for those checksums in the local whitelist.
941 Depending on the values associated with those checksums,
942 the DCC client asks a DCC server about them.
943 <P>
944 To use regular expressions with the DCC, consider procmail.
945 Procmail is included with many UNIX-like systems.
946 See also the
947 <A HREF="http://www.procmail.org/">Procmail Homepage</A>.
948 <P>
949 DCC clients can be configured to white- or blacklist
950 using called "substitute" headers.
951 See <A HREF="dccproc.html#OPTION-S">dccproc&nbsp;-S</A> or
952 <A HREF="dccm.html#OPTION-S">dccm&nbsp;-S</A>.
953 <P>
954 It is also possible to use a sendmail access_db file entries to
955 white- or blacklist based on portions of SMTP envelope and
956 client IP addresses.
957 For example, an access_db file line of "From:example.com OK"
958 can be used to tell dccm to whitelist all mail from SMTP clients
959 in the example.com domain.
960 See the -O argument to the
961 <A HREF="misc/hackmc">misc/hackmc</A> script.
962
963
964 <P><DT>
965 <A NAME="whitelist10">How do I whitelist mail from a legitimate
966 bulk mailer using its name or SMTP headers such as Mailing-List
967 headers?</A>
968 <DD>
969 Start by determining an envelope value or SMTP header that distinguishes
970 the bulk mail from a sample message or DCC log file.
971 The name of the sending computer is the <EM>mail_host</EM> value in
972 <A HREF="dccm.html#FILE-logdir">dccm log files</A>.
973 If the distinguishing header or envelope value is not among the main
974 <A HREF="dcc.html#White-and-Blacklists">DCC whitelist values</A>,
975 then a "substitute" value must be used.
976 An "ok substitute ..." line must be added to the whitelist file
977 and the DCC client program must be told with
978 <A HREF="dccproc.html#OPTION-S">dccproc&nbsp;-S</A> or
979 <A HREF="dccm.html#OPTION-S">dccm&nbsp;-S</A>.
980 There are example whitelist entries in the sample
981 <A HREF="homedir/whiteclnt">@prefix@/whiteclnt</A> file.
982 <P>
983
984 <P><DT><A NAME="incompat-whitelists">
985 Why does dccm or dccifd complain about "incompatible whitelists"?</A>
986 <DD>
987 There are several points during an SMTP transaction when an SMTP server
988 can reject a mail message.
989 Early points are when the SMTP client specifies the recipients of the
990 mail message.
991 The last point is after the entire message has been received by the SMTP
992 server.
993 Spam filters that check mail message bodies must wait until that last point.
994 The SMTP protocol does not allow an SMTP server to reject the
995 mail message for only some recipients.
996 The SMTP server must tell the SMTP client that the message has been
997 accepted for all or rejected for recipients.
998 This is a problem when the recipients of a single mail message have
999 differing
1000 <A HREF="dcc.html#White-and-Blacklists">DCC thresholds or other parameters</A>
1001 in their individual whitelist files
1002 that require that the mail message be delivered to some mailboxes but
1003 rejected for other mailboxes.
1004 <P>
1005 The DCC client programs solve this conflict in one of two ways.
1006 One is telling the SMTP client
1007 that the mail message has been accepted for all recipients and then
1008 discarding instead of delivering the message for mailboxes with parameters
1009 that make it spam.
1010 This solution has the disadvantage of not informing senders of the
1011 refusal to deliver the message.
1012 The other solution is to temporarily reject recipients with possibly
1013 incompatible parameters early in the SMTP transaction with the same
1014 SMTP error status number as too many recipients for a single SMTP transaction.
1015 This second solution has the advantage of ensuring that senders know
1016 when their mail is rejected but the disadvantage of sometimes
1017 requiring as many SMTP transactions as there are recipients for a mail message.
1018 <P>
1019 Which solution is used is determined by the
1020 <A HREF="dcc.html#White-and-Blacklists">forced-discard-ok</A>
1021 and <A HREF="dcc.html#White-and-Blacklists">forced-discard-nok</A>
1022 settings in the global and per-user
1023 <A HREF="dccm.html#FILE-whiteclnt">whiteclnt</A> files.
1024 Unless all recipients for a mail message agree on the first solution,
1025 perhaps by <EM>forced-discard-ok</EM> in the main
1026 <A HREF="homedir/whiteclnt">whiteclnt</A> file,
1027 the second solution is used.
1028
1029
1030 <P><DT><A NAME="whitelist4">
1031 Why do legitimate mail messages have
1032 <I>X-DCC</I> header lines that say they are "bulk", "many", or spam?</A>
1033 <DD>
1034 There are several possible causes of such problems.
1035 The first and most obvious is that the mail is solicited bulk mail
1036 and that the source needs to be added to your
1037 <A HREF="dcc.html#White-and-Blacklists">whitelist</A>.
1038
1039 <P>Another possible reason is that your individual legitimate mail messages
1040 have not been marked as spam because their <I>Body</I> or <I>Fuz1</I>
1041 checksum counts are small, but that the IP address or other checksum
1042 counts are large.
1043 The IP address checksum count, for example, is the total of all reports
1044 of addressees for that checksum.
1045 That total is independent of the other checksums, and so counts
1046 all reports for all messages with that source IP address.
1047 A source of legitimate mail that has sent a message that was reported
1048 as spam by one of its recipients will often have the totals
1049 for the checksums of its IP address, From header, and
1050 other values be <I>MANY</I>.
1051 This is why it usually does not make sense to reject mail based on what the
1052 DCC server reports for the IP address, From header, and other values that
1053 are not unique to the message.
1054 Only the last Received header line, the Message-ID line, and body checksums
1055 can be expected to be unique and sometimes not the Message-ID
1056 and Received header lines.
1057
1058 <P><DT><A NAME="qmail2">
1059 Why is legitimate mail from someone using <I>qmail</I>
1060 marked as spam?</A>
1061 <DD>
1062 A common cause for that and similar complaints involves
1063 null or missing Message-ID header lines.
1064 Spam often lacks Message-ID lines or has a null or "&lt&gt" ID,
1065 so rejecting mail with null or missing Message-IDs can be an
1066 effective filter.
1067 DCC clients treat missing Message-ID lines as if they were present but null.
1068 The sample <A HREF="homedir/whiteclnt">@prefix@/whiteclnt</A>
1069 <A HREF="dcc.html#White-and-Blacklists">whitelist</A> file in the DCC source
1070 includes the line:
1071 <PRE>
1072 many message-id &lt;&gt;
1073 </PRE>
1074 Some Mail Transfer Agents violate section 3.6.4 of RFC 2822 and
1075 do not include Message-ID header lines in mail they send,
1076 including some combinations of qmail and
1077 "<B>sendmail&nbsp;-bs</B>" acting as the originating MTA,
1078 and qmail by itself when it is generates a non-delivery message or "bounce."
1079 Solutions to this problem include removing that line from your
1080 <A HREF="dcc.html#White-and-Blacklists">whitelists</A>
1081 or adding lines specifying the From or envelope
1082 from values of senders of legitimate mail lacking Message-ID header lines.
1083
1084
1085 <P><DT><A NAME="whitelist5"></A>
1086 Are <A HREF="dcc.html#White-and-Blacklists">IP address blocks</A>
1087 in <A HREF="homedir/whiteclnt">whitelists</A> used by
1088 <A HREF="dccproc.html">dccproc</A>?
1089 <DD>
1090 Yes, <A HREF="dccproc.html">dccproc</A> can whitelist mail
1091 by the IP address of the immediately
1092 preceding SMTP client,
1093 but only if it knows that IP address.
1094 Unless the <A HREF="dccproc.html#OPTION-a">dccproc&nbsp;-a</A>
1095 or <A HREF="dccproc.html#OPTION-R">dccproc&nbsp;-R</A>
1096 options are used, dccproc does not know the IP address.
1097
1098
1099 <P><DT><A NAME="whitelist6">
1100 Why is</A> <A HREF="dccproc.html">dccproc</A> is ignoring
1101 <A HREF="dcc.html#White-and-Blacklists"><I>env_from</I> whitelist</A>
1102 entries?
1103 <DD>
1104 DCC checksums are of the entire header line or envelope value.
1105 An entry in the whitelist file for <I>jsmith@example.com</I>
1106 will have no effect on mail with an envelope value of
1107 <I>"J.Smith"&nbsp;jsmith@example.com</I>.
1108 The file must contain <I>"J.Smith"&nbsp;jsmith@example.com</I>.
1109 <P>
1110 Another common cause for this problem is implied by the fact that
1111 for an <I>env_from</I> whitelist entry
1112 to have any effect, dccproc must be able to find the envelope value
1113 in the message in a <I>Return-Path</I> header,
1114 an old UNIX-style <I>From_</I> header, or an <B>-f</B> argument.
1115 If your mail delivery agent does not add a <I>Return-Path</I> header
1116 and you do not use
1117 <A HREF="dccproc.html#OPTION-f">dccproc&nbsp;-f</A>,
1118 then dccproc cannot know about
1119 white or blacklist entries for envelope return addresses.
1120 <P>
1121 Note also that dccproc has no whitelist by default and
1122 that <A HREF="dccproc.html#OPTION-w">dccproc&nbsp;-w</A>
1123 must be used.
1124
1125
1126 <P><DT><A NAME="delck">
1127 What if I make a mistake with</A>
1128 <A HREF="dccproc.html#OPTION-t">dccproc&nbsp;-t&nbsp;many</A>
1129 and report legitimate mail as spam?
1130 <DD>
1131 It is possible to delete checksums from the distributed DCC
1132 database with the <A HREF="cdcc.html#OPERATION-delck-type-hex1-hex2-hex3-hex4">
1133 cdcc&nbsp;delck</A>
1134 operation.
1135 However, it is not worth the trouble.
1136 Unless the same (as far as the fuzzy checksums are concerned) message
1137 is sent again, no one is likely to notice the mistake before the
1138 report of the message's checksums expire from the DCC servers'
1139 databases for lack of repetition.
1140
1141
1142 <P><DT><A NAME="whitelist8">
1143 Can the sendmail "spamfriend" mechanism tell</A>
1144 <A HREF="dccm.html">dccm</A> to not check mail sent to some addresses?
1145 <DD>
1146 Sendmail decisions to accept, reject, or discard mail are largely
1147 independent of the decisions made by dccm.
1148 The DCC equivalent is to add
1149 <A HREF="dcc.html#White-and-Blacklists">env_to</A> entries to the
1150 <A HREF="dccm.html#FILE-whiteclnt">dccm whitelist</A>.
1151 See the sample <A HREF="homedir/whiteclnt">@prefix@/whiteclnt</A> file in the
1152 DCC source
1153 <P>
1154 However, if your sendmail.cf file sets the
1155 <I>dcc_notspam</I> macro while processing the
1156 envelope, then the message will by whitelisted.
1157 This is related to the <I>dcc_isspam</I> macro
1158 used by sendmail.cf modified by <A HREF="misc/hackmc">misc/hackmc&nbsp;-R</A>
1159 to tell dccm to report blacklisted messages as spam to the DCC server.
1160
1161
1162 <P><DT><A NAME="whitelist12">
1163 How do I tell</A> <A HREF="dccm.html">dccm</A>
1164 to not check mail for an entire domain?
1165 <DD>
1166 To whitelist all mail addressed to mailboxes in a domain,
1167 add the following line to the sendmail access_DB file and rebuild
1168 the database with the sendmail tool, <I>makemap</I>:
1169 <PRE>
1170 To:domain.com DCC:OK
1171 </PRE>
1172 <P>
1173 You can apply finer control by adding
1174 a third argument to the FEATURE(dcc) macro in your sendmail.mc file
1175 as described in
1176 <A HREF="misc/dcc.m4.in">misc/dcc.m4</A>.
1177 All mail for the domain can use a single "per-user"
1178 <A HREF="homedir/whiteclnt">whiteclnt</A> file,
1179 often in the @prefix@/userdirs/esmtp/example.com, where @prefix@/userdirs
1180 is the default value for <EM>DCCM_USERDIRS</EM>in the DCC configuration file
1181 <A HREF="homedir/dcc_conf.in">@prefix@/dcc_conf</A>.
1182 Making @prefix@/userdirs/esmtp a symbolic link to @prefix@/userdir/local
1183 can be handy.
1184
1185
1186 <P><DT><A NAME="false-positives">
1187 How can I avoid polluting databases of DCC servers with
1188 checksums of my mail that is not spam?</A>
1189 <DD>
1190 Reports of checksums with
1191 <A HREF="dcc.html#White-and-Blacklists">whitelist</A>
1192 entries in your server's database are not flooded to its peers.
1193 The checksums of messages whitelisted with entries in local
1194 <A HREF="dccm.html">dccm</A> or <A HREF="dccproc.html">dccproc</A>
1195 whitelists are not reported to DCC servers.
1196 It is good to add entries to DCC server and client
1197 <A HREF="dcc.html#White-and-Blacklists">whitelists</A>
1198 for localhost, your IP address blocks, and your domains if
1199 you know that none of your users will ever send spam.
1200 <P>
1201 However, in the common mode in which the DCC is used, no
1202 checksums of mail are pollution.
1203 Checksums of genuinely private mail will have target counts of
1204 1 or a small number, and so will not be flooded by your server to
1205 other servers.
1206 Strangers will not see your private mail and so will not be able
1207 to ask any DCC server about the checksums of your private mail.
1208 On the other hand, the DCC functions best by collecting reports
1209 of the receipt of bulk mail as soon as possible.
1210 That implies that it is generally desirable
1211 to send reports of all mail to a DCC server.
1212 The DCC flooding protocol does not send checksums with counts
1213 below 10 <!--fix if BULK_THRESHOLD changes-->
1214 to other servers.
1215
1216
1217 <P><DT><A NAME="spamtrap">
1218 Can DCC be fed with <Q lang="en-us">spam traps</Q>?</A>
1219 <DD>
1220 A spam trap is a mail address that should practically
1221 never receive legitimate mail,
1222 and that treats any mail that it does receive as spam.
1223 A spam trap might a common name such as
1224 <Q lang="en-us">user1</Q> that has never been valid
1225 and is discovered by unsolicited bulk email
1226 advertisers by <Q lang="en-us">dictionary attacks</Q> or guessing.
1227 It might instead be an address hidden in a web page
1228 or a mailbox of an account that has been disabled for many months.
1229 <P>
1230 Any spam trap might receive legitimate mail.
1231 For example, a spam trap that differs from an ordinary mailbox by a
1232 single character might receive mail intended for the ordinary mailbox.
1233 It might be best for a system to reject mail sent to such a trap so
1234 that legitimate mail senders know that their messages have gone astray.
1235 A mailbox that is a long string of arbitrary letters and digits is much
1236 less likely to receive legitimate messages and so might best accept
1237 all messages without complaint.
1238 <P>
1239 There are several ways to connect
1240 <Q lang="en-us">spam trap</Q> mailboxes to DCC:
1241 <DL>
1242 <DT><A HREF="dccproc.html">dccproc</A>
1243 <DD>
1244 For example,
1245 <PRE>dccproc -R -tMANY -cCMN,MANY -o/dev/null</PRE>
1246 will accept a message on STDIN,
1247 look for the IP address of the sender among
1248 <Q lang="en-us">Received:</Q> SMTP fields,
1249 reports the message to the DCC server as spam and the IP address as the sender,
1250 and exit with the default value of
1251 <A HREF="dccproc.html#OPTION-x">dccproc&nbsp;-x</A>.
1252 <P>
1253 <DT>dccif-test
1254 <DD>
1255 dccif-test was written to test the interface to the DCC interface daemon,
1256 <A HREF="dccifd.html">dccifd</A>.
1257 When wired to a spam trap, it is more efficient than dccproc.
1258 For example,
1259 <PRE>dccif-test -cclnt-IP-addr -oSPAM -O/dev/null</PRE>
1260 will do much the same as the dccproc example above.
1261 <P>
1262 <DT><A HREF="dcc.html#White-and-Blacklists">whiteclnt file</A> option line
1263 <DD>
1264 The best way to build a spam trap is with a
1265 per-user <A HREF="dccm.html#OPTION-w">whiteclnt file</A>
1266 with an
1267 <EM>option spam-trap-accept</EM> or <EM>option spam-trap-reject</EM>
1268 line.
1269 <P>
1270 With sendmail, virtual user mapping can be used to send mail to invalid
1271 mailboxes to a single mailbox whose corresponding DCC per-user
1272 whiteclnt file contains an
1273 <EM>option spam-trap-accept</EM> or <EM>option spam-trap-reject</EM>
1274 line.
1275 </DL>
1276
1277
1278 <P><DT><A NAME="flood3">
1279 How many flooding peers does my DCC server need?</A>
1280 <DD>
1281 A single flooding peer delivers all reports of checksums of bulk
1282 mail seen by any DCC server. Additional peers provided reports
1283 sooner and so help the clients of a peer detect spews of spam sooner.
1284 However, more peers will cause more reports to be duplicates.
1285 <P>
1286 A DCC server in a network of many servers should have at least three
1287 flooding peers to ensure that the failure of a single server or network
1288 link cannot partition the network.
1289 Limiting the number the number of peers of any server to four or perhaps
1290 a few more ensures that no single server is critical to the network.
1291 To minimize the distances in the network, four peers
1292 per server seem necessary.
1293 <P>
1294 An organization with more than one server can be viewed as a single
1295 server by other organizations, with its servers flooding each other
1296 and external peers spread among its servers.
1297 This protects the network should the organization suffer large scale problems
1298 while protecting the organization from single points of failure.
1299
1300
1301 <P><DT><A NAME="flood1">
1302 Do I need to tell the operators of other DCC servers
1303 the password for controlling my server to turn on flooding?</A>
1304 <DD>
1305 No, you do not need to and generally should not tell other DCC server
1306 operators the passwords for controlling your server with
1307 the <A HREF="cdcc.html">cdcc</A> command.
1308 Every Inter-server flood of checksums is authorized by lines in
1309 each server's <A HREF="dccd.html#FILE-flod">@prefix@/flod</A> file
1310 and authenticated by the password associated with the
1311 <A HREF="dccd.html#FILE-flod">passwd-ID</A> in those lines.
1312 The passwd-ID is a <A HREF="dcc.html#Client-and-Server-IDs">server-ID</A>
1313 defined in the <A HREF="dccd.html#FILE-ids">@prefix@/ids</A> file
1314 that should generally be used only to authenticate floods of checksums.
1315
1316
1317 <P><DT><A NAME="flood2">
1318 How can I figure out why flooding is not working?</A>
1319 <DD>
1320 Many DCC server problems can be diagnosed by turning
1321 on one or more of the tracing modes in the server with the
1322 <A HREF="cdcc.html#OPERATION-trace">cdcc&nbsp;trace</A> operation
1323 or by restarting the server with
1324 <A HREF="dccd.html#OPTION-T">dccd&nbsp;-T</A>.
1325 <P>
1326 The <A HREF="cdcc.html#OPERATION-flood-list">cdcc flood list</A>
1327 operation displays the current flooding peers of a DCC server.
1328 Counts of checksum reports sent and received to and from
1329 a single peer can be displayed with
1330 <A HREF="cdcc.html#OPERATION-flood-stats">cdcc&nbsp;"flood stats ID"</A>
1331 <P>
1332 The positions in the local database of outgoing streams of checksums
1333 are displayed by the start of <A HREF="dblist.html">dblist&nbsp;-Hv</A>.
1334
1335
1336 <P><DT><A NAME="rtt">
1337 Why didn't the RTT reported by the</A>
1338 <A HREF="cdcc.html#OPERATION-info">cdcc&nbsp;info</A> operation
1339 change when my network topology changed?
1340 <DD>
1341 The RTT or round trip time is an average value.
1342 Changes in network topology, server load, and so forth are not
1343 immediately reflected in the RTT to avoid switching DCC servers
1344 too frequently.
1345
1346
1347 <P><DT><A NAME="socks1">
1348 When my clients are configured to use SOCKS, they do not
1349 realize immediately when a server is down.</A>
1350 <DD>
1351 When configured to use SOCKS, DCC clients cannot "connect"
1352 to a server and so do not receive ICMP errors and must wait for
1353 timeouts to know the server is not answering.
1354
1355
1356 </DL>
1357
1358 <P>
1359 <HR>
1360 <P class=small>
1361 This document describes DCC version 1.3.103.
1362 <P>
1363 <A HREF="http://www.dcc-servers.net/dcc/">
1364 <IMG SRC="http://logos.dcc-servers.net/border.png"
1365 class=logo ALT="DCC logo">
1366 </A>
1367 <A HREF="http://validator.w3.org/check?uri=referer">
1368 <IMG class=logo ALT="Valid HTML 4.01 Strict"
1369 SRC="http://www.w3.org/Icons/valid-html401">
1370 </A>
1371 </BODY>
1372 </HTML>
1373 <!-- LocalWords: dccproc libmilter pthreads procmail dccm dccd DCC libmilter
1374 -->
1375 <!-- LocalWords: homedir dbclean setenv nbsp Solaris crontab Linux ICMP flod
1376 -->
1377 <!-- LocalWords: gmake FreeBSD NetBSD CFLAGS PTHREAD LDFLAGS LIBS HPUX IDs DT
1378 -->
1379 <!-- LocalWords: cdcc DL DD ids var RTT TD TR whiteclnt dccifd whitelist MTA
1380 -->
1381 <!-- LocalWords: hackmc busters whitelisted dblist SpamAssassin
1382 -->
1383 <!-- LocalWords: ARGS
1384 -->