DCC

• DCC is not installed by default because its use requires software that has license restrictions for certain commercial uses, but it is still highly recommended. Before enabling this plugin, make sure to review the DCC license terms on the DCC website.
• DCC requires that port 6277 UDP OUT be opened if you are using a firewall.
• DCC detects if a message is bulk mail only. It does not determine if the message itself is spam.

The DCC or Distributed Checksum Clearinghouse is a system of servers collecting and counting checksums of millions of mail messages. The counts can be used by SpamAssassin to detect and reject or filter spam. Because simplistic checksums of spam can be easily defeated, the main DCC checksums are fuzzy and ignore aspects of messages. The fuzzy checksums are changed as spam evolves. You can view the DCC changelog here.

How it works

Warden enables the Mail::SpamAssassin::Plugin::DCC plugin in SpamAssassin, which provides two eval rules that power the tests listed below:

• check_dcc() - used by DCC_CHECK. Hits when a message's body or fuzzy checksum has been reported to the DCC servers at least as many times as configured with dcc_body_max, dcc_fuz1_max, and dcc_fuz2_max (default 999999, which is DCC's "MANY" count).
• check_dcc_reputation_range() - used by the DCC_REPUT_* tests. Hits when a message's DCC Reputation falls within the test's percentage range.

When scanning a message, SpamAssassin queries DCC through the dccifd(8) interface daemon if its socket is found in the DCC home directory (/var/lib/dcc) or specified with the dcc_dccifd_path setting; otherwise it falls back to running the dccproc binary (default /usr/bin/dccproc). Because Perl's taint mode clears the process PATH, an explicit dcc_path is important when relying on the binary.

Install

If you previously compiled DCC we recommend compiling it again using the amavis user instead of the old popuser. This allows admins to set more strict permissions on the DCC socket.

// AlmaLinux / CloudLinux / RHEL / Rocky Linux
yum install gcc make

// Debian / Ubuntu
apt-get install gcc make

// Important: remove the old dcc directory if you've previously built it with a different user
rm -rf /var/lib/dcc

// download and build dcc
wget https://www.dcc-servers.net/dcc/source/dcc.tar.Z
tar xzvf dcc.tar.Z
cd dcc-*
./configure --disable-dccm --bindir=/usr/bin --libexecdir=/usr/libexec/dcc --homedir=/var/lib/dcc -with-uid=amavis
make
make install

// update the DCC server list
cdcc rtt

// AlmaLinux/RHEL/RockyLinux - Apply selinux security labels to new files
restorecon -Rv /usr/bin/cdcc
restorecon -Rv /usr/bin/dcc*
restorecon -Rv /var/lib/dcc/
restorecon -Rv /usr/libexec/dcc/

// Test the DCC Servers
cdcc info

Enable the DCC Interface Daemon

Using the DCC interface daemon (dccifd) is recommended because it provides quicker DCC checks compared to calling the DCC binary. SpamAssassin will try to connect to the daemon socket located at /var/lib/dcc/dccifd first, then fall back to using the DCC binary /usr/bin/dccproc.

To enable the DCC interface daemon create the systemd unit file /usr/lib/systemd/system/dccifd.service with the following:

[Unit]
Description=DCC (Distributed Checksum Clearinghouses) interface daemon
After=network.target

[Service]
Type=forking
PermissionsStartOnly=true
RuntimeDirectory=dcc
ExecStart=/usr/libexec/dcc/rcDCC start
ExecStop=/usr/libexec/dcc/rcDCC stop
ExecReload=/bin/kill -HUP $MAINPID
StandardOutput=null
StandardError=null
Restart=always
User=amavis 
Group=amavis
Nice=1

[Install]
WantedBy=multi-user.target

Enable the DCC Interface Daemon Service

systemctl enable --now dccifd.service

Viewing the DCC Interface Daemon Status

You can view the daemon status with the command systemctl status dccifd.service

# systemctl status dccifd.service
● dccifd.service - DCC (Distributed Checksum Clearinghouses) interface daemon
     Loaded: loaded (/lib/systemd/system/dccifd.service; enabled; vendor preset: enabled)
     Active: active (running) since Wed 2024-06-19 04:55:29 MDT; 2min 17s ago
    Process: 2224364 ExecStart=/usr/libexec/dcc/rcDCC start (code=exited, status=0/SUCCESS)
   Main PID: 2224411 (dccifd)
      Tasks: 4 (limit: 4407)
     Memory: 1.9M
        CPU: 63ms
     CGroup: /system.slice/dccifd.service
             ├─2224411 /usr/libexec/dcc/dccifd -tREP,20 -tCMN,5, "-lD?log" -wwhiteclnt -Uuserdirs -SHELO -Smail_host -SSender -SList-ID
             └─2224412 /usr/libexec/dcc/dccifd -tREP,20 -tCMN,5, "-lD?log" -wwhiteclnt -Uuserdirs -SHELO -Smail_host -SSender -SList-ID

Jun 19 04:55:29 web0.danami.com systemd[1]: Starting DCC (Distributed Checksum Clearinghouses) interface daemon...
Jun 19 04:55:29 web0.danami.com systemd[1]: Started DCC (Distributed Checksum Clearinghouses) interface daemon.
Jun 19 04:55:29 web0.danami.com dccifd[2224412]: 2.3.169 listening to /var/lib/dcc/dccifd for ASCII protocol

Enable the DCC SpamAssassin plugin

Login to Plesk and go to Warden Anti-spam and Virus Protection -> Settings -> Plugin Settings -> Check DCC then save. You should see DCC Server running under the Services widget on the Warden Dashboard. You can see DCC rules being triggered under the Warden -> Logs -> Press the plus icon next to a log entry. You should see DCC_CHECK and DCC_REPUT_ rules in the Tests: line.

Testing

To verify that DCC is working, test both the connection to the DCC server network (UDP port 6277) and a live content query.

Server reachability — display the DCC server map and which servers are working:

# sudo -u amavis cdcc info
# 12 total, 11 working servers
dcc1.dcc-servers.net,- RTT  120 ms  anon
dcc2.dcc-servers.net,- RTT   95 ms  anon

For an active connection test that pings the upstream servers and updates the Round Trip Times, run:

# sudo -u amavis cdcc rtt

It prints the same server list with fresh RTT values. If the output shows 0 working servers or the command times out, outbound UDP port 6277 is likely blocked by a firewall (see the note at the top of this page).

Live content query — feed a sample message into dccproc to simulate a live message query against the DCC server network, like the Pyzor and Razor tests:

# echo "Test message body" | sudo -u amavis dccproc -C

The -C option outputs the message's checksums and the count targets returned by the server. A line in the output containing the count metric (e.g., count=0) confirms a successful live round-trip. A count of 0 is expected for the short test message — the test verifies the round-trip, not whether the message is listed.

Rules

Since DCC 2.x, DCC Reputation data is available to all users (not just commercial installations) and is used automatically when use_dcc_rep is enabled.

When a rule lists four scores: the first applies when neither the Bayesian classifier nor network tests are in use, the second when only network tests are in use, the third when only the Bayesian classifier is in use and the fourth when both are in use.

Tags

The DCC plugin adds the following tags that are available for use in reports, header fields, and other plugins:

Related Pages

• DCC Settings