Distributed Checksum Clearinghouse (DCC)

The Distributed Checksum Clearinghouse or (DCC) is a cooperative, distributed system intended to detect bulk mail or mail sent to many people. It allows individuals, receiving a single mail message, to determine that many other people have received essentially identical copies of the message and thus to reject or discard the message.

There are a group of servers on the Internet that maintain a database of reported mail by other DCC users. When the mail server receives an email it calculates a checksum of that email and sends this value to one of the DCC servers. The DCC server will then store this checksum and look through its database and return a count of how many emails it has already stored from other DCC users that closely match this checksum. If this email matches a high number of emails that have already been stored then it is considered bulk email. Based on a threshold that SMS users sets, this email will accrue a spam score.

DCC is a network based service, so the remote tests option should be enabled in Mail Filters :: General Filter Settings :: Filter Configuration for DCC to work.

• [NOTE:]No confidential information of any kind is transmitted to the DCC servers.

DCC Queries

You can enable or disable DCC checking. It is highly recommended that you enable DCC.

DCC Query Timeout

A query to the DCC server gets timed out after this many seconds. If the DCC server doesn't respond to queries even after this time period, the DCC test is dropped and the filter proceeds with other tests.

DCC Query Sensitivity

This setting is the threshold by which the email in question will receive spam points if the returned count from a DCC server is crossed. The default setting is 50000. In other words there needs to be at least 50000 emails reported to DCC by other DCC users that match the check sum of the email being filtered before it receives extra spam points. Setting this to a lower number will increase the sensitivity of the DCC test. Keep in mind that setting this to a very small number (<1000) may block legitimate mailing list messages since mail from mailing lists are sent to a large number of users and could have a large count in the DCC databases.

Distributed Checksum Clearinghouse (DCC) is a network-based service. In order to use DCC your Secure Mail Suite server must be able to communicate with DCC servers over UDP port 6277. There are two ways to ensure this communication. The first method is to configure your firewall to permit traffic to and from any external host over 6277/udp.

The second method is to only open up your firewall to valid DCC servers. This list changes every so often so this is not the preferred method. However if your company has a stringent firewall policy this may be your only option.

Visit http://infocenter.guardiandigital.com/dcc for a list of IP addresses used by the DCC servers.