Distributed Checksum Clearinghouses

Description

The Distributed Checksum Clearinghouses or DCC is an anti-spam content filter that runs on a variety of operating systems . As of 2010, it involves millions of users, more than six hundred thousand client computer systems, and about 200 servers collecting and counting checksums related to more than 300 million mail messages on week days. The counts can be used by SMTP servers and mail user agents to detect and reject or filter spam or unsolicited bulk mail. DCC servers exchange or "flood" common checksums. The checksums include values that are constant across common variations in bulk messages, including "personalizations." There are graphs of recently detected spam. Those graphs suggest the effectiveness of the system. For example, if you assume that 80% of all mail is spam and those graphs indicate that DCC finds 70% of mail is spam, then DCC detects 88% of spam. The idea of DCC is that if mail recipients could compare the mail they receive, they could recognize unsolicited bulk mail. A DCC server totals reports of checksums of messages from clients and answers queries about the total counts for checksums of mail messages. A DCC client reports the checksums for a mail message to a server and is told the total number of recipients of mail with each checksum. If one of the totals is higher than a threshold set by the client and according to local whitelists the message is unsolicited, the DCC client can log, discard, or reject the message. Because simplistic checksums of spam would not be effective, the main DCC checksums are fuzzy and ignore aspects of messages. The fuzzy checksums are changed as spam evolves. Since DCC started being used in late 2000, the fuzzy checksums have been modified several times. Unless used with isolated DCC servers and so losing much of its power, DCC causes some additional network traffic. However, the client-server interaction for a mail message consists of exchanging a single pair of UDP/IP datagrams of about 150 bytes. That is often less than the several pairs of UDP/IP datagrams required for a single DNS query. SMTP servers make DNS queries to check the envelope Mail_From value and often several more. As with the Domain Name System, DCC servers should be placed near active clients to reduce DCC network costs. DCC servers exchange or flood reports of checksums, but only the checksums of bulk mail.

Products & services

Similar companies nearby