From mboxrd@z Thu Jan  1 00:00:00 1970
X-Msuck: nntp://news.gmane.io/gmane.emacs.gnus.general/41843
Path: main.gmane.org!not-for-mail
From: Chris Shenton <chris@shenton.org>
Newsgroups: gmane.emacs.gnus.general
Subject: Anyone using DCC to block spam? How to config Gnus based on X-DCC-* ?
Date: 11 Jan 2002 14:26:01 -0500
Sender: owner-ding@hpc.uh.edu
Message-ID: <87advkpu46.fsf@thanatos.shenton.org>
References: <2nadvm2ex1.fsf@zsh.cs.rochester.edu>
NNTP-Posting-Host: coloc-standby.netfonds.no
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Trace: main.gmane.org 1035177175 8218 80.91.224.250 (21 Oct 2002 05:12:55 GMT)
X-Complaints-To: usenet@main.gmane.org
NNTP-Posting-Date: Mon, 21 Oct 2002 05:12:55 +0000 (UTC)
Return-Path: <owner-ding@hpc.uh.edu>
Original-Received: (qmail 13289 invoked from network); 11 Jan 2002 19:26:32 -0000
Original-Received: from malifon.math.uh.edu (mail@129.7.128.13)
  by mastaler.com with SMTP; 11 Jan 2002 19:26:32 -0000
Original-Received: from sina.hpc.uh.edu ([129.7.128.10] ident=lists)
	by malifon.math.uh.edu with esmtp (Exim 3.20 #1)
	id 16P7Ji-00063Z-00; Fri, 11 Jan 2002 13:26:18 -0600
Original-Received: by sina.hpc.uh.edu (TLB v0.09a (1.20 tibbs 1996/10/09 22:03:07)); Fri, 11 Jan 2002 13:26:11 -0600 (CST)
Original-Received: from sclp3.sclp.com (qmailr@sclp3.sclp.com [209.196.61.66])
	by sina.hpc.uh.edu (8.9.3/8.9.3) with SMTP id NAA29160
	for <ding@hpc.uh.edu>; Fri, 11 Jan 2002 13:26:02 -0600 (CST)
Original-Received: (qmail 13272 invoked by alias); 11 Jan 2002 19:26:04 -0000
Original-Received: (qmail 13267 invoked from network); 11 Jan 2002 19:26:03 -0000
Original-Received: from a3.ebbed1.client.atlantech.net (HELO Thanatos.Shenton.Org) (209.190.235.163)
  by gnus.org with SMTP; 11 Jan 2002 19:26:03 -0000
Original-Received: (qmail 59864 invoked by uid 1000); 11 Jan 2002 19:26:02 -0000
Original-To: ding@gnus.org
In-Reply-To: <2nadvm2ex1.fsf@zsh.cs.rochester.edu>
Original-Lines: 38
User-Agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.1
Precedence: list
X-Majordomo: 1.94.jlt7
Xref: main.gmane.org gmane.emacs.gnus.general:41843
X-Report-Spam: http://spam.gmane.org/gmane.emacs.gnus.general:41843

I recently started trying to use DCC (Distributed Checksum
Clearinghouse, http://www.rhyolite.com/anti-spam/dcc/) to block spam. 
I've configged my MTA to pass my mail through the "dccproc" which adds
a header to the mail based on the counts of potential spam the
clearinghouse has seen.  Seems to be working well, some obvious spam
showed up today with this DCC header: 

  X-DCC-Etherboy-Metrics: thanatos.shenton.org 1002; env_From=1 From=1
	Subject=1 Message-ID=1 Received=1 Body=many Fuz1=many

indicating the same body was received by "many" DCC users, though the
From, Subject, and Message-ID were all different. Another DCC header:

  X-DCC-wanadoo-be-Metrics: thanatos.shenton.org 1016; env_From=1 From=1
	Subject=many Message-ID=1 Received=1 Body=many Fuz1=many

indicates less clever spam with the exact same Subject, as well as
Body.


So my question is how can I get Gnus to nuke or filter based on this
line? I realize I could do something like:

(setq nnmail-split-methods
      '(
	("in.spam"		"^X-DCC-.*Body=many")
        ...))

But seems that more complicated decisions would require truly hairy
regexps. 

More immediately is how to examine the entire header, even though it
runs across multiple lines.  Or is Gnus smart enough to grab the
entire header somewhere I can play with it? 

Any suggestions? 

Thanks.