Atif,

I did miss your other post, sorry.

We do not trust the DCC. That system only takes into consideration the number of recipients the emails are sent to. Legitimate businesses however may send out huge amount of legitimate emails. Think about Microsoft's security advisories, or legitimate newsletters. This makes the system too prone to false positives, as the more emails a single company sends, the more likely it is going to be detected to be spam. We also do not trust the "fuzziness" which the DCC uses to detect similar emails.

The SFDC not only takes into consideration the number of similar emails being reported, it also considers the IP address(es) for the mail server(s) that sent such emails. If Microsoft uses just 2 or 3 mail servers to send out 100 million emails, the SFDC will completely ignore such signatures, as they originated from only 3 different source IPs, which is way below our minimum threshold of sources. They are likely legitimate. If they're not, almost certainly another filter will have detected that only 3 IPs are generating hundreds of millions of spam emails and will stop them...
Where the SFDC will excel is in detecting spam bots, as there will be many different source IPs for each compromised bot, each spewing out a lot of emails. Those will immediately get caught in a matter of minutes.

Think of the DCC being a sled being pulled on the ground, and the SFDC being a cart with 4 actual wheels...!