User Guide

26 Kaspersky Anti-Spam 2.0 Enterprise Edition / ISP Edition
4.3.1. Address, headers and message size
analysis
Filtering rules may contain description of the following conditions (as well as their
negations):
• the IP address of the server from which a message was received (i.e. the
relay server that sent the message) matches a specified address.
• the IP address of the server from which a message was received is
included in the specified list.
• one of the DNS-based RBL services included in the specified list
generates a message about "untrustworthiness" of the server from which
a certain message arrived.
• sender’s IP address is not found in the DNS.
• sender’s e-mail address matches a specified address.
• sender’s e-mail address is included in the specified list.
• recipient’s e-mail address (or one of the recipients if there are several
recipients) matches the specified one.
• recipient’s e-mail address (or one of the recipients if there are several
recipients) is included in the specified list.
• message has a header of the specified type (i.e. it contains a specified
name).
• message has a header with a specified name (e.g., From or To) that
matches specified template (regular expression).
• total message size exceeds the specified limit.
• the message content falls into a certain spam category (see para 4.3.2
page 27).
The lists to which filtering rules refer can be of the following types:
• IP addresses lists – contain IP addresses in the aaa.bbb.ccc.ddd or
aaa.bbb.ccc.ddd/nn format.
• E-mail lists – contain e-mail addresses in the [e-mail] or
@hostname.domain format. The latter format includes any user of the
specified domain.
• Lists of DNS-based RBL services – contain the names of zones used to
form requests to DNS to check if a certain IP address is included in the