User Guide

20 Kaspersky Anti-Spam 3.0
• append a special header to the message
• delete message
• reject message.
System administrator can define which of the listed actions will be performed
over messages with a specific status.
Preservation of all useful mail must be the top priority for the system
administrator because the loss of a single important message may
cause more trouble for the end user than receipt of a dozen of spam
messages. To avoid the loss of necessary mail, you are advised to use
only non-destructive actions with mail identified after content analysis
as spam or probable spam. E.g., append to the Subject header labels,
such as [!! SPAM].
2.4. Content filtration databases
The application recognizes spam messages using the records of its regularly
updated content filtration databases. These databases contain the sets of rules,
terms and message signatures used in the process of filtering.
Content filtration databases can be downloaded from the updating servers of
Kaspersky Lab using the updater module. During the procedure, the system
reduces the volume of downloaded data loading only those files, which have
changed.
Since new samples of spam messages appear every day, normal product
functioning requires regular updates to its content filtration databases.
Recommended updating frequency: every twenty minutes.
Be sure to update the content filtration databases immediately after
product setup on your computer!
2.5. Filtration policies
Kaspersky Anti-Spam employs filtration policies to determine the methods
applicable for spam recognition, the actions to be performed over messages and
the black and white lists of senders.
The product uses a double-layered system of filtration policies, which consists of
a default general filtration policy and group filtration policies. The default filtration
policy contains settings common for all groups: methods applicable for spam
recognition, and the black and white lists of senders. Group policies, in addition
to the mentioned settings, also define the actions performed over messages
depending upon their status.