7. Anti-Spam Configuration
7.1. Anti-Spam Interface
You will find the Anti-Spam server component's dialog in the Server Components section (left menu). It contains a brief information about the functionality of the server component, information on its current status (Anti-Spam Server for MS
Exchange component is active.), and some statistics.
Available links:
· Scan Results
Opens a new dialog where you can review anti-spam scan results:
A V G E mail Server E dition 2 0 1 1 © 2 0 1 0 C opyright A V G T ec hnologies C Z, s .r.o. A ll rights res erved.
3 7
Here you can check messages detected either as a SPAM (unwanted messages) or a Phishing attempt (an effort to steal your personal data, banking details, identity etc.). By default there are displayed only results for the last two days.
You can change the displayed period by amending the following options: o Show last - insert preferred days and hours.
o o
Show selection - choose a custom time and date interval.
Show all - Displays results for the whole time period.
·
Use Refresh button to reload the results.
Refresh statistical values - updates stats displayed above.
· Reset statistical values - resets all the stats to zero.
The working buttons are as follows:
·
·
Settings - use this button to open
Anti-Spam settings
.
Back - press this button to return to the Server components overview.
A V G E mail Server E dition 2 0 1 1 © 2 0 1 0 C opyright A V G T ec hnologies C Z, s .r.o. A ll rights res erved.
3 8
7.2. Anti-Spam Principles
Spam refers to unsolicited e-mail, mostly advertising a product or service that is mass mailed to a huge number of e-mail addresses at a time, filling recipients’ mail boxes.
Spam does not refer to legitimate commercial e-mail for which consumers have given their consent. Spam is not only annoying, but also can often be a source of scams, viruses or offensive content.
Anti-Spam checks all incoming e-mail messages and marks unwanted e-mails as
SPAM. It uses several analyzing methods to process each e-mail message, offering maximum possible protection against unwanted e-mail messages.
7.3. Anti-Spam Settings
In the Anti-Spam basic settings dialog you can check the Turn on Anti-Spam
protection checkbox to allow/forbid the anti-spam scanning of e-mail communication.
In this dialog you can also select more or less aggressive scoring measures. The Anti-
Spam filter assigns each message a score (i.e. how similar the message content is to
SPAM) based on several dynamic scanning techniques. You can adjust the Mark
message as spam if the score is greater or equal to setting by either typing the value (50 to 90) or by moving the slider left or right.
A V G E mail Server E dition 2 0 1 1 © 2 0 1 0 C opyright A V G T ec hnologies C Z, s .r.o. A ll rights res erved.
3 9
Here is a general review of the scoring threshold:
·
·
Value 90 - Most incoming e-mail messages will be delivered normally (without being marked as
spam ). The most easily identified spam will be filtered out, but a
significant amount of
spam may still be allowed through.
Value 80-89 - E-mail messages likely to be
spam will be filtered out. Some non-
spam messages may be incorrectly filtered as well.
·
·
Value 60-79 - Considered as a quite aggressive configuration. E-mail messages that are possibly
spam will be filtered out. Non-spam messages are likely to be
caught as well.
Value 50-59 - Very aggressive configuration. Non-spam e-mail messages are as likely to be caught as real
spam messages. This threshold range is not
recommended for normal use.
You can further define how the detected
spam e-mail messages should be treated:
·
·
Modify subject for messages marked as spam - tick this check box if you would like all messages detected as
spam to be marked with a specific word or
character in the e-mail subject field; the desired text can be typed in the activated text field.
Ask before reporting wrong detection - provided that during the installation process you agreed to participate in the Product Improvement Programme - this programme helps us to collect up-to-date information on the latest threats from all participants worldwide, and in return we can improve protection for everyone
- i.e. you allowed reporting of detected threats to AVG. The reporting is taken care of automatically. However, you may mark this check box to confirm you want to be asked before any detected spam gets reported to AVG to make sure the message should really be classified as spam.
Note: This option is not applicable for AVG Email Server Edition 2011.
Train Anti-Spam button opens the
Anti-Spam training wizard
described in details in the
next chapter .
7.3.1. Anti-Spam Training Wizard
The first dialog of the Anti-Spam Training Wizard asks you to select the source of e-mail messages you want to use for training. Usually, you will want to use either emails that have been incorrectly marked as SPAM, or spam messages that have not been recognized.
A V G E mail Server E dition 2 0 1 1 © 2 0 1 0 C opyright A V G T ec hnologies C Z, s .r.o. A ll rights res erved.
4 0
There are the following options to choose from:
· A specific e-mail client - if you use one of the listed e-mail clients (MS Outlook,
Outlook Express, The Bat!, Mozilla Thunderbird), simply select the respective option
· Folder with EML files - if you use any other e-mail program, you should first save the messages to a specific folder (in .eml format), or make sure that you know the location of your e-mail client message folders. Then select Folder with
EML files, which will enable you to locate the desired folder in the next step
For faster and easier training process, it is a good idea to sort the e-mails in the folders beforehand, so that the folder you will use for training contains only the training messages (either wanted, or unwanted). However, it is not necessary, as you will be able to filter the e-mails later on.
Select the appropriate option and click Next to continue the wizard.
7.3.2. Select Folder with Messages
Dialog displayed in this step depends on your previous selection.
Folders with EML files
A V G E mail Server E dition 2 0 1 1 © 2 0 1 0 C opyright A V G T ec hnologies C Z, s .r.o. A ll rights res erved.
4 1
In this dialog, please select the folder with the messages you want to use for training.
Press the Add folder button to locate the folder with the .eml files (saved e-mail
messages). The selected folder will then be displayed in the dialog.
In the Folders contain drop-down menu, set one of the two options - whether the selected folder contains wanted (HAM), or unsolicited (SPAM) messages. Please note that you will be able to filter the messages in the next step, so the folder does not have to contain only training e-mails. You can also remove unwanted selected folders from the list by clicking the Remove folder button.
When done, click Next and proceed to
Message filtering options .
Specific e-mail client
Once you confirm one of the options, new dialog will appear.
A V G E mail Server E dition 2 0 1 1 © 2 0 1 0 C opyright A V G T ec hnologies C Z, s .r.o. A ll rights res erved.
4 2
Note: In case of Microsoft Office Outlook, you will be prompted to select the MS
Office Outlook profile first.
In the Folders contain drop-down menu, set one of the two options - whether the selected folder contains wanted (HAM), or unsolicited (SPAM) messages. Please note that you will be able to filter the messages in the next step, so the folder does not have to contain only training e-mails. A navigation tree of the selected e-mail client is already displayed in the main section of the dialog. Please locate the desired folder in the tree and highlight it with your mouse.
When done, click Next and proceed to
Message filtering options .
7.3.3. Message filtering options
In this dialog, you can set filtering of the e-mail messages.
A V G E mail Server E dition 2 0 1 1 © 2 0 1 0 C opyright A V G T ec hnologies C Z, s .r.o. A ll rights res erved.
4 3
If you are sure that the selected folder contains only messages you want to use for training, select the All messages (no filtering) option.
If you are unsure about the messages contained in the folder, and you want the wizard to ask you about every single message (so that you can determine whether to use it for training or not), select the Ask for each message option.
For more advanced filtering, select the Use filter option. You can fill in a word (name), part of a word, or phrase to be searched for in the e-mail subject and/or the sender's field. All messages matching exactly the entered criteria will be used for the training, without further prompting.
Attention!: When you fill in both text fields, addresses that match just one of the two conditions will be used, too!
When the appropriate option has been selected, click Next. The following dialog will be informative only, telling you that the wizard is ready to process the messages. To start training, click the Next button again. Training will then start according to previously selected conditions.
7.4. Performance
The Engine performance settings dialog (linked to via the Performance item of the
A V G E mail Server E dition 2 0 1 1 © 2 0 1 0 C opyright A V G T ec hnologies C Z, s .r.o. A ll rights res erved.
4 4
left navigation) offers the Anti-Spam component performance settings. Move the slider left or right to change the level of scanning performance ranging between Low
memory / High performance modes.
· Low memory - during the scanning process to identify
spam , no rules will be
used. Only training data will be used for identification. This mode is not recommended for common use, unless the computer hardware is really poor.
· High performance - this mode will consume large amount of memory. During the scanning process to identify
spam , the following features will be used: rules and spam database cache, basic and advanced rules, spammer IP addresses and
spammer databases.
The Enable on-line checking item is on by default. It results in more precise
spam
detection via communication with the Mailshell servers, i.e. the scanned data will be compared with Mailshell databases online.
Generally it is recommended to keep the default settings and only change them if you have a valid reason to do so. Any changes to this configuration should only be done by expert users!
A V G E mail Server E dition 2 0 1 1 © 2 0 1 0 C opyright A V G T ec hnologies C Z, s .r.o. A ll rights res erved.
4 5
7.5. RBL
The RBL item open an editing dialog called Realtime Blackhole Lists:
In this dialog you can switch on/off the Query RBL servers function.
The RBL (Realtime Blackhole List) server is a DNS server with an extensive database of known spam senders. When this feature is switched on, all e-mail messages will be verified against the RBL server database and marked as
spam if identical to any of the
database entries.
The RBL servers databases contain the latest up-to-the-minute spam fingerprints, to provide the very best and most accurate
spam detection. This feature is especially
useful for users who receive large amounts of spam that is not being normally detected by the Anti-Spam engine.
The RBL servers list allows you to define specific RBL server locations. By default, two RBL server addresses are specified. We recommend to keep the default settings unless you are an experienced user and really need to change these settings!
Note: Enabling this feature may, on some systems and configurations, slow down the e-mail receiving process, as every single message must be verified against the RBL server database.
A V G E mail Server E dition 2 0 1 1 © 2 0 1 0 C opyright A V G T ec hnologies C Z, s .r.o. A ll rights res erved.
4 6
No personal data is sent to the server!
7.6. Whitelist
The Whitelist item opens a dialog with a global list of approved sender e-mail addresses and domain names whose messages will never be marked as
spam .
In the editing interface you can compile a list of senders that you are sure will never send you unwanted messages (
spam ). You can also compile a list of full domain names
(e.g. avg.com), that you know do not generate spam messages.
Once you have such a list of senders and/or domain names prepared, you can enter them by either of the following methods: by direct entry of each e-mail address or by importing the whole list of addresses at once. The following control buttons are available:
·
·
Edit - press this button to open a dialog, where you can manually enter a list of addresses (you can also use copy and paste). Insert one item (sender, domain name) per line.
Import - you can import your existing e-mail addresses by selecting this button.
The input file can be a text file (in plain text format, and the content must contain only one item - address, domain name - per line), WAB file or the import
A V G E mail Server E dition 2 0 1 1 © 2 0 1 0 C opyright A V G T ec hnologies C Z, s .r.o. A ll rights res erved.
4 7
· can be done from Windows Address Book or Microsoft Office Outlook.
Export - if you decide to export the records for some purpose, you can do so by pressing this button. All records will be saved to a plain text file.
7.7. Blacklist
The Blacklist item opens a dialog with a global list of blocked sender e-mail addresses and domain names whose messages will always be marked as
spam .
In the editing interface you can compile a list of senders that you expect to send you unwanted messages (
spam
). You can also compile a list of full domain names (e.g.
spammingcompany.com), that you expect or receive spam messages from. All e-mail from the listed addresses/domains will be identified as spam.
Once you have such a list of senders and/or domain names prepared, you can enter them by either of the following methods: by direct entry of each e-mail address or by importing the whole list of addresses at once. The following control buttons are available:
· Edit - press this button to open a dialog, where you can manually enter a list of addresses (you can also use copy and paste). Insert one item (sender, domain name) per line.
A V G E mail Server E dition 2 0 1 1 © 2 0 1 0 C opyright A V G T ec hnologies C Z, s .r.o. A ll rights res erved.
4 8
·
·
Import - you can import your existing e-mail addresses by selecting this button.
The input file can be a text file (in plain text format, and the content must contain only one item - address, domain name - per line), WAB file or the import can be done from Windows Address Book or Microsoft Office Outlook.
Export - if you decide to export the records for some purpose, you can do so by pressing this button. All records will be saved to a plain text file.
7.8. Advanced Settings
Typically it is recommended to keep the default settings and only change them if you have a valid reason to do so. Any changes to configuration should only be done by expert users!
If you still believe you need to change the Anti-Spam configuration at the very advanced level, please follow the instructions provided directly in the user interface.
Generally, in each dialog you will find one single specific feature and you can edit it its description is always included in the dialog itself:
·
·
·
Cache - fingerprint, domain reputation, LegitRepute
Training - maximum word entries, auto training threshold, weight
Filtering - language list, country list, approved IPs, blocked IPs, blocked countries, blocked charsets, spoofed senders
·
·
RBL - RBL servers, multihit, threshold, timeout, maximum IPs
Internet connection - timeout, proxy server, proxy server authentication
A V G E mail Server E dition 2 0 1 1 © 2 0 1 0 C opyright A V G T ec hnologies C Z, s .r.o. A ll rights res erved.
4 9
