Table of Contents:

 

Cheat Sheet Version 3

Editors

Bugs, Features, and Desired Features

Tips

Tips for reading the RFC:

I've written shorter and clearer documentation for the address, header and envelope commands, in a way that I think you'll find more comprehensible:

I also am including some miscellaneous FM and spam information that's Sieve related:

My own script:  First put in place 4/1/02 :

 

Cheat Sheet Version 3

So, you want to write your own Sieve Script? 

I wanted to do so, so I tried to read the RFC.  It’s very hard to grok (definition etymology).  That’s why I’m writing this.  If you do feel the need to read the RFC, see the Tips for reading the RFC section below first.


If the rest this document is overwhelming too:  Follow these relatively simple instructions instead:

The 'spam score' is inserted into a header called 'X-Spam-score'. If the score is over 5, it's considered probable spam (99.95% likely). In that case, a header 'X-Spam: spam' is added, as well as a number of 'SPAM: ' headers, one describing each rule that was hit by the message and the weight of that rule.

To utilise these system, create a reject rule or a fileinto rule, look in 'advanced' and use the phrases:

code:



header :contains "X-Spam" "spam"
header :contains "X-Spam" "high"



 


Editors
There's a program called Mulberry, from a now-defunct company, CyruSoft with a GUI-based Sieve Script editor in it. 
I suggest you use a color coding editor (emacs rules!) or emailaddresses.com/forums or similar PHP formatter to find syntax errors.   Preview a post with your script as PHP, and it'll be color coded.

Screen shot showing emacs syntax highlighting, etc.

 

Bugs, Features, and Desired Features

 

  1. There doesn't seem to be a way to search all headers.  E.g. if header :contains "" "Bulk" does NOT match the word Bulk in a header including "Precedence: Bulk".  IMHO, this is a BUG I'd like to see fixed.   According to the documentation: The null key ("") is contained in all values.
  2. I also wish there was a way to run a Sieve script on the messages already in a mail folder.  (Does mulberry or any other MUA support this yet?)
  3. There also is no way to search the message body.  This is a feature that helps keep Sieve from being too compute-intensive.
  4. On FastMail.fm, envelope is supported even if not enabled with <require "envelope">; this is a bug in the Sieve implementation (but IMHO a harmless (actually, beneficial) one. T. Showalter seems to have experience to suggest that it may be harmful, however.)
  5. Does FM's implementation support rejecting and filing the same email?  The Sieve RFC says this would be a bug, but IMHO, the exact opposite is true: I may want to reject and also use an email for anti-spam purposes.
     

Tips

Check out an unofficial Sieve home page: http://www.cyrusoft.com/sieve/  (RIP; find it at archive.org instead).

 

http://www.cyrusoft.com/sieve/sievewhitepaper.pdf (also RIP) is: "[M]eant as background information to help the reader understand the motivation behind its development and its anticipated application, and as a first introduction to the Sieve concept." "This is not meant to be an implementer’s guide to Sieve, nor a definitive model document for its use."

 

Check out my sieve script.  It's huge, but I've commented it, so it should be pretty readable.  DON'T copy it!  You're welcome to use it for inspiration, and copy individual lines from it, but if you copy the whole thing, and try to use it, you'll get screwed.  Only reuse parts that you understand! 

 

Here's a nifty Sieve snippet you might want to use to direct email received in a certain time frame.

header :regex "received" "(08:[3-5]|09:[0-5]|1[0-6]:[0-5])[0-9]:[0-9]{2} -0500"   #match messages rec'd between 8:30A and 5P (eastern)

 

A '-' only needs to be escaped when it appears on the RHS of a comparison, and only when the comparator is ':matches'. – Jeremy Howard

 

Tips for reading the RFC:

If I'd carefully read every word of
1.1. Conventions Used in This Document
and
2.6.x Arguments
I would have had less trouble.

Still, the RFC gives the syntax for a command with the arguments in one order, gives an example with the arguments in a different order, and then gives the syntax for another command with the arguments in yet another order. There's no good reason for this, and it is quite confusing! I've never noticed a manpage that doesn't keep the options in order.

 

 

I've written shorter and clearer documentation for the address, header and envelope commands, in a way that I think you'll find more comprehensible:

 

The ADDRESS, HEADER and ENVELOPE commands take up to three optional arguments in any order, followed by two required, ordered arguments.
The optional arguments are:
a COMPARATOR, an ADDRESS-PART, and a MATCH-TYPE, and define the "sameness" required.

 

[COMPARATOR] means
[ :comparator "i;octet"] //specifies case-sensitive instead of the default: case INsensitive.


[ADDRESS-PART] means
[ ":localpart" | ":domain" | ":all" ] // as in :localpart@:domain=:all
Matching on the whole address  (:all) is the default.


[MATCH-TYPE] means
[":is" | ":contains" | ":matches" ] //exact, substring, or ex?ct with wildca* matching, respectively
Exact matching (":is") is the default.

 

 

Syntactically, the required arguments are 2 lists (with a space, but NO comma between) of one or more quoted strings, square bracketed and comma separated, if there's more than one string,

e.g. ["foo", "bar"] "baz" could be the arguments to a command: a two- element list followed by a one element list.

 

Important things to remember:

"… the formal grammar does not specify the order, semantics, number or types of arguments to commands, nor the legal command names."
 
Tagged arguments must appear before positional arguments, but they
   may appear in any order with other tagged arguments.
 
   Implementations MUST support these tests: "address", "allof", "anyof", "exists", "false", "header", "not", "size", and "true".
   Implementations SHOULD support the "envelope" test.
 

 

 

 Below is a passage from the RFC.  It's about as comprehensible as the rest of the RFC.

 
    Each section on a command (test, action, or control structure) has a
   line labeled "Syntax:".  This line describes the syntax of the
   command, including its name and its arguments.  Required arguments
   are listed inside angle brackets ("<" and ">").  Optional arguments
   are listed inside square brackets ("[" and "]").  Each argument is
   followed by its type, so "<key: string>" represents an argument
   called "key" that is a string.  Literal strings are represented with
   double-quoted strings.  Alternatives are separated with slashes, and
   parenthesis are used for grouping, similar to [ABNF].
 
   In the "Syntax" line, there are three special pieces of syntax that
   are frequently repeated, MATCH-TYPE, COMPARATOR, and ADDRESS-PART.
   These are discussed in sections 2.7.1, 2.7.3, and 2.7.4,
   respectively.

 

 

 

 
 

 

 

I also am including some miscellaneous FM and spam information that's Sieve related:

 

 
So, you want to write your own Sieve Script?  (Well, FM now officially allows you to do this.  Keep reading…)

 

Sieve scripts on FM work for email collected through POP Links and hotmail too, now, but there are still problems with mail to aliases, AFAIK.

 

A great list of Server-level email filtering products: http://www.spamcon.org/directories/server-filters.shtml

 

Do IMAP clients send ID strings like web browsers do?

 So, you're looking for the best spam-catching sieve filter rules?  The best spam-catching NON-sieve filter rules I know of are http://www.spambouncer.org/sb-new.zip.  But, since Sieve is, by design, less powerful than procmail/perl, its powers will always be relatively weak (barring enhancements that are contrary to the original goals of Sieve – but hey, look how the original goals of HTML have been utterly perverted)  Please email any tips, suggestions, or good filters to me, for posting here.  I’m aware of http://SpamAssasin.ORG, http://Spaminator.Earthlink.NET, and http://www.SpamBouncer.ORG.  I don't know how SpamAssassin compares to spambouncer – anyone familiar with both?   BrightMail – based systems (like Spaminator) are great because the false positive rate is so low that I don’t' bother to go through my Grey Mail folder any more.  I've only once found anything in it that wasn't spam, and it was bulk email, I just happened to have actually subscribed for and wanted it.

 

JH said:

 

Hidden announcement

Just between you and me, I've changed the 'view sieve source' link on the Define Rules screen so that you can now edit your Sieve script.

The fact that this link is so hidden, and that this announcement is posted at the bottom of a techie thread, should give you some idea of exactly how 'official' this feature is...

It's working for me, and it's providing an error as appropriate when the Sieve script doesn't compile. IMPORTANT: if you click 'Done' on the normal 'Define Rules' screen, your custom Sieve script will be overwritten with one created from the Rules in that screen. So don't do that! Maybe you should paste your custom script into a text file and save it since one day you're bound to do this accidently!

So while Cyrus IMAP supports regex, an extension to Sieve, but does not have any other cool features, such as header "Received" <address in ORBS> mataching, AFAIK.

http://www.pc-gamereview.com/hosted_stuff.htm: If you're fed up with spam, spam, spam, and more spam, we offer spam-filtered mailboxes.  You can see the local spam blocking list at http://www.pc-gamereview.com/refuse.txt and the DNS blocking lists we currently use at http://relays.osirusoft.com and http://spamcop.net/bl.shtml - the combination has reduced our spam load from over 8,000 emails per day to about 3 or 4 per week.  You'll get standard POP3 access, 25 megabytes of storage, and no size limit per message (naturally, anything that would take you over your mailbox size limit will be rejected, so you can't get a 26-megabyte message).

Exactis pummelled MAPS  into submission

 

 

 

InsightConnector: Turning an IMAP Server into a Full <MS Exchange> Platform

 

     

My own script:  First put in place 4/1/02 :

I've put my script up on my website, as www.elvey.com/removeme/it/sieve/SieveScript.txt, (NB: the link is intentionally broken; remove "removeme" to make it work!)