Introduction

Server-side mail filtering applies policy before a user opens a mail client. Sieve is designed as a constrained filtering language so rules cannot execute arbitrary shell commands.

What you should be able to do after this lesson:

Read a basic Sieve script.
Match sender, recipient, headers, and message size.
Use keep, fileinto, redirect, reject, discard, and stop.
Understand rule ordering and required extensions.
Configure a controlled vacation response.

Big Idea: A Filter Is an Ordered Program with Delivery Side Effects

Sieve deliberately avoids arbitrary shell execution, but its actions still move, redirect, reject, or delete access to mail. Read rules from top to bottom and track whether an action cancels the implicit keep or whether later rules still run.

Basic Sieve Structure

require ["fileinto"];

if header :contains "subject" "Invoice" {
    fileinto "Finance";
    stop;
}

Sieve tests a message and applies actions. Extensions used by a script should be declared with require.

Common Tests

if address :domain :is "from" "example.test" { ... }
if header :matches "subject" "[Alert]*" { ... }
if size :over 10M { ... }

Comparison modifiers include :is, :contains, and :matches. Address parts such as :localpart, :domain, and :all refine email address matching.

Actions

keep preserves normal delivery.
fileinto delivers to another mailbox or folder.
redirect sends the message to another address.
reject refuses or returns a reason according to implementation behavior.
discard silently drops the message.
stop prevents later rules from processing it.

Understand implicit keep behavior: if no final delivery action cancels it, the message may still enter the default mailbox.

Vacation Responses

require ["vacation"];

vacation :days 7
  :subject "Away from the office"
  "I am unavailable until Monday.";

Vacation implementations such as Dovecot's extension avoid responding repeatedly to the same sender. Still exclude mailing lists, automated senders, and messages that should not receive replies.

Procmail Awareness

Procmail uses recipes and can execute commands, making it flexible but more dangerous and difficult to maintain. Sieve is preferred in many modern mail systems because its limited language is safer for server-side user rules.

Testing

Use implementation-specific validation tools, a test mailbox, and messages covering both matching and non-matching cases. Preserve the original message until rules are proven, especially before using discard or redirect.

Guided Practice: Build a Filter Test Matrix

Write a Sieve script for a lab mailbox that:

files messages with an X-Environment: staging header into Staging
redirects messages larger than a chosen size to an archive address
sends a vacation response no more than once per sender per period
keeps all unmatched messages

Before enabling it, prepare messages that match each condition alone, several conditions together, and no condition. Predict the action order and whether stop is needed.

Use the implementation's syntax checker, then deliver only test messages. Verify the destination folders, redirect envelope, original preservation, and vacation suppression. Do not begin with discard; replace it with a test folder until matching is proven.

Troubleshooting Scenario

A message is both filed into Finance and unexpectedly delivered to INBOX. The matching branch uses fileinto but the implementation preserves an implicit keep because the script lacks the expected final control behavior.

Review the supported Sieve semantics and extensions, add the appropriate stop or explicit delivery logic, validate, and retest overlapping cases. Moving the rule higher cannot fix an implicit action that remains active.

Exam Focus

Understand conditions, comparison operators, address parts, and extension declarations.
Know keep, fileinto, redirect, reject, discard, and stop effects.
Filter by sender, recipient, headers, and size.
Recognize Dovecot's vacation extension and legacy procmail behavior.

Recap

Sieve rules are ordered tests and actions.
Comparison modifiers change matching semantics.
stop controls subsequent evaluation.
Test destructive actions and automated responses conservatively.

211.2 Managing E-Mail Delivery