Sieve: A Mail Filtering Language
obsoleted by
Extracted elements (28)
Extensions must be declared with 'require' before use, and a script that requires an unknown capability MUST NOT execute at all. This design, informed by experience with LISP and Tcl, ensures predictable behavior rather than partial execution with missing features.
Sieve is intentionally not Turing-complete: it provides no variables, loops, or ability to shell out to external programs. This makes it safe to run server-side on systems where users cannot execute arbitrary code, such as black-box IMAP servers, and facilitates GUI-based filter editors.
Sieve uses an 'implicit keep' mechanism: if a script completes without any action that would deliver, redirect, or discard the message, the message is kept in the user's main mailbox. This prevents mail loss when scripts fail to cover all cases.
Implementations SHOULD decode message header charsets to UTF-8 for comparison, supporting at minimum US-ASCII, ISO-8859-1, and UTF-8. Implementations that do not support this MUST treat any string containing octets above 127 as unequal to any other string.
All implementations MUST support the 'i;octet' comparator (byte-by-byte comparison) and the 'i;ascii-casemap' comparator (case-insensitive ASCII comparison). The default comparator when none is specified is 'i;ascii-casemap'.
Extensions MUST define a unique capability string; a new version that changes existing extension functionality MUST use a different capability name. Extension actions MUST state how they interact with implicit keep and other base actions.
Implementations MUST prohibit more than one reject action per message. Implementations SHOULD prohibit reject when used in combination with other actions.
Implementations MUST support 31 bits of magnitude in numeric literals. The suffixes K, M, and G denote binary multiples (1024, 1048576, and 1073741824 respectively).
Implementations MUST support fifteen levels of nested blocks and fifteen levels of nested test lists.
Implementations MUST support the 'keep', 'discard', and 'redirect' actions. Implementations SHOULD support 'reject' and 'fileinto'; if fileinto is absent, at least one keep MUST be allowed.
Implementations MUST support these tests: 'address', 'allof', 'anyof', 'exists', 'false', 'header', 'not', 'size', and 'true'. Implementations SHOULD support the 'envelope' test.
Implementations SHOULD NOT deliver a message to the same folder more than once even if a script explicitly files it there twice; however, writing to a mailbox twice MUST NOT be treated as an error.
Tests MUST NOT have side effects; a test cannot alter the state of the filter or message. This constraint applies equally to extension-defined tests.
The 'discard' action MUST be silent: it MUST NOT generate any non-delivery notification (DSN, MDN, or otherwise). Discard is compatible with all other actions and only cancels the implicit keep.
The reject MDN MUST take the form of a failure MDN as specified by the MDN RFC; the MDN action-value MUST be 'deleted' and MUST have the MDN-sent-automatically and automatic-action modes set.
The 'require' command MUST appear before any other command (except another require). Any require appearing after a non-require command is an error. Scripts that declare an unknown capability via require MUST NOT be executed at all.
When an error occurs, implementations MUST notify the user of the error, which actions (if any) were taken, and MUST perform an implicit keep to ensure the message is not lost.
The ADDRESS-PART optional argument (':localpart', ':domain', ':all') selects which portion of an email address to compare against. The default when omitted is ':all', acting on the entire address.
The 'address' test matches Internet addresses in structured headers. Implementations MUST restrict it to headers containing addresses, but MUST include at minimum From, To, Cc, Bcc, Sender, Resent-From, and Resent-To.
The 'envelope' test matches against the SMTP envelope: the 'from' part matches the MAIL FROM address and the 'to' part matches the RCPT TO address that resulted in delivery to this user. All envelope tests MUST drop source routes.
The MIME type for a Sieve script is 'application/sieve'. Scripts are UTF-8 encoded; quoted-printable is appropriate for transport systems requiring 7-bit encoding. The conventional file extension is '.siv'.
The 'redirect' action performs an MTA-style forward: the SMTP envelope recipient is replaced with the supplied address and the message is retransmitted without altering the message body or existing headers (though new headers may be added).
The 'reject' action refuses delivery by sending a failure MDN back to the sender. The MDN action-value field MUST be 'deleted' with MDN-sent-automatically and automatic-action modes set. The reject action is optional and must be declared with require.
The 'size' test compares the message size (in octets from initial header to last character of body) against a threshold using ':over' (strictly greater than) or ':under' (strictly less than). A message exactly at the threshold satisfies neither.
Three match types are defined: ':is' (exact equality), ':contains' (substring), and ':matches' (glob-style wildcard with '*' matching zero-or-more characters and '?' matching one character). Commands default to ':is' when no match type argument is supplied.
IANA maintains a registry of Sieve capability strings on a first-come, first-served basis. Initial entries are: 'fileinto', 'reject', 'envelope', and 'comparator-*' (for each named comparator). Vendor extensions use names starting with 'vnd.'.
Script storage must be secure to prevent unauthorized modification (e.g., a user leaving a public terminal logged in). Implementations must sanity-check scripts to prevent mailbomb creation via repeated redirect or reject, and SHOULD implement action count limits. Implementations SHOULD take measures to prevent redirect loops.
Multi-line strings begin with 'text:' followed by CRLF and end with a CRLF, a single period, and another CRLF. Lines beginning with '.' are dot-stuffed (an extra '.' is prepended) to allow embedded single-dot lines; the implementation removes these extra dots when interpreting the script.