Sieve Email Filtering: Spamtest and Virustest Extensions
obsoletes
- rfc-3685 — SIEVE Email Filtering: Spamtest and VirusTest Extensions
Extracted elements (21)
The ':count' match type from RFC 5231 was added in this revision to allow scripts to reliably determine whether a spam or virus test was actually performed, rather than relying solely on the result value '0' which is ambiguous in the ':percent' mode.
The extensions were created to provide portable Sieve spam and virus filtering commands because each third-party tool uses its own header format, forcing users to write tool-specific scripts that break when tools are updated or replaced. The underlying implementation maps tool-specific results into the normalized numeric range.
The ':percent' argument was added (new in RFC 5235 vs. RFC 3685) to provide a 0–100 range for spamtest results, offering finer-grained spam likelihood reporting than the original 0–10 scale. The 'spamtestplus' capability identifier was introduced to distinguish implementations supporting this argument.
The optional text portion of the normalized result string after the numeric value carries implementation-specific details; using string comparators against this text will break portability since the text is likely specific to a particular implementation.
To determine whether a message was tested for spam when using ':percent', implementations can use either ':count' match type (testing for '0') or a non-percent spamtest with ':value' match testing for normalized result '0'.
If the ':percent' argument is not used with any spamtest test, then one or both of 'spamtest' or 'spamtestplus' capability identifiers MUST be present.
If the ':percent' argument is used with any spamtest test, then the 'spamtestplus' capability identifier MUST be present. Sieve implementations MUST return an error if ':percent' is used and 'spamtestplus' is not specified.
Scripts SHOULD NOT specify both 'spamtestplus' and 'spamtest' capability identifiers together, in the interests of brevity and clarity.
Server implementations MUST also support the Sieve relational extension (RFC 5231) in addition to these extensions, in order to support numeric comparisons against normalized result strings.
Sieve implementations SHOULD ensure that 'spamtest' and 'virustest' tests only report spam and virus test results for messages that have actually gone through a legitimate spam or virus check process, and MUST prevent header spoofing from tricking the implementation.
The normalized result string for both spamtest and virustest begins with a digit string indicating severity, optionally followed by a space and arbitrary implementation-specific text. The ':count' match type returns '1' if a test was done and '0' if not.
The 'spamtest' test evaluates to true if the normalized spamtest result matches a given value. It accepts an optional ':percent' argument, a comparator, and a match-type, defaulting to ':is' if no match type is specified.
The virustest normalized result uses a 0–5 scale: 0 = not tested, 1 = no known viruses, 2 = known virus replaced with harmless content, 3 = virus cured, 4 = possibly contains a known virus, 5 = definitely contains a known virus.
The 'virustest' test evaluates to true if the normalized result string matches a given value. It accepts a comparator and match-type, defaulting to ':is' if not specified, and uses a numeric range of 0–5.
When ':percent' is not used with spamtest, the normalized result is in the range 0–10: 0 means not tested or undetermined, 1 means clear of spam, 2–9 indicate increasing likelihood of spam, and 10 means definitely spam.
When ':percent' is used with spamtest, the normalized result is in the range 0–100: 0 means clear of spam or not tested, 1–99 indicate increasing likelihood, and 100 means definitely spam.
The 'spamtest' Sieve extension is registered with IANA as providing a test to check for varying likelihood of an email message being spam. This registration replaces the one from RFC 3685.
The 'spamtestplus' Sieve extension is newly registered with IANA as providing a spam likelihood test supporting an optional percentage range. This is a new registration not present in RFC 3685.
The 'virustest' Sieve extension is registered with IANA as providing a test to check for varying likelihood of malicious content in an email message. This registration replaces the one from RFC 3685.
If spam or virus checks rely on private header fields, implementations must ensure those headers cannot be spoofed by senders or intermediaries, which would trick the implementation into returning a wrong test result.
Server administrators must keep virus checking tools up to date, and users should be informed that 'virustest' does not provide 100% reliable virus removal; caution should still be exercised with messages of unknown content and origin.