Filter results with Dovecot Sieve

From dspam

Dovecot imap/pop server also supply an Local Delivery Agent supporting the Sieve language RFC5228 for mail filtering.

This support is brought by the Sieve plugin.

Sample scripts

Move all Spam into a Junk Folder and mark mail as read

This script allows all mail flagged as Spam by DSPAM to be moved into a Junk folder, and mark them as read.

If using Dovect >= 1.2, be sure to replace "imapflags" by "impa4flags".

require ["regex", "fileinto", "imapflags"];

# Catch mail tagged as Spam, except Spam retrained and delivered to the mailbox
if allof (header :regex "X-DSPAM-Result" "^(Spam|Virus|Bl[ao]cklisted)$",
          not header :contains "X-DSPAM-Reclassified" "Innocent") {

  # Mark as read
  setflag "\\Seen";

  # Move into the Junk folder
  fileinto "Junk";

  # Stop processing here
  stop;
}

Labelling Spam according to their rating

This is a more complete variation of the above script, allowing the mail tagged as spam to be labelled according to their rating, just as they are in the DSPAM Quarantine:

• high rating
• medium rating
• low rating

You need Dovecot >= 1.2 and the 'sieve' plugin for these rules to work.

require ["regex", "fileinto", "imap4flags", "variables", "relational", "comparator-i;ascii-numeric"];

# Catch mail tagged as spam, except spam retrained and delivered to the mailbox
if allof (header :regex "X-DSPAM-Result" "^(Spam|Virus|Bl[ao]cklisted)$",
          not header :contains "X-DSPAM-Reclassified" "Innocent" ) {

  # The relational comparator only deals with integers, hence we need to use variables and will only
  # use the decimal figures to get the rating
  if header :matches "X-DSPAM-Confidence" "*.*"
  {
    # Mark as read
    setflag "\\Seen";

    # Colour codes of 'standard' labels, at least recognized in Thunderbird and Evolution mail clients
    # addflag "$label1";  #ff0000 => red
    # addflag "$label2";  #ff9900 => orange
    # addflag "$label3";  #009900 => green
    # addflag "$label4";  #3333ff => blue
    # addflag "$label5";  #993399 => violet

    # High rating (rating = 1.0000)
    if string :value "eq" :comparator "i;ascii-numeric" "${2}" "0000"
    {
      addflag "$label2";
    }
    # Low rating (rating < 0.7000)
    elsif string :value "lt" :comparator "i;ascii-numeric" "${2}" "7000"
    {
      addflag "$label5";
    }
    # High rating (rating > 0.8000)
    elsif string :value "gt" :comparator "i;ascii-numeric" "${2}" "8000"
    {
      addflag "$label2";
    }
    # Medium rating (0.7000 >= rating <= 0.8000)
    else
    {
      addflag "$label4";
    }

    # Move into the Junk folder
    fileinto "Junk";

    # Stop processing here
    stop;
  }
}

And again the same as above but using only the regex extension to match the confidence.

require ["regex", "fileinto", "imap4flags"];

# Catch mail tagged as Spam, except Spam retrained and delivered to the mailbox
if allof (header :regex "X-DSPAM-Result" "^(Spam|Virus|Bl[ao]cklisted)$",
          not header :contains "X-DSPAM-Reclassified" "Innocent") {

    # Mark as read
    setflag "\\Seen";

    # Colour codes of 'standard' labels, at least recognized in Thunderbird
    # and Evolution mail clients
    # addflag "$label1";  #ff0000 => red
    # addflag "$label2";  #ff9900 => orange
    # addflag "$label3";  #009900 => green
    # addflag "$label4";  #3333ff => blue
    # addflag "$label5";  #993399 => violet
    if header :regex "X-DSPAM-Confidence" "^(1\.0{4}|0\.[89][0-9]{3})$"
    {
      # High rating (rating >= 0.8000)
      addflag "$label2";
    }
    elsif header :regex "X-DSPAM-Confidence" "^(0\.7[0-9]{3})$"
    {
      # Medium rating (0.7000 >= rating < 0.8000)
      addflag "$label4";
    }
    else
    {
      # Low rating (rating < 0.7000)
      addflag "$label5";
    }

    # Move into the Junk folder
    fileinto "Junk";

    # Stop processing here
    stop;
}

After applying this script, you can set up your mail client (eg. Thunderbird or Evolution) so that the mail are sorted according to their labels. This makes easier detecting of possible false positives.