14.7 Support for Sieve Extensions

In addition to the standard Sieve functions, Messaging Server provides support for a number extensions including addheader, addtag, spamtest and spamadjust. addheader and addtag are described in To Add a Header Containing SpamAssassin Score to Spam Messages and To Add the SpamAssassin Result String to the Subject Line.

These extensions gives administrators the ability to set different threshold values as well as the ability to set up white lists that override SpamAssassin verdicts. The two can even be combined to have different thresholds depending on who sent a particular message. spamadjust is a non-standard action. spamtest is described in ftp://ftp.isi.edu/in-notes/rfc3685.txt. Note that both can be used with Symantec Brightmail as well as SpamAssassin.

The internal separator character used to delimit multiple subject line tag additions for addtaghas been changed from space to vertical bar. This makes it possible to add a tag containing spaces, as some spam filters want to do. For example, previously, addtag "[Probable Spam]" was taken to mean addtag "[Probable"and add tag "spam]". Now it is seen as a single tag, "[Probable Spam]". This change prevents vertical bars from being used in tags.

spamtest can be used to compare SpamAssassin scores to specific values using the Sieve [RELATIONAL] extension with the "i;ascii-numeric" comparator. The SpamAssassin score is typically a real number, but spamtest forces the score into an integer value between 0 an 10 by first rounding the score to the nearest integer. Values below 0 are forced up to 0 while values above 10 are forced down to 10. Finally, the text string maintained by Messaging Server is appended to produce the test string that the spamtest test sees. :percent is supported by spamtest (see SIEVE Email Filtering: Spamtest and Virustest Extensions draft-ietf-sieve-spamtestbis-05). Note that spamtestcan be also be used with Brightmail.

spamadjust is used to adjust the current spam score. This action takes a single string argument which is scanned for a real numeric value. This value is used to adjust the current spam score. The entire string is also appended to the current score text string. In the example shown below, the string would be “undisclosed recipients.”

Multiple spamadjust actions are allowed; each one is added to the current score. Again, the score value always starts at 0. Signed numeric values are allowed, making it possible to lower the current score as well as raise it. There is no require clause for spamadjust; the spamtest extension should be listed instead.

For example, a possible use of spamadjust with a SpamAssassin MODE setting of 2 might be:

spamfilterX_string_action=data:,require ["spamtest"];spamadjust "$U";

A system-level Sieve filter could then modify the SpamAssassin score by checking for a particular type of header and, if found, adding 5 to the SpamAssassin score:

require "spamtest";  
if header :contains ["to", "cc", "bcc", "resent-to", "resent-cc", 
   "resent-bcc"]  ["<undisclosed recipients>", "undisclosed.recipients"]  
{spamadjust "+5 undisclosed recipients";}

Note that spamadjustcan be also be used with Brightmail.

Finally, a user-level Sieve script could test the resulting value, discard messages certain to be spam, file messages likely to be spam, and allow messages from addresses in the local domain to pass through:

require ["spamtest", "relational",  
"comparator-i;ascii-numeric", "fileinto"];                   
if anyof (address :matches "from" ["*@siroe.com", "*@*.siroe.com"]) 
    {keep;}                                                  
elsif spamtest :value "ge" :comparator "i;ascii-numeric" "8" 
    {discard;}                                               
elsif spamtest :value "ge" :comparator "i;ascii-numeric" "5" 
    {fileinfto "spam-likely";}                                
else                                                         
   {keep;}