Sieve (mail filtering language)

Sieve is a domain-specific language, which was conceived on a mail server to configure mail filtering by user. The exact specification can be found in RFC 5228. Sieve has been specified to give users the ability to define your own rules in a simple way to filter e-mails. However, it is not possible to use more complex program structures, for example, work with loops or variables or to launch external programs.

The main focus of Sieve is on expandability, ease and independence of the access and architecture and the operating system used.

Sieve scripts are already executed during the delivery of the e -mail on the incoming mail server.


Statements are ended with a semicolon.


Comments are preceded by the "#" character. These comments are always valid to end of line. Multiline comments are as in C with the string " / *" and completed by the string " * /".


Only positive integers are allowed. Optionally, there is the possibility that size on indications such as " K" ( KiB, 2 ^ 10), "M" ( MiB, 2 ^ 20) and "G" ( GiB 2 ^ 30) indicate. Example: 100K represents a size of 100 Kibibytes.


Strings (strings ) are " initiated. A backslash by the quote (" \ " ) is used to characterize further quotes or backslashes, which still belong to the current string (so-called " escaping "). String lists are with" [" initiated and completed with "]".

Control structures

The most important application in the filtering of email is to test for certain characteristics. There are also well-known Sieve the IF-THEN options:

  • If
  • Elsif
  • Else

An if introduces a conditional statement. Only if the tested condition is true, the next block of code is executed. If not, then additional conditions can be queried by means of elsif. If none of the conditions of the "if" - and " elsif " blocks so, the instructions in the "else" block is executed, if it exists.

Comparisons of strings

There are several ways to test a string. As this comparison operators are used:

Addresses matching

E -mail addresses are verified address with the keyword. Of course, it is possible to check the sender or the recipient address. It is generally only compared to the actual address, so everything that is written between brackets. In order to compare the entire string, you should check on name "<" address ">". The quotation marks indicate this string. In order to check addresses on the part before the @ or after the @, the optional arguments can: localpart or: used domain. By default, the complete address is checked (equivalent: all).

Size comparisons

The size of a mail checks to size with the keyword. Comparisons with numbers you can with the operators: over or: under perform.

Header fields

E -mail headers can be checked with the keyword header. Header fields can be searched using the normal string comparisons described above. It is important to ensure that the colon is not used.


Block statements are introduced and { with } with terminated. Blocks are used to perform several instructions according to a test.


The following instructions are specified according to the RFC:


Sieve also allows additional extensions that need to be declared at the beginning of the script with the keyword require.


The following example uses some of the examples described above, and defines an example script:

# Example script # require [ " fileinto ", " reject" ];   # Messages larger 100K are rejected with an error message #   if size: over 100K {     reject " Please send me the next time a smaller mail. For large Attachments, please upload the files to a server and send me a URL. Thank you. "; }   # A mailing list is to be moved to a folder "mailing list" #   elsif address: is [ "From", "To" ] " [email protected] " {     fileinto " INBOX.mailinglist "; }   # Spam rule: Message does not contain my address in the To, CC or Bcc # Header, or subject is something with "money" or " Viagra ". #   elsif anyof (not address: all: contains [ "To", " Cc ", " Bcc "] " [email protected] " header: matches "Subject" [" * you * ", "* Viagra * " ]) {        fileinto " INBOX.spam "; }     # All other mails we keep. # This rule would not be necessary, since the "implicit keep" # Already covered.   else {       keep; } Web Links

  • Official Documentation
  • Cyrus
  • RFC 5228
  • Programming language