RFC 3685

SIEVE Email Filtering: Spamtest and VirusTest Extensions

📅 published February 2004, from ietf

SIEVE Email Filtering: Spamtest and VirusTest Extensions ✨

okay so this RFC is literally the spec for two SIEVE tests, spamtest and virustest 🎀 It's a Standards Track doc from the Network Working Group, dated February 2004, and the author is C. Daboo from Cyrusoft International, Inc. 💅 The header doesn't list anything it obsoletes or updates, so it's standing on its own 🧚

Here's the official header block, just so you have the facts:

Network Working Group                                           C. Daboo
Request for Comments: 3685                  Cyrusoft International, Inc.
Category: Standards Track                                  February 2004

Status of This Memo

ok bestie, this part is the legal-ish stuff 🙈 It's an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 💖 If you want the current standardization state of this protocol, check the current edition of "Internet Official Protocol Standards" (STD 1). And yes, distribution of this memo is unlimited 🌈

Copyright Notice

Abstract

so the abstract is giving: SIEVE is the mail filtering language, and this doc adds two extensions, spamtest and virustest ✨ They let users write simple, portable commands for spam and virus checks on email. Each one is a new test that matches against numeric "scores" 🔥 The fun part is that the actual spam and virus checking is the job of the underlying SIEVE implementation. It does the checks, and those checks produce the values the tests return 👑

1.  Introduction and Overview  . . . . . . . . . . . . . . . . . .  2
2.  SIEVE Extensions . . . . . . . . . . . . . . . . . . . . . . .  3
    2.1.  General Considerations . . . . . . . . . . . . . . . . .  3
    2.2.  Test spamtest. . . . . . . . . . . . . . . . . . . . . .  3
    2.3.  Test virustest . . . . . . . . . . . . . . . . . . . . .  4
3.  Security Considerations  . . . . . . . . . . . . . . . . . . .  5
4.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . .  6
    4.1.  spamtest registration. . . . . . . . . . . . . . . . . .  6
    4.2.  virustest registration . . . . . . . . . . . . . . . . .  6
5.  References . . . . . . . . . . . . . . . . . . . . . . . . . .  7
    5.1.  Normative References . . . . . . . . . . . . . . . . . .  7
    5.2.  Informative References . . . . . . . . . . . . . . . . .  7
6.  Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . .  7
7.  Intellectual Property Rights Statement . . . . . . . . . . . .  7
8.  Author's Address . . . . . . . . . . . . . . . . . . . . . . .  8
9.  Full Copyright Statement . . . . . . . . . . . . . . . . . . .  9

1. Introduction and Overview 🧚

okay so SIEVE scripts are being used a LOT for spam and virus filtering 😭 Sometimes the script checks stuff directly, like a list of blocked senders written right into the script. Other times it tests messages that some outside spam or virus checker already touched before SIEVE got them 💅

Here's the problem: third-party tools are all different. Each one shows its result in its own way, usually as a header with some tool-specific syntax in it. So every user ends up writing their own SIEVE scripts to match those headers, and the scripts have to stay in sync with the tool every time it gets updated or swapped out 💀 That makes scripts tied to one specific environment, and they lose portability. Not it. 🙅‍♀️

So the purpose of this doc is to introduce two SIEVE tests that give you "generic" spam and virus checks 🎀 Each test returns a string with a numeric value that shows how bad the spam or virus problem is. It can also return a string that says the message never went through any spam or virus checking tool 🦋 The actual checking is still up to the underlying SIEVE implementation, and it maps its results onto the numeric ranges these new tests define. So an implementation can have a spam test that quietly looks for third-party spam headers and figures out how those map onto the spamtest range 🧠

Now, to do numeric comparisons on those returned strings, server implementations MUST also support the SIEVE relational [RELATIONAL] extension, on top of the extensions described here 🔥 All the examples below assume the relational extension is there ✨

Notation conventions follow [SIEVE] section 1.1, including the use of [KEYWORDS] 📚

Quick vocab check: "spam" means unsolicited or unwanted email messages 💌 This doc doesn't try to pin down exactly what counts as spam, how to spot it, or what to do once it's found. Same deal for "virus", which here means any message whose content can cause malicious damage 💀 The doc doesn't define what a virus is, how to identify one, or what actions to take either 🙈

2. SIEVE Extensions 🌸

2.1. General Considerations 💅

so both spamtest and virustest return a string that starts with a numeric value 🫶 That can be followed by an optional space (%x20) and then optional arbitrary text ✨ You compare the number using the SIEVE relational [RELATIONAL] extension together with the "i;ascii-numeric" comparator [ACAP] 🎀 That comparator checks whether a numeric value is at the start of the string and ignores any extra text after it 💖

The extra text is where implementations can put their own details about the tests they ran, plus descriptive comments about the result 🌈 You can run standard string comparators against that text if you need to fine-tune behavior 👀 BUT heads up: doing that breaks script portability, because the text will probably be specific to one implementation 🚨

2.2. Test spamtest 🍓

Syntax: spamtest [COMPARATOR] [MATCH-TYPE] <value: string>

implementations that have the spamtest test use the identifier "spamtest" with the capability mechanism 🧚

The spamtest test evaluates to true if the spamtest result matches the value ✨ The match type comes from the optional match argument, and it defaults to ":is" if you don't specify one 💅

The spamtest result is a string that starts with a numeric value in the range "0" (zero) through "10" 🔥 Here's what each value means:

spamtest    interpretation
value

   0          message was not tested for spam
   1          message was tested and is clear of spam
   2 - 9      message was tested and has a varying likelihood of
              containing spam in increasing order
   10         message was tested and definitely contains spam

the underlying SIEVE implementation maps whatever spam check it runs into this numeric range, as appropriate 🦋

Examples:

require ["spamtest", "fileinto",
         "relational", "comparator-i;ascii-numeric"];

if spamtest :value "eq" :comparator "i;ascii-numeric" "0"
{
    fileinto "INBOX.unclassified";
}
elsif spamtest :value "ge" :comparator "i;ascii-numeric" "3"
{
    fileinto "INBOX.spam-trap";
}

so in this example, any message that never went through a spam check tool gets filed into "INBOX.unclassified" 🫶 Any message with a spamtest value greater than or equal to "3" goes into a mailbox called "INBOX.spam-trap" in the user's mailstore 🕸️

2.3. Test virustest 🦋

Syntax: virustest [COMPARATOR] [MATCH-TYPE] <value: string>

implementations that have the virustest test use the identifier "virustest" with the capability mechanism 💖

The virustest test evaluates to true if the virustest result matches the value 🎀 The match type comes from the optional match argument, which defaults to ":is" if it isn't specified ✨

The virustest result is a string that starts with a numeric value in the range "0" (zero) through "5" 💅 Here's the breakdown:

virustest   interpretation
value

   0          message was not tested for viruses
   1          message was tested and contains no known viruses
   2          message was tested and contained a known virus which
              was replaced with harmless content
   3          message was tested and contained a known virus
              which was "cured" such that it is now harmless
   4          message was tested and possibly contains a
              known virus
   5          message was tested and definitely contains a
              known virus

the underlying SIEVE implementation maps whatever virus checks it runs into this numeric range, as appropriate 🌈 If no virus checking tool has categorized the message, then the virustest result is "0" 🙈

Example:

require ["virustest", "fileinto",
         "relational", "comparator-i;ascii-numeric"];

if virustest :value "eq" :comparator "i;ascii-numeric" "0"
{
    fileinto "INBOX.unclassified";
}
if virustest :value "eq" :comparator "i;ascii-numeric" "4"
{
    fileinto "INBOX.quarantine";
}
elsif virustest :value "eq" :comparator "i;ascii-numeric" "5"
{
    discard;
}

so in this one, any message that never went through a virus check tool goes into "INBOX.unclassified" 📦 A message with a virustest value equal to "4" lands in "INBOX.quarantine" in the user's mailstore 🔒 And a message with a virustest value equal to "5" gets discarded (removed) and never reaches the user's mailstore 💀

3. Security Considerations 🔐

ok this section is SERIOUS bestie, read it all 😭🚨

SIEVE implementations SHOULD ensure that "spamtest" and "virustest" tests can only happen for messages that went through a legitimate spam or virus check process 🛡️ If those checks depend on adding special headers to messages, the implementation has to make sure the sender can't spoof those headers 🙅‍♀️ Otherwise the implementation could get tricked into returning the wrong test result ⚠️

Server administrators MUST ensure that the virus checking tools stay up to date, so users get reasonable protection from the "virustest" test 🔥 Users should also know that the "virustest" test does NOT give a 100% reliable way to remove every virus 💀 They should keep being careful with messages of unknown content and origin 🫶

Beyond that, the "spamtest" and "virustest" extensions don't raise any security considerations that aren't already in the base [SIEVE] protocol. Those issues are discussed in [SIEVE] 📚

4. IANA Considerations 📋

the following templates spell out the IANA registration of the Sieve extensions in this doc 🎀

4.1. spamtest registration 🍓

To: iana@iana.org
Subject: Registration of new Sieve extension

Capability name: spamtest
Capability keyword: spamtest
Capability arguments: N/A
Standards Track/IESG-approved RFC XXXX: this RFC
Person and email address to contact for further information:

   Cyrus Daboo
   Cyrusoft International, Inc.
   5001 Baum Blvd., Suite 780,
   Pittsburgh, PA 15213
   U.S.A.

   <mailto:daboo@cyrusoft.com>

This information has been added to the list of sieve extensions given
on http://www.iana.org/assignments/sieve-extensions.

4.2. virustest registration ✨

To: iana@iana.org Subject: Registration of new Sieve extension

Capability name: virustest Capability keyword: virustest Capability arguments: N/A Standards Track/IESG-approved RFC XXXX: this RFC Person and email address to contact for further information:

Cyrus Daboo Cyrusoft International, Inc. 5001 Baum Blvd., Suite 780, Pittsburgh, PA 15213 U.S.A.

<mailto:daboo@cyrusoft.com>

This information has been added to the list of sieve extensions given on http://www.iana.org/assignments/sieve-extensions.

5. References 📚

5.1. Normative References 💖

[KEYWORDS] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.

[RELATIONAL] Segmuller, W., "Sieve Extension: Relational Tests", RFC 3431, December 2002.

[SIEVE] Showalter, T., "Sieve: A Mail Filtering Language", RFC 3028, January 2001.

5.2. Informative References 🦋

[ACAP] Newman, C. and J. Myers, "ACAP -- Application Configuration Access Protocol", RFC 2244, November 1997.

6. Acknowledgments 🫶

Thanks to Tony Hansen, Jutta Degener, Ned Freed, Ashish Gawarikar and Nigel Swinson for comments and corrections. 🎀

7. Intellectual Property Rights Statement 💅

The IETF takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on the IETF's procedures with respect to rights in standards-track and standards-related documentation can be found in BCP-11. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementors or users of this specification can be obtained from the IETF Secretariat.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which may cover technology that may be required to practice this standard. Please address the information to the IETF Executive Director.

8. Author's Address 🌸

Cyrus Daboo Cyrusoft International, Inc. 5001 Baum Blvd., Suite 780, Pittsburgh, PA 15213 U.S.A.

EMail: daboo@cyrusoft.com

9. Full Copyright Statement 🌈

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assignees.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement 💜

Funding for the RFC Editor function is currently provided by the Internet Society. ✨

📦 where this page comes from

ietf: rfc3685 2004-02
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms

RFC 3685

SIEVE Email Filtering: Spamtest and VirusTest Extensions ✨

Status of This Memo

Copyright Notice

Abstract

Table of Contents

1. Introduction and Overview 🧚

2. SIEVE Extensions 🌸

2.1. General Considerations 💅

2.2. Test spamtest 🍓

2.3. Test virustest 🦋

3. Security Considerations 🔐

4. IANA Considerations 📋

4.1. spamtest registration 🍓

4.2. virustest registration ✨

5. References 📚

5.1. Normative References 💖

5.2. Informative References 🦋

6. Acknowledgments 🫶

7. Intellectual Property Rights Statement 💅

8. Author's Address 🌸

9. Full Copyright Statement 🌈

Acknowledgement 💜