RFC 5173

Sieve Email Filtering: Body Extension

📅 published April 2008, from ietf

Sieve Email Filtering: Body Extension 🎀

Okay bestie, this is RFC 5173, and it's giving official spec 💅 It's a Standards Track doc from April 2008, written by J. Degener and P. Guenther at Sendmail, Inc. ✨ It updates RFC 5229. The header doesn't list anything it obsoletes 🌸

Status of This Memo

This document is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 🫶 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 💌

Abstract

Okay so this doc adds a brand new command to the "Sieve" email filtering language 🧚 The command checks whether one or more strings show up in the body of an email message 👀

1. Introduction ✨

The "body" test checks for one or more strings in the body of an email message. Apparently this was floated for the [SIEVE] base document at first, but it got cut because it was thought to be too costly to implement 💀

Still, several server vendors went and built some form of the "body" test anyway, so it's giving "we clearly needed this" 🙌

This document brings the "body" test back as an extension and spells out its syntax and semantics 🎀

2. Conventions Used in This Document 🎀

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [KEYWORDS].

Notation conventions follow [SIEVE] Section 1.1, including the use of the "Usage:" label for defining text and tagged argument syntax 🧚

The rules for reading the grammar are defined in [SIEVE] and inherited by this spec. Readers are reminded that according to [SIEVE] Sections 2.6.2 and 2.6.3, optional arguments such as COMPARATOR and MATCH-TYPE can appear in any order 🙈

3. Capability Identifier 🦋

The capability string for this extension is "body" 🍓

4. Test body 💖

Usage for the test looks like this 👇

Usage: "body" [COMPARATOR] [MATCH-TYPE] [BODY-TRANSFORM]
            <key-list: string-list>

The body test matches content in the body of an email message, which means anything following the first empty line after the header. (The empty line itself, if present, is not considered part of the body 🫠)

The COMPARATOR and MATCH-TYPE keyword parameters are defined in [SIEVE]. As specified in Sections 2.7.1 and 2.7.3 of [SIEVE], the default COMPARATOR is "i;ascii-casemap" and the default MATCH-TYPE is ":is" 💖

The BODY-TRANSFORM is a keyword parameter that governs how the set of strings to be matched gets extracted from the body of the message. If a message consists of a header only, not followed by an empty line, then that set is empty and all "body" tests return false, including the ones that test for an empty string 💀 (This is similar to how the "header" test always fails when the named header fields aren't present.) Otherwise, the transform must be followed as defined below in Section 5.

Note that the transformations defined here do not match against each line of the message independently, so the strings will usually contain CRLFs. How these can be matched is governed by the comparator and match-type. For example, with the default comparator of "i;ascii-casemap", they can be included literally in the key strings, or be matched with the "*" or "?" wildcards of the :matches match-type, or be skipped with :contains 🌈

5. Body Transform 🌈

Before matching content in a message body, "transformations" can be applied that filter and decode certain parts of the body. These transformations are selected by a "BODY-TRANSFORM" keyword parameter 🧁

Usage: ":raw"
     / ":content" <content-types: string-list>
     / ":text"

The default transformation is :text.

5.1. Body Transform ":raw" 🍓

The ":raw" transform matches against the entire undecoded body of a message as a single item.

If the specified body-transform is ":raw", the [MIME] structure of the body is irrelevant 🙃 The implementation MUST NOT remove any transfer encoding from the message, MUST NOT refuse to filter messages with syntactic errors (unless the environment it is part of rejects them outright), and MUST treat multipart boundaries or the MIME headers of enclosed body parts as part of the content being matched against, instead of MIME structures to interpret. Strict, but iconic 💅

Example:

require "body";

# This will match a message containing the literal text
# "MAKE MONEY FAST" in body parts (ignoring any
# content-transfer-encodings) or MIME headers other than
# the outermost RFC 2822 header.

if body :raw :contains "MAKE MONEY FAST" {
        discard;
}

5.2. Body Transform ":content" 🦋

If the body transform is ":content", the MIME parts that have the specified content types are matched against independently 🫶

If an individual content type begins or ends with a '/' (slash) or contains multiple slashes, then it matches no content types. Otherwise, if it contains a slash, then it specifies a full <type>/<subtype> pair, and matches only that specific content type. If it is the empty string, all MIME content types are matched. Otherwise, it specifies a <type> only, and any subtype of that type matches it.

The search for MIME parts matching the :content specification is recursive and automatically descends into multipart and message/rfc822 MIME parts. All MIME parts with matching types are searched for the key strings. The test returns true if any combination of a searched MIME part and key-list argument match ✨

If the :content specification matches a multipart MIME part, only the prologue and epilogue sections of the part will be searched for the key strings, treating the entire prologue and the entire epilogue as separate strings. The contents of nested parts are only searched if their respective types match the :content specification.

If the :content specification matches a message/rfc822 MIME part, only the header of the nested message will be searched for the key strings, treating the header as a single string. The contents of the nested message body parts are only searched if their content type matches the :content specification.

For other MIME types, the entire part will be searched as a single string.

(Matches against container types with an empty match string can be useful as tests for the existence of such parts 🧚)

Example:

        From: Whomever
        To: Someone
        Date: Whenever
        Subject: whatever
        Content-Type: multipart/mixed; boundary=outer

     &  This is a multi-part message in MIME format.
     &
        --outer
        Content-Type: multipart/alternative; boundary=inner

     &  This is a nested multi-part message in MIME format.
     &
        --inner
        Content-Type: text/plain; charset="us-ascii"

     $  Hello
     $
        --inner
        Content-Type: text/html; charset="us-ascii"

     %  <html><body>Hello</body></html>
     %
        --inner--
     &
     &  This is the end of the inner MIME multipart.
     &
        --outer
        Content-Type: message/rfc822

     !  From: Someone Else
     !  Subject: hello request

     $  Please say Hello
     $
        --outer--
     &
     &  This is the end of the outer MIME multipart.

In the above example, the '&', '$', '%', and '!' characters at the start of a line are used to show which parts of the example message get used in tests 👀

The lines starting with '&' are the ones tested when a 'body :content "multipart" :contains "MIME"' test is executed.
The lines starting with '$' are the ones tested when a 'body :content "text/plain" :contains "Hello"' test is executed.
The lines starting with '%' are the ones tested when a 'body :content "text/html" :contains "Hello"' test is executed.
The lines starting with '$' or '%' are the ones tested when a 'body :content "text" :contains "Hello"' test is executed.
The lines starting with '!' are the ones tested when a 'body :content "message/rfc822" :contains "Hello"' test is executed.

Comparisons are performed on octets. Implementations decode the content-transfer-encoding and convert text to [UTF-8] as input to the comparator. MIME parts that cannot be decoded and converted MAY be treated as plain US-ASCII, omitted, or processed according to local conventions. A NUL octet (character zero) SHOULD NOT cause early termination of the content being compared against. Implementations MUST support the "quoted-printable", "base64", "7bit", "8bit", and "binary" content transfer encodings. Implementations MUST be capable of converting to UTF-8 the US-ASCII, ISO-8859-1, and the US-ASCII subset of ISO-8859-* character sets 🌸

Each matched part is matched against independently: search expressions MUST NOT match across MIME part boundaries. MIME headers of the containing part MUST NOT be included in the data 🫠

Example:

require ["body", "fileinto"];

# Save any message with any text MIME part that contains the
# words "missile" or "coordinates" in the "secrets" folder.

if body :content "text" :contains ["missile", "coordinates"] {
        fileinto "secrets";
}

# Save any message with an audio/mp3 MIME part in
# the "jukebox" folder.

if body :content "audio/mp3" :contains "" {
        fileinto "jukebox";
}

7. IANA Considerations ✨

okay so IANA needs a little registration form to add this extension to their list, and here's the exact template you send them 💅🎀

To: iana@iana.org
Subject: Registration of new Sieve extension

Capability name: body
Description:     Provides a test for matching against the
                 body of the message being processed
RFC number:      RFC 5173
Contact Address: The Sieve discussion list
                 <ietf-mta-filters@imc.org>

8. Security Considerations 🔥

okay this section is SERIOUS bestie 😭 the system MUST be sized and restricted so that even malicious body matching can't deny service to other users of the host system. like, one nosy filter should never be able to tank everyone else's inbox 💀

also, filters that do string matches on the raw body of a message can end up catching way more stuff than you meant to 🙈 and text matching is NOT a replacement for spam, virus, or other security filtering. don't let your little body test be your whole bodyguard 🛡️💖

9. Acknowledgments 🫶

this doc got revised partly because of comments and chats that happened on and off the SIEVE mailing list, so huge thank you to everyone who reviewed it and dropped suggestions 🌸 Cyrus Daboo, Ned Freed, Bob Johannessen, Simon Josefsson, Mark E. Mallett, Chris Markle, Alexey Melnikov, Ken Murchison, Greg Shapiro, Tim Showalter, Nigel Swinson, Dowson Tong, and Christian Vogt. you're all iconic ✨👑

10. References 📚

10.1. Normative References

[KEYWORDS] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[MIME] Freed, N. and N. Borenstein, "Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies", RFC 2045, November 1996.
[SIEVE] Guenther, P., Ed., and T. Showalter, Ed., "Sieve: An Email Filtering Language", RFC 5228, January 2008.
[UTF-8] Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, November 2003.

10.2. Informative References

[VARIABLES] Homme, K., "Sieve Email Filtering: Variables Extension", RFC 5229, January 2008.

Authors' Addresses 💌

Jutta Degener 5245 College Ave, Suite #127 Oakland, CA 94618

EMail: jutta@pobox.com

Philip Guenther Sendmail, Inc. 6425 Christie Ave, 4th Floor Emeryville, CA 94608

EMail: guenther@sendmail.com

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 🦋

The IETF takes no position on whether any Intellectual Property Rights or other rights that might be claimed to apply to the technology in this document are valid or in scope, or whether any license under those rights might be available. It also doesn't claim to have done any independent search for such rights. Info on how RFC documents handle rights is in BCP 78 and BCP 79.

Copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses to be made available, or the results of an attempt to get a general license or permission to use those proprietary rights for implementers or users of this spec can be found in the IETF online IPR repository at http://www.ietf.org/ipr.

The IETF invites anyone to bring to its attention any copyrights, patents, patent applications, or other proprietary rights that may cover technology needed to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org. 💜

📦 where this page comes from

ietf: rfc5173 2008-04
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms

RFC 5173

Status of This Memo

Abstract

1. Introduction ✨

2. Conventions Used in This Document 🎀

3. Capability Identifier 🦋

4. Test body 💖

5. Body Transform 🌈

5.1. Body Transform ":raw" 🍓

5.2. Body Transform ":content" 🦋

7. IANA Considerations ✨

8. Security Considerations 🔥

9. Acknowledgments 🫶

10. References 📚

10.1. Normative References

10.2. Informative References

Authors' Addresses 💌

Full Copyright Statement ©️

Intellectual Property 🦋