RFC 5429

Sieve Email Filtering: Reject and Extended Reject Extensions

📅 published March 2009, from ietf

Sieve Email Filtering: Reject and Extended Reject Extensions 💌✨

Okay bestie, this RFC is literally the reason your spam filter can say "nope" to a message before it ever bounces back to some poor innocent person 🫶 It was written by A. Stone, Ed. at Serendipity, it's a Standards Track doc (so it's a real, official protocol spec, not just vibes 💅), and it came out in March 2009. It updates RFC 5228 and obsoletes RFC 3028, so it's basically the glow-up version of the old "reject" action 🦋

  • Series: Network Working Group, Request for Comments: 5429
  • Authors: A. Stone, Ed. (Serendipity)
  • Category: Standards Track
  • Date: March 2009
  • Obsoletes: 3028
  • Updates: 5228

Status of This Memo

This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited. 🌸

Copyright (c) 2009 IETF Trust and the persons identified as the document authors. All rights reserved. 🎀

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents in effect on the date of publication of this document (http://trustee.ietf.org/license-info). Please review these documents carefully, as they describe your rights and restrictions with respect to this document.

This document may contain material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. The person(s) controlling the copyright in some of this material may not have granted the IETF Trust the right to allow modifications of such material outside the IETF Standards Process. Without obtaining an adequate license from the person(s) controlling the copyright in such materials, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process, except to format it for publication as an RFC or to translate it into languages other than English.

Abstract

Okay so this memo updates the definition of the Sieve mail filtering language "reject" extension, which was originally defined in RFC 3028. 💜

A "Joe-job" is a spam run forged to look like it came from an innocent party, who then gets absolutely flooded by automated bounces, Message Disposition Notifications (MDNs), and personal messages with complaints 😭 The original Sieve "reject" action from RFC 3028 required MDNs for rejecting messages, which literally fed the flood of Joe-job spam aimed at the victims of Joe-jobs. Not it. 💀

This memo updates the "reject" action so messages can be refused during the SMTP transaction, and it defines the "ereject" action, which requires messages to be refused during the SMTP transaction, if possible. ✨

The "ereject" action is meant to replace the "reject" action wherever possible. It's similar to "reject", but it will always favor protocol-level message rejection 🔥

Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
     1.1.  Conventions Used in This Document  . . . . . . . . . . . .  3
   2.  Sieve "reject" and "ereject" Extensions  . . . . . . . . . . .  4
     2.1.  Action ereject . . . . . . . . . . . . . . . . . . . . . .  4
       2.1.1.  Rejecting a Message at the SMTP/LMTP Protocol Level  .  5
       2.1.2.  Rejecting a Message by Sending a DSN . . . . . . . . .  5
     2.2.  Action reject  . . . . . . . . . . . . . . . . . . . . . .  6
       2.2.1.  Rejecting a Message by Sending an MDN  . . . . . . . .  7
     2.3.  Silent Upgrade from "reject" to "ereject"  . . . . . . . .  8
     2.4.  Compatibility with Other Actions . . . . . . . . . . . . .  9
     2.5.  Details of Protocol-Level Refusal  . . . . . . . . . . . .  9
   3.  Changes from RFC 3028  . . . . . . . . . . . . . . . . . . . . 11
   4.  Security Considerations  . . . . . . . . . . . . . . . . . . . 11
   5.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 11
     5.1.  "reject" Extension Registration  . . . . . . . . . . . . . 11
     5.2.  "ereject" Extension Registration . . . . . . . . . . . . . 12
   6.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 12
     6.1.  Normative References . . . . . . . . . . . . . . . . . . . 12
     6.2.  Informative References . . . . . . . . . . . . . . . . . . 13
   Appendix A.  Acknowledgements  . . . . . . . . . . . . . . . . . . 14
   Appendix B.  Contributors  . . . . . . . . . . . . . . . . . . . . 14

1. Introduction ✨

So the Sieve mail filtering language, as originally defined in RFC 3028 [RFC3028], said that the "reject" action shall discard a message and send a Message Disposition Notification [MDN] to the envelope sender along with an explanatory message. Then the Sieve mail filtering language, as updated in RFC 5228 [SIEVE], doesn't define any "reject" action at all 🙈 That gap is literally why this document exists.

This document updates the definition of the "reject" action to permit refusal of the message during the SMTP transaction, if possible. It also defines a new "ereject" action to require refusal of the message during the SMTP transaction, if possible. 🦋

An important goal here is to reduce the risk of Sieve scripts being used to pull off "Joe-job" spam runs, where the MDN that's supposed to tell a sender their message wasn't delivered actually gets sent to an innocent third party. The original Sieve "reject" action from RFC 3028 required MDNs for rejecting messages, so it contributed to the flood of Joe-job spam hitting the victims. By rejecting the message at the protocol level, an MDN is less likely to be needed, and so it's less likely to be misdirected at an innocent third party. Iykyk, and now we're protecting the innocent 🫶

Implementations are further encouraged to use spam-detection systems to figure out how risky it is to send an MDN. This document also allows implementations to silently drop the MDN if the rejected message is deemed likely to be spam. Honestly, that's such a mood 💅

This document also describes how to use "reject"/"ereject" at different points in the email stack: the Mail Transfer Agent (MTA), the Mail Delivery Agent (MDA), and the Mail User Agent (MUA). For a full discussion of these environments, check out [EMAIL-ARCH] 📬

Generally speaking, an MDN is generated by an MUA, and it can be used to indicate the status of a message with respect to its recipient. A Delivery Status Notification (DSN) [DSN], on the other hand, is generated by an MTA, and it can be used to indicate whether or not a message was received and delivered by the mail system. Two different vibes, both important 🌈

If you want more on the risks of generating MDNs and the perks of protocol-level refusal, [Joe-DoS] is the one 👑

1.1. Conventions Used in This Document

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [KEYWORDS]. 🎀

Conventions for notations are as in Section 1.1 of RFC 5228 [SIEVE].

This document does not attempt to define spam or how it should be identified, nor does it attempt to define an email virus or how it should be detected. Implementors are advised to follow best practices and keep abreast of current research in these fields. Basically, that's not this doc's job, but you should totally stay up to date 🧚

2. Sieve "reject" and "ereject" Extensions 💖

2.1. Action ereject

Here's the syntax:

   Usage: ereject <reason: string>

Sieve implementations that implement the "ereject" action must use the "ereject" capability string. Yes, the lowercase "must" is intentional, it just reads like that in the original 😌

The "ereject" action cancels the implicit keep and refuses delivery of a message. The "reason" string is a UTF-8 [UTF-8] string that specifies the reason for refusal. How a message gets refused depends on the capabilities of the mail component (MDA or MTA) running the Sieve script. The Sieve interpreter MUST carry out one of the following actions (listed in order from most to least preferred), MUST carry out the most preferable action possible, and MUST fall back to lesser actions if a preferred action fails. Think of it like a ranking system, but make it protocol-level 👑

  1. Refuse message delivery by sending a 5XX response code over SMTP [SMTP] or Local Mail Transfer Protocol (LMTP) [LMTP]. See Section 2.1.1 for more details. 🚫
  2. Send a non-delivery report to the envelope sender ([REPORT] [DSN]), unless the envelope sender address is determined to be a forged or otherwise invalid address.

Now, the determination of whether or not an envelope sender is a forgery may be performed by site-specific and implementation-specific heuristic techniques, such as "return-path verification". The details of those are outside the scope of this document, so don't come for me on that one 🙃 Implementations SHOULD log instances when a non-delivery report is not sent, along with the reason for not sending it (e.g., content was spam, return-path invalid, etc.). Paper trail, periodt 📝

The "ereject" action MUST NOT be available in environments that do not support protocol-level rejection, e.g., an MUA, and MUST be available in all other environments that support the "reject" action. So an MUA is a no-go for this one, but everywhere else that does "reject" should have "ereject" too 💅

Here's an example:

       require ["ereject"];

       if address "from" "someone@example.com" {
           ereject "I no longer accept mail from this address";
       }

2.1.1. Rejecting a Message at the SMTP/LMTP Protocol Level 🍓

Sieve implementations that are able to reject messages at the SMTP/LMTP level MUST do so and SHOULD use the 550 response code. Real talk though, if a message is arriving over SMTP and has multiple recipients, and some of them already accepted it, Section 2.1.2 explains how to reject it. It's giving "it's complicated" 💀

The risk that these actions will generate blowback spam is minimized, but it can't be eliminated completely, even with "ereject". So be careful when you use these actions on messages you've determined to be spam, bestie 😭

Quick heads up: SMTP [SMTP] doesn't allow non-US-ACSII characters in the SMTP response text. If non-US-ACSII characters show up in the "reason" string, they can be sent at the protocol level if and only if the client and the server use an SMTP extension that allows transmission of non-US-ACSII reply text. (One example of such an SMTP extension is described in [UTF8-RESP].) Without an extension like that, the Sieve engine MUST replace any "reason" string being sent at the protocol level and containing non-US-ACSII characters with an implementation-defined US-ACSII-only string. Not ideal, but that's the deal 🌸

Users who don't like this behavior should consider using the "reject" action described in Section 2.2, if it's available 🎀

For the detailed instructions on protocol-level rejection, see Section 2.5. ✨

2.1.2. Rejecting a Message by Sending a DSN 💌

okay so picture this, bestie 🥺 a message comes in over SMTP with more than one RCPT TO, and the server already said "yes" to all of them. then at least one of those recipients is like "nope" 🙅‍♀️ (because of a Sieve "ereject" action or for some other reason), but the rest are still totally fine with it. ngl this is so messy 💀 In this case the server MUST accept the message and generate DSNs for all the recipients that are refusing it. 🫶

Quick tea ☕: this exception does NOT apply to LMTP, because LMTP can reject messages on a per-recipient basis, which is so much cleaner 💅 (But the LMTP client might end up having no choice except to generate a DSN to report the error, and that can lead to blowback spam 😭)

Also, according to [DSN], Delivery Status Notifications MUST NOT be generated if the MAIL FROM (or Return-Path) is empty. no notifications for nobody 🙈

The DSN message MUST follow the requirements of [DSN] and [REPORT]. The action-value field defined in [DSN], Section 2.3.3, MUST contain the value "failed". The human-readable part of the non-delivery report MUST contain the "reason" string from the "ereject" action, and SHOULD also include extra text letting the apparent original sender know that an email filter is what refused the message. ✨ It might look something like this:

Your message was refused by the recipient's mail filtering program.
The reason given is as follows:

I am not taking mail from you, and I don't want your birdseed,
either!

2.2. Action reject 🕊️

This section updates the definition of the "reject" action in Section 4.1 of RFC 3028 [RFC3028] and is an optional extension to [SIEVE]. so it's a glow-up of an old friend 🌸

Usage:   reject <reason: string>

Sieve implementations that implement the "reject" action have to use the "reject" capability string. no skipping this part, babe 📝

The "reject" action cancels the implicit keep and refuses delivery of a message. The "reason" string is a UTF-8 [UTF-8] string that explains why the message was refused. Unlike the "ereject" action we just talked about, this one always puts the exact wording of the refusal reason first 💖 Typically, the "reject" action refuses delivery by sending an MDN back to the sender (see Section 2.2.1). However, implementations MAY refuse delivery over the SMTP/LMTP protocol (as detailed in Section 2.5), if and only if ALL of the following conditions are true:

  1. The "reason" string consists of only US-ASCII characters
    • or
    • The "reason" string contains non-US-ASCII characters, and both the client and server support and negotiate use of an SMTP/LMTP extension for sending UTF-8 responses.
  2. LMTP protocol is used
    • or
    • SMTP protocol is used and the message has a single recipient
    • or
    • SMTP protocol is used, the message has multiple recipients, and all of them refused message delivery (whether or not Sieve is being used).

Example:

        require ["reject"];

        if size :over 100K {
            reject text:
Your message is too big.  If you want to send me a big attachment,
put it on a public web site and send me a URL.
.
            ;
        }

(Pretend that the "reason" string above contains some non-US-ACSII text. 🌍)

Implementations can use the techniques described in Section 2.1 to figure out whether a non-delivery report should NOT be sent to a forged sender 🕵️‍♀️ Implementations SHOULD log every time a non-delivery report is not sent, along with the reason for not sending it 📋

2.2.1. Rejecting a Message by Sending an MDN 📬

The "reject" action sends the received message back to the envelope sender named in the MAIL FROM (or Return-Path) address. It wraps the message in a "reject" form that explains the recipient refused it 🎀

Also according to [MDN], Message Disposition Notifications MUST NOT be generated if the MAIL FROM (or Return-Path) is empty. same energy as before, no cap 🧢

A reject message MUST take the form of a failure MDN as specified by [MDN]. The human-readable part of the message, which is the first component of the MDN, describes the error, and it SHOULD also contain extra text letting the apparent original sender know that mail was refused by an email filter. 💌

The MDN disposition-field, as defined in the MDN specification, MUST be "deleted", and MUST have the "MDN-sent-automatically" and "automatic-action" modes set (see Section 3.2.6 of [MDN]). it's very specific and I love that for us 🤓

In the following script, a message gets rejected and sent back to the sender 🪃

    Example:
            require ["reject"];

            if header :contains "from" "coyote@desert.example.org" {
                reject text:
I am not taking mail from you, and I don't
want your birdseed, either!
.
                ;
            }

For this script, the first part of the MDN might look like this:

The message was refused by the recipient's mail filtering program.
The reason given was as follows:

I am not taking mail from you, and I don't want your birdseed,
either!

2.3. Silent Upgrade from "reject" to "ereject" 🦋

Implementations MUST NOT silently upgrade "reject" actions to "ereject" actions in a Sieve script. why? because it could lead to unpleasant changes in behavior that the script owner did not expect 🙅‍♀️😬

User interfaces that show a generic rejection option and generate Sieve script output MAY switch from generating "reject" to generating "ereject" actions, as long as doing so does not create a confusing change for the script owner. 🪄

Script generators SHOULD make sure that a rejection action triggered by an anti-spam or anti-virus positive test uses the "ereject" action, because it is better suited to those rejections 🛡️

Script generators MAY automatically upgrade scripts that previously used the "reject" action for anti-spam or anti-virus related rejections. Note that such generators MUST make sure the target environment can support the "ereject" action. ✅

2.4. Compatibility with Other Actions 🧩

This section applies equally to "reject" and "ereject" actions. Every reference to the "reject" action in this section can be swapped out for the "ereject" action 🔁

A "reject" action cancels the implicit keep.

Implementations MUST prohibit the execution of more than one "reject" in a Sieve script. one reject per script, that's the vibe 🚫

"reject" MUST be incompatible with the "vacation" [VACATION] action. It is NOT RECOMMENDED that implementations allow "reject" to be used with actions that cause mail delivery, such as "keep", "fileinto", and "redirect". 🙅‍♀️💅

Making "reject" compatible with actions that cause mail delivery goes against the RFC 5321 [SMTP] principle that a message is either delivered or bounced back to the sender. So if you bounce a message back (reject it) and also deliver it, the sender will think the message was never delivered 😵‍💫

Still, there are existing laws that require certain organizations to archive every message they receive, even the rejected ones 📚 Also, it can be really useful to keep copies of rejected messages for later analysis 🔍

Any action that would modify the message body will have no effect on the body of any message refused by "reject" using an SMTP response code, and it MUST NOT have any effect on the content of generated DSNs/MDNs. hands off the paperwork 🙌

2.5. Details of Protocol-Level Refusal 🚪

If the "reason" string consists of multiple CRLF-separated lines, then the reason text MUST be returned as a multiline SMTP/LMTP response, per Section 4.2.1 of [SMTP]. Any line MUST NOT exceed the SMTP limit on maximal line length. To make the "reason" string fit those limits, the server MAY insert CRLFs and turn the response into a multiline response. ✂️

In the following script (which assumes support for the "spamtest" [SPAMTEST] and "fileinto" extensions), messages that test highly positive for spam get refused 🚫🗑️

    Example:
            require ["ereject", "spamtest", "fileinto",
                     "comparator-i;ascii-numeric"];

            if spamtest :value "ge"
                        :comparator "i;ascii-numeric" "6" {
                ereject text:
AntiSpam engine thinks your message is spam.
It is therefore being refused.
Please call 1-900-PAY-US if you want to reach us.
.
                ;
            } elsif spamtest :value "ge"
                             :comparator "i;ascii-numeric" "4" {
                fileinto "Suspect";
            }

Here's an excerpt from an SMTP session showing it in action 👀

      ...
      C: DATA
      S: 354 Send message, ending in CRLF.CRLF.
       ...
      C: .
      S: 550-AntiSpam engine thinks your message is spam.
      S: 550-It is therefore being refused.
      S: 550 Please call 1-900-PAY-US if you want to reach us.

If the SMTP/LMTP server supports RFC 2034 [ENHANCED-CODES], it MUST prepend an appropriate Enhanced Error Code to the "reason" text. Enhanced Error Code 5.7.1, or the more generic 5.7.0, is RECOMMENDED. 🏷️ With an Enhanced Error Code, the response to a DATA command in the SMTP example below will look like this:

      S: 550-5.7.1 AntiSpam engine thinks your message is spam.
      S: 550-5.7.1 It is therefore being refused.
      S: 550 5.7.1 Please call 1-900-PAY-US if you want to reach us.

...as long as the server picked "5.7.1" as the appropriate code. ✨

If a Sieve implementation that supports "ereject" doesn't want to reveal the reason for rejection right away (for example, that it detected spam), it's allowed to hold off on sending the 550 error code by sending a 4XX error code on the first attempt to receive the message. 🤫

3. Changes from RFC 3028 📝

  • Clarified that the "reject" action cancels the implicit keep.
  • Extended the list of allowable actions on "reject" to include protocol-level message rejection.
  • Added the "ereject" action, which is similar to "reject" but always favors protocol-level message rejection. 💫

4. Security Considerations 🔐

The introduction to this document discusses why rejecting messages before delivery is better than accepting and bouncing them. 🙌

While the details of the techniques that can be used to decide when to silently drop a non-delivery report are outside the scope of this document, the explicit permission this document gives to take such action may enable denial-of-service situations. Techniques such as spam-checking, return-path verification, and others can, and do, have false positives. Care should be exercised to prevent the loss of legitimate messages by failing to notify the sender of non-delivery. 🚨😭

Security issues associated with email auto-responders are fully discussed in the Security Considerations section of [RFC3834]. This document is not believed to introduce any additional security considerations in this general area. 🤍

The "ereject" extension does not raise any other security considerations that are not already present in the base [SIEVE] specification, and those issues are discussed in [SIEVE]. 🛡️

5. IANA Considerations 🗂️

The following section provides the IANA registrations for the Sieve extensions specified in this document. 🎀

5.1. "reject" Extension Registration ✨

okay bestie, IANA is being asked to update the registration for the Sieve "reject" extension 💅 here's the tea:

Capability name: reject
Description:     adds the "reject" action for refusing delivery
                 of a message.  The exact reason for refusal is
                 conveyed back to the client.
RFC number:      RFC 5429
Contact address: the Sieve discussion list <ietf-mta-filters@imc.org>

5.2. "ereject" Extension Registration 🦋

next up, IANA needs to swap out the preliminary registration for the Sieve refuse extension and replace it with this one, and it's giving main character energy 👑

Capability name: ereject
Description:     adds the "ereject" action for refusing delivery
                 of a message.  The refusal should happen as early
                 as possible (e.g., at the protocol level) and might
                 not preserve the exact reason for refusal if it
                 contains non-US-ASCII text.
RFC number:      RFC 5429
Contact address: the Sieve discussion list <ietf-mta-filters@imc.org>

6. References 📚

6.1. Normative References 🌸

these are the must-read docs the spec leans on, no skipping allowed 🙈

  • [DSN] Moore, K. and G. Vaudreuil, "An Extensible Message Format for Delivery Status Notifications", RFC 3464, January 2003.
  • [ENHANCED-CODES] Freed, N., "SMTP Service Extension for Returning Enhanced Error Codes", RFC 2034, October 1996.
  • [KEYWORDS] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
  • [LMTP] Myers, J., "Local Mail Transfer Protocol", RFC 2033, October 1996.
  • [MDN] Hansen, T. and G. Vaudreuil, "Message Disposition Notification", RFC 3798, May 2004.
  • [REPORT] Vaudreuil, G., "The Multipart/Report Content Type for the Reporting of Mail System Administrative Messages", RFC 3462, January 2003.
  • [SIEVE] Guenther, P. and T. Showalter, "Sieve: An Email Filtering Language", RFC 5228, January 2008.
  • [SMTP] Klensin, J., "Simple Mail Transfer Protocol", RFC 5321, October 2008.
  • [UTF-8] Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, November 2003.
  • [VACATION] Showalter, T. and N. Freed, "Sieve Email Filtering: Vacation Extension", RFC 5230, January 2008.

6.2. Informative References 🦋

these ones are good to know but aren't strictly required reading, ngl they're still super useful ✨

  • [EMAIL-ARCH] Crocker, D., "Internet Mail Architecture", Work in Progress, October 2008.
  • [Joe-DoS] Frei, S., Silvestri, I., and G. Ollman, "Mail Non-Delivery Notice Attacks", April 2004, http://www.techzoom.net/papers/mail_non_delivery_notice_attacks_2004.pdf.
  • [RFC3028] Showalter, T., "Sieve: A Mail Filtering Language", RFC 3028, January 2001.
  • [RFC3834] Moore, K., "Recommendations for Automatic Responses to Electronic Mail", RFC 3834, August 2004.
  • [SPAMTEST] Daboo, C., "Sieve Email Filtering: Spamtest and Virustest Extensions", RFC 5235, January 2008.
  • [UTF8-RESP] Melnikov, A., "SMTP Language Extension", Work in Progress, June 2007.

Appendix A. Acknowledgements 💖

huge thank-you energy to Ned Freed, Cyrus Daboo, Arnt Gulbrandsen, Kristin Hubner, Mark E. Mallett, Philip Guenther, Michael Haardt, and Randy Gellens for leaving comments and corrections 🫶

the authors also want to give a big shout-out to Tim Showalter, who wrote RFC 3028 and originally defined the "reject" action. iconic behaviour, honestly 👑

Appendix B. Contributors 🧚

Matthew Elvey, who is a real legend ✨

Matthew Elvey
The Elvey Partnership, LLC
1819 Polk Street, Suite 133
San Francisco, CA  94109
USA

EMail: matthew@elvey.com

Alexey Melnikov, also a total icon 🔥

Alexey Melnikov
Isode Limited
5 Castle Business Village
36 Station Road
Hampton, Middlesex  TW12 2BX
UK

EMail: Alexey.Melnikov@isode.com

Author's Address 🌈

the editor is Aaron Stone, from Serendipity 🎀

Aaron Stone (editor)
Serendipity
260 El Verano Ave
Palo Alto, CA  94306
USA

EMail: aaron@serendipity.palo-alto.ca.us
📦 where this page comes from