RFC 6133
Sieve Email Filtering: Use of Presence Information with Auto-Responder Functionality
RFC 6133: Sieve Email Filtering: Use of Presence Information with Auto-Responder Functionality 📬✨
okay bestie, let's get into this one 💅 it's an IETF doc, so I'm keeping every detail exact. Here's the title block tea:
Internet Engineering Task Force (IETF)
Authors: R. George and B. Leiba (both at Huawei Technologies), plus A. Melnikov (at Isode Limited) 👩💻
Category: Informational 🧚
ISSN: 2070-1721
Date: July 2011 🌸
The header doesn't list anything it obsoletes or updates, so no drama there 💖
Abstract 🦋
This doc is all about how the Sieve email filtering language, plus some extensions, can be used to set up automatic replies to incoming emails. The replies can depend on the recipient's address book and presence info. Iconic. 👑
Status of This Memo 🎀
This one is not an Internet Standards Track spec. It's published for informational purposes, so it's more of a "here's how this works" situation than a "you must do this" one 🍓
It's a product of the IETF, it represents the IETF community's consensus, got public review, and was approved for publication by the Internet Engineering Steering Group (IESG). Not every IESG-approved doc is up for any level of Internet Standard, though. See Section 2 of RFC 5741 for that 🤓
For the current status, any errata, and how to send feedback, check http://www.rfc-editor.org/info/rfc6133 ✨
Copyright Notice 🔒
Copyright (c) 2011 IETF Trust and the document authors. All rights reserved 💜
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the publication date. Please read those carefully, bestie, because they spell out your rights and restrictions. If you extract Code Components from this doc, they must include the Simplified BSD License text described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as the Simplified BSD License describes 🫶
Table of Contents 📑
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2
2. How To Create Auto-Replies . . . . . . . . . . . . . . . . . . 3
3. Example Use Cases for Auto-Replies . . . . . . . . . . . . . . 3
4. Security Considerations . . . . . . . . . . . . . . . . . . . . 6
5. Normative References . . . . . . . . . . . . . . . . . . . . . 81. Introduction ✨
Okay so this doc shows how the Sieve email filtering language [RFC5228], plus some extensions [RFC5230] [RFC5435] [RFC6134] [RFC6132] [RFC6131], can generate automatic replies to incoming emails based on the recipient's presence info. Super handy for telling a sender "hey, I'm busy or away right now, so I won't reply straight away" 🦋
The auto-reply can also depend on info about the sender from the recipient's address book, sub-lists from it, or other lists the recipient can access. That means different senders can get different replies. The recipient can make separate rules for friends, family, colleagues, and so on. Main character energy 👑
This works for mail filtering software, email-based info services, and other automatic responder setups. Tbh there are already loads of programs that auto-respond to email, and some of them spam people with useless or unwanted replies, or reply to the wrong addresses 💀 This mechanism is designed to help avoid those problems, but check Section 4 for the caveats 🙈 Implementations need to keep track of earlier messages from the same sender, and they'll start or stop replying as the recipient's presence status changes 🌈
Now, a very real note 🫶 people using any auto-reply should seriously think about whether auto-replies are even needed, and how often they make sense. Email is not Instant Messaging, and senders usually expect replies to take a while. Do you really need to tell someone you'll read their mail "in an hour or so"? Or can that just be how email works? There are times when it makes sense, but let's not make information overload worse 😭 Using presence info thoughtfully can help with that.
Implementors need to think about this too, about the features they show users and how those features could be misused. The option to create auto-responders might be tucked behind an "advanced" button, and users might get warned about the consequences and reminded of the considerations in the paragraph above 🔥
2. How To Create Auto-Replies 💌
When an email arrives, the Sieve script can use the notify_method_capability of the Notify extension [RFC5435] to check the recipient's presence info. The Notify-presence extension [RFC6132] adds more presence states, like "away" and "do not disturb" 🧚
The script can use the External-lists extension [RFC6134] to look the sender up in the recipient's address book or another list. If what's retrieved calls for an auto-reply, the reply can then be composed based on that info ✨
The Vacation extension [RFC5230] gives you an easy way to send the auto-reply to the sender. It automatically keeps track of replies and tries to avoid excessive messages and mail loops, which is so helpful 🙌 The Vacation-seconds extension [RFC6131] lets auto-replies go out more often than once a day when that's appropriate 🌸 (Or, alternatively, the script can use the Notify extension [RFC5435] to send a notification some way other than email.)
Personal and Group Responders can refuse to reply except to known correspondents, or to addresses the recipient otherwise knows about 🔒 They can also send different kinds of replies to "trusted" vs. "untrusted" addresses. That's useful for avoiding inappropriate disclosure of personal or confidential info to random addresses. Protect your privacy, bestie 💖
Part 1 of 2. More of this RFC is coming next, so stay tuned 🎀
3. Example Use Cases for Auto-Replies 🎀
Okay bestie, this is the fun part! 🧚 Here are five example scripts showing how auto-replies can get seriously smart. Each one has its own vibe.
1. Example 1 is giving main character energy 💅. It checks that the envelope "from" address is in the recipient's address book [RFC6134] and that the recipient's presence shows "extended away" [RFC6132]. If both of those are true, the "vacation" action [RFC5230] sends an auto-reply, and it makes sure we don't reply to the same sender more than once every half hour [RFC6131]. The variables extension [RFC5229] pulls out the recipient's natural-language presence status message, and that message becomes the response to the sender. So cute, right? 🥹
require ["envelope", "extlists", "enotify", "variables",
"vacation-seconds"];
if allof (
envelope :list "from" ":addrbook:default",
notify_method_capability "xmpp:me@example.com" "show" "xa"
) {
# :matches "*" is used here to extract the value
if notify_method_capability :matches
"xmpp:myjid@example.com" "status" "*" {
set "resp_msg" "${1}";
} else {
set "resp_msg" "Away for a while, without access to email.";
}
vacation :handle "ext-away" :seconds 1800 "${resp_msg}";
}2. Next up, Example 2 checks for the recipient's personal assistant and gives that sender very detailed info about the recipient's status 🫶. Senders in the "family" and "friends" lists also get an auto-reply. Everyone else is considered less important and doesn't need an auto-reply, so they just get left alone 🙈.
require ["envelope", "extlists", "enotify", "vacation-seconds"];
if envelope :is "from" "assistant@example.com"
{
if notify_method_capability "xmpp:me@example.com" "show" "away"
{
vacation :handle "away" :seconds 600
"I'm away for now, but I'll be back soon.";
}
elsif notify_method_capability "xmpp:me@example.com" "show" "dnd"
{
vacation :handle "dnd" :seconds 1800
"I'm not to be disturbed. I'll check mail later.";
}
elsif notify_method_capability "xmpp:me@example.com" "show" "xa"
{
vacation :handle "ext-away" :seconds 3600
"I'm away for a while, without access to email.";
}
elsif notify_method_capability "xmpp:me@example.com" "busy" "yes"
{
vacation :handle "busy" :seconds 1800
"I'm very busy, but might check email now and then.";
}
}
elsif envelope :list "from" [":addrbook:family",
":addrbook:friends"]
{
if notify_method_capability "xmpp:me@example.com" "show"
["away", "dnd", "xa"]
{
vacation :handle "away" :seconds 3600
"I'm not available to respond to email.";
}
}
else
{ # We could respond as below, making it only once a day
# for less important senders. Better to just omit
# that, though (see the end of the Introduction section).
#
# vacation :handle "catchall" :days 1
# "I got your message, and might read it eventually.";
}3. Example 3 is for when the sender is a work colleague and the recipient is on extended away status 💼. In that case, the reply gives alternative contact info. The message might also mention the reason for the absence, or other personal or confidential info that shouldn't go to senders who aren't connected to the recipient's company 🤫.
require ["envelope", "extlists", "enotify", "vacation"];
if envelope :list "from" ":addrbook:co-workers"
{
if notify_method_capability "xmpp:me@example.com" "show" "xa"
{
vacation :handle "bigtrip" :days 3
"I'm on an extended business trip to Texas for the Foo
project. Contact my backup, Susan <susan@example.com>,
or call my assistant on +1 666 555 1234 if you urgently
need to contact me.";
}
}4. Example 4 is the "every single message gets a reply" move 📬. A :seconds value of zero means it replies to every message, with no de-duplication for the same sender. Heads up though: this only works if the Sieve engine allows an interval of zero. If it doesn't, and it imposes a minimum value instead, then not every message will get an auto-reply ⚠️.
require ["envelope", "extlists", "vacation-seconds"];
if not envelope :list "from" ":addrbook:staff"
{
vacation :handle "auto-resp" :seconds 0
"Your request has been received. A service
representative will contact you as soon as
possible, usually within one business day.";
}5. Example 5 uses the same structure to automatically send a copy of each incoming message to the recipient's backup 🦋. That happens if the sender is a customer contact or a co-worker, or if the message's subject includes the word "urgent" 🚨.
require ["envelope", "extlists", "enotify"];
if anyof (
envelope :list "from" [":addrbook:customers",
":addrbook:co-workers"],
header :contains "subject" "urgent"
) {
if notify_method_capability "xmpp:me@example.com" "show" "xa"
{
redirect "susan@example.com"; # send a copy to my backup
keep; # also keep a copy for myself
}
}
}4. Security Considerations 🔐
Okay, security time, and I need you to take this part seriously 😭. For security discussions that aren't covered here, check the Security Considerations sections of these specs:
- Sieve base specification [RFC5228]
- Sieve Vacation extension [RFC5230]
- Vacation "Seconds" parameter [RFC6131]
- Sieve Externally Stored Lists extension [RFC6134]
- Sieve Notify extension [RFC5435] (and any applicable notification methods)
This document is about setting up a system that creates automatic replies in a smart way ✨. Even with all that "intelligence", mistakes in scripts can make way too many auto-reply messages go out. That's especially true when the reply interval is tiny, whether you're using the "notify" action or the "vacation" action with a small value for ":seconds" 💀.
The intelligence doesn't save you from everything, either. Mistakes in scripts can also let private info reach senders when it shouldn't. In example 3 in Section 3, for instance, if the :list test checks the wrong list, or none at all, info about the recipient's business trip might end up with someone who has no need to know it. That info should never have been sent 😱.
Even when the scripts are perfect, a sender who figures out that auto-replies depend on the recipient's presence can use that to probe the presence info 🕵️. One result is that the sender can spot changes in the recipient's presence that they wouldn't normally be allowed to see, which makes this an unintentional back door into the user's presence information. Another result is that it can create a "covert channel", letting the recipient send info to a sender by changing their presence info, their address book, and/or their Sieve script. (Though to be fair, the exposure here is comparable to any other case of shared presence info.)
An auto responder can leak other kinds of information too, and it could even open the door to attacks on cryptographic keying material 🔑. For example, by measuring how long a cryptographic operation takes, an attacker may learn something about the secret key. An auto responder that doesn't take timing into account could accidentally leak this kind of information.
It gets worse. If an auto responder script directly returns the results of a cryptographic operation, that could also be an attack vector 🚩. For example, if a script returns the results of a decryption operation, an attacker can send an arbitrarily encrypted message and use the results as a chosen cyphertext attack to decode the encryption key. Authors of scripts should be careful about what information they return to senders 🫢.
5. Normative References 📚
[RFC5228] Guenther, P. and T. Showalter, "Sieve: An Email Filtering
Language", RFC 5228, January 2008.
[RFC5229] Homme, K., "Sieve Email Filtering: Variables Extension",
RFC 5229, January 2008.
[RFC5230] Showalter, T. and N. Freed, "Sieve Email Filtering:
Vacation Extension", RFC 5230, January 2008.
[RFC5435] Melnikov, A., Leiba, B., Segmuller, W., and T. Martin,
"Sieve Email Filtering: Extension for Notifications",
RFC 5435, January 2009.
[RFC6131] George, R. and B. Leiba, "Sieve Vacation Extension:
"Seconds" Parameter", RFC 6131, July 2011.
[RFC6132] George, R. and B. Leiba, "Sieve Notification Using
Presence Information", RFC 6132, July 2011.
[RFC6134] Melnikov, A. and B. Leiba, "Sieve Extension: Externally
Stored Lists", RFC 6134, July 2011.Authors' Addresses 🌸
Robins George
Huawei Technologies
Bangalore, Karnataka 560071
India
Phone: +91-080-41117676
EMail: robinsgv@gmail.com
Barry Leiba
Huawei Technologies
Phone: +1 646 827 0648
EMail: barryleiba@computer.org
URI: http://internetmessagingtechnology.org/
Alexey Melnikov
Isode Limited
5 Castle Business Village, 36 Station Road
Hampton, Middlesex TW12 2BX
UK
EMail: Alexey.Melnikov@isode.com
URI: http://www.melnikov.ca/📦 where this page comes from
- ietf: rfc6133 2011-07
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms