Usage of Sieve


Sieve is used to filter messages directly on the imap server. In this way, it can replace local mail filter rules in the user’s email agent. This is very useful, if more then one email agent is used – e.g. if the same server is used from different computers or operatint systems. In my case, the company notebook is Windows driven (using Thunderbird) and my workstation is running on linux using Evolution as a mail client. My mails are filtered by Sieve so I do not need to edit filter rules for each client.


The installation on Debian based systems is included in the Cyrus21 setup files. For an imap installation the following files are needed

  • cyrus21-admin
  • cyrus21-imapd
  • cyrus21-common
  • cyrus21-clients


The file /etc/service must contain the needed sieve setup

sieve   2000/tcp  # Sieve mail filter daemon

The file /etc/cyrus.conf looks like

 # --- Normal cyrus spool, or Murder backends ---
 # add or remove based on preferences
 imap            cmd="imapd -U 30" listen="moonworld.muehlencord.intra:imap" prefork=0 maxchild=100
 imaplocal       cmd="imapd -C /etc/imapd.conf.local" listen="localhost:imap" preforf=0 maxchild=100
 # At least one form of LMTP is required for delivery
 # (you must keep the Unix socket name in sync with imap.conf)
 #lmtp           cmd="lmtpd" listen="localhost:lmtp" prefork=0 maxchild=20
lmtpunix        cmd="lmtpd" listen="/var/run/cyrus/socket/lmtp" prefork=0 maxchild=20
 # ----------------------------------------------
 # useful if you need to give users remote access to sieve
 # by default, we limit this to localhost in Debian
 sieve           cmd="timsieved" listen="moonworld.muehlencord.intra:sieve" prefork=0 maxchild=100
 sievelocal      cmd="timsieved -C /etc/imapd.conf.local" listen="localhost:sieve" preforf=0 maxchild=100
 # this one is needed for the notification services
 notify          cmd="notifyd" listen="/var/run/cyrus/socket/notify" proto="udp" prefork=1
 # ----------------------------------------------

Activate the server including the Sieve support using the following command

/etc/init.d/cyrus21 restart

Creating user’s rules

The user rules are typed into an ascii file using your favorite editor. You can select what ever you want as the file name – e.g. rules.txt. There are different action, which can be perfomed on each single mail. Some of them require an external subroutine being called first. They are marke with a (*) in the table below.

  • keep – keeps the message – it will be moved into the INBOX
  • fileinto(*) – moves the message into a given subfolder. Example: fileInto “INBOX.Spam”
  • discard – deletes the incomming email
  • vacation (*) – sends an out of office reply
  • redirect(*) – forwards the email to another email address
  • reject – sends the email back to the sender. Example reject “Message to sender”

The subroutines are called by the require statement at the beginning of the file. Supported are the following statements

  • require “fileinto”;
  • require [“fileinto”, “vacation”]


The main part is the if-then-else block, each filterfile contains

if { }
 elsif { }
 else { }

Each single mail is processed by using the rule file. If the check constraint is true, the action is performed on the email. The last action should be the “keep” action – to tell sieve not to touch the email in any case.

Check constraints

The table below is just a selection of the possible fields.

 address - from, to, cc, bcc - check emails address fields
 header - e.g. subject, date - any header field inside the email
 size - size of the email

Two or more checks can be combined using the allof of anyof aggregator functions. The syntax is

if anyof (


:is - exact match
 :contains - partial match
 :matches - enables wildcards (*,?) and regular expressions
 :under or :above - compare to a value

You can use K,M or G as a short cut for kilobyte, megabyte or gigabyte for the above or under operators.

Deploying user’s rules

Each user can deploy is own rules on the server. The use writes a rule file, and uses the programm “sieveshell” to deploy it to the Sieve server.

% myhost: $ sieveshell localhost
 Connecting to localhost
 Please enter your password

After the user has connected he can use

put myfile.txt
 activate myfile.txt

to load a new file, activate a file and double check which file are loaded and which one is activated.


moving mails from a mailinglist

 ## mailinglist
 if header :contains "X-BeenThere" "" {
 fileinto "INBOX.Linux.Lug-OWL";

reject large messages

if size :over 1M {
 reject "Please do not send me large attachments.";