S. Bosch
March 19, 2016
Sieve Email Filtering: Sending Abuse Feedback Reports
spec-bosch-sieve-report
Abstract
This document defines a new vendor-defined action command "report"
for the "Sieve" email filtering language. It provides the means to
send Messaging Abuse Reporting Format (MARF) reports (RFC 5965).
This format is intended for communications regarding email abuse and
related issues. The "report" command allows (partially) automating
the exchange of these reports, which is particularly useful when the
Sieve script is executed for an IMAP event (RFC 6785) that is
triggered by direct user action.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 1
2. Conventions Used in This Document . . . . . . . . . . . . . . 2
3. Action "report" . . . . . . . . . . . . . . . . . . . . . . . 2
4. Sieve Capability Strings . . . . . . . . . . . . . . . . . . 3
5. Example . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
6. Security Considerations . . . . . . . . . . . . . . . . . . . 6
7. References . . . . . . . . . . . . . . . . . . . . . . . . . 6
7.1. Normative References . . . . . . . . . . . . . . . . . . 6
7.2. Informative References . . . . . . . . . . . . . . . . . 6
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 7
1. Introduction
This is an extension to the Sieve filtering language defined by RFC
5228 [SIEVE]. It provides the means to send Messaging Abuse
Reporting Format (MARF) [MARF] report messages. This format is
intended to exchange reports on abuse and related issues.
This extension adds the "report" action command, which sends a MARF
report to the indicated recipient address. The author of the Sieve
script must also specify a human-readable messsage and the type of
the report. The recipient is usually an automated system that will
take the appropriate action based on the report.
Normally, Sieve scripts are executed at message delivery. In that
case, the "report" action would be of little use, since sending such
reports or performing the resulting actions is already part of the
Bosch Expires September 20, 2016 [Page 1]
Sieve: Sending Abuse Reports March 2016
abuse detection software that commonly runs before the message is
even delivered.
Instead, the "report" action is mainly useful when used in Sieve
scripts that are run as triggered by an IMAP event [IMAPSIEVE].
Then, the Sieve script is executed as a direct result of user action
in most cases. Certain user actions, such as moving or copying a
message into a particular mailbox, can then be defined to have a
special meaning. For example, placing a message into the "Spam
Report" mailbox could mean that the user reports the message as
unsolicited bulk mail. Conversely, placing a message in a mailbox
called "Ham Report" could mean that the user reports that the message
is erroneously classified as unsolicited bulk mail. Using the
"report" action, the Sieve script that is run as a result of these
actions can convey the report in the standard MARF format to the
entity responsible for handling such reports. This avoids the need
for the user's MUA software to support the MARF report format and the
need to configure where the reports are to be sent.
The "report" action is mainly intended to be used in Sieve scripts
that are controlled by the system administrator. Also, this
extension is specific to the Pigeonhole Sieve implementation for the
Dovecot Secure IMAP server. It will therefore most likely not be
supported by web interfaces and GUI-based Sieve editors.
2. Conventions Used in This Document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [KEYWORDS].
Conventions for notations are as in [SIEVE] Section 1.1, including
use of the "Usage:" label for the definition of action and tagged
arguments syntax.
3. Action "report"
Usage: report [":headers_only"] <feedback-type: string>
<message: string> <recipient: string>
The "report" action is used to send a Messaging Abuse Reporting
Format (MARF) [MARF] report to the supplied recipient address. The
"report" action composes the MARF report (the "report message") based
on the provided arguments and the "triggering message" that Sieve is
currently evaluating. The envelope sender address on the report
message is chosen by the sieve implementation.
Bosch Expires September 20, 2016 [Page 2]
Sieve: Sending Abuse Reports March 2016
The "feedback-type" argument is used as the value for the "Feedback-
Type" field in the machine-readable "message/feedback-report" MIME
part of the MARF report message. The "feedback-type" string value
must conform to the MIME "token" syntax [RFC2045].
The "message" argument is a UTF-8 [UTF-8] string specifying a human-
readable text explaining the nature of the report. It is directly
used as the body of the first MIME part of the MARF report with
content type "text/plain".
By default, the MARF report includes the triggering message in its
entirety as its third MIME part. When the ":headers_only" tag is
specified, it contains only a copy of the entire header block from
the triggering message. In that case the MIME type of the third part
is "text/rfc822-headers", rather than "message/rfc822" [MARF].
Since the "report" action is not normally used at message delivery,
the report message is not sent as a result of a newly delivered
message. In such cases, mail loops are very unlikely to occur.
However, for the uncommon case that the "report" action is used at
message delivery, implementations MUST always endeavor to avoid mail
loops. To that end, implementations MUST always include an "Auto-
Submitted:" field [RFC3834] in the report message. Furthermore,
implementations MUST NOT allow sending report messages to the mail
account running this Sieve script.
The "report" action is compatible with all other actions, and does
not affect the operation of other actions. In particular, the
"report" action MUST NOT cancel the implicit keep. Substitution of
variables [VARIABLES] is supported for all arguments.
Multiple executed "report" actions are allowed. However, only one
report message is sent for each unique combination of feedback type
and report recipient. Subsequent duplicate report actions are
ignored without error and only the human-readable message from the
first instance of the duplicate action is used in the report.
4. Sieve Capability Strings
A Sieve implementation that defines the "report" action command will
advertise the capability string "vnd.dovecot.report".
5. Example
In this example, Victor receives some unsolicited bulk email at his
account "victim@example.org" and his mail filter failed to recognize
it as such. The message is delivered to his INBOX and looks as
follows:
Bosch Expires September 20, 2016 [Page 3]
Sieve: Sending Abuse Reports March 2016
Return-Path: <spammer@example.com>
Received: from mail.example.com by mail.example.org
for <victim@example.org>; Wed, 17 Thu 2016 03:01:02 +0100
Message-ID: <1234567.89ABCDEF@example.com>
Date: Thu, 17 Mar 2016 2:59:19 +0100
From: "Steve Pammer" <spammer@example.com>
To: "Victor Timson" <victim@example.org>
Subject: Male enhancement products
X-Spam-Score: 3.3/5.0
X-Spam-Status: not spam
We have very interesting offers!
The administrator of Victor's email account has created a "Spam
Report" mailbox and has asked Victor to move any misclassified e-mail
into that mailbox. The following administrator-controlled Sieve
script is linked to that mailbox:
require ["imapsieve", "environment", "vnd.dovecot.report"];
if allof(
environment "imap.mailbox" "Spam Report",
environment "imap.cause" "COPY",
header "x-spam-status" "not spam") {
report "abuse" "This spam message slipped through."
"spam-report@example.org";
}
As instructed, Victor moves the message into the "Spam Report"
mailbox and the following message is sent to "spam-
report@example.org":
Bosch Expires September 20, 2016 [Page 4]
Sieve: Sending Abuse Reports March 2016
Message-ID: <1458401523-377250-0@example.org>
Date: Sat, 19 Mar 2016 16:32:03 +0100
From: Postmaster <postmaster@example.org>
To: <spam-report@example.org>
Subject: Report: Male enhancement products
Auto-Submitted: auto-generated (report)
MIME-Version: 1.0
Content-Type: multipart/report; report-type=feedback-report;
boundary="324/example.org"
This is a MIME-encapsulated message
--324/example.org
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
This spam message slipped through.
--324/example.org
Content-Type: message/feedback-report
Version: 1
Feedback-Type: abuse
User-Agent: Exemplimail/1.3.15.rc1
Original-Mail-From: <spammer@example.com>
--324/example.org
Content-Type: message/rfc822
Content-Disposition: attachment
Return-Path: <spammer@example.com>
Received: from mail.example.com by mail.example.org
for <victim@example.org>; Wed, 17 Thu 2016 03:01:02 +0100
Message-ID: <1234567.89ABCDEF@example.com>
Date: Thu, 17 Mar 2016 2:59:19 +0100
From: "Steve Pammer" <spammer@example.com>
To: "Victor Timson" <victim@example.org>
Subject: Male enhancement products
X-Spam-Score: 3.3/5.0
X-Spam-Status: not spam
We have very interesting offers!
--324/example.org--
Bosch Expires September 20, 2016 [Page 5]
Sieve: Sending Abuse Reports March 2016
6. Security Considerations
When used in IMAP context, the "report" command is executed for each
action and message that matches the criteria defined by the Sieve
script. If the user performs matching activities with a large volume
of messages, a great many reports can be sent at one time.
Implementations and deployments MUST be designed to cope with such
incidents, either by limiting the number of reports or by otherwise
mitigating their collective impact.
7. References
7.1. Normative References
[KEYWORDS]
Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[MARF] Shafranovich, Y., Levine, J., and M. Kucherawy, "An
Extensible Format for Email Feedback Reports", RFC 5965,
DOI 10.17487/RFC5965, August 2010,
<http://www.rfc-editor.org/info/rfc5965>.
[RFC2045] Freed, N. and N. Borenstein, "Multipurpose Internet Mail
Extensions (MIME) Part One: Format of Internet Message
Bodies", RFC 2045, DOI 10.17487/RFC2045, November 1996,
<http://www.rfc-editor.org/info/rfc2045>.
[RFC3834] Moore, K., "Recommendations for Automatic Responses to
Electronic Mail", RFC 3834, DOI 10.17487/RFC3834, August
2004, <http://www.rfc-editor.org/info/rfc3834>.
[SIEVE] Guenther, P. and T. Showalter, "Sieve: An Email Filtering
Language", RFC 5228, January 2008.
[UTF-8] Yergeau, F., "UTF-8, a transformation format of ISO
10646", STD 63, RFC 3629, November 2003.
[VARIABLES]
Homme, K., "Sieve Email Filtering: Variables Extension",
RFC 5229, January 2008.
7.2. Informative References
[IMAPSIEVE]
Leiba, B., "Support for Internet Message Access Protocol
(IMAP) Events in Sieve", RFC 6785, DOI 10.17487/RFC6785,
November 2012, <http://www.rfc-editor.org/info/rfc6785>.
Bosch Expires September 20, 2016 [Page 6]
Sieve: Sending Abuse Reports March 2016
Author's Address
Stephan Bosch
Enschede
NL
Email: stephan@rename-it.nl
Bosch Expires September 20, 2016 [Page 7]
