This is what I use with Exim, spam.sieve is included in from a master.sieve:
thebighonker.lerctr.org /home/ler $ more sieve/spam.sieve require ["fileinto","imap4flags"]; if header :contains ["X-LERCTR-Spam-Flag","X-TNTSCAN-Spam-Flag"] "YES" { redirect "spamtrap@spambouncer.org"; fileinto :flags "\\Seen Junk" "SPAM"; stop; }
thebighonker.lerctr.org /home/ler $ grep -B10 -A10 -- -Spam-Flag /usr/local/etc/exim/configure spam = smmsp:true warn message = X-LERCTR-Spam-Score: $spam_score ($spam_bar) ! authenticated = * spam = smmsp:true warn message = X-Spam-Report: $spam_report ! authenticated = * spam = smmsp:true warn message = X-LERCTR-Spam-Report: $spam_report ! authenticated = * spam = smmsp:true # Add X-Spam-Flag if spam is over system-wide threshold warn message = X-Spam-Flag: YES ! authenticated = * spam = smmsp:true condition = ${if >={$spam_score_int}{50}{1}{0}} warn message = X-LERCTR-Spam-Flag: YES ! authenticated = * spam = smmsp:true condition = ${if >={$spam_score_int}{50}{1}{0}}
#warn message = DomainKey-Status: $dkim_status # !condition = ${if eq{$dkim_status}{}{1}{0}} # Reject spam messages with score over 7, using an extra condition. deny message = This message scored $spam_score points. Congratulations! ! authenticated = * spam = smmsp:true thebighonker.lerctr.org /home/ler $
On 12/14/17, 1:04 PM, "dovecot on behalf of Gao"
Well I changed the line to
if header :contains "X-Spam-Status: YES" {
Then I got:
# sievec spam_to_junk.sieve
spam_to_junk: line 3: error: the header test requires 2 positional
argument(s), but 1 is/are specified.
spam_to_junk: error: validation failed.
sievec(root): Fatal: failed to compile sieve script 'spam_to_junk.sieve'
Should it be:
if header :contains "X-Spam-Status" "X-Spam-Status: YES" {
???
I need to learn some sieve grammar.
Gao
On 2017-12-14 10:02 AM, Richard wrote:
>
>> Date: Thursday, December 14, 2017 09:47:44 -0800
>> From: Gao <gao@pztop.com>
>>
>> I use a sieve filter to move spam email to user's Junk folder:
>> # cat spam_to_junk.sieve
>> require "fileinto";
>> if exists "X-Spam-Status" {
>> if header :contains "X-Spam-Status" "YES" {
>> fileinto "Junk";
>> stop;
>> } else {
>> }
>> }
>> if header :contains "subject" ["SPAM?"] {
>> fileinto "Junk";
>> stop;
>> }
>>
>> Most time this filter works fine but occasionally it move non-spam
>> in to Junk folder. Here is an example, this email is from dovecot
>> mailling list and it end up in my Junk folder. Mailllog and header
>> here. Would someone help me to figure out what went wrong here?
>>
>> Thanks.
>>
>> Gao
>>
> > X-Spam-Status: No, score=-2.9 required=5.0
> tests=ALL_TRUSTED,BAYES_00
>
>
> Because of the way you are bounding it, I suspect that the "YES" in
> BAYES_00, at the end of that line, is triggering the mis-filing.
>
> Why not make:
>
> contains "X-Spam-Status" "YES"
>
> a single string:
>
> contains "X-Spam-Status: YES"
>
> that would be more precise and avoid this issue.
>
>