Using Sieve for spam in Kerio Mailserver

Both Kerio Webmail or Kerio Outlook Connector allow you to write your own message processing rules. These let you do such things as automatically put messages into specified folders, reject messages outright and so on. You create these rules with a rules wizard that lets you check off the desired conditions and actions. That looks like this:

Once you have created a rule with the rule designer, a new option appears: "Edit Script"

If you use that, you are actually editing a Sieve script. Sieve is a mail filtering language and editing the scripts directly allows you to do things that the wizard rule creator will not.

For example, let's say your users get spam mail that pretends to be from "support@yourcompany.com". You need to send them legitimate mail using that address, and you are concerned that they may be confused and unable to know whether the mail really was from you. Here's a rule that might help:

if allof (
  address :all :contains "From" "support@yourcompany.com",
  not header :contains "Received" "10.6.32.30")
{
  fileinto "Junk E-mail";
  stop;
}
 

This says if the mail says it comes from "support@yourcompany.com", but doesn't have a received header that matches your IP address, it's junk. You can't create that rule with the wizard because the wizard doesn't know about "header" matches. You probably need a more complex rule, but this is the basic idea.

Note this special note from Kerio's manual:

Rules tested against From and To headers have a peculiarity which might be beneficial. If these rules go before the others, they will be tested on level of SMTP traffic. In case of denial rules, messages matching such a rule are blocked even before accepted to the queue of incoming messages. This decreases the load on the server. It helps the server avoid taking several actions and using of several tools such as antispam tests and antivirus control which is applied once a message is accepted to the queue of incoming messages. In case of permission rules, no other rules are applied if they are tested on level of SMTP traffic.

Search Google for "sieve script examples" to find other folks scripts.

Comments?

More Articles by Anthony Lawrence - Find me on Google+

Have you tried Searching this site?

Unix/Linux/Mac OS X support by phone, email or on-site: Support Rates

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more. We appreciate comments and article submissions.

Publishing your articles here