Help with Sieve rules

[emailer84]

I'd like to setup the following rules in Fastmail for a specific domain I own:

For emails received at *@mydomain.com, if one of the other recipients (to, cc, bcc) of the email is *@otherdomain.com:
- bounce/discard email

----
For emails received at *@mydomain.com, if the sender of the email is *@otherdomain.com:
- bounce/discard email

----
If the whole email is in Chinese or Cyrillic (including postmaster emails from providers such as Gmail that contain an explanation in English, but the bounced email is in Chinese):
- bounce/discard email or place in Spam folder if discarding not possible.
----

Can someone possibly help with creating these rules?

Thanks

[janusz]

Read this for dealing with messages with Chinese/Cyrillic characters

[n5bb]

You won't be able to tell which BCC addresses the sender used, since these are hidden from all recipients. But you can discard all messages containing the domain "otherdomain.com" in From, To, Cc, etc. as follows:

• Go to Advanced>Rules>Discard tab
• Create a Discard rule with Any Header > Contains > @otherdomain.com

You should be aware that discard rules are dangerous, since there is no way for you to see if they are discarding incorrect messages. So you might instead want to create a File into folders rule into the Junk Mail (shown as Spam) folder. If you use the Flag feature you can tell which message were filed in the Spam folder using that rule.

I suggest that you look carefully at several of the messages which are in Chinese or Cyrillic. While reading a message, use More>Show Raw Message and look at the contents of these headers (which are near the top).:

• X-Spam-source: Country, FromHeader, and MailFrom tags
• X-Spam-charsets

Once you know what exact characteristics you want to catch we can assist you in blocking those messages. There are three ways that people use for blocking messages they don't want:

• Discard: This method is dangerous, since you might discard messages you want to read and there is no way to see the messages improperly discarded.
• Automated reply message to the apparent sender): This works fine if used after a spam filter is applied so that the sender gets a vacation or change of email address message. But it is a very poor choice to use when spam makes it through the normal spam filters, since the recipients of the automatic reply may be innocent persons. Spammers often use fake From email addresses, and if your reply made it back to the spammer they would just bother you more, not less.
• File messages to the spam (Junk Mail) folder: This is a good general solution. You can check the spam folder to see if any messages are improperly filtered, and set the folder properties to discard after one month so that messages don't endlessly pile up in the spam folder.

Bill

[BritTim]

Originally Posted by n5bb

You won't be able to tell which BCC addresses the sender used, since these are hidden from all recipients. But you can discard all messages containing the domain "otherdomain.com" in From, To, Cc, etc. as follows:

• Go to Advanced>Rules>Discard tab
• Create a Discard rule with Any Header > Contains > @otherdomain.com

You should be aware that discard rules are dangerous, since there is no way for you to see if they are discarding incorrect messages. So you might instead want to create a File into folders rule into the Junk Mail (shown as Spam) folder. If you use the Flag feature you can tell which message were filed in the Spam folder using that rule.

I suggest that you look carefully at several of the messages which are in Chinese or Cyrillic. While reading a message, use More>Show Raw Message and look at the contents of these headers (which are near the top).:

• X-Spam-source: Country, FromHeader, and MailFrom tags
• X-Spam-charsets

Once you know what exact characteristics you want to catch we can assist you in blocking those messages. There are three ways that people use for blocking messages they don't want:

• Discard: This method is dangerous, since you might discard messages you want to read and there is no way to see the messages improperly discarded.
• Automated reply message to the apparent sender): This works fine if used after a spam filter is applied so that the sender gets a vacation or change of email address message. But it is a very poor choice to use when spam makes it through the normal spam filters, since the recipients of the automatic reply may be innocent persons. Spammers often use fake From email addresses, and if your reply made it back to the spammer they would just bother you more, not less.
• File messages to the spam (Junk Mail) folder: This is a good general solution. You can check the spam folder to see if any messages are improperly filtered, and set the folder properties to discard after one month so that messages don't endlessly pile up in the spam folder.

Bill

Bill, can you please just clarify one point that I have long been unsure of. If you simply file a message into the Junk Mail folder, does this automatically trigger spam learning for the message? Since I have been unsure of this, I have used a separate folder for manual spam (whether from an external mail client or sieve rules) that is set for Spam learning. (I do know that setting Spam learning for the main Junk Mail folder is a bad idea.)

[n5bb]

Originally Posted by BritTim

Bill, can you please just clarify one point that I have long been unsure of. If you simply file a message into the Junk Mail folder, does this automatically trigger spam learning for the message? Since I have been unsure of this, I have used a separate folder for manual spam (whether from an external mail client or sieve rules) that is set for Spam learning. (I do know that setting Spam learning for the main Junk Mail folder is a bad idea.)

A process runs once a day on each account which learns as spam or non-spam messages in folders which are set up to learn in those manners. Fastmail is worried about people not checking their Spam folder, which would cause false positives (good messages incorrectly thought to be spam by the automatic spam filter) to be learned as spam. The opposite could also happen - if the Inbox folder (or folders which receive new messages automatically due to filing rules) is set up to learn messages as non-spam, spam left in that folder might cause additional similar spam to be also deposited in Inbox. This all depends on how often you check those folders and how quickly you correct any mistakes.

I believe that the Report Spam and Not Spam buttons appropriately learn immediately. Based on the current help, I also believe that messages permanently deleted from the Spam (Junk Mail) folder are learned as spam, and messages which are manually archived are learned as non-spam. I'm not sure if messages which are automatically purged due to folder settings are automatically learned.

Bill

[BritTim]

Originally Posted by n5bb

A process runs once a day on each account which learns as spam or non-spam messages in folders which are set up to learn in those manners. Fastmail is worried about people not checking their Spam folder, which would cause false positives (good messages incorrectly thought to be spam by the automatic spam filter) to be learned as spam. The opposite could also happen - if the Inbox folder (or folders which receive new messages automatically due to filing rules) is set up to learn messages as non-spam, spam left in that folder might cause additional similar spam to be also deposited in Inbox. This all depends on how often you check those folders and how quickly you correct any mistakes.

I believe that the Report Spam and Not Spam buttons appropriately learn immediately. Based on the current help, I also believe that messages permanently deleted from the Spam (Junk Mail) folder are learned as spam, and messages which are manually archived are learned as non-spam. I'm not sure if messages which are automatically purged due to folder settings are automatically learned.

Bill

Thanks Bill. That mostly tallies with what I already believed. However,

... I also believe that messages permanently deleted from the Spam (Junk Mail) folder are learned as spam ...

This worries me. If a message has already been correctly identified as spam, I would not want the Bayesian probabilities to change by counting the message again. This could prejudice the percentages for both spammy and non spammy words. I would only want the probabilities to change if the message had originally been misclassified. Is my thinking on this flawed?

[janusz]

Originally Posted by n5bb

you might instead want to create a File into folders rule into the Junk Mail (shown as Spam) folder.

I suggest you create a dedicated folder, say "sieve test", for that purpose. Otherwise it's (next to) impossible to be sure whether any message was junked by your filter(s) under test, or by any other rule (e.g FM's default ones).

[emailer84]

Thanks for the replies, especially Bill's.

I'll try to direct suspected spam to a folder rather than discard.

Can anyone indicate what rules to setup for Chinese/Cyrillic charsets? Is it AnyHeader -> Contains "(specific charset)"? What are the Chinese/Cyrillic charsets I need to target?

Also, I'd like to direct emails from other domains, but ONLY if they are sent to one of my domains (I don't want the rule to be applied to all my domains), can I do conditional rules that allow this, such as:

If email is from @somedomain, and this SPECIFIC domain of mine is in the To/CC/BCC -> File in folder

Thanks,

[janusz]

Originally Posted by emailer84

TCan anyone indicate what rules to setup for Chinese/Cyrillic charsets? Is it AnyHeader -> Contains "(specific charset)"? What are the Chinese/Cyrillic charsets I need to target?

You'll find out when you examine the relevant message headers.
It's quite possible that the character set will be utf-8, which is NBG for filtering on.

[n5bb]

Originally Posted by janusz

I suggest you create a dedicated folder, say "sieve test", for that purpose. Otherwise it's (next to) impossible to be sure whether any message was junked by your filter(s) under test, or by any other rule (e.g FM's default ones).

That's why I suggested selecting Flag in the filing rule. This makes it very easy to see which messages were filed based on this rule.

Bill

[n5bb]

Originally Posted by emailer84

Can anyone indicate what rules to setup for Chinese/Cyrillic charsets? Is it AnyHeader -> Contains "(specific charset)"? What are the Chinese/Cyrillic charsets I need to target?

As a couple of us suggested:

I suggest that you look carefully at several of the messages which are in Chinese or Cyrillic. While reading a message, use More>Show Raw Message and look at the contents of these headers (which are near the top).
X-Spam-source: Country, FromHeader, and MailFrom tags
X-Spam-charsets

Now for your other request:

Originally Posted by emailer84

Also, I'd like to direct emails from other domains, but ONLY if they are sent to one of my domains (I don't want the rule to be applied to all my domains), can I do conditional rules that allow this, such as:
If email is from @somedomain, and this SPECIFIC domain of mine is in the To/CC/BCC -> File in folder

You need to create a filing rule of type (message with) Advanced using the text:

allof (header :contains "from" "@somedomain",header :contains ["to","cc","resent-to","x-delivered-to"] "@mydomain.com")

Bill

[emailer84]

Thanks.

I'll see how this goes and post again if I require help tweaking some rules.

[emailer84]

OK, I've managed to cut down on a lot of the spam, but the one that eludes me is mail bounced from Gmail's mailer daemon that's in Chinese. Basically, my domain is being forged to send out Chinese spam that Google is bouncing. Unfortunately, as the email is coming from Google, the header is not from the original Chinese sender so there's not much I can do to target the email in a rule. The spammer is sending in UTF-8 anyway...
Is there no rule that would say something like: if email is from Google mailer daemon, and if text above "----- Message truncated -----" is in Chinese, mark as spam. ("----- Message truncated -----" is something Google includes in the body of their bounced emails.)

Any other ideas?

Thanks,

[n5bb]

Can you post the full headers from one of those Gmail mailer daemon messages in this thread?

• Use the CODE button (hashtag) in the EMD compose panel (if you have the advanced version active), which places a tag with CODE in square brackets before your text and /CODE in square brackets after your text. You can also do this manually by placing [ CODE ] and [ /CODE ] (without the spaces) around your text.
• Be sure to go through what you post and munge (change) your email address so it's just an anonymous spam message. This forum is spidered by Google, and we don't want someone finding your email address or other private information here.

Bill

[emailer84]

Thanks,

I'm trying a rule where emails from google are put in a folder, at least it keeps them out of my inbox and I can quickly see if they are spam or not.

I'll get back to you if I need further help.

Thanks again.