This is what I use with Exim, spam.sieve is included in from a master.sieve:
thebighonker.lerctr.org /home/ler $ more sieve/spam.sieve require ["fileinto","imap4flags"]; if header :contains ["X-LERCTR-Spam-Flag","X-TNTSCAN-Spam-Flag"] "YES" { redirect "spamt...@spambouncer.org"; fileinto :flags "\\Seen Junk" "SPAM"; stop; } thebighonker.lerctr.org /home/ler $ grep -B10 -A10 -- -Spam-Flag /usr/local/etc/exim/configure spam = smmsp:true warn message = X-LERCTR-Spam-Score: $spam_score ($spam_bar) ! authenticated = * spam = smmsp:true warn message = X-Spam-Report: $spam_report ! authenticated = * spam = smmsp:true warn message = X-LERCTR-Spam-Report: $spam_report ! authenticated = * spam = smmsp:true # Add X-Spam-Flag if spam is over system-wide threshold warn message = X-Spam-Flag: YES ! authenticated = * spam = smmsp:true condition = ${if >={$spam_score_int}{50}{1}{0}} warn message = X-LERCTR-Spam-Flag: YES ! authenticated = * spam = smmsp:true condition = ${if >={$spam_score_int}{50}{1}{0}} #warn message = DomainKey-Status: $dkim_status # !condition = ${if eq{$dkim_status}{}{1}{0}} # Reject spam messages with score over 7, using an extra condition. deny message = This message scored $spam_score points. Congratulations! ! authenticated = * spam = smmsp:true thebighonker.lerctr.org /home/ler $ On 12/14/17, 1:04 PM, "dovecot on behalf of Gao" <dovecot-boun...@dovecot.org on behalf of g...@pztop.com> wrote: Well I changed the line to if header :contains "X-Spam-Status: YES" { Then I got: # sievec spam_to_junk.sieve spam_to_junk: line 3: error: the header test requires 2 positional argument(s), but 1 is/are specified. spam_to_junk: error: validation failed. sievec(root): Fatal: failed to compile sieve script 'spam_to_junk.sieve' Should it be: if header :contains "X-Spam-Status" "X-Spam-Status: YES" { ??? I need to learn some sieve grammar. Gao On 2017-12-14 10:02 AM, Richard wrote: > >> Date: Thursday, December 14, 2017 09:47:44 -0800 >> From: Gao <g...@pztop.com> >> >> I use a sieve filter to move spam email to user's Junk folder: >> # cat spam_to_junk.sieve >> require "fileinto"; >> if exists "X-Spam-Status" { >> if header :contains "X-Spam-Status" "YES" { >> fileinto "Junk"; >> stop; >> } else { >> } >> } >> if header :contains "subject" ["SPAM?"] { >> fileinto "Junk"; >> stop; >> } >> >> Most time this filter works fine but occasionally it move non-spam >> in to Junk folder. Here is an example, this email is from dovecot >> mailling list and it end up in my Junk folder. Mailllog and header >> here. Would someone help me to figure out what went wrong here? >> >> Thanks. >> >> Gao >> > > X-Spam-Status: No, score=-2.9 required=5.0 > tests=ALL_TRUSTED,BAYES_00 > > > Because of the way you are bounding it, I suspect that the "YES" in > BAYES_00, at the end of that line, is triggering the mis-filing. > > Why not make: > > contains "X-Spam-Status" "YES" > > a single string: > > contains "X-Spam-Status: YES" > > that would be more precise and avoid this issue. > >