Automate Mailbox Management with Dovecot Sieve: From Setup to Real‑World Scripts

Problem: Manual Folder Management is a Pain

Most users rely on client‑side rules to move newsletters into a dedicated folder or reply automatically when away. This approach has two major drawbacks:

• Rules must be configured on every client, and clients may not support advanced filtering.
• When a user switches devices or loses a client, the rules vanish, leaving mail scattered.

For a mail administrator, the solution is to push the logic to the server so that all incoming mail is processed consistently, regardless of the client.

Thesis: Dovecot’s Sieve Plugin Provides a Robust, Server‑Side Solution

Dovecot ships with the sieve plugin, a mailbox filtering language that runs on the server before the message is delivered. It supports standard actions like fileinto, redirect, and discard, and extensions such as vacation and reject for advanced scenarios. Because the rules live on the server, they apply to every client, and administrators can manage them centrally.

1. Enabling Sieve in Dovecot

1. Open the global configuration file (usually /etc/dovecot/dovecot.conf or a file in /etc/dovecot/conf.d/). Add or verify the following lines:

   plugin = sieve
   sieve = /var/lib/dovecot/sieve
   sieve_global_path = /var/lib/dovecot/sieve/global.sieve
   

   • plugin = sieve loads the module.
   • sieve points to the per‑user directory.
   • sieve_global_path allows a system‑wide default script.

2. Restart Dovecot to apply the changes:

   sudo systemctl restart dovecot
   

3. Verify the plugin is loaded:

   dovecot -n | grep sieve
   # Expected output: plugin = sieve
   

Permissions and Safety

Only root can edit dovecot.conf. The sieve directory should be owned by dovecot and readable by the service. Improper permissions can prevent the plugin from loading.

2. Writing and Deploying Sieve Scripts

Each user gets a default.sieve file in their mailbox directory (e.g., /var/mail/vhosts/example.com/alice/default.sieve). Dovecot compiles it to default.svbin automatically.

# Example: fileinto "News/"; keep;

To create a script:

1. SSH into the mail server as the mail user or as root.
2. Create or edit default.sieve:

#!/usr/bin/env sieve
require ["fileinto", "vacation", "reject"];

# Auto‑archive newsletters
if header :contains "List-Id" "newsletter" {
    fileinto "News/";
    keep;
}

# Vacation auto‑reply
if address :is "to" "*" {
    vacation "Out of office until 2026‑12‑31. I’ll reply when I return."
}

3. Set correct ownership (usually alice:mail) and permissions (644).
4. Run dovecot -n again to confirm no syntax errors appear. Dovecot will re‑compile the script automatically on the next connection.

Key points:

• require lists extensions needed; omit it for plain Sieve.
• fileinto moves the message; keep preserves a copy in the original folder.
• Vacation replies are sent once per sender per day unless vacation is configured with max-per-day or max-per-sender.

3. Managing Scripts via IMAP (X‑SIEVE)

Administrators can avoid SSH by using the IMAP X‑SIEVE extension. Many webmail interfaces expose a “Sieve” tab. Steps:

1. Log in to the user’s mailbox via an IMAP client that supports X‑SIEVE (e.g., Thunderbird, Outlook).
2. Navigate to the Sieve management section.
3. Upload or edit default.sieve directly.
4. Dovecot validates the script and compiles it on the fly.

This method is convenient for users who prefer a web interface and keeps the server configuration untouched.

4. Worked Example: Auto‑Archive Newsletters & Auto‑Reply

Assume we have a user bob@example.com who receives a flood of newsletters. We want:

• All messages with a List-Id header containing “newsletter” to go into News/.
• When Bob is away, automatically send a vacation reply.

Script (saved as bob/default.sieve):

require ["fileinto", "vacation"];

if header :contains "List-Id" "newsletter" {
    fileinto "News/";
    keep;
}

vacation "I’m away until 2026‑12‑31. I’ll get back to you then."

Deploy it by copying the file into Bob’s mailbox directory and ensuring ownership:

sudo chown bob:mail /var/mail/vhosts/example.com/bob/default.sieve
sudo chmod 644 /var/mail/vhosts/example.com/bob/default.sieve

Test:

1. Send a test email with List-Id: newsletter@example.com to bob@example.com.
2. Open an IMAP client and verify the message appears in News/.
3. Send a second test email from a different address and confirm the vacation reply is received.

5. Trade‑Offs and Limitations

• Syntax Strictness: A single typo in a Sieve script will cause the entire file to be ignored. Always validate with dovecot -n or an online Sieve validator before deploying.
• Extension Dependencies: The vacation and reject extensions require the corresponding Dovecot plugins (e.g., plugin = sieve-vacation). Missing plugins break the script.
• Performance Impact: Complex scripts with many conditions can add latency to delivery. Keep scripts lean and test performance on a staging server.
• User Control: Some administrators may want to allow users to override or disable Sieve. Dovecot can be configured to disable the plugin per user via ACLs.

6. Actionable Next Steps

1. Enable the Sieve plugin in dovecot.conf and restart Dovecot.
2. Create a global global.sieve if you want system‑wide defaults.
3. Distribute a starter script to users or use X‑SIEVE to let them create their own.
4. Monitor /var/log/dovecot.log for messages like script compiled successfully or syntax errors.
5. Periodically audit user scripts to ensure they still meet policy and performance requirements.

By centralizing filtering logic with Dovecot’s Sieve, you reduce client configuration drift, improve consistency, and free your users from repetitive manual sorting.