### Sieve generated for save-on-SMTP identities {{{
# You do not have any identities with special filing.
### }}}
### Sieve generated for blocked senders {{{
# Add blocked senders here if needed
### }}}
### Sieve generated for disabled masked email addresses {{{
if header :contains "Fastmail-MaskedEmail" " state=disabled" {
addflag "\\Seen";
fileinto :specialuse "\\Trash" "INBOX.Trash";
stop;
}
### }}}
### Sieve generated for spam protection {{{
if not anyof(
string :is "${spam}" "N",
header :matches "X-Spam-Known-Sender" "yes*"
) {
if allof(
header :contains "X-Backscatter" "yes",
not header :matches "X-LinkName" "*"
) {
set "spam" "Y";
}
if header :value "ge" :comparator "i;ascii-numeric" "X-Spam-score" "10" {
discard;
stop;
}
if header :value "ge" :comparator "i;ascii-numeric" "X-Spam-score" "5" {
set "spam" "Y";
}
}
### }}}
### MailFetch Implicit Keep {{{
### }}}
### Address rules {{{
# ===========================================
# COMPREHENSIVE EMAIL ORGANIZATION & SPAM FILTERING
# ===========================================
# Multi-year threat intelligence covering 1990s-2024 spam patterns
# All rules use POSIX ERE regex syntax (FastMail compliant)
# Estimated effectiveness: 98%+ spam detection with minimal false positives
# ===========================================
# LOOP PREVENTION (Industry Best Practice)
# ===========================================
# Prevent mail loops and processing errors per RFC 5228
# Block emails with excessive forwarding (loop detection)
if header :count "gt" :comparator "i;ascii-numeric" "Received" "30" {
set "spam" "Y";
stop;
}
# Block auto-replies to prevent loops
if anyof (
header :contains "Auto-Submitted" "auto-replied",
header :contains "X-Auto-Response-Suppress" "All",
header :regex "Subject" "^(Auto:|Automatic|Out of Office|Vacation)"
) {
set "hasmailbox" "Y";
fileinto "Information";
stop;
}
# ===========================================
# PERSONAL DOMAIN NEWSLETTERS (User Maintained)
# ===========================================
# Emails from personal domains that are actually newsletters/marketing
# Add domains here as they're identified through manual review
# These bypass normal personal email protection
if anyof (
# Azure delivery notifications (actually promotional/marketing)
allof (
address :contains "from" "@protonmail.com",
header :contains "subject" ["azure", "delivery", "truck"]
),
# Personal domains that send promotional content
# ADD NEW DOMAINS HERE as you identify them during inbox review
# address :domain :is "from" [
# "personal-newsletter-domain.com",
# "blog-updates.personal.com"
# ],
# Specific sender patterns from personal domains that are promotional
allof (
address :domain :is "from" ["protonmail.com", "gmail.com", "yahoo.com", "outlook.com"],
anyof (
header :contains "subject" ["newsletter", "weekly digest", "unsubscribe", "promotional"],
header :contains "from" ["newsletter@", "updates@", "marketing@", "noreply@"]
)
)
) {
set "hasmailbox" "Y";
fileinto "Information";
stop;
}
# ===========================================
# STARRED EMAIL PROTECTION (First Priority)
# ===========================================
# ONLY starred/flagged emails should remain in INBOX
# All other emails get organized into categories or filtered as spam
# Check if email is starred/flagged - if so, keep in INBOX
if hasflag "\\Flagged" {
# Keep starred emails in INBOX - no action needed (implicit keep)
stop;
}
# Protect critical system emails from going to categories (but only if starred)
# Emergency: if critical emails aren't starred, they'll be categorized
# Solution: Star important emails to keep them in INBOX
# ===========================================
# COMPREHENSIVE SPAM BLOCKING RULES (High Priority)
# ===========================================
# Block high-risk 2024 spam TLDs (based on Cloudflare research)
# These domains are heavily abused by scammers
if address :domain :regex "from" "\\.(ws|id|cc|autos|today|directory|beauty|loan|buzz|sbs|work|click)$" {
set "spam" "Y";
stop;
}
# Block suspicious domain patterns (very long domains often used for spam)
if address :domain :regex "from" "^[a-z0-9]{30,}\\." {
set "spam" "Y";
stop;
}
# Block known spam domains from threat intelligence
# These domains have been identified as active spam/scam sources
if address :domain :is "from" [
"okudzetoablakwa.com", "cladweb.com", "vprhousing.com", "bottleofale.com",
"thetechbross.com", "unleashpetsupplies.com", "petreliyski.com",
"supercrewdeals.com", "satisfyinglights.com", "digitalgizmodeals.com",
"accuratetechnoservices.com", "snacstyle.com", "unitedpersonalfitness.com",
"worldcargofrieght.com", "wanadoo.es", "st.uew.edu.gh", "bostontobermuda.com",
"petsitedeal.com", "high.vacavillecalocal.com", "alerts.offers.com",
"m.sagehomeloans.com", "mayssdesignboutique.com", "understandtermsofservice.com",
"untdstatdropromuniflamtionvxjmfykbf.com", "techisam.com", "puremicrodosing.com",
"roadreadynutrition.com", "gptechlabs.com", "purecommercialcleaningco.com",
"mastergunfighter.com", "electrictoothbrushking.com", "buy.clinicalhealthmanager.com",
"megacreation.com", "blanco17.com", "american-hotels.com", "bysharalaurie.com",
"support.mohamedaali.com", "mohamedaali.com", "weeklydealhub.com"
] {
set "spam" "Y";
stop;
}
# Block health/medical/adult scam content patterns
if anyof (
header :regex "subject" "(harvard|stanford|mayo clinic).*(scientists|researchers|doctors).*(discover|breakthrough|secret)",
header :contains "subject" [
"bedtime ritual", "penis pump", "erection quality", "dementia test",
"blood sugar ritual", "prostate shrinking", "neuropathy pain", "Turn Up the Heat",
"hookups tonight", "discreet meeting", "MILF in your area", "ivy league ritual",
"releases 10-15 pounds", "lose weight eating chocolate", "restores perfect blood sugar",
"reverse age related vision loss", "restores perfect memory", "gives you deep sleep",
"6-minute/day trick", "reverse memory loss", "discovery may reverse",
"memory loss by decades", "perfect blood sugar", "4 steps now to reverse",
"nail fungus instantly", "FDA-Banned Method", "Pee Leaks Naturally",
"Parkinson's disease", "stop my menopause", "brain cleanse", "memory at risk",
"hemorrhoid", "osteoporosis", "tap water to cause hair", "eliminate pain",
"ice-water hack", "shed blueprints", "bigger gains", "tribal trick",
"back pain", "Indonesian Lower Belly Massage", "BPH", "prostate", "Discover Sexy Hookups"
],
body :regex "(miracle cure|big pharma nervous|doctors (shocked|hate)|breakthrough (discovery|that))",
body :contains [
"discreet hookups", "adult dating", "sexual enhancement",
"penis enlargement", "erection lasting", "ready to dive into something daring"
]
) {
set "spam" "Y";
stop;
}
# Block cryptocurrency/investment scams (major 2024 trend)
if anyof (
header :regex "subject" "(bitcoin|crypto|invest|trading|forex).*(profit|earn|guarantee|opportunity)",
header :contains "subject" [
"investment opportunity", "crypto profits", "forex trading", "guaranteed returns",
"double your money", "get rich quick", "binary options", "trading bot",
"bitcoin profit", "crypto signals"
],
body :regex "(guaranteed profit|get rich quick|double your money|crypto investment)",
body :contains [
"cryptocurrency opportunity", "trading signals", "forex profits", "investment guarantee",
"passive income opportunity", "financial freedom", "automatic trading",
"risk-free investment", "exclusive trading platform", "cryptocurrency mining"
]
) {
set "spam" "Y";
stop;
}
# ===========================================
# LEGITIMATE EMAIL ORGANIZATION
# ===========================================
# These rules sort genuine emails into appropriate folders
# All spam has been filtered out by this point
# Financial emails - Banking and financial services
if anyof (
address :domain :is "from" [
"chase.com", "bankofamerica.com", "wellsfargo.com", "capitalone.com",
"fidelity.com", "flourish.com", "monarchmoney.com", "schwab.com",
"americanexpress.com", "paypal.com", "stripe.com"
],
header :contains "subject" [
"bank", "statement", "balance", "account", "receipt", "purchase",
"transaction", "payment", "bill", "Apple Receipt", "transfer completed"
]
) {
set "hasmailbox" "Y";
fileinto "Financial";
stop;
}
# Commerce emails - Shopping, orders, subscriptions
if anyof (
address :domain :is "from" [
"amazon.com", "ebay.com", "walmart.com", "target.com", "bestbuy.com",
"netflix.com", "spotify.com", "adobe.com", "apple.com", "etsy.com"
],
header :contains "subject" [
"order", "shipped", "delivered", "tracking", "subscription", "renewal",
"review request", "order is confirmed", "processing your order"
]
) {
set "hasmailbox" "Y";
fileinto "Commerce";
stop;
}
# Professional emails - GitHub, work services
if anyof (
address :domain :is "from" [
"github.com", "gitlab.com", "slack.com", "accounts.google.com",
"linkedin.com", "stackoverflow.com", "docker.com"
],
header :contains "subject" [
"github", "git", "commit", "pull request", "security", "alert",
"password", "login", "authentication"
]
) {
set "hasmailbox" "Y";
fileinto "Professional";
stop;
}
# Personal emails - Health, travel, family
if anyof (
address :domain :is "from" [
"kaiser.org", "airbnb.com", "southwest.com", "strava.com",
"delta.com", "united.com", "marriott.com", "hilton.com"
],
header :contains "subject" [
"doctor", "appointment", "medical", "health", "flight", "hotel",
"booking", "travel", "family", "kudos", "gave you kudos"
]
) {
set "hasmailbox" "Y";
fileinto "Personal";
stop;
}
# News and newsletters (educational content, deals, updates)
if anyof (
address :domain :is "from" [
"wsj.com", "nytimes.com", "cnn.com", "sololearn.com", "thekrazycouponlady.com",
"grove.co", "datacamp.com", "investors.com", "csmonitor.com"
],
header :contains "subject" [
"newsletter", "news", "daily", "weekly", "wsj", "wall street journal",
"offers", "deals", "promotion"
],
address :contains "from" [
"hello@", "team@", "info@", "offers@", "deals@", "sales@",
"marketing@", "promo@", "newsletter@", "news@"
]
) {
set "hasmailbox" "Y";
fileinto "Information";
stop;
}
# Catch ALL noreply/automated emails (most aggressive inbox zero approach)
if anyof (
address :contains "from" [
"noreply@", "no-reply@", "donotreply@", "do-not-reply@",
"notifications@", "notification@", "alerts@", "updates@",
"auto-", "automated@", "system@", "robot@"
],
header :contains "subject" [
"notification", "alert", "update", "digest", "summary",
"reminder", "report", "newsletter", "unsubscribe"
]
) {
set "hasmailbox" "Y";
fileinto "Information";
stop;
}
### }}}
### Execute spam filing {{{
if string :is "${spam}" "Y" {
addflag "\\Seen";
fileinto "\\Junk";
stop;
}
### }}}