Module 6 · 6.3

English

Nederlands English Deutsch Français Español Italiano

An out-of-office reply that gets it right

Module 6: Automatic: filters and out of office · Reading time: 9 minutes

Learning objective: After this lesson you can explain how an out-of-office reply works on the server and who does and doesn't get it. You can also set up an out-of-office reply that switches itself on and off and gives away nothing that helps scammers.

Key concepts: out-of-office reply, Sieve vacation, Reply interval (:days), My e-mail addresses (:addresses), List-Id, Auto-Submitted, Start time and End time, Incoming message action

A filter that replies

Technically, an out-of-office reply is a filter. It sits in the same filter set as your other filters (lesson 6.1), so it also runs on the server, at the moment mail arrives. Your laptop can be switched off. The Sieve extension is called vacation (RFC 5230). This is how the webmail writes an out-of-office reply for the Christmas holidays:

require ["date","relational","vacation"];
# rule:[Afwezigheidsbericht]
if allof (currentdate :zone "+0100" :value "ge" "date" "2026-12-21", currentdate :zone "+0100" :value "le" "date" "2027-01-03")
{
	vacation :days 7 :addresses ["sanne@example.com","info@example.com"] :subject "Afwezig tot en met 3 januari" "Dank je voor je mail. Ik ben er tot en met 3 januari niet. Voor bestellingen kun je terecht bij Daan: daan@example.com.";
}

What it says:

currentdate ... "ge" ... "2026-12-21" and "le" ... "2027-01-03": the current date must be on or after 21 December, and on or before 3 January. Those are your Start time and End time. Outside that period the filter does nothing. :zone "+0100" is the time zone from your settings.
vacation :days 7: the same address gets a reply at most once every 7 days.
:addresses [...]: the addresses that belong to you.
:subject and the text after it: the subject and body of the reply.

One reply per sender per interval

Without a limit, someone who emails you ten times would get the same reply ten times. That's why the server remembers who it has already replied to. Within the Reply interval (in Sieve :days) the same sender doesn't get a second reply. If you don't choose anything, the standard says 7 days (RFC 5230, section 4.1). For a two-week holiday, 7 is a fine value: anyone who emails again after a week gets a reminder that you're still away. Less than 1 day is usually not possible.

The reply goes to the envelope sender (Return-Path, lesson 1.1), not necessarily to the address in From. For ordinary mail these are the same. For newsletters and systems it's often a technical address, and that's exactly the point: this way an automatic reply doesn't end up with a person who can't do anything with it.

Who doesn't get a reply

An out-of-office reply can do a lot of damage if it replies to the wrong mail: replies to a mailing list with a thousand members, or two automatic messages endlessly responding to each other. That's why the standard (RFC 5230, section 4.6) says the server doesn't reply to:

mail with a List-Id header or other List headers: newsletters and mailing lists;
mail with an Auto-Submitted header with a value other than "no": automatic messages, such as another out-of-office reply or a notification from a system;
mail from addresses such as MAILER-DAEMON, or addresses that start with "owner-" or end with "-request".

Your own reply gets the header Auto-Submitted: auto-replied itself. That way another out-of-office reply knows it shouldn't reply back, and no loop is created.

My e-mail addresses: only reply if it's meant for you

The server only replies if one of your addresses is in the To or Cc header (RFC 5230, section 4.5). This prevents you from replying to mail that came in via a list or as Bcc. The server only half knows which addresses are yours: it certainly knows your mailbox address, but not the info@ address that is forwarded to you.

That's why the My e-mail addresses field matters (in Sieve :addresses). Enter every address you receive mail on, including forwarding addresses. With Fill with all my addresses, the webmail copies the addresses of your identities. If you forget info@, a customer who emails info@ gets no out-of-office reply and may wait in vain.

Start, end and what happens to the mail

With a Start time and an End time the reply switches on and off by itself. That's the safest way: you can't forget to switch it off. If you leave them empty, the reply stays active as long as Status is set to On. An out-of-office reply that keeps running for weeks after the holiday is a well-known mistake and confusing for customers.

Under Incoming message action you choose what happens to the mail itself. Leave this set to Keep. Vacation simply leaves the message in your mailbox (RFC 5230, section 4.7), and after you get back you'll want to read what came in. Discard means mail you receive disappears. Redirect to or Send copy to only make sense towards a colleague in your own organisation, with the same drawbacks as in lesson 6.2.

The Out of Office section with Subject, Body, Start time, End time and Status — (1) Subject, (2) Body, (3) Start time and End time, (4) Status, (5) Reply interval

What you do and don't write

A good out-of-office reply is short and helps the sender move on:

When you're back, or until when you won't reply.
Who takes over in the meantime, with an address or phone number that is staffed.
What the sender can do if it's urgent.

And what you don't write: details that help scammers and burglars. The reply goes to everyone who emails you, including spammers and strangers. So don't mention that you're abroad for three weeks, where you're going, your personal phone number, or the name of your stand-in together with a role a scammer could misuse ("email our bookkeeper Jan for payments"). Scammers love using a message like that to write a convincing fake email, for example an urgent payment request in the name of someone who can't be reached anyway.

Example of a good reply:

Onderwerp: Afwezig tot en met 3 januari

Dank je voor je mail. Ik lees mijn mail weer vanaf 4 januari.
Voor bestellingen en vragen kun je terecht bij info@example.com.

Not twice

You can also set up an out-of-office reply in your hosting control panel, which at WebOké is DirectAdmin. Use one of the two. If both are active, everyone gets two automatic replies.

In practice: how it works in the webmail

The out-of-office reply is under Settings > Out of Office, with Subject, Body, Start time, End time and Status, and under Advanced settings you'll find My e-mail addresses, Reply interval and Incoming message action. You can see the result in Filters > Actions > Edit filter set. The steps are in the Roundcube manual under Setting up an out-of-office reply. Other webmail works in a similar way: Gmail has a vacation responder in its settings, Outlook.com has automatic replies.

Summary

An out-of-office reply is a Sieve filter (vacation, RFC 5230) that runs on the server.
The same sender gets at most one reply per Reply interval; if you don't choose, that's 7 days.
No reply to mailing lists (List-Id) or automatic mail (Auto-Submitted), and only if one of your addresses is in To or Cc.
Add your forwarding addresses to My e-mail addresses too, use a start and end date, and leave the action set to Keep.
Write when you're back and who people can contact, but no details that help scammers.

Quiz

Exercise

Exercise A6.3: Get your out-of-office reply checked. In your own mailbox, prepare an out-of-office reply under Settings > Out of Office, with a Start time and an End time that are both in the future; that way the reply isn't really active yet and nobody gets a reply now. Fill in a subject, a text, My e-mail addresses and a Reply interval, and leave Incoming message action set to Keep. Then paste your filter set (Settings > Filters > Actions > Edit filter set, copy everything) or upload the file from Download. The program reads the script in memory (nothing is stored) and checks: there is a vacation action; :days is at least 1; the subject is not empty; the text is longer than 40 characters; there is a date limit with currentdate (otherwise orange: won't you forget to switch it off?); :addresses contains at least one address (otherwise orange); and the message is kept, so no discard and no redirect to an address outside your domain. After the exercise, switch the reply off again if you don't need it.

Cookies at WebOké

Cookie settings

Necessary

Marketing