Facebook Mail false positiv

TheBit · May 26, 2023

Hallo, wir stellen fest, dass original Facebook Mails als Spam eingestuft werden, der SPF Check ist auch positiv, wie kann man diesen false/positiv umgehen?

Stoiko Ivanov · May 26, 2023

Hmm - spannend - kurz die Nachfrage - ist es tatsächlich ein legitimes mail? (ich würde nochmal die header genau anschauen)

Ansonsten als Tip wie in so einem Fall vorgegangen werden kann um herauszufinden was genau passiert:

Code:

grep -r FACEBOOKMAIL /var/lib/spamassassin/
...
4.000000/kam_sa-channels_mcgrail_com/KAM.cf:header              __KAM_FACEBOOKMAIL1     From =~ /\@facebookmail.com/i
4.000000/kam_sa-channels_mcgrail_com/KAM.cf:header              __KAM_FACEBOOKMAIL2     From =~ /Ramakanth Raavi/i
4.000000/kam_sa-channels_mcgrail_com/KAM.cf:meta                KAM_FACEBOOKMAIL        ((__KAM_FACEBOOKMAIL2 >= 1) || (__KAM_FACEBOOKMAIL1 >=1 && (SPF_FAIL + DKIM_ADSP_ALL >=1)))
...

sprich die regel springt an (für den fall relevant), wenn im from-header @facebookmail.com vorkommt, und SPF_FAIL oder DKIM_ADSP_ALL anspringen - (die 2 rules koennen dann ebenso mit grep gesucht werden) - in dem fall ist SPF_PASS - damit ist DKIM das problem (und wie angezeigt ist DKIM_INVALID auch angesprungen)

eine Möglichkeit warum das bei einer legitimen mail passieren kann, ist, dass die Max Spam Size (GUI->Configuration->Spam Detector->Options) kleiner ist als die mail (PMG liefert dann an spamassassin nur den abgeschnittenen teil des mail-inhalts - und da ist der body-hash dann falsch)

Ich hoffe das hilft!

TheBit · May 26, 2023

Ich habe den Header eingefügt, für mich sieht das legitim aus. Die Mail ist nur 16KB Groß - sehen Sie hier einen Fehler?

Code:

/var/lib/spamassassin/3.004006/kam_sa-channels_mcgrail_com/KAM.cf:#FAKE FACEBOOKMAIL
/var/lib/spamassassin/3.004006/kam_sa-channels_mcgrail_com/KAM.cf:header                __KAM_FACEBOOKMAIL1     From =~ /\@facebookmail.com/i
/var/lib/spamassassin/3.004006/kam_sa-channels_mcgrail_com/KAM.cf:header                __KAM_FACEBOOKMAIL2     From =~ /Ramakanth Raavi/i
/var/lib/spamassassin/3.004006/kam_sa-channels_mcgrail_com/KAM.cf:meta          KAM_FACEBOOKMAIL        ((__KAM_FACEBOOKMAIL2 >= 1) || (__KAM_FACEBOOKMAIL1 >=1 && (SPF_FAIL + DKIM_ADSP_ALL >=1)))
/var/lib/spamassassin/3.004006/kam_sa-channels_mcgrail_com/KAM.cf:describe      KAM_FACEBOOKMAIL        Fake or Abused Facebook Mail
/var/lib/spamassassin/3.004006/kam_sa-channels_mcgrail_com/KAM.cf:score         KAM_FACEBOOKMAIL        8.0

Code:

Delivered-To: xxx@xxx.de
Return-Path: friendupdates@facebookmail.com
Received-SPF: pass (facebookmail.com: 66.220.144.143 is authorized to use 'friendupdates@facebookmail.com' in 'mfrom' identity (mechanism 'ip4:66.220.144.128/25' matched)) receiver=pmg2.bitskin.de; identity=mailfrom; envelope-from="friendupdates@facebookmail.com"; helo=66-220-144-143.mail-mail.facebook.com; client-ip=66.220.144.143
Received: from 66-220-144-143.mail-mail.facebook.com (66-220-144-143.mail-mail.facebook.com [66.220.144.143])
    by pmg2.xxxx.de (Proxmox) with ESMTPS id 4F3A521271
    for <xxx@xxx.de>; Fri, 26 May 2023 14:08:21 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=facebookmail.com;
    s=s1024-2013-q3; t=1685102883;
    bh=m1ZKqk2cr9uhQHr66HQnKWmqwM57hyI9HL9EmPnbf/I=;
    h=Date:To:Subject:From:MIME-Version:Content-Type;
    b=nqt5pKC97BtYwOGL30NiimYMDG0G8KT2fk+rouRavnBosulJnTnfZuBa+8CjNImED
     V0KGA6hcSfitfLF4ZYnhGXWfecJPXte2xfvgW08Gsv91Q01rpH6phop144Uxf5i93R
     f2QK/hPqecaTHESIFpg9MKQ73gDwFST04bZ9u5l8=
X-Facebook: from 2401:db00:5c:2214:face:0:398:0 ([MTI3LjAuMC4x])
    by www.facebook.com with HTTPS (ZuckMail);
Date: Fri, 26 May 2023 05:08:03 -0700
To: =?UTF-8?B?S2Fyc3RlbiBTcGllw58=?= <spiess@bitskin.de>
subject: SPAM: =?UTF-8?Q?=F0=9F=93=84=20?=xxxxxxxxhat ein Update gepostet
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
From: "Facebook" <friendupdates@facebookmail.com>
Reply-to: noreply <noreply@facebookmail.com>
Errors-To: friendupdates@facebookmail.com
X-Facebook-Notify: nf_status_story; mailid=U1U5fc974d17f97cG5af3608c0060G5fc9796adfc4eG313
List-Unsubscribe: <https://www.facebook.com/o.php?k=AS0IrBHTQOcaxx2LP7I&u=100001343340640&mid=5fc974d17f97cG5af3608c0060G5fc9796adfc4eG313&ee=AY2amC3zW69P2IQJPd6SMJSsPj66J4B_8CW7mtc7ac34ThivHGHGmw2aK3azS6NM1-rko9ryFiUMMbY>
BIMI-Selector: v=BIMI1; s=fb2023q1v2;
Feedback-ID: 6:nf_status_story:Facebook
X-FACEBOOK-PRIORITY: 1
X-Auto-Response-Suppress: All
Require-Recipient-Valid-Since: xxx@xxxxx.de; Tuesday,  6 Jul 2010 10:23:08 +0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="b1_6d93e70f8c1bdb733e7011b3c787eb81"
Message-ID: <f73eb390-fbbd-11ed-a237-2311304c8a54@facebookmail.com>
X-SPAM-LEVEL: Spam detection results:  3
    DKIM_ADSP_ALL             1.1 No valid author signature, domain signs all mail
    DKIM_INVALID              0.1 DKIM or DK signature exists, but is not valid
    DKIM_SIGNED               0.1 Message has a DKIM or DK signature, not necessarily valid
    ENV_AND_HDR_SPF_MATCH    -0.5 Env and Hdr From used in default SPF WL Match
    HTML_FONT_LOW_CONTRAST  0.001 HTML font color similar or identical to background
    HTML_MESSAGE            0.001 HTML included in message
    KAM_DMARC_STATUS         0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
    KAM_FACEBOOKMAIL            8 Fake or Abused Facebook Mail
    KAM_REALLYHUGEIMGSRC      0.5 Spam with image tags with ridiculously huge http urls
    RCVD_IN_DNSWL_BLOCKED   0.001 ADMINISTRATOR NOTICE: The query to DNSWL was blocked.  See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information.
    RCVD_IN_SORBS_WEB         1.5 SORBS: sender is an abusable web server
    SPF_HELO_NONE           0.001 SPF: HELO does not publish an SPF Record
    SPF_PASS               -0.001 SPF: sender matches SPF record
    TVD_RCVD_IP             0.001 Message was received from an IP address
    T_SCC_BODY_TEXT_LINE    -0.01 -
    USER_IN_DEF_SPF_WL       -7.5 From: address is in the default SPF welcome-list

Stoiko Ivanov · May 30, 2023

TheBit said:
Ich habe den Header eingefügt, für mich sieht das legitim aus. Die Mail ist nur 16KB Groß - sehen Sie hier einen Fehler?

wie groß ist die max spam size?

TheBit · May 30, 2023

Default würde ich sagen: 262144 Bytes

Stoiko Ivanov · May 30, 2023

ok - 256kb - da sollte die 16kb mail reinpassen

dennoch erkennt spamassassin die DKIM signature als invalid..
beim durchschauen sehe ich nur dass das subject ein 'SPAM:' vorne stehen hat - woher kommt das?

(wenn es durch das PMG rule-system kommt, sollte das keine rolle spielen, da die spamanalyse davor passiert - ansonsten würde das die ungültige Signatur erklären).

TheBit said:
subject: SPAM: =?UTF-8?Q?=F0=9F=93=84=20?=xxxxxxxxhat ein Update gepostet

TheBit · May 30, 2023

Vermutlich durch PMG - die Mail ist ja so im System vorhanden - Ich habe wieder eine Mail im Spamfilter:

Code:

Delivered-To: xxx@xxx.de
Return-Path: friendupdates@facebookmail.com
Received-SPF: pass (facebookmail.com: 69.171.232.148 is authorized to use 'friendupdates@facebookmail.com' in 'mfrom' identity (mechanism 'ip4:69.171.232.0/24' matched)) receiver=xxx.xxx.de; identity=mailfrom; envelope-from="friendupdates@facebookmail.com"; helo=69-171-232-148.mail-mail.facebook.com; client-ip=69.171.232.148
Received: from 69-171-232-148.mail-mail.facebook.com (69-171-232-148.mail-mail.facebook.com [69.171.232.148])
    by xxx.xxx.de (Proxmox) with ESMTPS id 855ED215AE
    for <xxx@xxx.de>; Mon, 29 May 2023 12:56:59 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=facebookmail.com;
    s=s1024-2013-q3; t=1685357801;
    bh=jOyAOHbf0ueL5zp5tTnxKqii12ovZ/X+L33OOANmwRA=;
    h=Date:To:Subject:From:MIME-Version:Content-Type;
    b=YSyQpANk4iKeT3YyxpZ8XjIUHYp27B2RzOIcMU7VAKKbOa1ExUvLsNNoCQFIa9kgt
     s1QYLGQRfH1inPXYo+WYOcf5P+598EvNEaBYxPwRACc6EBdKmmOhQr6TkOzhpgzGt+
     0mz5oovNDSNdU9E/gUiBK62SN7OT2JOgT+Nw8Hko=
X-Facebook: from 2401:db00:111c:4501:face:0:3c0:0 ([MTI3LjAuMC4x])
    by www.facebook.com with HTTPS (ZuckMail);
Date: Mon, 29 May 2023 03:56:41 -0700
To: =?UTF-8?B?S2Fyc3RlbiBTcGllw58=?= <xxx@xxx.de>
subject: SPAM: =?UTF-8?Q?=F0=9F=94=97=20?=xxx xxx hat einen Link geteilt
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
From: "Facebook" <friendupdates@facebookmail.com>
Reply-to: noreply <noreply@facebookmail.com>
Errors-To: friendupdates@facebookmail.com
X-Facebook-Notify: nf_share_story; mailid=U1U5fcd2a763bc64G5af3608c0060G5fcd2f0f9bf36G318
List-Unsubscribe: <https://www.facebook.com/o.php?k=AS02jiakZOYGG7NP_nw&u=100001343340640&mid=5fcd2a763bc64G5af3608c0060G5fcd2f0f9bf36G318&ee=AY0Nc_mrUay_Fx8i2oxartdoRU6onhlCruP5umVGvC2cCc0VgQu9Fn8v-jnlsYXZtoOzOqd1KHxrGqM>
BIMI-Selector: v=BIMI1; s=fb2023q1v2;
Feedback-ID: 9:nf_share_story:Facebook
X-FACEBOOK-PRIORITY: 1
X-Auto-Response-Suppress: All
Require-Recipient-Valid-Since: xxx@xxx.de; Tuesday,  6 Jul 2010 10:23:08 +0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="b1_409b144b462fe5ec47238f3fa60ab4c6"
Message-ID: <7e0e577e-fe0f-11ed-84fc-23f919531530@facebookmail.com>
X-SPAM-LEVEL: Spam detection results:  4
    DKIM_ADSP_ALL             1.1 No valid author signature, domain signs all mail
    DKIM_INVALID              0.1 DKIM or DK signature exists, but is not valid
    DKIM_SIGNED               0.1 Message has a DKIM or DK signature, not necessarily valid
    DMARC_PASS               -0.1 DMARC pass policy
    HTML_FONT_LOW_CONTRAST  0.001 HTML font color similar or identical to background
    HTML_MESSAGE            0.001 HTML included in message
    KAM_DMARC_STATUS         0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
    KAM_FACEBOOKMAIL            8 Fake or Abused Facebook Mail
    KAM_REALLYHUGEIMGSRC      0.5 Spam with image tags with ridiculously huge http urls
    RCVD_IN_MSPIKE_H3       0.001 Good reputation (+3)
    RCVD_IN_MSPIKE_WL       0.001 Mailspike good senders
    RCVD_IN_PSBL              2.7 Received via a relay in PSBL
    SPF_HELO_NONE           0.001 SPF: HELO does not publish an SPF Record
    SPF_PASS               -0.001 SPF: sender matches SPF record
    TVD_RCVD_IP             0.001 Message was received from an IP address
    T_SCC_BODY_TEXT_LINE    -0.01 -
    USER_IN_DEF_SPF_WL       -7.5 From: address is in the default SPF welcome-list



--b1_409b144b462fe5ec47238f3fa60ab4c6
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hallo Karsten,

=F0=9F=94=97 XXXX XXXX hat einen Link geteilt

Gr=C3=BC=C3=9Fe,
Das Facebook-Team

Search

Search

Facebook Mail false positiv

TheBit

Member

Stoiko Ivanov

Proxmox Staff Member

TheBit

Member

Stoiko Ivanov

Proxmox Staff Member

TheBit

Member

Stoiko Ivanov

Proxmox Staff Member

TheBit

Member

We value your privacy