Fastmail Spam Message False Positives are Out of Control

[bbrener]

In the past week I have had about 25 emails marked as spam that have never been marked as spam before. Clearly they have changed algorithms recently that have made this a real problem.
Today I sent them an email from eBay received in February confirming an order with an X-Spam score of 0.0. Yesterday I received an identical email confirming an eBay order that now has a spam score of 7.1.
How do Identical emails from the same source go from 0 to 7.1?
I have many other examples.
I'm waiting for an answer but while I understand the need to prevent the spam scourge, this is not the way.

[hadaso]

To determine the reasons for the spam score you need to look in the email headers, especially in the X-Spam-hits header that lists the constituents of the spam score.
To see the headers in the web app you need to choose "Show raw message" from the action menu (sadly the "show headers" action was gone many years ago).

[BritTim]

The most common reason for a sudden jump in spam score is that one of the servers used has found its way onto an email blacklist (often through no fault of the owner). However, as advised by hadaso, the first step is to look at a X-Spam-hits header.

[bbrener]

I do know how to read the spam score. The point is being missed. The email is from eBay which should not be classified by anybody as a spam server. Godaddy is the provider. Also not spam.
The X-Spam score in February is:

X-Spam-sender-reputation: 500 (none)
X-Spam-score: 0.0

X-Spam-hits: BAYES_50 0.8, HEADER_FROM_DIFFERENT_DOMAINS 0.25,
HTML_FONT_LOW_CONTRAST 0.001, HTML_MESSAGE 0.001,
ME_DMARC_IN_FMWL -0.001, ME_SC_DMARC_IN_FMWL -100,
ME_SENDERREP_NEUTRAL 0.001, MIME_HTML_ONLY 0.1,
RCVD_IN_DNSWL_NONE -0.0001, SHORTCIRCUIT -0.0001, SPF_HELO_NONE 0.001,
SPF_PASS -0.001, LANGUAGES en, BAYES_USED user, SA_VERSION 3.4.6

The X-Spam score in April for an identical email is:

X-Spam-sender-reputation: 500 (none)
X-Spam-score: 7.1
X-Spam-hits: BAYES_80 2, DCC_CHECK 1.1, HEADER_FROM_DIFFERENT_DOMAINS 1,
HTML_FONT_LOW_CONTRAST 0.001, HTML_MESSAGE 0.001,
ME_DMARC_IN_FMWL -0.001, ME_SC_NH -0.001, ME_SENDERREP_NEUTRAL 0.001,
ME_VADESPAM_HIGH 3, MIME_HTML_ONLY 0.1, RCVD_IN_DNSWL_NONE -0.0001,
RCVD_IN_MSPIKE_H3 -0.01, RCVD_IN_MSPIKE_WL -0.01, SPF_HELO_NONE 0.001,
SPF_PASS -0.001, LANGUAGES en, BAYES_USED user, SA_VERSION 3.4.6

I have to believe some algorithm has changed which causes much email to be labelled by Spam by Fastmail that never was before.

Bayes_80; DCC Check; header from different domains; ME_Vadespam all new

Its the ME_Vadespam that gets me. Ebay is spam? Godaddy is the provider. Vade seems to be new for Fastmail and is causing false positives.

[jarland]

Gotta be real careful with these too, because by default fastmail reports any email they mark as spam back through feedback loops. This will cause you to be removed from a lot of mailing lists, and many service providers will halt outbound mail to you as a result of it.

If they have a feature to disable that reporting, you'll want to turn that off. If they don't have that feature, you may want to dramatically change your spam settings.

It's been a while since I used fastmail now, I just like to bring this up because I'm often on the receiving end of their feedback loops and I have to provide support as an indirect result of it. It's not to say anything negative about fastmail, it's just useful information for users. Every service has it's quirks.

[Bamb0]

Hey Mr Jarland its good to see ya buddy

I see many providers marking stuff as spam that isnt and its aggravating.......

[jarland]

Originally Posted by Bamb0

Hey Mr Jarland its good to see ya buddy

I see many providers marking stuff as spam that isnt and its aggravating.......

It's inevitable really. It's just that feedback loops are heavily utilized for real functions and automations, so you always want to be careful.

Another example of feedback loop practices worth knowing about, for example, a lot of users with Comcast emails claim to only be deleting emails when they get reported as spam back through feedback loops.

You always want to be careful with those. When I worked at DigitalOcean we used a transactional provider that disabled outbound to anyone who came back in a FBL. Cloudflare cut off abuse complaints at another job because we used Fastmail and they were filtered as spam, which auto reported them to the FBL. It's becoming more common, good for people to know about it.

To add context for anyone unaware, a FBL is typically when you click "report spam" and your email provider sends a complaint to the provider that the email came from.

[Bamb0]

Yes its not easy to run an email server is it??

I give you and Jeff alot of credit

[BritTim]

It appears that one of the tools used by Fastmail to detect spam is Vade.Secure. Periodically, there have been issues with the spam filtering done by Vade. Here is an older thread that described a similar issue a few years ago: http://emaildiscussions.com/showthread.php?t=74033.

There is nothing you can do other than wait for Fastmail and Vade Secure to come up with a solution.

EDIT: Actually, it would be possible to write a sieve rule that bypassed spam checking if the X-Spam-hits header contained ME_VADESPAM_HIGH. This might lead to some genuine spam getting through, however.

[SideshowBob]

The VADE result wouldn't have mattered if it weren't for the BAYES_80 result. If Bayes had identified it correctly, it would have hit BAYES_00 instead, leading to an overall score of 3.5.

Bayes is a bit hit and miss at identifying spam, but with training it can be very good at positively identifying ham. This is key to minimizing FPs in SpamAssassin. The BAYES_50 in the first scan means Bayes didn't recognize it, that's not good either.

[BritTim]

An important question: when Fastmail is erroneously identifying a message as spam, are you explicitly marking it as "not spam". This is very important for training your user Bayes database.