I noticed the same thing this morning. This is new for me as of
yesterday. They appear legit, but they get caught up in my filters for
the dyn ip "appearance".
________________________________
From: Kenneth Porter <sh...@sewingwitch.com>
Sent: Saturday, October 5, 2019 10:05 AM
To: users@spamassassin.apache.org
Subject: Facebook notifications sent from dynamic address
(Nothing wrong with SA. Just an FYI about a popular service that abuses the
Internet and SA catches it.)
I noticed one of my notifications from Facebook today got tagged by SA.
Here's the two that put it over:
3.9 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr 2)
1.5 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server
[66.220.155.138 listed in dnsbl.sorbs.net]
Here's the offending header:
Received: from 66-220-155-138.mail-mail.facebook.com
(66-220-155-138.mail-mail.facebook.com [66.220.155.138])
So who do I bitch at? I've never found any good way to complain to Facebook.
