Mail tried to establish a connection to facebookmail.com

When I open Mail app (desktop), Littlesnitch informs me of continual connection attempts to facebookmail.com server, which I have blocked. I only receive emails from apple and google servers. Plus, I don't have any facebook accounts for them to send me emails. Why is Mail continually trying to connect to facebookmail.com? Has some malware been installed? How do I stop this connection? Is there a way to remove the server from Mail, cache, etc? This is very strange.



MacBook Air 13″, macOS 15.4

Posted on Apr 20, 2025 7:01 PM

Reply
Question marked as Top-ranking reply

Posted on Apr 23, 2025 2:26 PM

Having seen the same issue, a search of the Library/Mail folder yielded this:

BIMI-Location: v=BIMI1; l=https://facebookmail.com/cdn/cacheable/bimi_logo/facebook.svg a=https://facebookmail.com/cdn/cacheable/bimi_logo/facebook.pem


Wikipedia says:

Brand Indicators for Message Identification, or BIMI (/ˈbɪmi/), is a specification allowing for the display of brand logos next to authenticated e-mails.


So there might be a message with this BIMI-header that is causing Mail to attempt to download this logo, and not taking a (persistent) network error as a reason to stop. Or the setting "Block All Remote Content", for that matter.


What I did was searching Mail for "facebookmail" and moving all found messages out of the Inbox. Once Mail had no more messages for which to display brand logos, there were no more connection attempts in LittleSnitch.

3 replies
Question marked as Top-ranking reply

Apr 23, 2025 2:26 PM in response to AtomicFly

Having seen the same issue, a search of the Library/Mail folder yielded this:

BIMI-Location: v=BIMI1; l=https://facebookmail.com/cdn/cacheable/bimi_logo/facebook.svg a=https://facebookmail.com/cdn/cacheable/bimi_logo/facebook.pem


Wikipedia says:

Brand Indicators for Message Identification, or BIMI (/ˈbɪmi/), is a specification allowing for the display of brand logos next to authenticated e-mails.


So there might be a message with this BIMI-header that is causing Mail to attempt to download this logo, and not taking a (persistent) network error as a reason to stop. Or the setting "Block All Remote Content", for that matter.


What I did was searching Mail for "facebookmail" and moving all found messages out of the Inbox. Once Mail had no more messages for which to display brand logos, there were no more connection attempts in LittleSnitch.

Apr 26, 2025 4:17 AM in response to AtomicFly

That might be the case, as long as there is a header like the BIMI-Location somewhere. But I've seen this only with mails in the Inboxes.


In the Terminal app, this should show if there is anything still in the Inboxes trying to "ring home":

find ~/Library/Mail -name 'INBOX.mbox' -exec grep -r -e 'https://facebookmail.com/' {} \;


(Replace "INBOX" or the URL as appropriate for your case.)


Or, to just search everything that the Mail app might go through:

grep -r -e 'https://facebookmail.com/' ~/Library/Mail

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Mail tried to establish a connection to facebookmail.com

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.