Smart Spam Gets Irritating

Smart Spam Gets Irritating

Spammers have gotten clever about grabbing your attention. Typical spam filters have become sophisticated enough to send unwanted emails straight to a junk folder. It seemed like spammers had no way to win, until they discovered that the calendar was wide open for abuse.

The trick they landed on was sending Google Calendar invites, which trigger the calendar app to automatically add events and alert you to their spammy ways.

My calendar and email setup is a bit fragmented. I use Fastmail as my email provider and Apple Mail (mostly) to read messages. I use iCloud Calendar and Apple Calendar to manage events.

Some suggestions I’ve come across were to disable calendar notifications so nothing would automatically be added to the calendar. However, I like this feature for legitimate invitations.

Fastmail provides a best-in-class email filtering system plus a sophisticated Sieve scripting tool to customize filtering rules. That got me thinking: a Sieve script could help filter out spammy calendar emails.

I gathered up all of the spammy calendar emails I received and started analyzing them to see how they are different from legitimate ones.

What I Found in the Headers

Every email carries hidden headers that tell the story of where it came from and how it was classified. Fastmail tags every incoming message with two independent spam classification systems.

The first is a SpamAssassin-based score in the X-Spam-score header. Fastmail’s built-in Sieve rules use this to file messages into Junk when the score reaches 5 or higher. Straightforward enough.

The second is a Vade Security classification in the X-ME-VSCategory header. This one uses categories like clean, ham, spam:medium, spam:high, and scam. The spam calendar invites I received all had categories of spam:medium, spam:high, or scam. A legitimate Google Calendar invitation from a real person? clean. Vade Security could tell the difference even when the SpamAssassin score was borderline.

I also noticed that every spam calendar invite carried an invite.ics attachment, identified by Fastmail’s X-Attached header. Legitimate calendar invites carry the same attachment, so on its own it’s not enough to tell them apart. But combined with the Vade Security classification, it provides a reliable signal: if a message has an invite.ics attachment and Vade didn’t call it clean, it’s spam.

There was one more critical detail. The rule has to run before Fastmail’s own spam filing block, because Apple Mail processes .ics attachments even from messages sitting in the Junk folder. Filing spam to Junk doesn’t stop the notification. The message has to be discarded before it reaches any IMAP folder at all.

The Working Rule

Here is the Sieve rule, placed at the top of the first editable section of Fastmail’s Sieve script (after the require line, before all generated blocks):

# Discard spam/scam calendar invitations at the earliest possible
# point. Uses X-Attached to detect invite.ics attachments (set
# before Sieve runs) combined with X-ME-VSCategory to ensure only
# spam/scam messages are discarded. Placed at the top so discard
# happens before spam filing (which would file to Junk where
# Apple Mail can still see the .ics).

if allof (
    header :contains "X-Attached" "invite.ics",
    not anyof (
        header :contains "X-ME-VSCategory" "clean",
        header :contains "X-ME-VSCategory" "ham"
    )
) {
    discard;
    stop;
}

The rule requires two conditions to match before discarding:

1. The message has an invite.ics attachment. This is what Apple Mail processes to add the event to your calendar. Without this, there’s no calendar spam threat.

2. Fastmail’s Vade Security did not classify the message as clean or ham. This is the safety gate. Legitimate Google Calendar invitations get X-ME-VSCategory: clean, so they pass through untouched. Anything flagged as spam:medium, spam:high, scam, or any other suspicious category gets discarded.

The discard action permanently deletes the message at the server. It never enters any IMAP folder, so Apple Mail never sees it and no notification is triggered. The stop action halts all further Sieve processing for that message.

Testing with Fastmail’s Sieve Tester

Fastmail provides a Sieve tester where you can paste your script and upload a raw .eml file to see how it would be processed. I tested the rule against every spam and legitimate calendar email I had collected. The spam was discarded and the legitimate invitation passed through. That gave me confidence before deploying it to my live Sieve script.

One note on debugging: I tried adding a log action to trace rule execution, but it requires the vnd.cyrus.log extension in the require line. Since Fastmail auto-generates that line and does not allow manual edits to it, logging was not an option. The Sieve tester turned out to be sufficient anyway.

The Takeaway

Of course spammers would eventually discover this weakness in how calendar invitations work. Fortunately, Fastmail’s excellent filtering tools are available to both novice and advanced users, and I was able to test and deploy a solution that should hold up well against future spam attempts, or whatever else they cook up next.