Is @support.facebook.com a legit email?

Is facebookmail.com a legit email?

Yes. The name looks made up, which is why people search for it, but facebookmail.com is on Meta’s own list in the help article Check if an email is really from Facebook, with fb.com, facebook.com, instagram.com, meta.com, metamail.com and global.metamail.com.

Three consequences follow from that list:

• Every subdomain counts. support.facebook.com, business.fb.com or global.metamail.com belong to Meta because only the owner of the main domain can create them.
• The exact mailbox name doesn’t matter. Meta doesn’t publish every address like security@facebookmail.com. If the part after the @ is on the list and the message passes the header check below, the name before the @ is Meta’s choice.
• Anything else is not on the list. A domain like facebook-mail.example or fb-support.example is not one Meta names, however close it looks. Meta’s page says to look out for “a misspelled version” of its domains.

A real Meta address does not make the content safe. In its article on phishing on Facebook, Meta warns that Business Manager partner requests with phishing links came from its legitimate facebookmail.com domain. The notification is genuine; the request inside it was written by a stranger. Don’t follow links in requests from people or businesses you don’t know.

Meta offers two more checks: in Gmail, Yahoo Mail and Apple Mail you can trust the email “if the Facebook logo appears alongside our email address”, and every security email appears under Recent emails in your account (see the box below).

How to check the headers of a Facebook email

The From line is just text the sender typed. What your provider recorded when the message arrived is not. Open the full headers (in Gmail: More > Show original; other apps in the email header analyzer) and find the topmost Authentication-Results header. For a real Facebook notification it looks roughly like this (shortened):

Authentication-Results: mx.example.net;
  dkim=pass header.d=facebookmail.com;
  spf=pass smtp.mailfrom=facebookmail.com;
  dmarc=pass (p=REJECT) header.from=facebookmail.com

What to look for:

1. dmarc=pass with header.from on a Meta domain. DMARC passes only if SPF or DKIM passed for a domain that matches the From domain or shares its organizational domain (RFC 9989). So dkim=pass header.d=facebookmail.com for a From address at facebookmail.com is the proof you want.
2. A pass for the wrong domain proves nothing. A scammer’s own domain can pass SPF and DKIM perfectly. If header.from says facebook-help.example, the message comes from that domain, whatever the display name says.
3. dmarc=fail for a Meta domain means forged. The Meta domains in the table publish p=reject (for metamail.com, its sending subdomains do), so providers that enforce DMARC normally refuse such mail. If one still reaches you, through a forwarding rule for example, treat it as fake. For metamail.com itself, which has no DMARC record, a result of dmarc=none also means the message is not authenticated.

Only trust the topmost Authentication-Results, the one your own provider wrote. Copies further down can be written by anyone. The email header analyzer reads the verdicts for you, and what is a DMARC record explains the policies behind p=reject.

Look-alike tricks in fake Facebook emails

A forged facebookmail.com From address fails DMARC, so phishing that imitates Facebook needs tricks that pass every technical check:

• Look-alike domains: a letter swapped (0 for o, rn for m), a letter added or dropped, or a different ending. faceb00k-security.example reads as “facebook” at a glance.
• Brand plus a lure word: facebook-support-team.example or meta-business-appeal.example. Words like “support” or “business” do appear in Meta’s addresses, but only in front of a listed domain, as in support.facebook.com.
• The real name in front of another domain: in facebook.com.verify-page.example the domain that counts is the end, verify-page.example.
• Display-name spoofing: "Facebook Security" <alerts@example.net> shows up as “Facebook Security” in many inboxes. Tap the name to see the address.
• A Reply-To elsewhere: the From address looks right, but replies go to an unrelated address. Check where a reply would go before you answer anything.

The scam email checker above flags these patterns and compares the domain with Meta’s official domains. Instagram mail follows the same rules; its addresses are on the Instagram sender check.