Question Could it be DKIM be set for domain example.com, would not work for mail-server mail.example.com?

[Ehud]

Server operating system version

OS version: Ubuntu 22.04 x86_64 Postfix mail_version = 3.6.4 Server version: Apache/2.4.57 (Ubuntu) Server built: 2023-04-08T12:56:02nginx version: nginx/1.22.1

Plesk version and microupdate number

Product version: Plesk Obsidian 18.0.52.3 OS version: Ubuntu 22.04 x86_64 Build date: 2023/05/16 12:00 Revision: a3b74dbc9de2e47afd4e532d02fa7759b29d3fa5

Hi,

As default configuration, I have DKIM set with 'default' selector on the domain example.com.

I have recently received a DMARC report from mail.ru claiming an IP in Russia was able to send an email which had SPF failure, however DKIM pass.

On our server example.com, the sub-domain mail.example.com is used to send outgoing SES SMTP emails.

Could it be, that in order to prevent the above seemed bypassing of DKIM, in addition to default DKIM configured by Plesk for domain example.com, some sort of SKIM configuration should also be set for mail-server sub-domain mail.example.com?

And if so, how should this be done?


Please note:
POSSIBLY, the email was an email generated originally on our server example.com, and AUTO FORWADED by contact form recipient of a copy of the contacting us form, thus POSSIBLY relying on our DKIM PASS.

<?xml version='1.0' encoding='utf-8'?><feedback>
<report_metadata><org_name>Mail.Ru</org_name><email>[email protected]</email>
<extra_contact_info>Почта</extra_contact_info><report_id>4999999999999999999990</report_id>
<date_range><begin>1685664000</begin><end>1685750400</end></date_range></report_metadata>

<policy_published>
<domain>example.com</domain>
<adkim>s</adkim><aspf>s</aspf><p>reject</p><sp>quarantine</sp><pct>100</pct>
</policy_published>

<record>
<row>
<source_ip>185.78.30.999</source_ip>
<count>1</count>

<policy_evaluated>
<disposition>none</disposition>
<dkim>pass</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>example.com</header_from>
</identifiers>

<auth_results>
<dkim><domain>amazonses.com</domain><selector>xxxxxxxxxxxxxxxxxxxx</selector><result>pass</result></dkim>
<dkim><domain>example.com</domain><selector>xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx</selector><result>pass</result></dkim>
<spf><domain>amazonses.com</domain><scope>mfrom</scope><result>fail</result></spf>
</auth_results>


</record>
</feedback>