Issue DKIM and mailer daemon emails

[QWeb Ric]

Server operating system version

CentOS Linux 7.9.2009

Plesk version and microupdate number

Plesk Obsidian Version 18.0.44 Update #3

We recently added DKIM to main domain, to combat some spam issues and get our sender reputation back up, but our server hostname is a subdomain of this domain and it looks like this is resulting in mailer daemon bounce emails being rejected because they're not sent with the appropriate DKIM signature.

i.e. the server is hosting3.[domain].co.uk and one of the domains it hosts is [domain].co.uk, which has DKIM enabled, and now in the mail logs when the server tries to generate a mailer daemon email from hosting3.[domain].co.uk, I'm seeing "550 Sender's policy prohibits this message: Reject (in reply to end of DATA command))" because these emails don't contain the DKIM for [domain].co.uk

Similarly, the usual Plesk generated emails for things like resource usage notifications don't seem to include this DKIM signature either.

Not sure what the resolve is for this one?

 

[elephpant90]

Same Issue here , has anyone a solution for this specific problem ?

 

[Peter Debik]

I am afraid that currently DKIM for the hostname is unsupported. We have a feature request for it, but it did not get many votes, so it is not a priority. Maybe you would like to add your vote to it?

Allow DKIM/DMARC/SPF records for the server's hostname domain

This thing that Plesk does not present DKIM public key, referred to server's hostname, is quite annoying. cPanel does, for example. And I'm not going to mess things up with changing hostname, so to match it with a newly created domain (whose purpose would be just having a DKIM in place).

plesk.uservoice.com

Until then, maybe you can change the hostname so that it becomes independent of your domain's DKIM settings.

Changing Your Server’s Host Name

You specify your server’s host name during your very first login to Plesk. If you want to change the host name later,...

docs.plesk.com

https://support.plesk.com/hc/en-us/articles/12377750836375--How-to-change-or-get-the-server-hostname-on-Plesk-server

 

[QWeb Ric]

Voted.

For anybody else stumbling on to this, until it's properly resolved we just adopted a DMARC policy of p=quarantine;sp=none; which seems to work well enough. It offers basically zero protection against mail spoofing but means your legitimate emails with DKIM signatures at least make it through the spam filters.

We really do need a proper fix though.