• Hi, Pleskians! We are running a UX testing of our upcoming product intended for server management and monitoring.
    We would like to invite you to have a call with us and have some fun checking our prototype. The agenda is pretty simple - we bring new design and some scenarios that you need to walk through and succeed. We will be watching and taking insights for further development of the design.
    If you would like to participate, please use this link to book a meeting. We will sent the link to the clickable prototype at the meeting.
  • (Plesk for Windows):
    MySQL Connector/ODBC 3.51, 5.1, and 5.3 are no longer shipped with Plesk because they have reached end of life. MariaDB Connector/ODBC 64-bit 3.2.4 is now used instead.
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.

Issue DKIM and SPF do not align with RFC5322. Then DMARC result is fail.

cmartinez127

Basic Pleskian
Server operating system version
CentOS Linux 7.9.2009
Plesk version and microupdate number
18.0.57 #5
Hi, I'm having a problem when I use Mailgun with Plesk email account on one specific server. We have multiple servers with similar configuration, but this problem only happens in a specific server. The problem is that RFC5322 does not align with DKIM and SPF when using Mailgun and for that reason DMARC fails too.

When I configure Mailgun for a domain I always follow the next steps:
  • First of all, I set up the specific DNS records for Mailgun (SPF, DKIM, MX and MX) in Plesk DNS zone. I checked that the records are correct.
    • These DNS records usually have this format. No mailgun: "example.es", Mailgun: "smtp.example.es"
  • Secondly, I set up the mail account in any email client (Outlook in this case) and add SMTP settings (smtp.eu.mailgun.org + SMTP account). I did it without any problem.
So far, so good. However, when I send an email to dmarc tester, I get this:
For privacy reasons I censored domain names, but let's call it "example.es" and "smtp.example.es".
1705320709337.png

When it says "SPF/DKIM domain does not align with RFC5322. From domain (smtp.example.es != example.es)." it's actually right, because in email headers I can the read this:
DKIM-Signature: v=1; ...; d=smtp.example.es; ...
From: [email protected]

That means DKIM is not in alignment, but what I don't understand is that in another server with same exact Mailgun and DNS configuration it works, even though domains in "DKIM-Signature" and "From:" don't match either.

Here is the domain's DNS zone with the SMTP/Mailgun records. I censored for privacy reasons the domain name and other irrelevant records.

I just added the last DMARC record (_dmarc.smtp.example.es. TXT v=DMARC1; p=none) to test and this way it works perfectly.

Is there any way to make it work with this policy "v=DMARC1; p=quarantine; adkim=s; aspf=s"? Our client would like to, for security reasons.

If I try "_dmarc.smtp.example.es. TXT v=DMARC1; p=quarantine; adkim=s; aspf=s" it's when it fails and shows the errors in the first screenshot.
1705321723354.png
 
UPDATE:
Now it fails with "_dmarc.smtp.example.es. TXT v=DMARC1; p=none" too. I don't know why but it did work yesterday.
 
I've been reading about this, the solution may be implementing ARC signing. When I update Plesk to 18.0.58 and try it I will share here the results.
 
Back
Top