• Halloween is coming! To celebrate the occasion, we dusted off a couple of old skins, and even created a brand new one (Pixel).
    To get into the festive spirit, install the Skins extension.
  • The new Python extension is now available. It allows customers to deploy and manage WSGI-based Python applications on their websites directly from Plesk.
  • The Plesk Mobile apps for iOS and Android and the Plesk Mobile Center extension have been deprecated, and are no longer available for new installations. In Plesk Obsidian 18.0.84, the Plesk Mobile Center extension will be removed from servers during the upgrade, and the Plesk Mobile apps will lose their server management features.
  • The Social Login extension has been deprecated and will be removed in Plesk Obsidian 18.0.84. After that, it will no longer be possible to log in to Plesk with a Google, Facebook, GitHub account, or with a passkey. Plesk usernames and passwords, as well as logging in with a WebPros Account, are not affected.

Issue DKIM and SPF do not align with RFC5322. Then DMARC result is fail.

cmartinez127

Basic Pleskian
Server operating system version
CentOS Linux 7.9.2009
Plesk version and microupdate number
18.0.57 #5
Hi, I'm having a problem when I use Mailgun with Plesk email account on one specific server. We have multiple servers with similar configuration, but this problem only happens in a specific server. The problem is that RFC5322 does not align with DKIM and SPF when using Mailgun and for that reason DMARC fails too.

When I configure Mailgun for a domain I always follow the next steps:
  • First of all, I set up the specific DNS records for Mailgun (SPF, DKIM, MX and MX) in Plesk DNS zone. I checked that the records are correct.
    • These DNS records usually have this format. No mailgun: "example.es", Mailgun: "smtp.example.es"
  • Secondly, I set up the mail account in any email client (Outlook in this case) and add SMTP settings (smtp.eu.mailgun.org + SMTP account). I did it without any problem.
So far, so good. However, when I send an email to dmarc tester, I get this:
For privacy reasons I censored domain names, but let's call it "example.es" and "smtp.example.es".
1705320709337.png

When it says "SPF/DKIM domain does not align with RFC5322. From domain (smtp.example.es != example.es)." it's actually right, because in email headers I can the read this:
DKIM-Signature: v=1; ...; d=smtp.example.es; ...
From: [email protected]

That means DKIM is not in alignment, but what I don't understand is that in another server with same exact Mailgun and DNS configuration it works, even though domains in "DKIM-Signature" and "From:" don't match either.

Here is the domain's DNS zone with the SMTP/Mailgun records. I censored for privacy reasons the domain name and other irrelevant records.

I just added the last DMARC record (_dmarc.smtp.example.es. TXT v=DMARC1; p=none) to test and this way it works perfectly.

Is there any way to make it work with this policy "v=DMARC1; p=quarantine; adkim=s; aspf=s"? Our client would like to, for security reasons.

If I try "_dmarc.smtp.example.es. TXT v=DMARC1; p=quarantine; adkim=s; aspf=s" it's when it fails and shows the errors in the first screenshot.
1705321723354.png
 
UPDATE:
Now it fails with "_dmarc.smtp.example.es. TXT v=DMARC1; p=none" too. I don't know why but it did work yesterday.
 
I've been reading about this, the solution may be implementing ARC signing. When I update Plesk to 18.0.58 and try it I will share here the results.
 
Back
Top