Issue DKIM and SPF do not align with RFC5322. Then DMARC result is fail.

cmartinez127

Basic Pleskian
Server operating system version
CentOS Linux 7.9.2009
Plesk version and microupdate number
18.0.57 #5
Hi, I'm having a problem when I use Mailgun with Plesk email account on one specific server. We have multiple servers with similar configuration, but this problem only happens in a specific server. The problem is that RFC5322 does not align with DKIM and SPF when using Mailgun and for that reason DMARC fails too.

When I configure Mailgun for a domain I always follow the next steps:
  • First of all, I set up the specific DNS records for Mailgun (SPF, DKIM, MX and MX) in Plesk DNS zone. I checked that the records are correct.
    • These DNS records usually have this format. No mailgun: "example.es", Mailgun: "smtp.example.es"
  • Secondly, I set up the mail account in any email client (Outlook in this case) and add SMTP settings (smtp.eu.mailgun.org + SMTP account). I did it without any problem.
So far, so good. However, when I send an email to dmarc tester, I get this:
For privacy reasons I censored domain names, but let's call it "example.es" and "smtp.example.es".
1705320709337.png

When it says "SPF/DKIM domain does not align with RFC5322. From domain (smtp.example.es != example.es)." it's actually right, because in email headers I can the read this:
DKIM-Signature: v=1; ...; d=smtp.example.es; ...
From: [email protected]

That means DKIM is not in alignment, but what I don't understand is that in another server with same exact Mailgun and DNS configuration it works, even though domains in "DKIM-Signature" and "From:" don't match either.

Here is the domain's DNS zone with the SMTP/Mailgun records. I censored for privacy reasons the domain name and other irrelevant records.

I just added the last DMARC record (_dmarc.smtp.example.es. TXT v=DMARC1; p=none) to test and this way it works perfectly.

Is there any way to make it work with this policy "v=DMARC1; p=quarantine; adkim=s; aspf=s"? Our client would like to, for security reasons.

If I try "_dmarc.smtp.example.es. TXT v=DMARC1; p=quarantine; adkim=s; aspf=s" it's when it fails and shows the errors in the first screenshot.
1705321723354.png
 
UPDATE:
Now it fails with "_dmarc.smtp.example.es. TXT v=DMARC1; p=none" too. I don't know why but it did work yesterday.
 
I've been reading about this, the solution may be implementing ARC signing. When I update Plesk to 18.0.58 and try it I will share here the results.
 
Back
Top