Issue DKIM problem with alias domain

[Erwan]

Server operating system version

AlmaLinux 9.6

Plesk version and microupdate number

18.0.71

Hi all,
We have a website configured with domain A and two alias domains (B & C) with email and DNS.
DKIM is enabled at the email level.

When we send an email via a dedicated script (PHPMailer - PHP 8.1), with contact@B as the sender, everything works except that the DKIM signature is invalid.

Tested with Mail-tester.com & appmaildev.com.

After various tests/changes at the PHPmailer & Postfix level, we still have the problem.

If I do this simple test:

$mail = new PHPMailer();
$mail->setFrom("[email protected]", "[email protected]");
$mail->addAddress("[email protected]", "[email protected]");
$mail->isHTML(true);
$mail->Subject = "This is a test";
$mail->Body = "Test";
$mail->CharSet = 'UTF-8';
$mail->send();

AppMaildev said there is a problem:
Public-Key: v=DKIM1; p=MIGfMA......;;
DKIM-Result: fail (bad signature)

This seems to indicate that the signature is indeed added by Postfix/Plesk, but it is incorrect (wrong private/public key pair).

In Plesk DNS, DKIM keys are the same for the 3 domains.

The private key in /etc/domainkeys/domainA/default & /etc/domainkeys/domainB/default are the same...

How to fix the problem?

 

[Kaspar]

Just to be sure, did you also check if the DKIM DNS records for the alias domain has the correct value or that there is no duplicate record for the DKIM key?

If the DKIM key in the DNS record is valid you might want to try run the repair utility for the domain plesk repair mail example.com -y to see if that solves the issue.

 

[Erwan]

Sorry, the DKIM DNS are defined for the 3 domains (main and 2 aliases) but are differents:
Main domain: default._domainkey.domainA.com. TXT v=DKIM1; p=MIIBIj........IDAQAB;
Alias1: default._domainkey.domainB.com. TXT v=DKIM1; p=MIGfMA........IDAQAB;;
Alias2: default._domainkey.domainC.com. TXT v=DKIM1; p=MIGfMA........IDAQAB;;

Both aliases have the same keys.

plesk repair mail example.com -y

I've made this command about ten times

I just redid it. No change. Note that the command is only valid for the main domain.

 

[Kaspar]

On the domain alias settings, is the mail service enabled?

 

[Erwan]

Yes.

 

[Kaspar]

Maybe try removing the alias and re-adding it?

Are you able to successfully send an email from webmail if you add the alias a sender profile in there?

I am unable to replicate the issue on my server, which makes it a hard to come up any more suggestions.

 

[Erwan]

I can't. This is prod website behind it.
For webmail, I can only log in with the main account [email protected]. There is a certificate error to access webmail.domainB.com. But no problem with the email account under Outlook for example.