Issue DKIM signing fails for website-generated emails

[tickteam-daryl]

Server operating system version

AlmaLinux 9.8

Plesk version and microupdate number

18.0.81 #2

I'm trying to resolve an issue with DKIM signing on a Plesk server and wondered whether anyone has encountered something similar.

Environment

• Plesk Obsidian 18.0.81.2
• AlmaLinux 9.8
• Postfix
• Laravel with Symfony Mailer 6.4.46

The problem

Emails sent by our Laravel application are delivered successfully, but DKIM signing fails. The mail log reports:

Sendmail (...) -> signing
DKIM error: DKIM Syntax error
As a result, the messages reach the recipient without a valid DKIM signature, causing email authentication issues.

What we've established

• DKIM signing is enabled in Plesk.
• The DKIM signing handler is enabled and registered.
• The private key exists and passes OpenSSL validation.
• A manually submitted test email from SSH is successfully signed and passes DKIM verification.
• Emails generated by the Laravel website fail with the syntax error above.
• Restarting Postfix and running plesk repair mail -y have not resolved the issue.
• No newer mail-driver package was reported by the package update check.

Our Laravel application uses Symfony Mailer's Sendmail transport, configured to invoke Sendmail in -t -i mode. -bs mode does not work.

I also noticed the Plesk Obsidian 18.0.79 changelog entry stating:

Emails sent locally via /usr/sbin/sendmail are now processed with DKIM signing applied.

As we're running a later Plesk version, I would expect this functionality to be available.

Has anyone experienced this behaviour, or can anyone suggest what might cause Plesk's DKIM handler to reject application-generated messages while successfully signing a manually submitted message?

It's causing deliverability issues with Microsoft email clients - but at a loss to explain why even though we've enabled it, Plesk just refuses to sign the message.

Any ideas would be appreciated.

 

[tessa67]

It's a confirmed bug? I don' know... But these are the most likely causes and steps:

Compare the raw message. “DKIM Syntax error” almost always means a header or format the handler can’t parse. Temporarily have Laravel send through a wrapper script that tees stdin to a file and then pipes it to /usr/sbin/sendmail -t -i.

Replay the file over SSH with:

/usr/sbin/sendmail -t -i < file.eml

and compare it with your working test mail. Usual suspects: a folded or RFC 2047-encoded Subject/From header, a UTF-8 display name, a duplicate header (Message-ID, Date) or a Bcc header.

Set the envelope sender. In -t mode Symfony passes no -f, so the sender becomes the system user (user@hostname). Plesk signs based on the sender domain.

Use:

/usr/sbin/sendmail -t -i -f [email protected]

with DKIM enabled for that domain in Plesk.

Check line endings:
Symfony converts CRLF to LF. If the captured file shows mixed line endings (e.g. from templates containing CR), the parser may fail.

Cleanest workaround:
Switch Laravel to the SMTP transport (MAIL_MAILER=smtp, host 127.0.0.1 or the server name, port 587 with auth). Mail then goes through Postfix and signing no longer depends on the sendmail wrapper.

If step 1 shows fully compliant headers and signing still fails, it is likely a Plesk bug.
Report it to Plesk support with the .eml file.

If you post the headers of the failing message (anonymized), it can be helpful.

Regards
Tessa