Issue DMARC REJECT after forwarding

[Flachzange]

Dear community,

I did some experiments with SPF/DKIM/DMARC and it seemed to work in general, but now and then I get a few DMARC REJECTs in my mail log for incoming emails, although the sender is assumed to be correct. A few spot checks on the senders' DNS settings confirmed by assumption. Many rejects had in common that the email was previously being forwarded (either externally or internally).

What happens:

1. I get an email for [email protected] by a valid sender
2. SPF/DKIM/DMARC results are positive in terms of email is accepted. DMARC result is PASS.
3. All emails for [email protected] are forwarded to [email protected]. (Both domains are hosted by the same plesk instance)
4. SRS rewriting scheme seems to be in place
5. This time only the DKIM and DMARC checks seem to be done for [email protected]. (SPF is missing from the log)
6. The DMARC check is negative and the message is discarded without any further explanation.

Any idea why the DMARC check fails and the message is being discarded? Is there a way to enable some kind of debug logging for the DMARC check to see what exactly is causing the issue?

Thank you.

Jul 16 06:51:30 rs000326 postfix/smtpd[382]: connect from pmta40066.emarsys.net[91.211.240.66]
Jul 16 06:51:30 rs000326 postfix/smtpd[382]: 2A4C75C13B5: client=pmta40066.emarsys.net[91.211.240.66]
Jul 16 06:51:30 rs000326 greylisting filter[391]: Starting greylisting filter...
Jul 16 06:51:30 rs000326 /usr/lib/plesk-9.0/psa-pc-remote[8003]: handlers_stderr: SKIP
Jul 16 06:51:30 rs000326 /usr/lib/plesk-9.0/psa-pc-remote[8003]: SKIP during call 'grey' handler
Jul 16 06:51:30 rs000326 postfix/cleanup[385]: 2A4C75C13B5: message-id=<[email protected]>
Jul 16 06:51:30 rs000326 check-quota[392]: Starting the check-quota filter...
Jul 16 06:51:30 rs000326 /usr/lib/plesk-9.0/psa-pc-remote[8003]: handlers_stderr: SKIP
Jul 16 06:51:30 rs000326 /usr/lib/plesk-9.0/psa-pc-remote[8003]: SKIP during call 'check-quota' handler
Jul 16 06:51:30 rs000326 spf[394]: Starting the spf filter...
Jul 16 06:51:30 rs000326 spf[394]: SPF result: pass
Jul 16 06:51:30 rs000326 spf[394]: SPF status: PASS
Jul 16 06:51:30 rs000326 /usr/lib/plesk-9.0/psa-pc-remote[8003]: handlers_stderr: PASS
Jul 16 06:51:30 rs000326 /usr/lib/plesk-9.0/psa-pc-remote[8003]: PASS during call 'spf' handler
Jul 16 06:51:30 rs000326 postfix/qmgr[8049]: 2A4C75C13B5: from=<[email protected]>, size=297081, nrcpt=1 (queue active)
Jul 16 06:51:30 rs000326 postfix-local[396]: postfix-local: [email protected], [email protected], dirname=/var/qmail/mailnames
Jul 16 06:51:30 rs000326 dk_check[397]: Starting the dk_check filter...
Jul 16 06:51:30 rs000326 dk_check[397]: DKIM verify result: DKIM verification (d=limango.de, 1024-bit key) succeeded
Jul 16 06:51:30 rs000326 dmarc[398]: Starting the dmarc filter...
Jul 16 06:51:30 rs000326 dmarc[398]: DMARC: PASS message for [email protected]
Jul 16 06:51:30 rs000326 check-quota[402]: Starting the check-quota filter...
Jul 16 06:51:30 rs000326 plesk sendmail[401]: handlers_stderr: SKIP
Jul 16 06:51:30 rs000326 plesk sendmail[401]: SKIP during call 'check-quota' handler
Jul 16 06:51:30 rs000326 postfix/smtpd[382]: disconnect from pmta40066.emarsys.net[91.211.240.66] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7
Jul 16 06:51:30 rs000326 postfix/pickup[9348]: 981735C13B7: uid=30 from=<SRS0=nZzl=6T=rp.limango.de=e3-33351505922-191960II125864II6@ruegen-urlaub.com>
Jul 16 06:51:30 rs000326 postfix/cleanup[385]: 981735C13B7: message-id=<[email protected]>
Jul 16 06:51:30 rs000326 postfix/pipe[395]: 2A4C75C13B5: to=<[email protected]>, orig_to=<[email protected]>, relay=plesk_virtual, delay=0.47, delays=0.41/0.01/0/0.06, dsn=2.0.0, status=sent (delivered via plesk_virtual service)
Jul 16 06:51:30 rs000326 postfix/qmgr[8049]: 2A4C75C13B5: removed
Jul 16 06:51:30 rs000326 postfix/qmgr[8049]: 981735C13B7: from=<SRS0=nZzl=6T=rp.limango.de=e3-33351505922-191960II125864II6@ruegen-urlaub.com>, size=297795, nrcpt=1 (queue active)
Jul 16 06:51:30 rs000326 postfix-local[407]: postfix-local: from=SRS0=nZzl=6T=rp.limango.de=e3-33351505922-191960II125864II6@ruegen-urlaub.com, [email protected], dirname=/var/qmail/mailnames
Jul 16 06:51:30 rs000326 spamassassin[408]: Starting the spamassassin filter...
Jul 16 06:51:30 rs000326 spamd[4099]: spamd: connection from localhost [::1]:35680 to port 783, fd 5
Jul 16 06:51:30 rs000326 spamd[4099]: spamd: using default config for [email protected]: /var/qmail/mailnames/annegret-evers.de/post/.spamassassin/user_prefs
Jul 16 06:51:30 rs000326 spamd[4099]: spamd: processing message <[email protected]> for [email protected]:30
Jul 16 06:51:31 rs000326 spamd[4099]: spamd: clean message (-0.8/5.0) for [email protected]:30 in 1.3 seconds, 292915 bytes.
Jul 16 06:51:31 rs000326 spamd[4099]: spamd: result: . 0 - BAYES_00,HEADER_FROM_DIFFERENT_DOMAINS,HTML_FONT_LOW_CONTRAST,HTML_IMAGE_RATIO_06,HTML_MESSAGE,MPART_ALT_DIFF_COUNT,RCVD_IN_DNSWL_NONE,T_DKIM_INVALID scantime=1.3,size=292915,[email protected],uid=30,required_score=5.0,rhost=localhost,raddr=::1,rport=35680,mid=<[email protected]>,bayes=0.000000,autolearn=no autolearn_force=no
Jul 16 06:51:31 rs000326 dk_check[410]: Starting the dk_check filter...
Jul 16 06:51:31 rs000326 dk_check[410]: DKIM verify result: DKIM verification (d=limango.de, 1024-bit key) succeeded
Jul 16 06:51:31 rs000326 dmarc[411]: Starting the dmarc filter...
Jul 16 06:51:31 rs000326 dmarc[411]: DMARC: REJECT message for [email protected]
Jul 16 06:51:31 rs000326 postfix-local[407]: message discarded by a mail handler
Jul 16 06:51:31 rs000326 postfix/pipe[395]: 981735C13B7: to=<[email protected]>, orig_to=<[email protected]>, relay=plesk_virtual, delay=1.3, delays=0.01/0/0/1.3, dsn=2.0.0, status=sent (delivered via plesk_virtual service)
Jul 16 06:51:31 rs000326 postfix/qmgr[8049]: 981735C13B7: removed
Jul 16 06:51:31 rs000326 spamd[18012]: prefork: child states: II

 

[H9k]

I believe this has been fixed in 17.5.3 Update 18

 

[Flachzange]

Thanks for pointing that out.

Unfortunately this issue has not been fixed, or at least I can observe the exact same behaviour as described above. I cannot use the DMARC feature right now (although I don't think I miss something)