Issue Emails that are sent locally inside the server are rejected – PPPM-7190 not fixed with 18.0.79

[King555]

Server operating system version

Ubuntu 24.04.4 LTS

Plesk version and microupdate number

Plesk Obsidian 18.0.79 Update #2 Web Admin Edition

I had the problem that all local mails were moved to the spam folder (e.g. mails from Watchdog, fail2ban, Plesk PUM, etc.). I did the workaround which was described here by creating a file called /etc/psa/dmarc.conf:

https://support.plesk.com/hc/en-us/articles/12377454166935-Emails-that-are-sent-locally-inside-the-server-are-rejected-with-DMARC-REJECT-message-or-DMARC-message-moved-to-QUARANTINE

Meanwhile the workaround is not there anymore, because the article says that this bug has been fixed. So I deleted the file. But on my server it's even worse than before. While the mails were moved to the spam folder before, they are now completely deleted/rejected. This happened immediately after deleting the file which was created as the workaround.

The log entry is: 938A51B407C0: DMARC: smtpdomain=example.com maildomain=example.com [email protected] stamp=1784165641 ip=unknown adkim=relaxed aspf=relaxed p=REJECT sp=UNSPECIFIED pct=100 align_dkim=fail align_spf=fail spfres=unknown dkimres=unknown dmarccheck=DMARC_POLICY_REJECT dmarcstatus=STOP

 

[Sebahat.hadzhi]

Hi, @King555 . There are certain conditions that this bug did not address as they either qualify as expected behavior or different scenario. For example:

1. If you use Qmail as the bug was strictly related to Postfix
2. If the domain names are not properly configured
3. For Plesk notifications - if the sender email is not configured manually in panel.ini.

Could you please confirm what's the DMARC policy configured for the recipient domain?
Could you please also confirm if you have senderAddress defined in panel.ini?
Is the Postfix "myhostname" value different than the Plesk domain

The customization of the /etc/psa/dmarc.conf was likely:

IgnoreMailFrom  virtual.domain.tld

 

[King555]

@Sebahat.hadzhi I use Postfix.

The sender address is defined in panel.ini:

[notification]
[email protected]

Some mails are sent from Bash scripts with another sender address, which are also blocked without the dmarc.conf file. And Watchdog for example uses [email protected]. Does this matter?

I guess the Postfix "myhostname" value is identical to the Plesk domain. At least the myhostname entry is identical to the server's hostname and identical to the domain where I'm opening Plesk.

The recipient domain's DMARC DNS entry is: v=DMARC1; p=reject

Since having the dmarc.conf file again, all (new) mails are coming again.

 

[Sebahat.hadzhi]

Thank you. I will attempt to replicate the behavior and follow up with more details.

 

[King555]

As an additional note, according to the protocol overview in Plesk ("Track Email Delivery") the mails were sent correctly (at least the label is green and it says "Sent"). This is a complete log entry from that list:

Jul 16 02:01:36 BD7B81B413B9: uid=0 from=<[email protected] >
Jul 16 02:01:36 BD7B81B413B9: message-id=<[email protected] >
Jul 16 02:01:36 BD7B81B413B9: from=<[email protected] >, size=1574, nrcpt=1 (queue active)
Jul 16 02:01:36 BD7B81B413B9: from=<[email protected] >, to=<[email protected] >, dirname=/var/qmail/mailnames
Jul 16 02:01:36 BD7B81B413B9: DKIM Feed: No signature
Jul 16 02:01:36 BD7B81B413B9: dk_check: stderr: PASS
Jul 16 02:01:36 BD7B81B413B9: SPF record was not found in Authentication-Results
Jul 16 02:01:36 BD7B81B413B9: DMARC: smtpdomain=svr.example.com  maildomain=svr.example.com  [email protected]  stamp=1784167296 ip=unknown adkim=relaxed aspf=relaxed p=REJECT sp=UNSPECIFIED pct=100 align_dkim=fail align_spf=fail spfres=unknown dkimres=unknown dmarccheck=DMARC_POLICY_REJECT dmarcstatus=STOP
Jul 16 02:01:36 BD7B81B413B9: dmarc: stderr: STOP
Jul 16 02:01:36 BD7B81B413B9: to=<[email protected] >, relay=plesk_virtual, delay=0.22, delays=0.04/0/0/0.18, dsn=2.0.0, status=sent (delivered via plesk_virtual service)
Jul 16 02:01:36 BD7B81B413B9: removed

Shouldn't the list show an error here?

 

[Sebahat.hadzhi]

I ran a test on an Ubuntu 24 server with Enable DMARC to check incoming mail and a domain configured with DMARC record set to v=DMARC1; p=reject and I was able to receive Plesk and Watchdog notifications. I would suggest opening a ticket with Plesk support for further investigation on your server. To sign-in and open a ticket please go to:

• https://support.plesk.com

If you got your license from a reseller, your reseller is in charge of providing you with support. You can raise the inquiry with them, and they can forward it to our team for further processing.

 

[Aleksandr Mezin]

Hi @King555

PPPM-7190 was a combination of multiple issues, which were fixed across multiple releases. Recently, we reviewed and re-tested it, and found that DMARC works correctly for local e-mails, except a few known issues: 1. QMail 2. Bounces/delivery notifications between local mailboxes (which is tracked as a separate bug). So we decided to mark PPPM-7190 as "resolved".

It looks like your case isn't among these known issues.

We rely on DKIM signing for local messages to pass DMARC check. According to the log you've sent, messages don't get signed for some reason: BD7B81B413B9: DKIM Feed: No signature. So the message fails DMARC check - and gets rejected according to the receiver domain's policy. Is DKIM signing enabled for the sender domain?

If it is enabled, yes, please open a ticket.

 

[King555]

@Aleksandr Mezin DKIM signing of all domains on my server is enabled, according to what I see here:



A quick question: After I delete the file dmarc.conf, should I reboot the whole server? I did not do this before.

 

[Aleksandr Mezin]

DKIM signing of all domains

Yes, that's the correct checkbox. Only the sender domain matters though (the one you called svr.example.com)

A quick question: After I delete the file dmarc.conf, should I reboot the whole server?

No, it's being re-read for every message, you don't even have to reload postfix.

It looks like you need to open a support ticket.

 

[King555]

Since Hetzner is my Plesk license reseller, I will try to open a ticket there, but I think they do not offer support for Plesk at all.