Question Incoming spamd: T_DKIM_INVALID but dk_check succeeds -why?

[swaan]

a customer complained that some messages from adobe.com do not arrive. I checked and they are indeed rejected but why? SPF and DKIM are both PASS?!?

Dec 27 14:51:26 plesk postfix/smtpd[2443]: connect from a14-29.smtp-out.amazonses.com[54.240.14.29]
Dec 27 14:51:27 plesk postfix/smtpd[2443]: 7E8787D02E: client=a14-29.smtp-out.amazonses.com[54.240.14.29]
Dec 27 14:51:27 plesk postfix/cleanup[2500]: 7E8787D02E: message-id=<01000160983df374-904b1746-9835-44aa-a697-bd75b298d2ab-000000@email.amazonses.com>
Dec 27 14:51:27 plesk /usr/lib/plesk-9.0/psa-pc-remote[13364]: handlers_stderr: SKIP
Dec 27 14:51:27 plesk /usr/lib/plesk-9.0/psa-pc-remote[13364]: SKIP during call 'limit-out' handler
Dec 27 14:51:27 plesk check-quota[2502]: Starting the check-quota filter...
Dec 27 14:51:27 plesk /usr/lib/plesk-9.0/psa-pc-remote[13364]: handlers_stderr: SKIP
Dec 27 14:51:27 plesk /usr/lib/plesk-9.0/psa-pc-remote[13364]: SKIP during call 'check-quota' handler
Dec 27 14:51:27 plesk spf[2503]: Starting the spf filter...
Dec 27 14:51:27 plesk spf[2503]: SPF result: pass
Dec 27 14:51:27 plesk spf[2503]: SPF status: PASS
Dec 27 14:51:27 plesk /usr/lib/plesk-9.0/psa-pc-remote[13364]: handlers_stderr: PASS
Dec 27 14:51:27 plesk /usr/lib/plesk-9.0/psa-pc-remote[13364]: PASS during call 'spf' handler
Dec 27 14:51:28 plesk postfix/qmgr[17820]: 7E8787D02E: from=<01000160983df374-904b1746-9835-44aa-a697-bd75b298d2ab-000000@amazonses.com>, size=3167, nrcpt=1 (queue active)
Dec 27 14:51:28 plesk postfix-local[2505]: postfix-local: from=01000160983df374-904b1746-9835-44aa-a697-bd75b298d2ab-000000@amazonses.com, [email protected], dirname=/var/qmail/mailnames
Dec 27 14:51:28 plesk spamassassin[2506]: Starting the spamassassin filter...
Dec 27 14:51:28 plesk spamd[22507]: spamd: connection from localhost [::1]:42206 to port 783, fd 5
Dec 27 14:51:28 plesk spamd[22507]: spamd: using default config for [email protected]: /var/qmail/mailnames/customer.com/info/.spamassassin/user_prefs
Dec 27 14:51:28 plesk spamd[22507]: spamd: processing message <01000160983df374-904b1746-9835-44aa-a697-bd75b298d2ab-000000@email.amazonses.com> for [email protected]:30
Dec 27 14:51:28 plesk spamd[22507]: spamd: clean message (0.2/6.5) for [email protected]:30 in 0.5 seconds, 3677 bytes.
Dec 27 14:51:28 plesk spamd[22507]: spamd: result: . 0 - HEADER_FROM_DIFFERENT_DOMAINS,HTML_MESSAGE,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_PASS,SURBL_BLOCKED,T_DKIM_INVALID,T_RP_MATCHES_RCVD,URIBL_BLOCKED scantime=0.5,size=3677,[email protected],uid=30,required_score=6.5,rhost=localhost,raddr=::1,rport=42206,mid=<01000160983df374-904b1746-9835-44aa-a697-bd75b298d2ab-000000@email.amazonses.com>,autolearn=no autolearn_force=no
Dec 27 14:51:28 plesk dk_check[2508]: Starting the dk_check filter...
Dec 27 14:51:29 plesk spamd[22506]: prefork: child states: II
Dec 27 14:51:29 plesk dk_check[2508]: DKIM verify result: DKIM verification (d=adobe.com, 1024-bit key) succeeded
Dec 27 14:51:29 plesk dmarc[2509]: Starting the dmarc filter...
Dec 27 14:51:29 plesk dmarc[2509]: DMARC: REJECT message for [email protected]
Dec 27 14:51:29 plesk postfix-local[2505]: message discarded by a mail handler
Dec 27 14:51:29 plesk postfix/pipe[2504]: 7E8787D02E: to=<[email protected]>, relay=plesk_virtual, delay=2.8, delays=1.3/0/0/1.5, dsn=2.0.0, status=sent (delivered via plesk_virtual service)
Dec 27 14:51:29 plesk postfix/qmgr[17820]: 7E8787D02E: removed

 

[MartinB]

Hello swaan !

What I noticed right now:

Dec 27 14:51:29 plesk dmarc[2509]: DMARC: REJECT message for [email protected]

So, there must be going something wrong ...

Check your DMARC settings at the DNS ...

I wish you success


Bye, MartinB

 

[swaan]

That is exactly what I was stating in the OP: DMARC rejects - but why?

 

[swaan]

Ok I have the same problem now with accepting emails from Postmark who is sending emails as [email protected] to [email protected]
Same T_DKIM_INVALID from spamd.
dkimvalidatior.com says DKIM, SPF are both ok when I asked Postmark to send there.
plesk dk_check also results in "succeeded"
Then DMARC comes and declares REJECT.

Please help me at least understand why spamd and dk_check get different results.