Issue Lots of DKIM/DMARC errors - mails are rejected

[TorbHo]

Server operating system version

Debian 11.11

Plesk version and microupdate number

Plesk Obsidian 18.0.68 Update 2

We are currently receiving a large number of DKIM/DMARC errors. All emails with a DMARC policy of "reject" are being rejected. There doesn’t seem to be any reasonable cause for this, so we wanted to disable DMARC until the issue can be narrowed down.

However, disabling the DMARC check for incoming emails and restarting Postfix doesn't seem to have any effect — the errors persist and emails continue to be rejected.

How can we properly disable the DMARC check?

Disabling DMARC under Tools and Settings > Mail Server Settings > DMARC has no effect.

Logs show

2025-04-08 14:31:57   
warning
dmarc [2748749]
B82806B21F8B: DMARC: smtpdomain=senderdomain.de maildomain=senderdomain.de [email protected] stamp=1744115517 ip=xx.xxx.xxx.xx adkim=relaxed aspf=relaxed p=REJECT sp=UNSPECIFIED pct=100 align_dkim=fail align_spf=fail spfres=softfail dkimres=pass dmarccheck=DMARC_POLICY_REJECT dmarcstatus=STOP

 

[Sebahat.hadzhi]

Hello, @TorbHo . Could you please run the following command and provide the output (you can private message me if more convenient):

grep "B82806B21F8B" /var/log/maillog

 

[TorbHo]

@Sebahat.hadzhi
Thank you for your response. Here is the output:

Apr  8 14:31:56 servername postfix/smtpd[2745145]: B82806B21F8B: client=mx.mailserver.de[9x.9x.2x.1xx]
Apr  8 14:31:56 servername psa-pc-remote[1680301]: B82806B21F8B: from=<[email protected]> to=<[email protected]>
Apr  8 14:31:56 servername postfix/cleanup[2745112]: B82806B21F8B: message-id=<AM6PR05MB54736EC34579BF8A365EB10ACFB52@AM6PR05MB5473.eurprdxx.prod.outlook.com>
Apr  8 14:31:57 servername psa-pc-remote[1680301]: B82806B21F8B: py-limit-out: stderr: INFO:__main__:No SMTP AUTH and not running in sendmail context (incoming or unrestricted outgoing mail). SKIP message.
Apr  8 14:31:57 servername psa-pc-remote[1680301]: B82806B21F8B: py-limit-out: stderr: SKIP
Apr  8 14:31:57 servername psa-pc-remote[1680301]: B82806B21F8B: check-quota: stderr: SKIP
Apr  8 14:31:57 servername psa-pc-remote[1680301]: B82806B21F8B: spf: stderr: PASS
Apr  8 14:31:57 servername psa-pc-remote[1680301]: B82806B21F8B: dk_check: stderr: PASS
Apr  8 14:31:57 servername dmarc[2748749]: B82806B21F8B: DMARC: smtpdomain=smdtpdomain.de maildomain=smdtpdomain.de [email protected] stamp=1744115517 ip=9x.9x.2x.1xx adkim=relaxed aspf=relaxed p=REJECT sp=UNSPECIFIED pct=100 align_dkim=fail align_spf=fail spfres=softfail dkimres=pass dmarccheck=DMARC_POLICY_REJECT dmarcstatus=STOP
Apr  8 14:31:57 servername psa-pc-remote[1680301]: B82806B21F8B: dmarc: stderr: REJECT
Apr  8 14:31:57 servername postfix/cleanup[2745112]: B82806B21F8B: milter-reject: END-OF-MESSAGE from mx.mailserver.de[9x.9x.2x.1xx]: 5.7.1 Command rejected; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mx.mailserver.de>

 

[Sebahat.hadzhi]

Thank you for the update. So, it looks like the SPF and DKIM checks are successful, and what I believe happens here is the address in the envelope from doesn't match and this results in SPF and DKIM alignment failure. This is just my guess. I am not quite sure why the emails are still rejected if you have disable the setting.

Could you please try applying the workaround from the following guide for the senders you have having issues with:

• https://support.plesk.com/hc/en-us/...-a-domain-from-DMARC-check-in-Plesk-for-Linux