Resolved Lots of DKIM/DMARC errors - mails are rejected

[TorbHo]

Server operating system version

Debian 11.11

Plesk version and microupdate number

Plesk Obsidian 18.0.68 Update 2

We are currently receiving a large number of DKIM/DMARC errors. All emails with a DMARC policy of "reject" are being rejected. There doesn’t seem to be any reasonable cause for this, so we wanted to disable DMARC until the issue can be narrowed down.

However, disabling the DMARC check for incoming emails and restarting Postfix doesn't seem to have any effect — the errors persist and emails continue to be rejected.

How can we properly disable the DMARC check?

Disabling DMARC under Tools and Settings > Mail Server Settings > DMARC has no effect.

Logs show

2025-04-08 14:31:57   
warning
dmarc [2748749]
B82806B21F8B: DMARC: smtpdomain=senderdomain.de maildomain=senderdomain.de [email protected] stamp=1744115517 ip=xx.xxx.xxx.xx adkim=relaxed aspf=relaxed p=REJECT sp=UNSPECIFIED pct=100 align_dkim=fail align_spf=fail spfres=softfail dkimres=pass dmarccheck=DMARC_POLICY_REJECT dmarcstatus=STOP

 

[Sebahat.hadzhi]

Hello, @TorbHo . Could you please run the following command and provide the output (you can private message me if more convenient):

grep "B82806B21F8B" /var/log/maillog

 

[TorbHo]

@Sebahat.hadzhi
Thank you for your response. Here is the output:

Apr  8 14:31:56 servername postfix/smtpd[2745145]: B82806B21F8B: client=mx.mailserver.de[9x.9x.2x.1xx]
Apr  8 14:31:56 servername psa-pc-remote[1680301]: B82806B21F8B: from=<[email protected]> to=<[email protected]>
Apr  8 14:31:56 servername postfix/cleanup[2745112]: B82806B21F8B: message-id=<AM6PR05MB54736EC34579BF8A365EB10ACFB52@AM6PR05MB5473.eurprdxx.prod.outlook.com>
Apr  8 14:31:57 servername psa-pc-remote[1680301]: B82806B21F8B: py-limit-out: stderr: INFO:__main__:No SMTP AUTH and not running in sendmail context (incoming or unrestricted outgoing mail). SKIP message.
Apr  8 14:31:57 servername psa-pc-remote[1680301]: B82806B21F8B: py-limit-out: stderr: SKIP
Apr  8 14:31:57 servername psa-pc-remote[1680301]: B82806B21F8B: check-quota: stderr: SKIP
Apr  8 14:31:57 servername psa-pc-remote[1680301]: B82806B21F8B: spf: stderr: PASS
Apr  8 14:31:57 servername psa-pc-remote[1680301]: B82806B21F8B: dk_check: stderr: PASS
Apr  8 14:31:57 servername dmarc[2748749]: B82806B21F8B: DMARC: smtpdomain=smdtpdomain.de maildomain=smdtpdomain.de [email protected] stamp=1744115517 ip=9x.9x.2x.1xx adkim=relaxed aspf=relaxed p=REJECT sp=UNSPECIFIED pct=100 align_dkim=fail align_spf=fail spfres=softfail dkimres=pass dmarccheck=DMARC_POLICY_REJECT dmarcstatus=STOP
Apr  8 14:31:57 servername psa-pc-remote[1680301]: B82806B21F8B: dmarc: stderr: REJECT
Apr  8 14:31:57 servername postfix/cleanup[2745112]: B82806B21F8B: milter-reject: END-OF-MESSAGE from mx.mailserver.de[9x.9x.2x.1xx]: 5.7.1 Command rejected; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mx.mailserver.de>

 

[Sebahat.hadzhi]

Thank you for the update. So, it looks like the SPF and DKIM checks are successful, and what I believe happens here is the address in the envelope from doesn't match and this results in SPF and DKIM alignment failure. This is just my guess. I am not quite sure why the emails are still rejected if you have disable the setting.

Could you please try applying the workaround from the following guide for the senders you have having issues with:

• https://support.plesk.com/hc/en-us/...-a-domain-from-DMARC-check-in-Plesk-for-Linux

 

[iainh]

@TorbHo, set your DMARC policy to none or quarantine, then send a message to another mail service (which should be delivered with a DMARC policy of 'none') and inspect the header. As @Sebahat.hadzhi said, you likly have a domain conformance failure, probably due to you setting the 5322.From header to something differen to the 5321.MailFrom domain and DKIM signing domain. The 'C' on the end of DMARC is for 'domain conformance. Basically...

• The 'From' address in your Email (the 5322.From) MUST match (conform to) the domain in the 5321.MailFrom used by your mail server when sending the message, AND...
• The From address (5322.From) MUST match the domain used for the DKIM signing

This is to stop you sending a message with a From that looks like it's from a legit sender, but actually getting an SPF pass with your mail server sending 'bad-domain.ru'. Likewise the DKIM signature. No good it passing a 'badguys.ru' signature if the visible From is for something quite different.

Having a smaple SMTP header form a test with p=none set will allow you to see what the service things of the Email. A test Gmail acocunt is helpful for this kind of thing

 

[TorbHo]

Thank you very much for your help.
We were able to narrow down the issue further. It appears to be related to the fact that we have a spam filter server in front of the mail server in place that relays the emails to the destination server.

We added the spam filter’s IP address to the local SPF rules under

Tools and Settings > Mail Server Settings > Local SPF-Settings

and now it seems to be working.