Question Plesk server in a cPanel farm

[Littleboy]

Server operating system version

Debian 10.13

Plesk version and microupdate number

Plesk Obsidian 18.0.61 Update #6

Hi all.
I hope you can help me with this.

I have a cPanel solution farm, with different servers. DNSOnly servers from cPanel, Hosting servers with cPanel, and Plesk servers:

1. DNS Servers where created with nsx.domainname.com (only cPanel)

2. Hosting servers where created with hsx.domainname.com (cPanel and Plesk)



There is a cPanel hosting server with the donaminane.com DNS configured, as it is synchronized with NS1 and NS2 servers (nsx.domainname.com).

That hosting one is called hs1.domainname.com, and DNS are ns1.domainname.com and ns2.domainname.com (for privacy reasons, of course)


My hosting plesk server was created with a hostname hs2.domainname.com and it has only one domain name from a client working alone.
Everything seems to work fine. But, every single email from the server/system (not from the client domain) is marked as a possible spam.
As you can imagine, there is no domainname.com or hs2.domainname.com account created on that server.

Therefore, all the queries to hs3.domainname.com are just solved by DNS servers with an A record. But the server itself has not DNS info, no DKIM, no SPF, nothing. Just the hostname and IP.


I just need to know how should i configure that plesk server to create a DKIM and SPF to send safe and signed emails from the system.
Should i create a domain name called hs2.domainname.com in the Plesk server? What kind of configuration on DNS, because, DNS servers are the cPanel farm, and the domainname.com is hosted in another hosting server.

I assume that if i create that, the access through a browser "hs2.domainname.com:8443" won't work at all, at least, until i solve this redirection.
Please, note that the templates on the plesk server, or DNS zones are clean, no information is declared.



I would really appreciate someone to help me.

 

[Kaspar@Plesk]

Hi there,

Everything seems to work fine. But, every single email from the server/system (not from the client domain) is marked as a possible spam.
As you can imagine, there is no domainname.com or hs2.domainname.com account created on that server.

That fine, it's not necessary to have the host as domain in Plesk.

Therefore, all the queries to hs3.domainname.com are just solved by DNS servers with an A record. But the server itself has not DNS info, no DKIM, no SPF, nothing. Just the hostname and IP.

Generally DKIM is not required. But having a SPF and DMARC record are recommended (and required by some providers). So make sure those records exists for hs3.domainname.com. Also make sure that you have rDNS setup correctly and pointing to hs3.domainname.com.

 

[Littleboy]

Hello,
First of all, thank you Kaspar.

I do not understand how can i configure the server to send system mails with DKIM, DMARC and SPF, because there is no place to do it.
I am not sure if you are suggesting to create DKIM, SPF and DMARC on hs1 (host server 1 who has domainname.com setup with DNS), and copy-paste on plesk afterwards.

Please, can you help me with the steps?
Otherwise, my solution is to deploy my clients on cPanel and close Plesk server.

 

[Kaspar@Plesk]

I do not understand how can i configure the server to send system mails with DKIM, DMARC and SPF, because there is no place to do it.

I think I need to emphasize that email messages aren't 'sent' with DMARC or SPF. These are authentication checks done at receiving side. However you do need to configure these for the sending domain. DKIM is done at the sending side. It adds an key to the email which can be validated by the receiving server. I wanted to point that to avoid any confusion. However DKIM isn't relevant in this case as the notification aren't signed with DKIM.

I am not sure if you are suggesting to create DKIM, SPF and DMARC on hs1 (host server 1 who has domainname.com setup with DNS), and copy-paste on plesk afterwards.

On the DNS zone for domainname.com you create a TXT record for the hs3 host for both SPF and DMARC.

For SPF record you can use something like v=spf1 a -all. For the DMARC record you can use something like: v=DMARC1; p=none.

That's all there is to it.

 

[Littleboy]

Hi Kaspar,
Thank you for your explanations.

So, to be clear. Your suggestion is to:

SERVER HS1
Current SPF:
domainname.com 14400 TXT v=spf1 +mx +a -all (that is default SPF from cPanel domain creation)
Current DMARC:
_dmarc.domainname.com 14400 TXT v=DMARC1;p=reject;sp=reject;adkim=r;aspf=r;pct=100;fo=0;rf=afrf;ri=86400;rua=mailto:[email protected];ruf=mailto:[email protected]
Current A:
hs2.domainname.com 14400 A XX.XX.XX.XX


YOUR SUGGESTION: Add TXT on HS1
Custom SPF:
hs2.domainname.com 14400 TXT v=spf1 a -all
Custom DMARC:
_dmarc.hs2.domainname.com 14400 TXT v=DMARC1;p=reject;sp=reject;adkim=r;aspf=r;pct=100;fo=0;rf=afrf;ri=86400;rua=mailto:[email protected];ruf=mailto:[email protected]

After that, i was checking through online tools like DMARCIAN or MXTOOLBOX, and all of them agreed with this configuration.

However, i have my reasonable doubts about this, that maybe you can explain to me (for security reasons).
In your suggestion, you are using A label for SPF, but it is true that HS2 is not declared here. I mean, there must be only one server with hs2.domainname.com sending emails labeled or marked "from hs2.domainame.com". We do not want HS1 to mark or label those emails (at least, i do not want it, for identification reasons). That A label or value or modifier, seems to be that local IP can send emails. Maybe I should change this for "a:xx.xx.xx.xx" (where xx is the hs2 IP).
Please note that, there is no CNAME for hs2.domainname.com on HS1.

I don't know if i explained right my doubts.
I know, i should be an expert using SPF and DMARC, but I am not

And, the final question: (please, do not hate me)
Should I add something to PLESK server to make system emails properly signed according with this new DNS configuration. How can i check it?

 

[Kaspar@Plesk]

So, to be clear. Your suggestion is to:

SERVER HS1
Current SPF:
domainname.com 14400 TXT v=spf1 +mx +a -all (that is default SPF from cPanel domain creation)
Current DMARC:
_dmarc.domainname.com 14400 TXT v=DMARC1;p=reject;sp=reject;adkim=r;aspf=r;pct=100;fo=0;rf=afrf;ri=86400;rua=mailto:[email protected];ruf=mailto:[email protected]
Current A:
hs2.domainname.com 14400 A XX.XX.XX.XX

These SPF and DMARC records are for the domainname.com (second level) domain. Which, as far as any mail authentication protocol (like SPF and DMARC) is concerned, are unrelated to hs2.domainname.com subdomain. So they don't have any influence on mail sent from you Plesk server.

YOUR SUGGESTION: Add TXT on HS1
Custom SPF:
hs2.domainname.com 14400 TXT v=spf1 a -all
Custom DMARC:
_dmarc.hs2.domainname.com 14400 TXT v=DMARC1;p=reject;sp=reject;adkim=r;aspf=r;pct=100;fo=0;rf=afrf;ri=86400;rua=mailto:[email protected];ruf=mailto:[email protected]

The DMARC policy seems a bit more complicated than it needs to be. But it's alright. To only note I have would be that the aspf=r part defines a relaxed alignment policy for SPF. I'd consider using a strict alignment policy for SPF (aspf=s).

However, i have my reasonable doubts about this, that maybe you can explain to me (for security reasons).
In your suggestion, you are using A label for SPF, but it is true that HS2 is not declared here. I mean, there must be only one server with hs2.domainname.com sending emails labeled or marked "from hs2.domainame.com". We do not want HS1 to mark or label those emails (at least, i do not want it, for identification reasons). That A label or value or modifier, seems to be that local IP can send emails. Maybe I should change this for "a:xx.xx.xx.xx" (where xx is the hs2 IP).
Please note that, there is no CNAME for hs2.domainname.com on HS1.

The a qualifier in the SPF record would only allow mail from the IP address used for hs2.domainname.com (based on the DNS A type record for hs2.domainname.com). But you can used the ip4 qualifier instead if you like (ip4:123.123.123.123)

I don't know if i explained right my doubts.
I know, i should be an expert using SPF and DMARC, but I am not

Don't sweat it. This a difficult topic and hard to grasp for most
A good resource that explains SPF pretty well (and I still frequently use myself) is: SPF record: Protect your domain reputation and email delivery

And, the final question: (please, do not hate me)

I would never.

Should I add something to PLESK server to make system emails properly signed according with this new DNS configuration. How can i check it?

Nope, nothing else you need to do. (That is, if I have understand your initial issue correctly. Which I hope I do).