Forwarded to devs Possible DMARC Bypass - Spoofed MAILER-DAEMON Return-Path Not Rejected

[nethubonline]

Username:

TITLE

Possible DMARC Bypass - Spoofed MAILER-DAEMON Return-Path Not Rejected

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE

Plesk 18.0.76, AlmaLinux release 9.4

PROBLEM DESCRIPTION

Inbound spoofed emails are accepted even when SPF, DKIM, and DMARC are properly configured (including DMARC policy set to p=reject), if the attacker forges the envelope sender as MAILER-DAEMON.

Spammers can impersonate system-generated bounce messages by setting:

• Return-Path: <MAILER-DAEMON> (empty/null sender)
• From: an address within the protected domain (e.g., [email protected])

These messages are delivered to users instead of being rejected, allowing spoofing despite strict DMARC policy.

STEPS TO REPRODUCE

1. Configure a domain in Plesk with:
   • DKIM Verify incoming mail: enabled
   • Enable SPF spam protection to check incoming mail: enabled
   • Enable DMARC to check incoming mail: enabled
   • DMARC DNS record set to "v=DMARC1; p=reject; sp=none;"
   • SPF DNS record set to "v=spf1 a mx -all"
     
2. Send an email to a mailbox on that domain using a script that forges the envelope sender as MAILER-DAEMON.
   Example PHP script:
   
   
   

   <?php
   
   $to = "[email protected]";
   $subject = "Test Message";
   $message = "This is a spoofing email.";
   $headers = [];
   $headers[] = "From: [email protected]";
   $headers[] = "Reply-To: [email protected]";
   
   mail(
       $to,
       $subject,
       $message,
       implode("\r\n", $headers),
       "-f MAILER-DAEMON"
   );

   
   
3. Observe whether the message is accepted by the mail server.

ACTUAL RESULT

The spoofed message is accepted and delivered to the recipient's mailbox.

DMARC policy (p=reject) is not enforced for messages using an empty or MAILER-DAEMON envelope sender.

EXPECTED RESULT

The message should be rejected during SMTP reception because:

• The From domain is spoofed
• Authentication checks fail alignment
• DMARC policy is set to reject

Forged bounce messages should not bypass domain authentication protections.

ANY ADDITIONAL INFORMATION

This behavior allows attackers to impersonate system notifications or bounce messages, which may lead to spam delivery or phishing attempts.

The issue appears related to how null senders (<>) or MAILER-DAEMON envelope senders are treated during DMARC evaluation.

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM

Confirm bug

 

[Sebahat.hadzhi]

Thank you for the report, @nethubonline . I forwarded it to our team for further review.

 

[Sebahat.hadzhi]

@nethubonline , could you please confirm whether Plesk Email Security and Amavis are used on your server? Thank you in advance.