Facebook
Twitter
Hi!
I recently added DKIM to my Plesk 12.0.8 #10 setup since it is essential to not have my emails being more likely to go into Gmail user's spam folders. That is when I noticed an issue with SPF not allowing any HELO messages from localhost. This clashes with the way postfix's cleanup server works (http://www.postfix.org/MILTER_README.html):
There's one small complication when using Milter applications for non-SMTP mail: there is no SMTP session. To keep Milter applications happy, the Postfix cleanup(8) server actually has to simulate the SMTP client CONNECT and DISCONNECT events, and the SMTP client EHLO, MAIL FROM, RCPT TO and DATA commands.
When new mail arrives via the sendmail(1) command line, the Postfix cleanup(8) server pretends that the mail arrives with ESMTP from "localhost" with IP address "127.0.0.1". The result is very similar to what happens with command line submissions in Sendmail version 8.12 and later, although Sendmail uses a different mechanism to achieve this result.
The point where it breaks is written into postfix/main.cf:
milter_protocol=6
non_smtpd_milters = inet:127.0.0.1:8891, inet:127.0.0.1:12768
With the opendkim daemon listening on port 8891 and psa-pc-remote on 12768.
The problem not only occurs with mail originated locally (e.g. php-scripts sending mail via Wordpress using sendmail) but also if a local mail recipient is configured to forward to an external email address. It doesn't happen with milter_protocol=2 but together with opendkim, the psa-pc-remote crashes with a segfault then (http://blog.matoski.com/articles/spf-dk-dkim-plesk-debian/). milter_protocol=6 is also the default for current postfix setups.
Anyway, during the milter action, mail is sent with a HELO message from localhost which is generally not allowed by Plesk's SPF implementation resulting in mail being bounced:
spf filter[18524]: Wrong HELO hostname: localhost
The best workaround I found so far is to take out psa-pc-remote for non_smtpd_milters but leave it in for smtpd_milters:
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:127.0.0.1:8891, inet:127.0.0.1:12768
non_smtpd_milters = inet:127.0.0.1:8891
Another one is to leave psa-pc-remote in for non_smtpd_milters but disable SPF checking in the panel.
Since I believe the first workaround disables the new outgoing mail limitation and possibly other things, this is something the Plesk team should definitely look into in my opinion. Apparently, they already are but the fix has not arrived so far:
http://forum.parallels.com/showthre...mail-binary-are-blocked-because-of-wrong-HELO
reported to development (PPP-10678 for your reference)
Just thought this might be interesting to other users possibly running into this issue.
Kind regards
I recently added DKIM to my Plesk 12.0.8 #10 setup since it is essential to not have my emails being more likely to go into Gmail user's spam folders. That is when I noticed an issue with SPF not allowing any HELO messages from localhost. This clashes with the way postfix's cleanup server works (http://www.postfix.org/MILTER_README.html):
There's one small complication when using Milter applications for non-SMTP mail: there is no SMTP session. To keep Milter applications happy, the Postfix cleanup(8) server actually has to simulate the SMTP client CONNECT and DISCONNECT events, and the SMTP client EHLO, MAIL FROM, RCPT TO and DATA commands.
When new mail arrives via the sendmail(1) command line, the Postfix cleanup(8) server pretends that the mail arrives with ESMTP from "localhost" with IP address "127.0.0.1". The result is very similar to what happens with command line submissions in Sendmail version 8.12 and later, although Sendmail uses a different mechanism to achieve this result.
The point where it breaks is written into postfix/main.cf:
milter_protocol=6
non_smtpd_milters = inet:127.0.0.1:8891, inet:127.0.0.1:12768
With the opendkim daemon listening on port 8891 and psa-pc-remote on 12768.
The problem not only occurs with mail originated locally (e.g. php-scripts sending mail via Wordpress using sendmail) but also if a local mail recipient is configured to forward to an external email address. It doesn't happen with milter_protocol=2 but together with opendkim, the psa-pc-remote crashes with a segfault then (http://blog.matoski.com/articles/spf-dk-dkim-plesk-debian/). milter_protocol=6 is also the default for current postfix setups.
Anyway, during the milter action, mail is sent with a HELO message from localhost which is generally not allowed by Plesk's SPF implementation resulting in mail being bounced:
spf filter[18524]: Wrong HELO hostname: localhost
The best workaround I found so far is to take out psa-pc-remote for non_smtpd_milters but leave it in for smtpd_milters:
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:127.0.0.1:8891, inet:127.0.0.1:12768
non_smtpd_milters = inet:127.0.0.1:8891
Another one is to leave psa-pc-remote in for non_smtpd_milters but disable SPF checking in the panel.
Since I believe the first workaround disables the new outgoing mail limitation and possibly other things, this is something the Plesk team should definitely look into in my opinion. Apparently, they already are but the fix has not arrived so far:
http://forum.parallels.com/showthre...mail-binary-are-blocked-because-of-wrong-HELO
reported to development (PPP-10678 for your reference)
Just thought this might be interesting to other users possibly running into this issue.
Kind regards
