Forwarded to devs SPF record is checked on local zone active while zone is remote

[Kaspar]

Username:

TITLE

SPF record is checked on local zone active while zone is remote

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE

Plesk 18.0.78#3
Alma 9.8

PROBLEM DESCRIPTION

If the DNS zone for a domain is managed remotely, but a zone exists in Plesk (because the domain has been added in Plesk), it seems that when receiving mail for this domain, the SPF record is checked locally, rather than SPF record from the active remote DNS zone.

I ran into this issue on an production environment today and vaguely seem to remember that this issue may already have been reported in the past, but I am not 100% sure. I could not find any similar report and decided to report it in case it's not a known issue yet.

STEPS TO REPRODUCE

1) Setup two domains in Plesk (domain-a.ro & domain-b.ro)
2) Create an mailbox for domain domain-a.ro
3) Create or sync the DNS zone of the other domain (domain-b.ro) to an remote DNS server or service (for example CloudFlare)
4) Point name servers to remote DNS server /service of the the other domain (domain-b.ro)
5) For testing purposes edit the SPF record of the other domain (domain-b.ro) from the remote DNS zone to fail everything (v=spf1 -all)
6) From an different server send an email to the mailbox of the domain-a.ro (created in the 2nd step) while suing domain-b.ro as the sending domain

If needed, you can change the SPF record from the local zone in Plesk and run more tests to see that the local SPF record is used instead of the remote SPF record.

ACTUAL RESULT

The the SPF record (v=spf1 -all) of the domain from the external zone is ignored and instead the local SPF record is used for validation.

EXPECTED RESULT

When validating the sending domain with SPF, the SPF record is used from the actual active DNS zone.

ANY ADDITIONAL INFORMATION

(DID NOT ANSWER QUESTION)

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM

Confirm bug

 

[Sebahat.hadzhi]

Hi, Kaspar. I was unable to find an existing report for the behavior. Forwarded to our team for a further review.

 

[Sebahat.hadzhi]

Thank you for your patience, Kaspar. Our team was unable to replicate the behavior. The SPF filter uses locally configured resolver, so they suggest checking and correcting the settings of the local DNS resolver.