Applicable to:
- Plesk Onyx for Linux
Symptoms
-
Mail messages from Amazon or other particular senders do not pass the DMARC filter and placed directly into Spam, or rejected by dmarc handler, as can be observed in
/var/log/maillog
:CONFIG_TEXT: spamd[11617]: prefork: child states: II
dmarc[15077]: Starting the dmarc filter...
dmarc[15077]: DMARC: REJECT message for user@example.com
postfix-local[15071]: message discarded by a mail handler - A record like the following can be found in
/var/log/maillog
:CONFIG_TEXT: dmarc[15077]: Wrong the essential DMARC policy parameters for user@example.com
-
Correct SPF and DKIM are present in the message, as can be observed in
/var/log/maillog
:CONFIG_TEXT: spf[15067]: Starting the spf filter...
spf[15067]: SPF result: pass
spf[15067]: SPF status: PASS
dk_check[15076]: Starting the dk_check filter...
dk_check[15076]: DKIM verify result: DKIM verification (d=example.com, 1024-bit key) succeeded -
The following can be found in
/var/log/maillog
through records of email handling:CONFIG_TEXT: server01 dmarc[27080]: DMARC: message moved to QUARANTINE for john.doe@example.com
-
Public mail server, such as Gmail, accept messages from those domains.
-
Domain in Mail-From: header in the received message differs from the domain in From: header:
CONFIG_TEXT: Return-Path: return+jdoe@example.org
<...>
From: John Doe newsletter@example.org -
Domain in the From: header has "relaxed" SPF and DKIM policy (adkim and aspf are absent, or equal to r):
# host -t txt _dmarc.example.org
_dmarc.example.org descriptive text "v=DMARC1; p=reject"
Cause
Product issue:
-
#PPPM-6847 "Emails from amazon.de and husqvarnagroup.com now pass the DMARC verification and do not go to spam."
Fixed in:- Plesk Onyx 17.8 22 April 2019 (Linux)
- Plesk Obsidian 02 July 2018 (fixed as PPP-32584, Linux)
- Plesk Onyx 17.5 25 September 2017 (Linux)
- Plesk Onyx 17.5 14 August 2017 (Linux)
Resolution
Workaround
Note: In some cases, after Plesk updates are installed, it will be required to run plesk repair mail
command.
Apply the latest Plesk updates.
In case an update is not an option, try applying the fix for the corresponding version:
For Plesk Onyx 17.8 on CentOS 6/Rhel 6/CloudLInux 6 replace the file /usr/local/psa/handlers/hooks/dmarc
and /usr/local/psa/handlers/hooks/dk_check
with patched one from attachments:
-
Connect to the server via SSH
-
Download the file from the attachment:
# wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz
-
Backup non-patched file and replace it with the downloaded one:
# tar -xzvf dmarc.tar.gz
# chmod 0750 dmarc/centos6/dmarc dmarc/centos6/dk_check
# chown root:popuser dmarc/centos6/dmarc dmarc/centos6/dk_check
# mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
# mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
# cp -a dmarc/centos6/dmarc /usr/local/psa/handlers/hooks/dmarc
# cp -a dmarc/centos6/dk_check /usr/local/psa/handlers/hooks/dk_check
For Plesk Onyx 17.8 on CentOS 7/Rhel 7/CloudLinux 7 replace the file /usr/local/psa/handlers/hooks/dmarc
and /usr/local/psa/handlers/hooks/dk_check
with patched one from attachments:
-
Connect to the server via SSH
-
Download the file from the attachment:
# wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz
-
Backup non-patched file and replace it with the downloaded one:
# tar -xzvf dmarc.tar.gz
# chmod 0750 dmarc/centos7/dmarc dmarc/centos7/dk_check
# chown root:popuser dmarc/centos7/dmarc dmarc/centos7/dk_check
# mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
# mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
# cp -a dmarc/centos7/dmarc /usr/local/psa/handlers/hooks/dmarc
# cp -a dmarc/centos7/dk_check /usr/local/psa/handlers/hooks/dk_check
For Plesk Onyx 17.8 on Debian 8 replace the file /usr/local/psa/handlers/hooks/dmarc
and /usr/local/psa/handlers/hooks/dk_check
with patched one from attachments:
-
Connect to the server via SSH
-
Download the file from the attachment:
# wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz
-
Backup non-patched file and replace it with the downloaded one:
# tar -xzvf dmarc.tar.gz
# chmod 0750 dmarc/debian8/dmarc dmarc/debian8/dk_check
# mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
# mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
# cp -a dmarc/debian8/dmarc /usr/local/psa/handlers/hooks/dmarc
# cp -a dmarc/debian8/dk_check /usr/local/psa/handlers/hooks/dk_check
For Plesk Onyx 17.8 on Debian 9 replace the file /usr/local/psa/handlers/hooks/dmarc
and /usr/local/psa/handlers/hooks/dk_check
with patched one from attachments:
-
Connect to the server via SSH
-
Download the file from the attachment:
# wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz
-
Backup non-patched file and replace it with the downloaded one:
# tar -xzvf dmarc.tar.gz
# chmod 0750 dmarc/debian9/dmarc dmarc/debian9/dk_check
# chown root:popuser dmarc/debian9/dmarc dmarc/debian9/dk_check
# mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
# mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
# cp -a dmarc/debian9/dmarc /usr/local/psa/handlers/hooks/dmarc
# cp -a dmarc/debian9/dk_check /usr/local/psa/handlers/hooks/dk_check
For Plesk Onyx 17.8 on Ubuntu 14 replace the file /usr/local/psa/handlers/hooks/dmarc
and /usr/local/psa/handlers/hooks/dk_check
with patched one from attachments:
-
Connect to the server via SSH
-
Download the file from the attachment:
# wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz
-
Backup non-patched file and replace it with the downloaded one:
# tar -xzvf dmarc.tar.gz
# chmod 0750 dmarc/ubuntu14/dmarc dmarc/ubuntu14/dk_check
# chown root:popuser dmarc/ubuntu14/dmarc dmarc/ubuntu14/dk_check
# mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
# mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
# cp -a dmarc/ubuntu14/dmarc /usr/local/psa/handlers/hooks/dmarc
# cp -a dmarc/ubuntu14/dk_check /usr/local/psa/handlers/hooks/dk_check
For Plesk Onyx 17.8 on Ubuntu 16 replace the file /usr/local/psa/handlers/hooks/dmarc
and /usr/local/psa/handlers/hooks/dk_check
with patched one from attachments:
-
Connect to the server via SSH
-
Download the file from the attachment:
# wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz
-
Backup non-patched file and replace it with the downloaded one:
# tar -xzvf dmarc.tar.gz
# chmod 0750 dmarc/ubuntu16/dmarc dmarc/ubuntu16/dk_check
# chown root:popuser dmarc/ubuntu16/dmarc dmarc/ubuntu16/dk_check
# mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
# mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
# cp -a dmarc/ubuntu16/dmarc /usr/local/psa/handlers/hooks/dmarc
# cp -a dmarc/ubuntu16/dk_check /usr/local/psa/handlers/hooks/dk_check
For Plesk Onyx 17.8 on Ubuntu 18 replace the file /usr/local/psa/handlers/hooks/dmarc
and /usr/local/psa/handlers/hooks/dk_check
with patched one from attachments:
-
Connect to the server via SSH
-
Download the file from the attachment:
# wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz
-
Backup non-patched file and replace it with the downloaded one:
# tar -xzvf dmarc.tar.gz
# chmod 0750 dmarc/ubuntu18/dmarc dmarc/ubuntu18/dk_check
# chown root:popuser dmarc/ubuntu18/dmarc dmarc/ubuntu18/dk_check
# mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
# mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
# cp -a dmarc/ubuntu18/dmarc /usr/local/psa/handlers/hooks/dmarc
# cp -a dmarc/ubuntu18/dk_check /usr/local/psa/handlers/hooks/dk_check
Note: Try applying the fix for corresponding version. In case it is not working, please specify the OS version and Plesk version in the comment section below.
Comments
6 comments
What would I do for the combination Plesk Onyx 17.8 on Ubuntu 14.04? T/T
@Tom Tonic The hotfix does not depend on the version, so it should not break the Plesk. However, if you facing the same issue on Plesk Onyx 17.8 on Ubuntu 14.04, I would like to recommend you to create a support request to look closer.
Hi, what would I do for the combination Plesk Onyx 17.8.11 on Debian 8.11?
Mail messages from Mailchimp do not pass the DMARC filter and rejected by dmarc handler. As can be observed in
/var/log/maillog
:Nov 23 17:49:57 server dk_check[35313]: Starting the dk_check filter...
Nov 23 17:49:57 server dk_check[35313]: DKIM verify result: DKIM verification (d=mailchimp.com, 1024-bit key) succeeded
Nov 23 17:49:57 server dmarc[35314]: Starting the dmarc filter...
Nov 23 17:49:57 server spamd[9308]: prefork: child states: II
Nov 23 17:49:57 server dmarc[35314]: DMARC: REJECT message for user@example.com
Nov 23 17:49:57 server postfix-local[35310]: message discarded by a mail handler
@Salecroix Charly
First of all, we need to understand is it the same issue or another one, as the bug was fixed in 17.5. So I would like to recommend you referring the troubleshooting steps from
https://dmarcian.com/start-dmarc/ and https://dmarc.org/wiki/FAQ to get some additional details. If it will not help to shed light on the issue, you you may submit a request to support: How to submit a request to Plesk support?
@Robert Asilbekov
Hi Robert Asilbekov,
Indeed, is it the same issue as the bug was fixed in 17.5.
I followed the problem solving procedure for "Plesk Onyx 17.8 on CentOS 7", CentOS getting closer to Debian.
So I can tell you that by following this procedure the problem is now solved and Mailchimp's mail messages now pass the DMARC filter.
I invite you to test the resolution of the problem by yourself and to provide to all users experiencing this problem in Debian this solution.
Have a niceday everybody.
@Salecroix Charly
The article has been updated with hotfixes for Plesk Onyx 17.8 on Debian 8, Ubuntu 14
Please sign in to leave a comment.