Articles in this section

See more

[FIXED BUG] Mail messages with different 'smtp.mailfrom' and 'from' do not pass the DMARC filter and go to spam

Avatar
Marc Vidal
Updated
Follow

Applicable to:

  • Plesk Onyx for Linux

Symptoms

  • Mail messages from Amazon or other particular senders do not pass the DMARC filter and placed directly into Spam, or rejected by dmarc handler, as can be observed in /var/log/maillog:

    CONFIG_TEXT: spamd[11617]: prefork: child states: II
    dmarc[15077]: Starting the dmarc filter...
    dmarc[15077]: DMARC: REJECT message for user@example.com
    postfix-local[15071]: message discarded by a mail handler

  • A record like the following can be found in /var/log/maillog:

    CONFIG_TEXT: dmarc[15077]: Wrong the essential DMARC policy parameters for user@example.com

  • Correct SPF and DKIM are present in the message, as can be observed in /var/log/maillog:

    CONFIG_TEXT: spf[15067]: Starting the spf filter...
    spf[15067]: SPF result: pass
    spf[15067]: SPF status: PASS
    dk_check[15076]: Starting the dk_check filter...
    dk_check[15076]: DKIM verify result: DKIM verification (d=example.com, 1024-bit key) succeeded

  • The following can be found in /var/log/maillog through records of email handling:

    CONFIG_TEXT: server01 dmarc[27080]: DMARC: message moved to QUARANTINE for john.doe@example.com

  • Public mail server, such as Gmail, accept messages from those domains.

  • Domain in Mail-From: header in the received message differs from the domain in From: header:

    CONFIG_TEXT: Return-Path: return+jdoe@example.org
    <...>
    From: John Doe newsletter@example.org

  • Domain in the From: header has "relaxed" SPF and DKIM policy (adkim and aspf are absent, or equal to r):

    # host -t txt _dmarc.example.org
    _dmarc.example.org descriptive text "v=DMARC1; p=reject"

Cause

Product issue:

Resolution

Please consider updating your server:

Workaround

Note: In some cases, after Plesk updates are installed, it will be required to run plesk repair mail command.

Apply the latest Plesk updates.

In case an update is not an option, try applying the fix for the corresponding version:

For Plesk Onyx 17.8 on CentOS 6/Rhel 6/CloudLinux 6

For Plesk Onyx 17.8 on CentOS 6/Rhel 6/CloudLInux 6 replace the file /usr/local/psa/handlers/hooks/dmarc and /usr/local/psa/handlers/hooks/dk_check with patched one from attachments:

  1. Connect to the server via SSH

  2. Download the file from the attachment:

    # wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz

  3. Backup non-patched file and replace it with the downloaded one:

    # tar -xzvf dmarc.tar.gz
    # chmod 0750 dmarc/centos6/dmarc dmarc/centos6/dk_check
    # chown root:popuser dmarc/centos6/dmarc dmarc/centos6/dk_check
    # mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
    # mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
    # cp -a dmarc/centos6/dmarc /usr/local/psa/handlers/hooks/dmarc
    # cp -a dmarc/centos6/dk_check /usr/local/psa/handlers/hooks/dk_check

For Plesk Onyx 17.8 on CentOS 7/Rhel 7/CloudLinux 7

For Plesk Onyx 17.8 on CentOS 7/Rhel 7/CloudLinux 7 replace the file /usr/local/psa/handlers/hooks/dmarc and /usr/local/psa/handlers/hooks/dk_check with patched one from attachments:

  1. Connect to the server via SSH

  2. Download the file from the attachment:

    # wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz

  3. Backup non-patched file and replace it with the downloaded one:

    # tar -xzvf dmarc.tar.gz
    # chmod 0750 dmarc/centos7/dmarc dmarc/centos7/dk_check
    # chown root:popuser dmarc/centos7/dmarc dmarc/centos7/dk_check
    # mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
    # mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
    # cp -a dmarc/centos7/dmarc /usr/local/psa/handlers/hooks/dmarc
    # cp -a dmarc/centos7/dk_check /usr/local/psa/handlers/hooks/dk_check

For Plesk Onyx 17.8 on Debian 8

For Plesk Onyx 17.8 on Debian 8 replace the file /usr/local/psa/handlers/hooks/dmarc and /usr/local/psa/handlers/hooks/dk_check with patched one from attachments:

  1. Connect to the server via SSH

  2. Download the file from the attachment:

    # wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz

  3. Backup non-patched file and replace it with the downloaded one:

    # tar -xzvf dmarc.tar.gz
    # chmod 0750 dmarc/debian8/dmarc dmarc/debian8/dk_check
    # mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
    # mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
    # cp -a dmarc/debian8/dmarc /usr/local/psa/handlers/hooks/dmarc
    # cp -a dmarc/debian8/dk_check /usr/local/psa/handlers/hooks/dk_check

For Plesk Onyx 17.8 on Debian 9

For Plesk Onyx 17.8 on Debian 9 replace the file /usr/local/psa/handlers/hooks/dmarc and /usr/local/psa/handlers/hooks/dk_check with patched one from attachments:

  1. Connect to the server via SSH

  2. Download the file from the attachment:

    # wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz

  3. Backup non-patched file and replace it with the downloaded one:

    # tar -xzvf dmarc.tar.gz
    # chmod 0750 dmarc/debian9/dmarc dmarc/debian9/dk_check
    # chown root:popuser dmarc/debian9/dmarc dmarc/debian9/dk_check
    # mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
    # mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
    # cp -a dmarc/debian9/dmarc /usr/local/psa/handlers/hooks/dmarc
    # cp -a dmarc/debian9/dk_check /usr/local/psa/handlers/hooks/dk_check

For Plesk Onyx 17.8 on Ubuntu 14

For Plesk Onyx 17.8 on Ubuntu 14 replace the file /usr/local/psa/handlers/hooks/dmarc and /usr/local/psa/handlers/hooks/dk_check with patched one from attachments:

  1. Connect to the server via SSH

  2. Download the file from the attachment:

    # wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz

  3. Backup non-patched file and replace it with the downloaded one:

    # tar -xzvf dmarc.tar.gz
    # chmod 0750 dmarc/ubuntu14/dmarc dmarc/ubuntu14/dk_check
    # chown root:popuser dmarc/ubuntu14/dmarc dmarc/ubuntu14/dk_check
    # mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
    # mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
    # cp -a dmarc/ubuntu14/dmarc /usr/local/psa/handlers/hooks/dmarc
    # cp -a dmarc/ubuntu14/dk_check /usr/local/psa/handlers/hooks/dk_check

For Plesk Onyx 17.8 on Ubuntu 16

For Plesk Onyx 17.8 on Ubuntu 16 replace the file /usr/local/psa/handlers/hooks/dmarc and /usr/local/psa/handlers/hooks/dk_check with patched one from attachments:

  1. Connect to the server via SSH

  2. Download the file from the attachment:

    # wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz

  3. Backup non-patched file and replace it with the downloaded one:

    # tar -xzvf dmarc.tar.gz
    # chmod 0750 dmarc/ubuntu16/dmarc dmarc/ubuntu16/dk_check
    # chown root:popuser dmarc/ubuntu16/dmarc dmarc/ubuntu16/dk_check
    # mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
    # mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
    # cp -a dmarc/ubuntu16/dmarc /usr/local/psa/handlers/hooks/dmarc
    # cp -a dmarc/ubuntu16/dk_check /usr/local/psa/handlers/hooks/dk_check

For Plesk Onyx 17.8 on Ubuntu 18

For Plesk Onyx 17.8 on Ubuntu 18 replace the file /usr/local/psa/handlers/hooks/dmarc and /usr/local/psa/handlers/hooks/dk_check with patched one from attachments:

  1. Connect to the server via SSH

  2. Download the file from the attachment:

    # wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz

  3. Backup non-patched file and replace it with the downloaded one:

    # tar -xzvf dmarc.tar.gz
    # chmod 0750 dmarc/ubuntu18/dmarc dmarc/ubuntu18/dk_check
    # chown root:popuser dmarc/ubuntu18/dmarc dmarc/ubuntu18/dk_check
    # mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
    # mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
    # cp -a dmarc/ubuntu18/dmarc /usr/local/psa/handlers/hooks/dmarc
    # cp -a dmarc/ubuntu18/dk_check /usr/local/psa/handlers/hooks/dk_check

Note: Try applying the fix for corresponding version. In case it is not working, please specify the OS version and Plesk version in the comment section below.

Comments

6 comments

Sort by Date Votes
  • Avatar
    Tom Tonic

    What would I do for the combination Plesk Onyx 17.8 on Ubuntu 14.04? T/T

    0
    Comment actions Permalink
  • Avatar
    Robert Asilbekov

    @Tom Tonic The hotfix does not depend on the version, so it should not break the Plesk. However, if you facing the same issue on Plesk Onyx 17.8 on Ubuntu 14.04, I would like to recommend you to create a support request to look closer.

    0
    Comment actions Permalink
  • Avatar
    Salecroix Charly

    Hi, what would I do for the combination Plesk Onyx 17.8.11 on Debian 8.11?

    Mail messages from Mailchimp do not pass the DMARC filter and rejected by dmarc handler. As can be observed in /var/log/maillog:

    Nov 23 17:49:57 server dk_check[35313]: Starting the dk_check filter...
    Nov 23 17:49:57 server dk_check[35313]: DKIM verify result: DKIM verification (d=mailchimp.com, 1024-bit key) succeeded
    Nov 23 17:49:57 server dmarc[35314]: Starting the dmarc filter...
    Nov 23 17:49:57 server spamd[9308]: prefork: child states: II
    Nov 23 17:49:57 server dmarc[35314]: DMARC: REJECT message for user@example.com
    Nov 23 17:49:57 server postfix-local[35310]: message discarded by a mail handler



    0
    Comment actions Permalink
  • Avatar
    Robert Asilbekov

    @Salecroix Charly 

    First of all, we need to understand is it the same issue or another one, as the bug was fixed in 17.5. So I would like to recommend you referring the troubleshooting steps from 

    https://dmarcian.com/start-dmarc/  and https://dmarc.org/wiki/FAQ to get some additional details. If it will not help to shed light on the issue, you you may submit a request to support: How to submit a request to Plesk support?

    0
    Comment actions Permalink
  • Avatar
    Salecroix Charly

    @Robert Asilbekov

    Hi Robert Asilbekov,

    Indeed, is it the same issue as the bug was fixed in 17.5.
    I followed the problem solving procedure for "Plesk Onyx 17.8 on CentOS 7", CentOS getting closer to Debian.
    So I can tell you that by following this procedure the problem is now solved and Mailchimp's mail messages now pass the DMARC filter.

    I invite you to test the resolution of the problem by yourself and to provide to all users experiencing this problem in Debian this solution.

    Have a niceday everybody.

    0
    Comment actions Permalink
  • Avatar
    Robert Asilbekov

    @Salecroix Charly

    The article has been updated with hotfixes for Plesk Onyx 17.8 on Debian 8, Ubuntu 14

     

    0
    Comment actions Permalink

Please sign in to leave a comment.

Have more questions? Submit a request

Related articles