Mail messages with different 'smtp.mailfrom' and 'from' do not pass the DMARC filter and go to spam – Plesk Help Center

Applicable to:

Plesk Onyx for Linux

Note: This article has the reference to the issue with the fix available:

#PPPM-6847 "Mail from specific senders, including amazon.de and husqvarnagroup.com, could not pass DMARC verification."
Fixed in:
- Plesk Onyx 17.5.3 Update 18 14 August 2017 (Linux)
- Plesk Onyx 17.5.3 Update 23 25 September 2017 (Linux)
- Plesk Onyx 17.8.11 Update 51 22 April 2019 (Linux)

Please consider updating your server:

Symptoms

Mail messages from Amazon or other particular senders do not pass the DMARC filter and placed directly into Spam, or rejected by dmarc handler, as can be observed in /var/log/maillog:

CONFIG_TEXT: spamd[11617]: prefork: child states: II
dmarc[15077]: Starting the dmarc filter...
dmarc[15077]: DMARC: REJECT message for user@example.com
postfix-local[15071]: message discarded by a mail handler
A record like the following can be found in /var/log/maillog:
CONFIG_TEXT: dmarc[15077]: Wrong the essential DMARC policy parameters for user@example.com
Correct SPF and DKIM are present in the message, as can be observed in /var/log/maillog:

CONFIG_TEXT: spf[15067]: Starting the spf filter...
spf[15067]: SPF result: pass
spf[15067]: SPF status: PASS
dk_check[15076]: Starting the dk_check filter...
dk_check[15076]: DKIM verify result: DKIM verification (d=example.com, 1024-bit key) succeeded
The following can be found in /var/log/maillog through records of email handling:

CONFIG_TEXT: server01 dmarc[27080]: DMARC: message moved to QUARANTINE for john.doe@example.com
Public mail server, such as Gmail, accept messages from those domains.
Domain in Mail-From: header in the received message differs from the domain in From: header:

CONFIG_TEXT: Return-Path: return+jdoe@example.org
<...>
From: John Doe newsletter@example.org
Domain in the From: header has "relaxed" SPF and DKIM policy (adkim and aspf are absent, or equal to r):

# host -t txt _dmarc.example.org
_dmarc.example.org descriptive text "v=DMARC1; p=reject"

Cause

A bug in the product with ID #PPPM-6847 which is planned to be completely fixed in future Plesk updates.

Resolution

Note: In some cases, after Plesk updates are installed, it will be required to run plesk repair mail command.

Apply the latest Plesk updates.

In case an update is not an option, try applying the fix for the corresponding version:

For Plesk Onyx 17.8 on CentOS 6/Rhel 6/CloudLinux 6

For Plesk Onyx 17.8 on CentOS 6/Rhel 6/CloudLInux 6 replace the file /usr/local/psa/handlers/hooks/dmarc and /usr/local/psa/handlers/hooks/dk_check with patched one from attachments:

Connect to the server via SSH
Download the file from the attachment:

# wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz
Backup non-patched file and replace it with the downloaded one:

# tar -xzvf dmarc.tar.gz
# chmod 0750 dmarc/centos6/dmarc dmarc/centos6/dk_check
# chown root:popuser dmarc/centos6/dmarc dmarc/centos6/dk_check
# mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
# mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
# cp -a dmarc/centos6/dmarc /usr/local/psa/handlers/hooks/dmarc
# cp -a dmarc/centos6/dk_check /usr/local/psa/handlers/hooks/dk_check

For Plesk Onyx 17.8 on CentOS 7/Rhel 7/CloudLinux 7

For Plesk Onyx 17.8 on CentOS 7/Rhel 7/CloudLinux 7 replace the file /usr/local/psa/handlers/hooks/dmarc and /usr/local/psa/handlers/hooks/dk_check with patched one from attachments:

Connect to the server via SSH
Download the file from the attachment:

# wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz
Backup non-patched file and replace it with the downloaded one:

# tar -xzvf dmarc.tar.gz
# chmod 0750 dmarc/centos7/dmarc dmarc/centos7/dk_check
# chown root:popuser dmarc/centos7/dmarc dmarc/centos7/dk_check
# mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
# mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
# cp -a dmarc/centos7/dmarc /usr/local/psa/handlers/hooks/dmarc
# cp -a dmarc/centos7/dk_check /usr/local/psa/handlers/hooks/dk_check

For Plesk Onyx 17.8 on Debian 8

For Plesk Onyx 17.8 on Debian 8 replace the file /usr/local/psa/handlers/hooks/dmarc and /usr/local/psa/handlers/hooks/dk_check with patched one from attachments:

Connect to the server via SSH
Download the file from the attachment:

# wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz
Backup non-patched file and replace it with the downloaded one:

# tar -xzvf dmarc.tar.gz
# chmod 0750 dmarc/debian8/dmarc dmarc/debian8/dk_check
# mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
# mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
# cp -a dmarc/debian8/dmarc /usr/local/psa/handlers/hooks/dmarc
# cp -a dmarc/debian8/dk_check /usr/local/psa/handlers/hooks/dk_check

For Plesk Onyx 17.8 on Debian 9

For Plesk Onyx 17.8 on Debian 9 replace the file /usr/local/psa/handlers/hooks/dmarc and /usr/local/psa/handlers/hooks/dk_check with patched one from attachments:

Connect to the server via SSH
Download the file from the attachment:

# wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz
Backup non-patched file and replace it with the downloaded one:

# tar -xzvf dmarc.tar.gz
# chmod 0750 dmarc/debian9/dmarc dmarc/debian9/dk_check
# chown root:popuser dmarc/debian9/dmarc dmarc/debian9/dk_check
# mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
# mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
# cp -a dmarc/debian9/dmarc /usr/local/psa/handlers/hooks/dmarc
# cp -a dmarc/debian9/dk_check /usr/local/psa/handlers/hooks/dk_check

For Plesk Onyx 17.8 on Ubuntu 14

For Plesk Onyx 17.8 on Ubuntu 14 replace the file /usr/local/psa/handlers/hooks/dmarc and /usr/local/psa/handlers/hooks/dk_check with patched one from attachments:

Connect to the server via SSH
Download the file from the attachment:

# wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz
Backup non-patched file and replace it with the downloaded one:

# tar -xzvf dmarc.tar.gz
# chmod 0750 dmarc/ubuntu14/dmarc dmarc/ubuntu14/dk_check
# chown root:popuser dmarc/ubuntu14/dmarc dmarc/ubuntu14/dk_check
# mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
# mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
# cp -a dmarc/ubuntu14/dmarc /usr/local/psa/handlers/hooks/dmarc
# cp -a dmarc/ubuntu14/dk_check /usr/local/psa/handlers/hooks/dk_check

For Plesk Onyx 17.8 on Ubuntu 16

For Plesk Onyx 17.8 on Ubuntu 16 replace the file /usr/local/psa/handlers/hooks/dmarc and /usr/local/psa/handlers/hooks/dk_check with patched one from attachments:

Connect to the server via SSH
Download the file from the attachment:

# wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz
Backup non-patched file and replace it with the downloaded one:

# tar -xzvf dmarc.tar.gz
# chmod 0750 dmarc/ubuntu16/dmarc dmarc/ubuntu16/dk_check
# chown root:popuser dmarc/ubuntu16/dmarc dmarc/ubuntu16/dk_check
# mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
# mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
# cp -a dmarc/ubuntu16/dmarc /usr/local/psa/handlers/hooks/dmarc
# cp -a dmarc/ubuntu16/dk_check /usr/local/psa/handlers/hooks/dk_check

For Plesk Onyx 17.8 on Ubuntu 18

For Plesk Onyx 17.8 on Ubuntu 18 replace the file /usr/local/psa/handlers/hooks/dmarc and /usr/local/psa/handlers/hooks/dk_check with patched one from attachments:

Connect to the server via SSH
Download the file from the attachment:

# wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz
Backup non-patched file and replace it with the downloaded one:

# tar -xzvf dmarc.tar.gz
# chmod 0750 dmarc/ubuntu18/dmarc dmarc/ubuntu18/dk_check
# chown root:popuser dmarc/ubuntu18/dmarc dmarc/ubuntu18/dk_check
# mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
# mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
# cp -a dmarc/ubuntu18/dmarc /usr/local/psa/handlers/hooks/dmarc
# cp -a dmarc/ubuntu18/dk_check /usr/local/psa/handlers/hooks/dk_check

Note: Try applying the fix for corresponding version. In case it is not working, please specify the OS version and Plesk version in the comment section below.

dmarc.tar.gz
500 KB Download

Comments

6 comments

Tom Tonic November 16, 2018 14:19

What would I do for the combination Plesk Onyx 17.8 on Ubuntu 14.04? T/T

0

Robert Asilbekov November 21, 2018 07:45

@Tom Tonic The hotfix does not depend on the version, so it should not break the Plesk. However, if you facing the same issue on Plesk Onyx 17.8 on Ubuntu 14.04, I would like to recommend you to create a support request to look closer.

0

Salecroix Charly November 23, 2018 17:49

Hi, what would I do for the combination Plesk Onyx 17.8.11 on Debian 8.11?

Mail messages from Mailchimp do not pass the DMARC filter and rejected by dmarc handler. As can be observed in /var/log/maillog:

Nov 23 17:49:57 server dk_check[35313]: Starting the dk_check filter...
Nov 23 17:49:57 server dk_check[35313]: DKIM verify result: DKIM verification (d=mailchimp.com, 1024-bit key) succeeded
Nov 23 17:49:57 server dmarc[35314]: Starting the dmarc filter...
Nov 23 17:49:57 server spamd[9308]: prefork: child states: II
Nov 23 17:49:57 server dmarc[35314]: DMARC: REJECT message for user@example.com
Nov 23 17:49:57 server postfix-local[35310]: message discarded by a mail handler

0

Robert Asilbekov November 27, 2018 09:21

@Salecroix Charly

First of all, we need to understand is it the same issue or another one, as the bug was fixed in 17.5. So I would like to recommend you referring the troubleshooting steps from

https://dmarcian.com/start-dmarc/ and https://dmarc.org/wiki/FAQ to get some additional details. If it will not help to shed light on the issue, you you may submit a request to support: How to submit a request to Plesk support?

0

Salecroix Charly November 28, 2018 09:42

@Robert Asilbekov

Hi Robert Asilbekov,

Indeed, is it the same issue as the bug was fixed in 17.5.
I followed the problem solving procedure for "Plesk Onyx 17.8 on CentOS 7", CentOS getting closer to Debian.
So I can tell you that by following this procedure the problem is now solved and Mailchimp's mail messages now pass the DMARC filter.

I invite you to test the resolution of the problem by yourself and to provide to all users experiencing this problem in Debian this solution.

Have a niceday everybody.

0

Robert Asilbekov November 29, 2018 09:23

@Salecroix Charly

The article has been updated with hotfixes for Plesk Onyx 17.8 on Debian 8, Ubuntu 14

0

Please sign in to leave a comment.

Have more questions? Submit a request

Articles in this section

Applicable to:

Note: This article has the reference to the issue with the fix available:

Symptoms

Cause

Resolution

Related articles