Applicable to:
- Plesk for Linux
Symptoms
-
The domain uses a local or external antispam server, like SpamExperts.
-
Some messages are rejected because of SPF, with this logged to
/var/log/maillog
/usr/lib64/plesk-9.0/psa-pc-remote[23076]: handlers_stderr: REJECT
/usr/lib64/plesk-9.0/psa-pc-remote[23076]: REJECT during call 'spf' handler
postfix/cleanup[8479]: 237388036910C: milter-reject: END-OF-MESSAGE from filter.antispamserver.tld[203.0.113.2]: 5.7.1 Command rejected; from=notification@example.com to=admin@example.com proto=ESMTP helo=<filter.antispamserver.tld>postfix/smtpd[31935]: disconnect from filter.antispamserver.tld[203.0.113.2] ehlo=2 starttls=1 mail=1 rcpt=1 bdat=3 quit=1 commands=9
dk_check[5484]: Starting the dk_check filter...
dk_check[5484]: DKIM verification (d=sender.tld, 1024-bit key) succeeded
postfix-local[5483]: PASS during call 'dd52-domainkeys' handler
dmarc[5485]: Starting the dmarc filter...
dmarc[5485]: Store DKIM result for 'sender.tld' into DMARC library.
dmarc[5485]: DMARC: smtpdomain=sender.tld maildomain=sender.tld mailfrom=externaluser@sender.tld stamp=1617091525 ip=2 adkim=relaxed aspf=relaxed p=REJECT sp=NONE pct=100 align_dkim=fail align_spf=fail spfres=fail dkimres=pass dmarccheck=DMARC_POLICY_REJECT dmarcstatus=STOP
dmarc[5485]: DMARC: REJECT message for john.doe@example.com
Cause
The incoming message goes through the antispam server, which changes the sender's IP address. The new IP address doesn't match the domain's SPF record, so the email gets rejected.
Resolution
Configure the local SPF rules in Tools & Settings > Mail Server Settings > SPF local rules correctly. The exact set of rules varies depending on each specific configuration.
Note: The examples below use placeholders. Make sure to replace them with actual values from the real environment.
Use either of these rules:
ip4:203.0.113.2
a:hostname.example.com
Where 203.0.113.2
is the server's IP address, and hostname.example.com
is the server's hostname.
Use this rule: include:spf.antispamcloud.com
Refer to the SpamExperts documentation for additional details.
Contact the service's support team to get the exact SPF local rules. Generally speaking, the following rules are used:
ip4:<remote filter's IP address>
a:<remote filter's hostname>
include:<remote filter's hostname>
Comments
0 comments
Please sign in to leave a comment.