Mail spoofing a locally hosted domain receives a valid DKIM signature from Plesk

Symptoms

• An incoming, unsigned email whose "From" address matches a locally hosted domain arrives with a DKIM signature added by the Plesk server.
• Server has Allow signing outgoing mail and Verify incoming mail enabled in Tools & Settings > Mail Server Settings, and Use DKIM spam protection system to sign outgoing email messages enabled in Domains > example.com > Mail Settings.

• The following is logged in /var/log/maillog:

  CONFIG_TEXT: postfix/smtpd[23204]: connect from unknown[203.0.113.2]
  postfix/smtpd[23204]: D3F4582B3F: client=unknown[203.0.113.2]
  postfix/cleanup[23210]: D3F4582B3F: message-id=<201902020739.x127ddrn003023@example.org>
  <...>
  dk_sign[23214]: Starting the dk_sign filter...

Cause

Because of handler ordering, an unsigned incoming message whose "From" address matches a locally hosted domain is signed before delivery.

This issue is caused by bug identified as PPPM-10028, which has been resolved in Plesk Obsidian 18.0.80

Resolution

In order to resolve the issue, update Plesk to the latest version.