Delivery Status Notifications (DSN) sent between local mailboxes are marked as spam by DMARC

Symptoms

• Delivery Status Notifications (DSN) sent between local mailboxes are marked as spam by DMARC.
• Postfix is used as the mail server.

• The mail delivery log shows something like this:

  CONFIG_TEXT: Jul 21 19:46:41 ptechs postfix/bounce[204034]: 624AF1BA181F: sender delivery status notification: 0A44F1BA182F
  Jul 21 19:46:41 ptechs postfix/qmgr[420976]: 0A44F1BA182F: from=<>, size=3238, nrcpt=1 (queue active)
  Jul 21 19:46:41 ptechs postfix-local[204036]: 0A44F1BA182F: from=<MAILER-DAEMON>, to=<test@example.com>, dirname=/var/qmail/mailnames
  Jul 21 19:46:41 ptechs spamd[3345194]: spamd: processing message <20230516174641.0A44F1BA182F@oxygen.example.com> for test@example.com:30
  Jul 21 19:46:41 ptechs spamd[3345194]: spamd: result: . -99 - NO_RELAYS,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED,URI_HEX,USER_IN_WELCOMELIST,USER_IN_WHITELIST scantime=0.2,size=3251,user=test@example.com,uid=30,required_score=7.0,rhost=localhost.localdomain,raddr=::1,rport=41232,mid=<20230516174641.0A44F1BA182F@oxygen.example.com>,autolearn=ham autolearn_force=no
  Jul 21 19:46:41 ptechs postfix-local[204036]: 0A44F1BA182F: spam: stderr: PASS
  Jul 21 19:46:41 ptechs dk_check[204049]: 0A44F1BA182F: DKIM Feed: No signature
  Jul 21 19:46:41 ptechs postfix-local[204036]: 0A44F1BA182F: dk_check: stderr: PASS
  Jul 21 19:46:41 ptechs dmarc[204050]: 0A44F1BA182F: SPF record was not found in Authentication-Results
  Jul 21 19:46:41 ptechs dmarc[204050]: 0A44F1BA182F: DMARC: smtpdomain= maildomain=hydrogen.example.com mailfrom=example@hydrogen.example.com stamp=1684259201 ip=unknown adkim=relaxed aspf=relaxed p=QUARANTINE sp=QUARANTINE pct=100 align_dkim=fail align_spf=fail spfres=unknown dkimres=unknown dmarccheck=DMARC_POLICY_QUARANTINE dmarcstatus=DEFER
  Jul 21 19:46:41 ptechs dovecot: service=lda, user=test@example.com, ip=[]. sieve: msgid=<20230516174641.0A44F1BA182F@oxygen.example.com>: stored mail into mailbox 'INBOX.Spam'
  Jul 21 19:46:41 ptechs postfix-local[204036]: 0A44F1BA182F: dmarc: stderr: STOP
  Jul 21 19:46:41 ptechs postfix/pipe[201963]: 0A44F1BA182F: to=<test@example.com>, relay=plesk_virtual, delay=0.24, delays=0/0/0/0.23, dsn=2.0.0, status=sent (delivered via plesk_virtual service)
  

Cause

The notification mail seems to be injected directly into the mail system with from as <> and it bypasses all mail handlers except those called from postfix-local (i.e. before-local mail queue). This means that neither spf, nor dk_sign are called, but dk_check and dmarc are.

Resolution

1. Connect to the Plesk server via SSH.

2. Execute the following command to enable DMARC reject at SMTP:

   # plesk bin settings -s mail_dmarc_reject_at_smtp=true && plesk repair mail -y