Knowledge Base

Emails go to Spam: DKIM record is corrupted

Symptoms

Emails go to the Spam folder instead of the Inbox folder when the DKIM spam protection is enabled for the domain in Plesk > Domains > example.com > Mail Settings > Use DKIM spam protection system to sign outgoing email messages.
DKIM is marked as Fail in by email services, for example, Gmail or Hotmail.

Cause

DKIM record is corrupted.

Resolution

Log into Plesk
Go to Domains > example.com > Mail Settings.
Create New DKIM Selector > Set Selector Name as test > Create
Under Active DKIM Selector select the radio toggle for test > Apply
Under Active DKIM Selector click Remove for default > OK
Repeat the same steps to create a new default DKIM selector and delete the test
Create New DKIM Selector > Set Selector Name as default > Create
Under Active DKIM Selector select the radio toggle for default > Apply
Under Active DKIM Selector click Remove for test > OK > Apply.

Note: on Plesk for Windows the DKIM record is recreated instead of regenerating, this is enough for the case when the DKIM record is broken.

Note: is DNS is hosted externally, manually copy default._domainkey.example.com record to the external DNS server

How to apply on Plesk 18.0.55 and Below

Log into Plesk
Go to Domains > example.com > Mail Settings.
Disable the Use DKIM spam protection system to sign outgoing email messages option.
Press the Apply button.
Enable the Use DKIM spam protection system to sign outgoing email messages option.
Press the OK to button to generate a new DKIM record.

How to Update default DKIM for ALL Domains at once via CLI

Running the following command can be dangerous as it will update every single domain in Plesk at once. This command will also Delete all current Default DKIM keys for ALL Domains on Plesk and reissue a new default domainkey while Enabling DKIM signing for ALL Domains. It is important to note that during the time it takes for this new DNS Record to propagate out, DKIM will fail till propagation completes.

If DNS is Hosted Externally for a Domain, this Command will break DKIM. You will need to manually copy this DKIM record into your External DNS Server. More on this here - https://support.plesk.com/hc/en-us/articles/12377243733015-Outbound-emails-do-not-pass-DKIM-verification-when-DNS-is-hosted-externally

# plesk bin site -l | while read name; do plesk bin domain -u $name -mail_dkim false && rm -f /etc/domainkeys/$name/default && plesk bin domain -u $name -mail_dkim true; done