Emails that are sent locally inside the server are rejected with “DMARC: REJECT message” or “DMARC: message moved to QUARANTINE”

Symptoms

• Emails that are sent locally inside the server (emails from Plesk administrator, local domains or web forms) are rejected or moved to the spam folder with the following records in /var/log/maillog:

  dmarc[15768]: Starting the dmarc filter...
  dmarc[15768]: DMARC: REJECT message for [email protected]
  postfix-local[15764]: message discarded by a mail handler

  ---

  dk_check[15713]: Starting the dk_check filter...
  dk_check[15713]: DKIM verify result: DKIM Feed: No signature
  dmarc[15714]: Starting the dmarc filter...
  dmarc[15714]: SPF record was not found in Authentication-Results:
  dovecot: service=lda, [email protected], ip=[]. msgid=[[email protected]]: saved mail to INBOX.Spam
  dmarc[15714]: DMARC: message moved to QUARANTINE for [email protected]
  postfix-local[15648]: message discarded by a mail handler

• The DMARC policy is set as "p=quarantine" (treat with suspicion) or "p=reject" (block outright) in Plesk at Domains > example.com > DNS Settings.

  _dmarc.example.com.        TXT        v=DMARC1; p=quarantine

Cause

This is a Plesk bug with ID PPPM-7190, which is planned to be fixed in future product updates.

Resolution

Apply one of the following workarounds:

Workaround I

1. Check the "Return-Path" value from the email header which was moved to spam:

   Return-Path: <[email protected]>

2. Connect to the Plesk server via SSH.

3. Whitelist the domain from "Return-Path" by adding its name to the "IgnoreMailFrom" string in the file /etc/psa/dmarc.conf:

   3.1. Create the file /etc/psa/dmarc.conf:

   # touch /etc/psa/dmarc.conf

   3.2. Open the file in a text editor. In this example, we are using the vi editor:

   # vi /etc/psa/dmarc.conf

   3.3. Add the required domains as a line after 'IgnoreMailFrom':

   Note: Replace example.com with actual domain name(s).

   IgnoreMailFrom example.com, example.net, example.org

   3.4. Save the changes and close the file.

Workaround II

Modify the DMARC record of the recipient domain: Change "p=quarantine" or "p=reject" to "p=none" at Domains > example.com > DNS Settings.