Knowledge Base

Mail messages with different ‘smtp.mailfrom’ and ‘from’ do not pass the DMARC filter and go to spam

Symptoms

Mail messages from Amazon or other particular senders do not pass the DMARC filter and placed directly into Spam, or rejected by dmarc handler, as can be observed in /var/log/maillog:

spamd[11617]: prefork: child states: II
 dmarc[15077]: Starting the dmarc filter...
 dmarc[15077]: DMARC: REJECT message for [email protected]
 postfix-local[15071]: message discarded by a mail handler

A record like the following can be found in /var/log/maillog:

dmarc[15077]: Wrong the essential DMARC policy parameters for [email protected]

Correct SPF and DKIM are present in the message, as can be observed in /var/log/maillog:

spf[15067]: Starting the spf filter...
 spf[15067]: SPF result: pass
 spf[15067]: SPF status: PASS
 dk_check[15076]: Starting the dk_check filter...
 dk_check[15076]: DKIM verify result: DKIM verification (d=example.com, 1024-bit key) succeeded

The following can be found in /var/log/maillog through records of email handling:

server01 dmarc[27080]: DMARC: message moved to QUARANTINE for [email protected]

Public mail server, such as Gmail, accept messages from those domains.
Domain in Mail-From: header in the received message differs from the domain in From: header:
```
Return-Path: [email protected]
 <...>
 From: John Doe [email protected]
```
Domain in the From: header has “relaxed” SPF and DKIM policy (adkim and aspf are absent, or equal to r):

# host -t txt _dmarc.example.org
_dmarc.example.org descriptive text “v=DMARC1; p=reject”

Cause

Product issue:

#PPPM-6847 “Emails from amazon.de and husqvarnagroup.com now pass the DMARC verification and do not go to spam.”
Fixed in:
- Plesk Onyx 17.8 22 April 2019 (Linux)
- Plesk Obsidian 02 July 2018 (fixed as PPP-32584, Linux)
- Plesk Onyx 17.5 25 September 2017 (Linux)
- Plesk Onyx 17.5 14 August 2017 (Linux)

Resolution

Please consider updating your server:

How to install Plesk updates

Workaround

Note: In some cases, after Plesk updates are installed, it will be required to run plesk repair mail command.

Apply the latest Plesk updates.

In case an update is not an option, try applying the fix for the corresponding version:

For Plesk Onyx 17.8 on CentOS 6/Rhel 6/CloudLinux 6

For Plesk Onyx 17.8 on CentOS 6/Rhel 6/CloudLInux 6 replace the file /usr/local/psa/handlers/hooks/dmarc and /usr/local/psa/handlers/hooks/dk_check with patched one from attachments:

Connect to the server via SSH
Download the file from the attachment:

# wget https://support.plesk.com/hc/en-us/article_attachments/360025070393/dmarc.tar.gz
Backup non-patched file and replace it with the downloaded one:

# tar -xzvf dmarc.tar.gz
# chmod 0750 dmarc/centos6/dmarc dmarc/centos6/dk_check
# chown root:popuser dmarc/centos6/dmarc dmarc/centos6/dk_check
# mv /usr/local/psa/handlers/hooks/dmarc{,.orig}
# mv /usr/local/psa/handlers/hooks/dk_check{,.orig}
# cp -a dmarc/centos6/dmarc /usr/local/psa/handlers/hooks/dmarc
# cp -a dmarc/centos6/dk_check /usr/local/psa/handlers/hooks/dk_check