DKIM, SPF, and DMARC Protection

Plesk supports a number of anti-spam solutions for validation of mail messages identity:

  • DKIM (DomainKeys Identified Mail) is a method used to associate a domain name identity with an outgoing message and to validate a domain name identity associated with an incoming message through cryptographic authentication.
  • SPF (Sender Policy Framework) is a method used to prevent sender address forgery, i.e. using fake sender addresses. It allows mail server to check that incoming mail from a domain comes from a host authorized by that domain’s administrator. In addition, Plesk uses SRS (Sender Rewriting Scheme), so that forwarded messages can pass SPF checking.
  • DMARC (Domain-based Message Authentication, Reporting and Conformance) is a technology to extend the capabilities of the SPF and DKIM methods. The DMARC policy defines how the receiver should treat email messages depending on the results of DKIM and SPF checking.

The mail server requirements for these solutions are as follows:

Mail Server DKIM SPF SRS DMARC
Postfix (Linux) ➕ ➕ ➕ ➕
Qmail ➕ ➕ ➖ ➕
MailEnable Professional ➕ ➕ ➖ ➖
MailEnable Standard Version 9.16 or later ➖ ➖ ➖
SmarterMail ➕ ➕ ➕ ➕
IceWarp ➕ ➕ ➕ ➖

In this table, ‘+’ means that the solution is supported by all versions that are supported by Plesk Obsidian. ‘-‘ means that the solution is not supported.

DKIM

DKIM (DomainKeys Identified Mail) provides a method used to validate a domain name identity that is associated with a message. It lets an organization to take responsibility for a sent message by attaching an automatically generated digital signature to it and uses cryptographic techniques to validate authorization for the signature presence.

To provide the DKIM support, Plesk uses the functionality of an external library (Linux) or of the mail server supplied with Plesk (Windows).

Warning

If you use an external DNS service, DKIM signing will work for outgoing messages, but the receiving mail server will not be able to validate these messages. As a workaround, you can switch off Plesk DNS server and add a corresponding DKIM-related DNS record on the external DNS service. In this case, the receiving server will be able to validate the messages. Learn how to enable DKIM email signing for domains that use an external DNS server.

Enabling or disabling DKIM on the Server

DKIM is enabled in Plesk by default. To disable DKIM or to keep it only for outgoing or incoming mail, go to Tools & Settings > Mail Server Settings (under “Mail”), scroll down to the “DKIM spam protection” section, and clear one of the following checkboxes or both of them:

  • Allow signing outgoing mail. This option enables customers to switch on the DKIM signing of outgoing mail on a per-domain basis. It does not automatically enable signing of all outgoing email messages. To use DKIM, users must switch it on for individual domains.
  • Verify incoming mail (Plesk for Linux). This option switches on DKIM checking for all incoming mail. All messages are checked, and if the check fails, are marked with a special header.

Note

You cannot disable DKIM checking for incoming mail if DMARC is enabled.

Enabling DKIM Email Signing for a Domain

If DKIM signing is enabled on the server (see the Enabling or disabling DKIM on the Server section above), customers can sign outgoing mail for their domains.

To enable DKIM signing of outgoing mail for an individual domain:

  1. Open the corresponding subscription for managing.
  2. Go to the Mail tab > Mail Settings.
  3. Select the domain and click Activate/Deactivate Services.
  4. Select Enable for DKIM spam protection system to sign outgoing email messages and click OK.

Note

The DNS service must be activated on a domain.

After you have activated DKIM for a domain, Plesk adds the following two records to the DNS zone of the domain:

  • default._domainkey.<example.com> - contains the public part of the generated key.
  • _ domainkey.<example.com> - contains the DKIM policy.

SPF and SRS

SPF (Sender Policy Framework) is a method used to prevent sender address forgery, i.e. using fake sender addresses. SPF allows a domain’s administrator to set a policy that authorizes particular hosts to send mail from the domain. A receiving mail server checks that the incoming mail from a domain comes from a host authorized by that domain’s administrator. SPF is based on the rules specified by the administrator in the sender’s DNS zone.

In Plesk, you can set up an SPF policy for outgoing mail by specifying rules in a DNS record. In Plesk for Linux, SPF also checks incoming mail by default.

When SPF for incoming mail is enabled, the mail server performs DNS lookup on the sender’s host to search for an SPF-related DNS record. The following sets of rules can be defined:

  • Local rules - the rules that are used by the spam filter before the SPF check is actually done by the mail server.

    Note

    These rules are concatenated with the rules specified in the SPF-related DNS record or the sender. For example, if the sender has the following SPF policy: example.com. TXT v=spf1 +a +mx -all and the local rule is a:test.plesk.com, then the resulting policy will be example.com. TXT v=spf1 +a +mx +a:test.plesk.com -all.

  • Guess rules - the rules that are applied to domains that do not publish SPF records.

The information on statuses of SPF checking can be found here.

To set up an SPF policy for outgoing mail:

Go to Tools & Settings > DNS Template and edit the TXT DNS record related to SPF. This DNS record is always present in the server-wide DNS template. Here is an example of SPF record created by Plesk:

example.com.    TXT    v=spf1 +a +mx +a:test.plesk.com -all

The parts of this record mean the following:

Part Description
v=spf1 The domain uses SPF of the version 1.
+a All the hosts from the “A” records are authorized to send mail.
+mx All the hosts from the “MX” records are authorized to send mail.
+a:test.plesk.com The domain test.plesk.com is authorized to send mail.
-all All other domains are not authorized to send mail.

Read more about the syntax of SPF DNS records. The policy notation is available at RFC7208.

(Plesk for Linux) To configure SPF to check incoming mail:

  1. Go to Tools & Settings > Mail Server Settings (under “Mail”) and scroll down to the “SPF spam protection” section.

  2. Select an option from the SPF checking mode drop-down box to specify how to deal with email when SPF applies local and guess rules:

    1. Only create Received SPF-headers, never block - to accept all incoming messages regardless of SPF check results.
    2. Use temporary error notices when you have DNS lookup problems - to accept all incoming messages regardless of SPF check results, even if SPF check failed due to DNS lookup problems.
    3. Reject mail if SPF resolves to “fail” (deny) - to reject messages from senders who are not authorized to use the domain in question.
    4. Reject mail if SPF resolves to “softfail” - to reject the messages from senders who cannot be identified by SPF system as authorized or are not authorized because the domain has no SPF records published.
    5. Reject mail if SPF resolves to “neutral” - to reject the messages from senders who cannot be identified by SPF system as authorized or are not authorized because the domain has no SPF records published.
    6. Reject mail if SPF does not resolve to “pass” - to reject the messages that do not pass SPF check for any reason (for example, when sender’s domain does not implement SPF and SPF checking returns the “unknown” status).
  3. To specify local rules, type the rules you need in the SPF local rules box.
    For example: include:spf.trusted-forwarder.org.

    Learn more about SPF rules.

  4. You can also specify the guess rules in the SPF guess rules box.

    For example: v=spf1 +a/24 +mx/24 +ptr ?all

  5. To specify an arbitrary error notice that is returned to the SMTP sender when a message is rejected, type it into the SPF explanation text box.

    If no value is specified, the default text will be used as a notification.

  6. To complete the setup, click OK.

(Plesk for Linux) To disable SPF checking for incoming mail:

  1. Go to Tools & Settings > Mail Server Settings (under “Mail”).
  2. In the “DMARC” section, clear the “Enable DMARC to check incoming mail” checkbox if it is selected.
  3. In the “SPF spam protection” section, clear the “Enable SPF spam protection to check incoming mail” checkbox and then click OK.

Using SRS

Additionally to SPF, some mail servers in Plesk support SRS (Sender Rewriting Scheme), a mechanism for rewriting sender addresses when an email is forwarded in such a way that the forwarded email continues to be SPF compliant. SRS helps to make sure that messages are delivered in case of using SPF.

SRS is used automatically when messages are forwarded from Plesk-hosted mailboxes.

To provide the SRS functionality, Plesk uses the capabilities of an external library (Linux) or of the mail server software (Windows).

DMARC

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a technology to extend the capabilities of the SPF and DKIM sender policies. The DMARC policy defines how the receiver should treat email messages depending on the results of DKIM and SPF checking. This technology is based on the rules specified in the sender’s DNS zone.

In Plesk, you can set up a DMARC policy for outgoing mail by specifying rules in a DNS record. In Plesk for Linux and Plesk for Windows that uses SmarterMail, DMARC also checks incoming mail by default.

To set up a custom DMARC policy for outgoing mail:

Go to Tools & Settings > DNS Template and edit the DNS records related to the DMARC policy. These DNS records are always present in the server-wide DNS template. (By contrast, DNS records related to DKIM are added to DNS zones of individual domains when you activate DKIM on the domain.)

For example, the Plesk default DMARC policy is defined in the following record:

_dmarc.<domain>.    TXT    v=DMARC1; p=none

This policy recommends that the receiving mail server does not delete messages even if they failed checking. You can specify a stricter policy. However, note that the receiving server is free to apply its own policy to incoming mail.

Hosting customers can edit the policies for individual domains.

For information on DMARC, including policy notations, refer to https://datatracker.ietf.org/doc/rfc7489/.

To disable DMARC to check incoming mail:

  1. Go to Tools & Settings > Mail Server Settings (under “Mail”).
  2. In the DMARC section, clear the “Enable DMARC to check incoming mail” checkbox and then click OK.

image-78142.png