Forwarded to devs Plesk DMARC checker parses invalid TXT records that do not start with "v=DMARC1;" - deviates from RFC 7489

[nethubonline]

Username:

TITLE

Plesk DMARC checker parses invalid TXT records that do not start with "v=DMARC1;" - deviates from RFC 7489

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE

Plesk Obsidian Web Host Edition 18.0.75
AlmaLinux 9.7
Postfix + Dovecot, DMARC checking enabled (Tools & Settings → Mail → Enable DMARC to check incoming mail)

PROBLEM DESCRIPTION

When a domain has multiple TXT records at _dmarc.domain.com and one (or more) of them does not start with v=DMARC1;, Plesk's DMARC filter still tries to parse the invalid record(s). This leads to syntax errors even though a perfectly valid DMARC record also exists.

Example DNS records:

_dmarc.example.com. TXT "v=DMARC1; p=reject; sp=reject"
_dmarc.example.com. TXT "somerandomstring v=DMARC1"

Observed error in /var/log/maillog:
dmarc[...]: Wrong the essential DMARC policy parameters for 'example.com': 'Found DMARC record lacked a required p= entry'

Result: legitimate incoming (or even local) mail gets rejected because of the garbage record.

According to RFC 7489 §6.6.3 (Policy Discovery):
"Records that do not start with a "v=" tag that identifies the current version of DMARC are discarded."

reference: RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC)

STEPS TO REPRODUCE

1. Add two TXT records to a test domain's _dmarc subdomain:
   Valid: "v=DMARC1; p=reject; sp=reject"
   Invalid (no leading v=): "randomtext v=DMARC1"
   
   
2. Enable DMARC checking in Plesk for another domain.
3. Send a few emails from the test domain to the domain with DMARC checking enabled.
4. Observe error in maillog from the invalid record.

ACTUAL RESULT

Plesk sometimes tries to parse the invalid record (the one without leading v=DMARC1).

Please log this as a bug in the Plesk DMARC integration and prioritize aligning the behavior with the RFC.

EXPECTED RESULT

• Discard anything not starting with v=DMARC1.
• Use the one valid record if it exists.
• No policy applied only if zero or multiple valid records.

ANY ADDITIONAL INFORMATION

(DID NOT ANSWER QUESTION)

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM

Confirm bug

 

[Sebahat.hadzhi]

Thank you for the report, @nethubonline . I was able to replicate the behavior and opened an internal task for further investigation. I will follow-up with more details as soon as possible.

 

[Sebahat.hadzhi]

@nethubonline , the behavior was recognized as a bug identified with ID PPPM-15275. Our team will release a fix in one of the upcoming Plesk releases. At this point, I cannot provide an ETA. The only workaround we can suggest for the time being is to request the sender to remove any extra _dmarc TXT subdomain records from the sender domain's DNS zone.
Thank you for bringing our attention to the issue.