Panellicense

Plesk email deliverability: SPF, DKIM, DMARC, and rDNS setup

Configure SPF, DKIM, DMARC, and reverse DNS on Plesk Obsidian so Gmail and Outlook accept your mail — including the DNS template defaults that quietly break third-party senders.

PlAll Plesk Obsidian articlesTutorials & how-tos8 min readUpdated 2026-10-01
pleskemaildkimdmarcdeliverabilitydns
schema: HowToschema: FAQPageschema: BreadcrumbList

Plesk does more of the email authentication work for you than cPanel does. The default DNS template already publishes SPF and DMARC records, and DKIM signing is one checkbox away. The trouble is in the defaults themselves: the DMARC record Plesk ships uses p=quarantine with strict alignment. That's fine for a domain that only sends through Plesk's Postfix. It causes silent spam-foldering as soon as a customer adds Mailchimp, SendGrid, or Google Workspace.

This guide is for operators running Plesk Obsidian on Linux with Postfix. It covers the order that actually fixes deliverability: reverse DNS, then DKIM, then SPF, then DMARC. It's the Plesk companion to our cPanel deliverability checklist. The DNS records are the same on both panels; the panel steps are not.

1. Fix reverse DNS and the SMTP greeting first

Gmail and Outlook do a forward-confirmed reverse DNS check on every connecting IP. If the PTR record is missing, or doesn't match the name Postfix announces in its EHLO, no amount of DKIM will save you.

Set the PTR at your infrastructure provider (Hetzner, OVH, Vultr, AWS, and so on). Plesk can't set it. Then check that both sides agree:

postconf -h myhostname
dig +short -x 198.51.100.42
dig +short A server1.example.com

All three must line up: the PTR returns server1.example.com, which resolves back to 198.51.100.42, and Postfix greets with the same name.

Multi-IP servers

If subscriptions sit on dedicated IPs, go to Tools & Settings → Mail Server Settings and look at Outgoing mail mode. The default sends everything from the server's main IP. If you switch to sending from domain IP addresses, every one of those IPs needs its own matching PTR. A dedicated IP with no rDNS is worse than a shared IP that has one. Unless you have a reason to isolate a sender's reputation, leave the default.

2. Enable DKIM signing

DKIM in Plesk has two switches, and both must be on.

Server-wide permission

In Tools & Settings → Mail Server Settings, tick Allow signing outgoing mail under DKIM spam protection. Or from the shell:

plesk bin mailserver --sign-outgoing-mail true

Per-domain signing

In the subscription, go to Mail → Mail Settings, select the domains, click Activate/Deactivate Services, and enable Use DKIM spam protection system to sign outgoing email messages. For an existing fleet, run it from the shell instead:

for domain in $(plesk db -Ne "SELECT name FROM domains WHERE parentDomainId=0"); do
  plesk bin domain_pref --update "$domain" -sign_outgoing_mail true
done

Plesk generates a keypair and stores the private key under /etc/domainkeys/<domain>/. If Plesk is authoritative for the zone, it also publishes two TXT records:

  • default._domainkey.example.com: the public key, using selector default
  • _domainkey.example.com: the DKIM policy record

Since Plesk Obsidian 18.0.55, new keys are 2048-bit and the panel offers no selector. Keys generated on older versions stay 1024-bit until you regenerate them. Check yours:

dig +short TXT default._domainkey.example.com | wc -c

A 1024-bit key comes out at around 250 characters, and a 2048-bit key at over 400.

3. Check the SPF record

The server-wide DNS template (Tools & Settings → DNS Settings) ships this SPF record:

v=spf1 +a +mx +a:server1.example.com -all

For a domain that only sends through Plesk, that's correct as shipped. The -all hardfail is stricter than cPanel's ~all default. That's fine, but it means any sender you forget to list gets rejected.

When a customer adds a third-party sender, merge everything into one record. Two SPF TXT records on the same name is a permanent error, and receivers treat it as a fail:

v=spf1 +a +mx +a:server1.example.com include:_spf.google.com include:sendgrid.net ~all

Drop to ~all while you onboard new senders and watch DMARC reports. Go back to -all once the reports are clean. Keep the record under 10 DNS lookups: every include, a, and mx counts.

Inbound SPF checking

The same Mail Server Settings page has Switch on SPF spam protection, which checks incoming mail. Use the mode that rejects only on an explicit fail. Stricter modes that also reject on softfail and neutral bounce legitimate mail from badly configured senders, and your customers will blame you, not the sender.

4. Fix the DMARC default before it bites

Plesk's default template publishes:

_dmarc.example.com. TXT "v=DMARC1; adkim=s; aspf=s; p=quarantine"

There are three problems with that:

  1. Strict alignment (adkim=s; aspf=s) needs an exact domain match. Most ESPs sign with a subdomain such as em1234.example.com, or send with a bounce domain on a subdomain. Under strict alignment those messages fail DMARC even when DKIM and SPF pass.
  2. p=quarantine from day one means those failures go straight to spam, with no warning.
  3. No rua tag, so you get no aggregate reports and never learn what's failing.

For a mixed-sender domain, replace it with relaxed alignment and reporting:

plesk bin dns --del example.com -txt "v=DMARC1; adkim=s; aspf=s; p=quarantine" -domain _dmarc
plesk bin dns --add example.com -txt "v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1" -domain _dmarc

Run p=none for two to four weeks, read the aggregate reports, fix whatever fails, then move to p=quarantine and finally p=reject. For domains that only send through Plesk, the shipped default is fine, but add an rua tag anyway.

To change the default for new domains, edit the _dmarc record in Tools & Settings → DNS Settings. Template edits don't touch existing zones until you click Apply DNS Template Changes, and that click overwrites per-domain customisations. Apply it only to the domains you choose.

5. When Plesk isn't the DNS host

None of the above gets published if the domain's nameservers point at Cloudflare, Route 53, or the registrar. Plesk still signs mail, but receivers can't find the key, so every message fails DKIM. This is the single most common "DKIM enabled but not working" ticket.

Copy the records out of Plesk's local zone and add them at the external DNS host:

dig @127.0.0.1 +short TXT default._domainkey.example.com
dig @127.0.0.1 +short TXT example.com
dig @127.0.0.1 +short TXT _dmarc.example.com

If you run your own secondary nameservers, the Slave DNS Manager guide keeps Plesk authoritative and avoids this problem completely.

6. Verify end to end

Send a message to a Gmail address, open it, and click Show original. You want PASS on all three lines: SPF, DKIM, and DMARC. From the shell, confirm the public records:

dig +short TXT example.com | grep spf1
dig +short TXT default._domainkey.example.com
dig +short TXT _dmarc.example.com

Authentication only proves who sent a message. It does nothing for a server that's relaying spam. Pair it with Plesk outbound mail throttling so one compromised mailbox can't burn the IP reputation you just built, and keep an eye on blocklists with Imunify360 reputation management.

Why does Plesk say DKIM is enabled but Gmail shows dkim=none?+
Usually the domain's DNS is hosted outside Plesk, so the default._domainkey TXT record was never published. Copy it from the local zone with dig @127.0.0.1 and add it at your external DNS provider.
How do I change the DKIM key length in Plesk?+
Plesk Obsidian 18.0.55 and later generate 2048-bit keys by default. To force 1024-bit keys, for DNS providers that can't handle long TXT records, add dkimKeySize = 1024 under a [mail] section in panel.ini, then regenerate the key by turning DKIM off and on for the domain.
What is the default DMARC record in Plesk?+
v=DMARC1; adkim=s; aspf=s; p=quarantine. The strict alignment and quarantine policy break most third-party senders, so switch to relaxed alignment with p=none and an rua address until reports are clean.
Can I have two SPF records for one domain in Plesk?+
No. Two v=spf1 TXT records on the same name is a permanent error that receivers treat as a fail. Merge all senders into one record using include: mechanisms.
Does Plesk set the PTR record for my server IP?+
No. Reverse DNS belongs to whoever owns the IP block, usually your VPS or dedicated server provider. Set it in their control panel so it matches the hostname Postfix uses in its EHLO greeting.

Next steps

Related articles

All Plesk Obsidian →All tutorials & how-tos →
how to
Email deliverability on cPanel: SPF, DKIM, DMARC, MTA-STS
A 2026 deliverability checklist for cPanel operators — reverse DNS, SPF, DKIM, DMARC enforcement, and MTA-STS, with the exact records and where cPanel still expects you to do it by hand.
6 min read
how to
Set up DNSSEC on Plesk with the DNSSEC extension
Sign Plesk-hosted zones with the DNSSEC extension — pick an algorithm, set KSK and ZSK rollover policy, publish DS records, verify the chain, and unsign without SERVFAIL.
8 min read
how to
Plesk outbound mail throttling: stop abuse before Spamhaus does
Per-domain Postfix caps, PHP-to-port-25 lockdown, and Plesk's outgoing-mail controls — the layered defence that keeps one compromised mailbox from blacklisting the whole server.
7 min read
how to
Set up secondary DNS for Plesk with Slave DNS Manager
A Plesk box serving its own DNS is a single point of failure. Wire up a plain BIND server as a secondary nameserver with the Slave DNS Manager extension.
8 min read
changelog
Plesk CVE-2026-65646, 65642, and 65647: patch your server
Three critical Plesk flaws expose server files, customer databases, and root access. Check the affected builds and update Plesk plus both extensions.
3 min read
how to
Installing Plesk Obsidian on AlmaLinux 9
Clean Plesk Obsidian install on AlmaLinux 9 — auto-installer flags, the SELinux and firewalld settings that bite you on first boot, license activation, and a short post-install checklist.
7 min read
Switch in an afternoon

Switch from your current reseller — free.

We migrate active cPanel, Plesk, LiteSpeed and CloudLinux licenses from any reseller. We prorate the first month so you never pay twice, and your customers see zero downtime during the swap.