Your SPF and DKIM are both failing:
Authentication-Results: spf=none (sender IP is 5.9.XX.XX)
smtp.mailfrom=v9.my-domain.co.uk; dkim=none (message not signed)
header.d=none;dmarc=fail action=quarantine
header.from=v9.my-domain.co.uk;compauth=fail reason=000
I would guess that there is no SPF TXT record for v9.my-domain.co.uk
dig v9.my-domain.co.uk TXT
You would need to create a TXT record for v9.my-domain.co.uk that includes an SPF record. Maybe DirectAdmin has a tool that does this? I don't know.
I don't know if you have a DNS zone record for v9.my-domain.co.uk or if you are just using v9 as a third level domain in the DNS zone record for my-domain.co.uk.
The record would need to look something like:
v9.my-domain.co.uk. IN TXT "v=spf1 a ip4:%the_servers_ip% ~all"
I would argue that -all should be used, but that again is going beyond the scope of this discussion.
You probably don't need the ip4 part if
v9.my-domain.co.uk is resolving to
%the_servers_ip% but I usually include it anyway.
As for making a DKIM key for the server's hostname... I don't know if DirectAdmin has a DirectAdmin way of doing this or not. I never looked, I just create my own.
Use at your own risk - although this shouldn't overwrite anything by default. If DirectAdmin has their own way to create a DKIM public/private key pair for the server's hostname I'd use that. I tend to do a lot of stuff on my own, so I don't always go digging through a control panel's documentation on how to do things or have the patience to wait for the developer of a control panel to add a feature I need, so I can't always speak for what's "proper" and what's not. I know DirectAdmin create DKIM keys for added domains (like end user domain names) and it's basically doing what I'm doing here - it's just done automagically instead of parsing through the whole nuts and bolts.
Bash:
mkdir -p /root/dkim
rm -f /root/dkim/rsa.private /root/dkim/rsa.public
openssl genrsa -out /root/dkim/rsa.private 2048
openssl rsa -in /root/dkim/rsa.private -out /root/dkim/rsa.public -pubout -outform PEM
# You have to split a 2048 bit key
HEADCOUNT=$((255-$(echo -n "v=DKIM1; k=rsa; p=" | wc -c)))
FULLCOUNT=$(cat /root/dkim/rsa.public | grep -v '^-----' | tr '\n' ' ' | sed s/" "//g | wc -c)
DNS1="$(cat /root/dkim/rsa.public | grep -v '^-----' | tr '\n' ' ' | sed s/" "//g | head -c ${HEADCOUNT})"
DNS2="$(cat /root/dkim/rsa.public | grep -v '^-----' | tr '\n' ' ' | sed s/" "//g | tail -c $((${FULLCOUNT}-${HEADCOUNT})))"
echo "Add this to the DNS zone file for ${HOSTNAME}"
echo "x._domainkey.${HOSTNAME}. IN TXT \"v=DKIM1; k=rsa; p=${DNS1}\" ${DNS2}\\;"
mkdir -p /etc/virtual/${HOSTNAME}
chown mail:mail /etc/virtual/${HOSTNAME}
chmod 711 /etc/virtual/${HOSTNAME}
if [ -f "/etc/virtual/${HOSTNAME}/dkim.private.key" ]
then
echo "/etc/virtual/${HOSTNAME}/dkim.private.key" already exists"
else
cp -f /root/dkim/rsa.private /etc/virtual/${HOSTNAME}/dkim.private.key
fi
if [ -f "/etc/virtual/${HOSTNAME}/dkim.public.key" ]
then
echo "/etc/virtual/${HOSTNAME}/dkim.public.key already exists
else
cp -f /root/dkim/rsa.public /etc/virtual/${HOSTNAME}/dkim.public.key
fi
chown mail:mail /etc/virtual/${HOSTNAME}/dkim.private.key /etc/virtual/${HOSTNAME}/dkim.public.key
chmod 600 /etc/virtual/${HOSTNAME}/dkim.private.key /etc/virtual/${HOSTNAME}/dkim.public.key
Basically... DirectAdmin's exim will check the envelope-sender of a message that is being sent out and take the domain part of that email address. If the file -
/etc/virtual/%thatdomain%/dkim.public.key - exists, then Exim uses that file to sign the message with DKIM. By default, DirectAdmin exim uses "x" as the DKIM selector, maybe this is customizable? Not sure.
So when the recipient receives this message, it will see that it was signed with DKIM for the
${HOSTNAME} domain with the "x" selector, so it will query DNS:
x._domainkey.${HOSTNAME}
for a TXT record that will have a matching public key. If the signature of the signed message matches the signature of the message with that public key, then the message passes DKIM.
You would need either the SPF TXT record added for v9.my-domain.co.uk. or the DKIM key signing to pass in order for DMARC to pass and for Outlook to (presumably) accept your message as valid. Although, you're always at the mercy of however the recipient mail server (outlook.com in this case) decides to treat your message. Passing SPF, DKIM, and DMARC is not going to guarantee that your message will always go through. But a failing SPF, DKIM, and DMARC is probably going to mean that your message won't make it through (or will end up in the user's spam/junk box).
