Account creation email not DMARC signed

wavoe

Verified User
Joined
Nov 21, 2007
Messages
80
Location
Belgium
When I'm trying to send the first time the email notification for the account creation to for example gmail address, I get the message in the exim logs that the email couldn't be delivered due to the DMARC policy that is active for my hosting domain "mydomain.be".

When doing a password reset the email is sent and received correctly.

The main difference I see in the exim logs is the first time it's just like a command /usr/sbin/sendmail -t and second time it's like /usr/sbin/sendmail -t -f "admin <[email protected]>"
So is this something which should be improved or is it something we can control ourself?

2026-02-14 00:48:44 cwd=/usr/local/directadmin 2 args: /usr/sbin/sendmail -t
2026-02-14 00:48:44 1vr2tw-0000000Cxko-22mR <= [email protected] U=diradmin P=local S=2040 T="Your account for testdomain.be is now ready for use." from <[email protected]> for [email protected]
2026-02-14 00:48:44 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1vr2tw-0000000Cxko-22mR
2026-02-14 00:48:45 1vr2tw-0000000Cxko-22mR ** [email protected] F=<[email protected]> R=lookuphost T=remote_smtp H=gmail-smtp-in.l.google.com [2a00:1450:400c:c06::1b] X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=yes : SMTP error from remote mail server after end of data: 550-5.7.26 Unauthenticated email from mydomain.be is not accepted due to\n550-5.7.26 domain's DMARC policy. Please contact the administrator of\n550-5.7.26 mydomain.be domain if this was a legitimate mail. To learn about\n550-5.7.26 the DMARC initiative, go to\n550 5.7.26 https://support.google.com/mail/?p=DmarcRejection ffacd0b85a97d-43796a6e2e6si7374052f8f.121 - gsmtp
2026-02-14 00:48:45 cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1vr2tw-0000000Cxko-22mR
2026-02-14 00:48:45 1vr2tw-0000000Cxko-22mR Completed

2026-02-14 00:50:09 cwd=/usr/local/directadmin 4 args: /usr/sbin/sendmail -t -f "admin <[email protected]>"
2026-02-14 00:50:09 1vr2vJ-0000000Cy6c-1Bxv <= [email protected] U=diradmin P=local S=2035 T="Your account for testdomain.be is now ready for use." from <[email protected]> for [email protected]
2026-02-14 00:50:09 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1vr2vJ-0000000Cy6c-1Bxv
2026-02-14 00:50:09 1vr2vJ-0000000Cy6c-1Bxv => [email protected] F=<[email protected]> R=lookuphost T=remote_smtp S=2950 H=gmail-smtp-in.l.google.com [2a00:1450:400c:c06::1b] X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=yes C="250 2.0.0 OK 1771026609 ffacd0b85a97d-43796afa36esi7092442f8f.384 - gsmtp"
2026-02-14 00:50:09 1vr2vJ-0000000Cy6c-1Bxv Completed
 
I think this problem applies more to resellers than to the main DirectAdmin admin user.

When a reseller creates an account, the Your account for %domain% is now ready for use. message is going to user a Header From of the email address in:

cat /usr/local/directadmin/data/users/%resellerusername%/user.conf | grep ^email=

This is wrong. Or at least I will argue that it's wrong.

Gmail won't accept the message - specifically if the reseller has their email address set to an @gmail.com email address, but probably any other email address as well. The SPF and lack of DKIM signing for the gmail.com domain - means that your server, whatever server that may be, is not authorized to send out mail from the gmail.com domain.

The envelope-sender or return-path is set correctly. It is set to diradmin@%servername% but Gmail (and other email service providers?) will look at the Header From for SPF, DKIM, and DMARC alignment.

Looks like I posted about this in November 2025:


I thought all of this sounded familiar. Looks like I even came up with a hackified solution. Still wish DirectAdmin implemented a real solution to this.
 
Back
Top