[ Sending-service guides ]

Authenticate outgoing Plesk Obsidian mail with the correct domain and DNS authority

Enable domain signing on the supported Plesk mail stack, publish generated keys at the authoritative DNS host, and verify the actual mailbox and alias routes.

By the EmailAuth research team · 6 min read

[ Key points ]

  • Verify the installed mail stack and outgoing signing permission.
  • Publish installation-generated public records for each sending alias.
  • Separate incoming protection, outgoing alignment and forwarding evidence.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Separate incoming protection, outgoing alignment and forwarding evidence.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Match signing to authoritative DNS

Plesk settings and publicly served DNS must agree for the actual domain and aliases.

Next steps

  1. Confirm the installed mail stack and signing permissions.
  2. Publish the generated public records at the active DNS host.
  3. Capture receiver headers for each sending route.

CISO / SecOps

Require scoped authentication evidence

Protocol correctness and actual receiver alignment are the acceptance criteria.

Next steps

  1. Keep private signing keys out of DNS and evidence bundles.
  2. Review alignment modes and forwarding limitations.
  3. Approve enforcement changes only after representative tests.

Founder / Non-technical

Protect hosted business mail

The visible hosting domain can have several independent sending paths.

Next steps

  1. Name the business-critical mailbox and application flows.
  2. Assign the server and DNS owners.
  3. Approve a controlled change window.

[ FAQs ]

Frequently asked questions

Does a domain in Plesk necessarily send through Plesk mail?

No. A website or application may use another SMTP service. Establish the actual route first.

Plesk Obsidian Enabling DKIM Email Signing Plesk Obsidian DKIM SPF DMARC and ARC SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Why does DKIM fail when Plesk shows the key?

The public nameservers may be external, the owner may be wrong, or the published key may not match the signer. Query authoritative DNS.

Plesk Obsidian Enabling DKIM Email Signing Plesk Obsidian DKIM SPF DMARC and ARC SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Where do I get the DNS values for external hosting?

Use the domain Mail Settings hint for external DNS and copy the records generated by that installation.

Plesk Obsidian Enabling DKIM Email Signing Plesk Obsidian DKIM SPF DMARC and ARC SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Are sending aliases automatically covered?

Do not assume so. Plesk instructs administrators to add corresponding DKIM records for aliases used to send mail, then verify their received signatures.

Plesk Obsidian Enabling DKIM Email Signing Plesk Obsidian DKIM SPF DMARC and ARC SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Does the DKIM header contain the private key?

No. It carries a signature. DNS contains the public key; the private key remains on the signing system.

Plesk Obsidian Enabling DKIM Email Signing Plesk Obsidian DKIM SPF DMARC and ARC SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Does Plesk incoming SPF protection authenticate outbound mail?

No. Incoming checks and the outgoing domain SPF policy are separate controls.

Plesk Obsidian Enabling DKIM Email Signing Plesk Obsidian DKIM SPF DMARC and ARC SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Must both SPF and DKIM pass for DMARC?

No. One passing and aligned mechanism can satisfy DMARC. Check the actual From domain and alignment mode.

Plesk Obsidian Enabling DKIM Email Signing Plesk Obsidian DKIM SPF DMARC and ARC SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Has this Plesk procedure been live tested?

No. Current documentation was reviewed; customer DNS, server configuration, receiver evidence and SME approval remain pending.

Plesk Obsidian Enabling DKIM Email Signing Plesk Obsidian DKIM SPF DMARC and ARC SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

[ Sources ]

Sources

  1. Plesk Obsidian Enabling DKIM Email Signing

    Sections Domain signing60–74; protocol errors55/76 superseded by cited RFCs

  2. Plesk Obsidian DKIM SPF DMARC and ARC

    Sections Mail-stack support65–76; DKIM controls; ARC224–263, limitations230–234

  3. SPF RFC 7208

    Sections §3.2; 3.3; 4.6.4

  4. DKIM RFC 6376

    Sections §3.5; 3.6.2; 6.1

  5. DMARC RFC 9989

    Sections §4.4; 4.7; 4.10; 5

[ Glossary ]

Glossary

Authoritative DNS
The nameservers that publish the domain records recipients actually query.
Domain alias
Another domain associated with the hosted domain, requiring its own sending-identity verification when used in From addresses.
DKIM selector
The signature value that identifies which public key to retrieve under the signing domain.
ARC
A mechanism for intermediaries to preserve authentication assessments for downstream receivers to evaluate.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base