[Solved] Fixing Broken DomainKeys and DKIM Signatures Sent via PHP mail()

When sending emails through PHP's native mail() function on a server configured with SPF, DomainKeys, and DKIM (such as Plesk), desktop mail clients (Outlook, Thunderbird) may sign outbound emails correctly, but emails dispatched from web scripts fail DKIM verification with invalid domain signatures.

The Trap: Setting a raw From: string inside $additional_headers causes the sendmail wrapper to misidentify the originating signing domain d=$DOMAIN.

The Problematic Call

// This breaks DKIM signatures by overriding the sender envelope incorrectly:
mail($to, $subject, $message, "From: Name <user@domain.com>");

The Solution

Explicitly pass the envelope sender using the -f flag in the 5th parameter ($additional_parameters):

// Correct invocation with verified envelope sender:
mail($to, $subject, $message, "", "-f user@domain.com");

Verification Tip: Send a test email to check-auth@verifier.port25.com. The automated robot will reply within seconds with a detailed SPF, DKIM, DomainKeys, and SpamAssassin diagnostic report.

[Solved] Postfix SASL Authentication Failure: realm changed: authentication aborted in Plesk

When enabling STARTTLS on a Plesk server running Postfix, mail clients like Mozilla Thunderbird may connect normally, while Microsoft Outlook clients repeatedly fail with authentication popups and the following mail log errors:

Environment: Plesk • Postfix with STARTTLS • Cyrus SASL Authentication

postfix/smtpd[1929]: warning: SASL authentication failure: realm changed: authentication aborted
postfix/smtpd[1929]: warning: SASL DIGEST-MD5 authentication failed: authentication failure

Root Cause & Solution

Outlook struggles with DIGEST-MD5 SASL negotiation over TLS on certain Cyrus SASL configurations. Restricting the SASL mechanism list to CRAM-MD5, PLAIN, and LOGIN resolves the negotiation conflict:

1. Edit /usr/lib64/sasl2/smtpd.conf and update mech_list:

   mech_list: CRAM-MD5 PLAIN LOGIN

2. Edit /etc/postfix/main.cf and confirm security options:

   smtpd_sasl_security_options = noanonymous

3. Restart services:

   service postfix restart
   service saslauthd restart