Gmail rejecting DirectAdmin system emails: authenticating server hostnames with SPF and DKIM

You configure a server running DirectAdmin, setup client email accounts, validate SPF and DKIM, and everything lands cleanly in Gmail inboxes. But when the server tries to dispatch automated nightly backup alerts or disk quota notices, the emails never arrive.

Checking Exim mail logs reveals why: Gmail rejected the server's own automated mail with error:

550-5.7.26 This message does not pass authentication checks (SPF or DKIM). 
550-5.7.26 Gmail requires all senders to authenticate with either SPF or DKIM.

Here is how to identify this hostname authentication gap and set up the necessary DKIM keys and DNS records.

1. The blind spot: why the hostname fails authentication#

When DirectAdmin sends administrative notifications, it uses the server Fully Qualified Domain Name (FQDN, like srv1.yourdomain.com) in the message headers and SMTP envelope.

Most administrators create SPF and DKIM records only for the apex domain (yourdomain.com) or client domains, forgetting to authenticate the server machine subdomain (srv1.yourdomain.com).

Modern mailbox providers (Gmail, Yahoo, Outlook) enforce strict alignment per subdomain. Without explicit records for the hostname, automated system mail is rejected.

2. Tracking the failure in Exim logs#

To inspect delivery failures in the Exim logs:

# Filter recent authentication rejections
grep -E "550-5.7.26|DKIM" /var/log/exim/mainlog | tail -n 20

To test routing behavior for external addresses:

# Simulate route resolution
exim -bt admin@gmail.com

3. Generating DKIM keys and configuring DNS#

Step 1: Create virtual path and generate hostname DKIM keys#

In DirectAdmin, every subdomain signing mail needs an entry in /etc/virtual/:

# 1. Create virtual directory for the hostname
sudo mkdir -p /etc/virtual/srv1.yourdomain.com
sudo chown mail:mail /etc/virtual/srv1.yourdomain.com
sudo chmod 711 /etc/virtual/srv1.yourdomain.com

# 2. Generate DKIM keypair using DirectAdmin script
sudo /usr/local/directadmin/scripts/dkim_create.sh srv1.yourdomain.com

Step 2: Add DNS records in the apex zone#

In the authoritative DNS zone for yourdomain.com, add the four dedicated records for the server hostname:

; 1. Server IPv4 Address
srv1        IN A        123.123.123.123

; 2. Hostname SPF Record
srv1        IN TXT      "v=spf1 ip4:123.123.123.123 ~all"

; 3. Public DKIM Record (copied from dkim.public.key)
x._domainkey.srv1 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

; 4. Hostname DMARC Policy
_dmarc.srv1 IN TXT      "v=DMARC1; p=quarantine; pct=100; rua=mailto:postmaster@yourdomain.com"

Step 3: Verify reverse DNS (rdns / PTR)#

The server public IP address must resolve in PTR to srv1.yourdomain.com:

dig +short -x 123.123.123.123

Step 4: Validate and reload BIND9#

sudo named-checkzone yourdomain.com /var/named/yourdomain.com.db
sudo systemctl reload named

4. Testing delivery from the CLI#

Send a test message from the terminal to verify incoming headers:

echo "DirectAdmin system email authentication test" | mail -s "Hostname Delivery Test" yourtest@gmail.com

In Gmail, open the message, select Show original, and verify the header authentication results:

• SPF: PASS with IP 123.123.123.123
• DKIM: PASS with domain srv1.yourdomain.com
• DMARC: PASS

Production takeaways#

1. Authenticate hostnames like real domains: Hostnames require SPF, DKIM, and DMARC with identical rigor as client mailboxes.
2. Monitor DMARC reports: Use rua= to receive automated reports when mailbox providers reject notifications.
3. Keep selector x intact: DirectAdmin defaults to selector x in dkim_create.sh.
4. Manage Exim queues and counters: If outgoing queues stall or users hit sending limits, read our DirectAdmin Exim queue and counter unblocking guide and our DNS BIND9 zone resolution guide.

See also

Infrastructure Infra diary: taming antispam gateways, SPF failures, and Bash filters

Email The Exim black hole, DMARC alignment failures, and restoring IP reputation

Email Meeting Google and yahoo email authentication requirements: practical SPF, DKIM, and DMARC guide

This post is licensed under CC BY-NC.