Master Plesk DNS Diagnostics: Fix MX, SPF & DNSSEC Issues

Running email services on a VPS or dedicated server requires careful management of DNS records, MX entries, SPF policies and, increasingly, DNSSEC signatures. Even a small typo can cause mail to be rejected, flagged as spam, or fail authentication. Plesk’s built‑in DNS Diagnostic tool removes much of the guesswork by checking the health of your DNS zone and pointing out exactly where the problem lies.

Why Use Plesk’s DNS Diagnostics?

• All‑in‑one view – A single scan checks MX, SPF and DNSSEC records and presents the results in a clear table.
• Instant feedback – Errors are highlighted with line numbers and suggested fixes, so you can correct them directly in the Plesk UI.
• Server‑agnostic – The diagnostics query public DNS, not the local resolver, so they work the same on Ubuntu, Debian, AlmaLinux, Rocky or any other supported OS.

Preparing Your Environment

Before launching the diagnostic, make sure the domain’s zone is managed by Plesk and that you have administrative access.

1. Log in to Plesk as an administrator.
2. Navigate to Websites & Domains and select the domain you want to check.
3. Click DNS Settings and confirm that the zone contains the expected MX, TXT (SPF) and DNSSEC records.

If you need to install or update the DNS Server component (BIND, PowerDNS, etc.), use the package manager for your OS.

Debian/Ubuntu (apt)

# Update package index
sudo apt update

# Install BIND9 (if not already present)
sudo apt install bind9

# Restart the DNS service
sudo systemctl restart bind9

AlmaLinux/Rocky/RHEL (dnf)

# Refresh repository metadata
sudo dnf makecache

# Install BIND (named)
sudo dnf install bind bind-utils

# Enable and start the service
sudo systemctl enable --now named

Windows Server uses its own DNS role; add it via Server Manager > Add Roles and Features if required.

Running the Integrated DNS Diagnostic

1. From the domain’s DNS Settings page, click the DNS Diagnostic button (usually near the top right).
2. The tool performs a series of checks:
   • MX Record Validation – Confirms that each MX points to a reachable host with an A/AAAA record.
   • SPF Syntax Check – Parses the SPF TXT record for syntax errors, unsupported mechanisms and length limits.
   • DNSSEC Consistency – Verifies that DS, DNSKEY and RRSIG records are present, correctly signed and match the parent zone.
3. When the scan finishes, a table appears with rows marked OK, Warning or Error. Click any row to see a detailed explanation and a suggested command or record change.

Fixing Common MX Issues

MX problems usually fall into two categories: unreachable mail hosts and missing A/AAAA records.

Scenario: MX points to a non‑existent host

1. Locate the offending MX entry in the diagnostic table (it will show “Host not found”).
2. In DNS Settings, edit the MX record to point to the correct mail server hostname.
3. If the hostname is new, add an A record for it:
   • Hostname: mail.example.com
   • IP address: 203.0.113.45
4. Save changes and click Update to apply the zone.
5. Re‑run the DNS Diagnostic to confirm the MX now resolves.

Scenario: MX points to a host with only an IPv6 address, but your sending servers lack IPv6

1. Add an IPv4 A record for the mail host, or adjust the MX priority to prefer a host that has IPv4.
2. After editing, click Update and verify with the diagnostic tool.

Correcting SPF Syntax Errors

SPF records are stored as TXT records and must follow a strict format. The diagnostic tool highlights three typical mistakes.

1. Missing “~all” or “-all” qualifier

Without a terminating qualifier, receivers treat the SPF as “neutral,” which can increase the spam score.

# Example of a corrected SPF record
v=spf1 ip4:203.0.113.0/24 include:_spf.google.com -all

2. Exceeding the 255‑character limit

Long SPF strings need to be split into multiple TXT records, each under 255 characters, while preserving order.

# First TXT record
v=spf1 ip4:203.0.113.0/24 ip4:198.51.100.0/24

# Second TXT record (continuation)
include:_spf.google.com ~all

3. Using unsupported mechanisms (e.g., “ptr”)

Remove the unsupported term and replace it with a more reliable mechanism such as “ip4” or “include”.

1. In DNS Settings, edit the SPF TXT record.
2. Replace ptr with the appropriate IP range or include.
3. Save and re‑run the diagnostic.

Verifying and Repairing DNSSEC Inconsistencies

DNSSEC adds cryptographic signatures to your zone, protecting against spoofing. Mis‑configurations often arise after key rollovers or when the parent zone’s DS record is out of sync.

Step‑by‑step DNSSEC check

1. In the diagnostic table, locate any rows marked “DNSSEC error”. Typical messages include “DS record mismatch” or “RRSIG expired”.
2. Open DNS Settings → DNSSEC tab.
3. If the zone shows “Signed” but the DS record is missing in the registrar, log in to your domain registrar’s control panel and add the DS record exactly as shown in Plesk (algorithm, digest type and digest).
4. For a “RRSIG expired” warning, generate a new key pair:
   • Click Generate New Key in the DNSSEC tab.
   • Select a key size (e.g., 2048‑bit RSA) and click Generate.
5. After generating, click Apply Changes to re‑sign the zone.
6. Update the DS record at the registrar with the new key’s digest.
7. Run the DNS Diagnostic again; all DNSSEC rows should now show “OK”.

Automating Regular Checks

DNS records can drift over time. Scheduling regular diagnostics helps catch regressions early.

Using the Plesk CLI (Debian/Ubuntu and AlmaLinux/Rocky)

# List available CLI commands
sudo plesk bin dns --help

# Run a full diagnostic for a domain and output as JSON
sudo plesk bin dns --diagnostic example.com --output json > /var/log/plesk-dns-diagnostic.log

Set up a cron job to run the command daily and email you if any errors appear.

Debian/Ubuntu (apt) – cron entry

0 2 * * * root /usr/local/sbin/plesk-dns-check.sh

AlmaLinux/Rocky (dnf) – cron entry

0 2 * * * root /usr/local/sbin/plesk-dns-check.sh

In plesk-dns-check.sh, parse the JSON log for “Error” or “Warning” entries and pipe them to mail -s for notification.

Conclusion

Plesk’s Integrated DNS Diagnostics turns a manual, error‑prone process into a straightforward workflow. By systematically checking MX, SPF and DNSSEC records, you can quickly pinpoint misconfigurations, apply precise fixes within the Plesk UI, and automate ongoing health checks. Keeping your DNS zone clean improves mail deliverability and strengthens the overall security posture of your web and application servers.