System mails generated by your Plesk server, such as bounce notices from MAILER-DAEMON@hostname.example.com, cron output from root@hostname.example.com, or Plesk notifications, often land in the spam folder, even though normal user mailboxes (e.g. info@example.com) deliver fine.

This happens because your server’s hostname is a subdomain of your main domain, and your main domain’s DMARC policy is silently inherited by every subdomain that does not publish its own. Without dedicated authentication for the hostname, self-generated system mail fails DMARC alignment and is quarantined by your own authentication stack.

This article walks through the root cause, the one-DNS-record fix that solves the visible symptom for most admins, and the full authentication setup for getting non-bounce system mail to genuinely pass DMARC.

The quick fix: override subdomain inheritance

Add a dedicated DMARC record for your server hostname with p=none:

_dmarc.hostname.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

This overrides apex inheritance for the hostname subdomain only. Your main domain DMARC policy stays strict, your user mailboxes stay protected, but system mail from the hostname stops being quarantined.

This single record solves the symptom for most admins. No Plesk changes are required. No server configuration is required. //

If you also want cron output and Plesk notifications (not just bounces) to genuinely pass DMARC, continue to the complete fix below. If you just want your system mail out of spam, you can stop here.