Trouble setting up a second domain with DMS

[RealHypnoticOcelot]

I was able to get DMS running just fine with my main domain, and got Roundcube set up too. However, I have a second domain that I wanted to also be able to send and receive emails from, and that's where I'm having problems.

These are the steps I took to set up my second domain:

1. Added an MX and PTR record pointing to my main mailserver domain
2. Generated a DKIM record using docker exec -ti mailserver setup config dkim domain newdomain.tld
3. Added a DKIM, SPF, and DMARC record
4. Set my new domain as an alias of my main domain so that I can send and receive emails from it

I received a Sender address rejected: not owned by user error in Roundcube, but this was fixed by adding a specific alias instead of a catch-all. At this point, I was somewhat able to send emails, but Proton Mail would flag them as "spoofed or improperly forwarded", and Gmail would make the email bounce, with the reason that the DKIM and SPF were incorrect.

After troubleshooting with https://learndmarc.com/, I was able to fix the SPF issue by manually setting ip4:XX.XX.XX.XXX. This allowed my messages to go through on both Gmail and Proton Mail. However, I still can't receive emails, which is an issue. My guess is that something is still wrong with my DNS configuration, but I'm not too sure what? My DKIM is flagging as incorrect for some reason, but I don't know what else could be the issue. Any help would be appreciated, thanks!

[polarathene]

• MX DNS records should point to DMS hostname, you do not need an alias/CNAME (point 4) for such, just refer to mail.main.domain. MX record is where mail should be delivered. If this were Gmail or some other service it would not share your new domain, so avoid trying to treat it like such.
• PTR record AFAIK should be for your HELO/EHLO greeting when connecting to other mail servers, hence your mail.main.domain should have a PTR record that is valid and resolves to mail.main.domain.
• TXT records like SPF for newdomain.tld are for the mail domain itself [email protected] and need to grant DMS (aka mail.main.domain authority to send mail on behalf of your domain. You shouldn't need to use ip4, so long as you provide an a: or mx: that resolves to the correct IP for DMS. PTR record should then reverse IP match back to the same value, but this won't be the case if you try to be sneaky with a mail.newdomain.tld.

If you have SPOOF_PROTECTION=1 enabled, this restricts your sender address to the DMS account address you created for authentication. Don't login with aliases (the ability to do such is an unintended side effect of a workaround for Dovecot feature ENABLE_QUOTAS=1 support).

[RealHypnoticOcelot]

By alias, I meant an email alias, so I ran docker exec -ti mailserver setup alias add @new.domain [email protected]. Sorry for the confusion! The above records are for my second domain, so I'm pretty sure the MX is right (where new.domain points to mail.main.domain). So I don't need a PTR record on this second domain?

I'm not trying to hook it up so that there's both mail.main.domain and mail.new.domain, just the former. I do have SPOOF_PROTECTION=1 enabled, but I'm able to send through both emails with one account because [email protected] is set as an alias of [email protected] in Dovecot.

As for the TXT records, I think that's where I'm having trouble. I've tried updating my SPF record so that instead of ip:XX.XX.XX.XXX, it's mx:mail.main.domain, but with https://learndmarc.com/ that fails.
EDIT:
I think my issue with the SPF record was due to Cloudflare proxying the IP of my A record for mail.main.domain. Turning that off allows it to pass!

After some testing, I'm mostly having issues with DKIM. I added a DKIM record the same way as I did on my main domain(which passes all tests) but for some reason it fails here. The keys should be different for each domain, right? They aren't identical, because they were generated separately for each domain. This is my result:

I'm wondering if maybe Roundcube isn't sending DKIM headers? I just added the second email under the "Identities" section of Roundcube, so maybe for DKIM to pass I need to have an extra step there.

TL;DR MX, SPF, and DMARC are working fine. I still have the PTR record, although it's maybe not necessary? And DKIM isn't working for some reason.

EDIT: I gave my server some time to let the DNS records propagate, and now all signatures pass perfectly! Thank you!