How to Install Properly

[Tahinli]

Hi, I installed Stalwart Mail Server. I can send emails and be able to get from others. But the problem is Gmail and Outlook didn't like my setup.

What hotmail says:

What gmail says:

I understand I gotta do few more steps but couldn't figure it out properly. Stalwart Mail installed pretty easily, I didn't even need to do dns record for them. Just got tls certificate from Let's encrypt(I already got them before actually). I searched but couldn't understand enough to do some stuff. I use cloudflare as dns recorder normally. What I need to do to fix this problems. Can you guide me ?

[williamdes]

You should try mail-tester.com
It will help you find what's wrong

[Tahinli]

You should try mail-tester.com It will help you find what's wrong

Thanks for website. Generally problems are related to DKIM but I don't understand how to fix.

[jayknyn]

Hi Ahmet, you need to create SPF and DKIM DNS records at your DNS registrar, Cloudflare. For SPF, create a TXT record like this, substituting your email domain for domain.tld:

Type: TXT
Name: domain.tld
Content: v=spf1 mx ~all

For DKIM, you need to use the web admin UI to generate a DKIM key for your domain and then create the following DNS record, pasting in the actual key for the Content:

Type: TXT
Name: mail._domainkey
Content: v=DKIM1; h=sha256; k=rsa; p=<generated DKIM key>

And then use this MXToolBox tool to verify your SPF and DKIM settings.

[Tahinli]

Hi Ahmet, you need to create SPF and DKIM DNS records at your DNS registrar, Cloudflare. For SPF, create a TXT record like this, substituting your email domain for domain.tld:

Type: TXT
Name: domain.tld
Content: v=spf1 mx ~all

For DKIM, you need to use the web admin UI to generate a DKIM key for your domain and then create the following DNS record, pasting in the actual key for the Content:

Type: TXT
Name: mail._domainkey
Content: v=DKIM1; h=sha256; k=rsa; p=<generated DKIM key>

And then use this MXToolBox tool to verify your SPF and DKIM settings.

I think I did spf but couldn't sure how to generate dkim.

if this is the place, how can I create new key. when I want to create new signature it wants priv key from me. should I use my letsencrypt key ?

checked the site that you sent, here are the results.

[yannikbloscheck]

In the webadmin go to "Domains" under "Directory" (/manage/directory/domains). There is a button "DNS Records" for each domain. When you click on it, it should show you all the DNS record you need to set up for the corresponding domain.
If you add a new domain under "Directory" (/manage/directory/domains), the DKIM signatures (including private keys) get automatically created.

[Tahinli]

it really helped me thanks a lot.But still I'm in spam folder for gmail, hotmail doesn't even let me in spam folder. mail-tester.com says I have problem with spam assassin.

and this one also comes from mail-tester.com

What can I do about them ?

[williamdes]

says I have problem with spam assassin.
What can I do about them ?

Ignore all the spamassasin and Pyzor stuff. And unsubscribe.

The reverse DNS should be fixed and next item would be the DKIM key (did you DNS publish it?)
Can we have the domain name ? Does it really start with numbers ?

First step: the mail server IP/IPs must resolve to a name. And the name to IPs.
Example: mx1.mails.wdes.eu -> 185.xxx.xxx.122. dig -x 185.xxx.xxx.122 gives back PTR mx1.mails.wdes.eu.
Then the mail server HELO must be the same value: mx1.mails.wdes.eu and be a real FQDN domain

[shellyeah]

I was able to see the unedited version of the above post (subscribed via e-mail). The hostname is the default, automatically populated hostname from stalwart. Just a random alphanumeric string, no FQDN.
@Tahinli you need to set your hostname under Server > Network > Hostname to the same FQDN you set your PTR to. This should get rid of at least "HELO_NO_DOMAIN".

[Tahinli]

I was able to see the unedited version of the above post (subscribed via e-mail). The hostname is the default, automatically populated hostname from stalwart. Just a random alphanumeric string, no FQDN. @Tahinli you need to set your hostname under Server > Network > Hostname to the same FQDN you set your PTR to. This should get rid of at least "HELO_NO_DOMAIN".

yes this fixed the problem thanks a lot.

[Tahinli]

says I have problem with spam assassin.
What can I do about them ?

Ignore all the spamassasin and Pyzor stuff. And unsubscribe.

The reverse DNS should be fixed and next item would be the DKIM key (did you DNS publish it?) Can we have the domain name ? Does it really start with numbers ?

First step: the mail server IP/IPs must resolve to a name. And the name to IPs. Example: mx1.mails.wdes.eu -> 185.xxx.xxx.122. dig -x 185.xxx.xxx.122 gives back PTR mx1.mails.wdes.eu. Then the mail server HELO must be the same value: mx1.mails.wdes.eu and be a real FQDN domain

dix -x serverip returns my hosting provider related results
like this

[Tahinli]

Okay I fixed the r-dns via server interface that my server provider gave.

[DerDennisOP]

Hi I'm getting a similar error:

Feb 11 18:11:22 mail stalwart-mail[666]: 2025-02-11T17:11:22Z WARN DKIM signer not found (dkim.signer-not-found) listenerId = "smtp", localPort = 25, remoteIp = [ip], remotePort = 64228, id = "rsa-myexample.com"
Feb 11 18:11:22 mail stalwart-mail[666]: 2025-02-11T17:11:22Z WARN DKIM signer not found (dkim.signer-not-found) listenerId = "smtp", localPort = 25, remoteIp = [ip], remotePort = 64228, id = "ed25519-myexample.com"

My cloudflare has the record:

There are 2 Stalwart signatures configured. One rsa and one ed25519, both keys generated like the docs explain with openssl.
BUT only one DKIM signature is recognized by stalwart for the coresponding domain. What is going on?

[mdecimus]

Hi, try reloading the configuration. Also make sure these signatures are listed under the DKIM settings. Stalwart generates DKIM signatures automatically but if you have your own you need to add them manually under DKIM signatures.

[DerDennisOP]

can you take a look at my issue: #1205

Feb 13 11:31:46 mail stalwart-mail[660]: 2025-02-13T10:31:46Z INFO DKIM verification failed (smtp.dkim-fail) listenerId = "submissions", localPort = 465, remoteIp = xx.xx.xx.xx, remotePort = 48732, strict = false, result = [], elapsed = 0ms Feb 13 11:31:46 mail stalwart-mail[660]: 2025-02-13T10:31:46Z INFO ARC verification passed (smtp.arc-pass) listenerId = "submissions", localPort = 465, remoteIp = xx.xx.xx.xx, remotePort = 48732, strict = false, result = No DKIM signature (dkim.none), elapsed = 0ms

this error persists. I verified the records, now I also got the 2. (rsa) dkim signature showing up. but the error persists
any idea why result = []?