ACME DNS-01 not issuing certificates

TheSpeedCubing · July 17, 2026, 6:47pm

Your question

It’s not generating certificates, (I think)
The cert is for IMAP and SMTP

Issue

WARN No TLS certificates available (tls.no-certificates-available) total = 0

There’s no any logs starts with (or contains) ACME, I’m not sure if it’s a problem.
Is it even trying to issue certificates?

Environment

Application: Docker: stalwartlabs/stalwart:v0.16.13
DNS server: cloudflare

Cloudflare API Permission Settings

Cloudflare API:

Zone.Zone → Edit
Zone.DNS → Edit
Zone.DNS Settings → Edit

UI Settings

Domains/Domains:
- Domain:
  - Domain Name: domain.com
- TLS:
  - Certificate Management: ACME TLS certificate management
  - ACME Provider: https://acme-v02.api.letsencrypt.org/directory (selected)
  - Additional Hostnames: mail
- DNS:
  - DNS Management: Automatic DNS management
  - DNS Server: cloudflare (selected)
  - Zone Origin: domain.com
Network/ASN & GeoIP/DNS/DNS Providers:
- DNS server type: cloudflare
- Authentication:
  - API Token: Secret value
  - Secret: ****
TLS/ACME Providers:
- ACME Provider:
  - Directory URL: https://acme-v02.api.letsencrypt.org/directory
  - Challenge-type: DNS-01
  - Contact Email: ****
  - Renew before: 2/3
  - Perferred chain: empty
- External Account Binding:
  - Key ID: Not set
  - HMAC Key: empty
- Account:
  - Account URI: https://acme-v02.api.letsencrypt.org/acme/acct/****
  - Account Key: ****

DNS Records

DNS Records:

A `mail.domain.com` `(mailserver ip address)` // (proxy: off) (8080 is not from here)

hostname = "_submissions._tcp.domain.com.", details = "domain.com", type = "SRV", value = ["0 1 465 mail.domain.com."]

hostname = "autodiscover.domain.com.", details = "domain.com", type = "CNAME", value = ["mail.domain.com."]

hostname = "ua-auto-config.domain.com.", details = "domain.com", type = "CNAME", value = ["mail.domain.com."]

hostname = "autoconfig.domain.com.", details = "domain.com", type = "CNAME", value = ["mail.domain.com."]

hostname = "domain.com.", details = "domain.com", type = "MX", value = ["10 mail.domain.com"]

hostname = "mail.domain.com.", details = "domain.com", type = "TXT", value = ["v=spf1 a -all"]

hostname = "_jmap._tcp.domain.com.", details = "domain.com", type = "SRV", value = ["0 1 443 mail.domain.com."]

hostname = "domain.com.", details = "domain.com", type = "TXT", value = ["v=spf1 mx -all"]

hostname = "domain.com.", details = "domain.com", type = "CAA", value = ["0 issue "letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/**********"", "0 iodef "mailto:[email protected]""]

hostname = "_pop3s._tcp.domain.com.", details = "domain.com", type = "SRV", value = ["0 1 995 mail.domain.com."]

hostname = "_ua-auto-config.domain.com.", details = "domain.com", type = "TXT", value = ["v=UAAC1; a=sha256; d=s8xtVGL+1mn9yMZPOkvVMZKwORG3pzDO8Nd2+CY31xA="]

hostname = "_imaps._tcp.domain.com.", details = "domain.com", type = "SRV", value = ["0 1 993 mail.domain.com."]

hostname = "_validation-persist.domain.com.", details = "domain.com", type = "TXT", value = ["letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/**********"]

hostname = "_carddavs._tcp.domain.com.", details = "domain.com", type = "SRV", value = ["0 1 443 mail.domain.com."]

hostname = "v1-ed25519-20260716._domainkey.domain.com.", details = "domain.com", type = "TXT", value = ["v=DKIM1; k=ed25519; h=sha256; p=8ivOIxn3wtbG7y0Rl2EqBkKABXe3rhiVPWFLe9BNP04="]

hostname = "_mta-sts.domain.com.", details = "domain.com", type = "TXT", value = ["v=STSv1; id=10725752429275503055"]

hostname = "mta-sts.domain.com.", details = "domain.com", type = "CNAME", value = ["mail.domain.com."]

hostname = "_smtp._tls.domain.com.", details = "domain.com", type = "TXT", value = ["v=TLSRPTv1; rua=mailto:[email protected]"]

hostname = "_caldavs._tcp.domain.com.", details = "domain.com", type = "SRV", value = ["0 1 443 mail.domain.com."]

hostname = "_dmarc.domain.com.", details = "domain.com", type = "TXT", value = ["v=DMARC1; p=reject; rua=mailto:[email protected]"]

What I’ve done

Running Actions:

TLS certificates， Reload: Action executed successfully.

logs (TRACE):

2026-07-17T18:45:01Z DEBUG HTTP request URL (http.request-url) listenerId = "http", localPort = 8080, remoteIp = 10.0.1.151, remotePort = 51070, url = "/jmap/"
2026-07-17T18:45:01Z TRACE Expression evaluation result (eval.result) listenerId = "http", localPort = 8080, remoteIp = 10.0.1.151, remotePort = 51070, id = "Http with id singleton", key = "allowedEndpoints", result = "Integer(200)"
2026-07-17T18:45:01Z DEBUG Cache hit (store.cache-hit) key = 1, collection = "accessToken"
2026-07-17T18:45:01Z TRACE Write batch operation (store.data-write) elapsed = 0ms, total = 2
2026-07-17T18:45:01Z TRACE HTTP request body (http.request-body) listenerId = "http", localPort = 8080, remoteIp = 10.0.1.151, remotePort = 51070, (skipped) details = [ contents = "{"using":["urn:ietf:params:jmap:core","urn:stalwart:jmap","urn:ietf:params:jmap:blob","urn:ietf:params:jmap:mail","urn:ietf:params:jmap:calendars","urn:ietf:params:jmap:contacts","urn:ietf:params:jmap:principals","urn:ietf:params:jmap:sieve","urn:ietf:params:jmap:vacationresponse"],"methodCalls":[["x:Action/set",{"accountId":"b","create":{"action-0":{"@type":"ReloadTlsCertificates"}}},"0"]]}", size = 394
2026-07-17T18:45:01Z TRACE Data store iteration operation (store.data-iterate) elapsed = 0ms
2026-07-17T18:45:01Z DEBUG JMAP method call (jmap.method-call) listenerId = "http", localPort = 8080, remoteIp = 10.0.1.151, remotePort = 51070, id = "x:Action/set", accountId = 1, elapsed = 0ms
2026-07-17T18:45:01Z TRACE HTTP response body (http.response-body) listenerId = "http", localPort = 8080, remoteIp = 10.0.1.151, remotePort = 51070, contents = "{"methodResponses":[["x:Action/set",{"accountId":"b","created":{"action-0":{"id":"bvfu1bn"}}},"0"]],"sessionState":"4ceefe4f"}", code = 200, size = 126

Full Logs

logs (INFO):

stalwart  | 2026-07-18T07:27:52Z INFO Starting Stalwart Server (server.startup) hostname = "334680eb8b7e", version = "0.16.13"
stalwart  | 2026-07-18T07:27:52Z INFO Spam classifier model not found (spam.model-not-found)
stalwart  | 2026-07-18T07:27:52Z WARN Log collector error (telemetry.log-error) details = "Failed to create log file", path = "/var/log/stalwart/stalwart.2026-07-18", reason = "No such file or directory (os error 2)"
stalwart  | 2026-07-18T07:27:52Z INFO Task manager started (task-manager.manager-started)
stalwart  | 2026-07-18T07:27:52Z INFO Network listener started (network.listen-start) listenerId = "imaps", localIp = ::, localPort = 993, tls = true
stalwart  | 2026-07-18T07:27:52Z INFO Network listener started (network.listen-start) listenerId = "sieve", localIp = ::, localPort = 4190, tls = false
stalwart  | 2026-07-18T07:27:52Z INFO Network listener started (network.listen-start) listenerId = "http", localIp = ::, localPort = 8080, tls = false
stalwart  | 2026-07-18T07:27:52Z INFO Network listener started (network.listen-start) listenerId = "test", localIp = ::, localPort = 465, tls = true
stalwart  | 2026-07-18T07:27:52Z INFO Network listener started (network.listen-start) listenerId = "test2", localIp = ::, localPort = 587, tls = false
stalwart  | 2026-07-18T07:27:52Z INFO Task scheduler started (task-manager.scheduler-started)
stalwart  | 2026-07-18T07:27:52Z INFO Task scheduled for future execution (task-manager.task-scheduled) due = 2026-07-18T23:59:59Z, id = "purgeAccount"
stalwart  | 2026-07-18T07:27:52Z INFO Task scheduled for future execution (task-manager.task-scheduled) due = 2026-07-19T01:59:59Z, id = "purgeDataStore"
stalwart  | 2026-07-18T07:27:52Z INFO Task scheduled for future execution (task-manager.task-scheduled) due = 2026-07-19T03:59:59Z, id = "purgeBlobStore"
stalwart  | 2026-07-18T07:27:52Z INFO Task scheduled for future execution (task-manager.task-scheduled) due = 2026-07-18T19:27:51Z, id = "trainSpamClassifier"
stalwart  | 2026-07-18T07:27:52Z INFO Task scheduled for future execution (task-manager.task-scheduled) due = 2026-07-18T07:27:52Z, id = "calculateMetrics"
stalwart  | 2026-07-18T07:27:52Z INFO MTA queue started (queue.started)
stalwart  | 2026-07-18T07:27:52Z INFO Task scheduled for future execution (task-manager.task-scheduled) due = 2026-07-18T07:32:51Z, id = "calculateMetrics"
stalwart  | 2026-07-18T07:27:52Z INFO Metrics collected (telemetry.metrics-collected) elapsed = 7ms
stalwart  | 2026-07-18T07:27:53Z INFO Downloading external resource (resource.download-external) details = "Downloaded ASN/Geo data", url = "https://cdn.jsdelivr.net/npm/@ip-location-db/asn/asn-ipv4.csv", elapsed = 1097ms
stalwart  | 2026-07-18T07:27:53Z INFO Downloading external resource (resource.download-external) details = "Downloaded ASN/Geo data", url = "https://cdn.jsdelivr.net/npm/@ip-location-db/asn/asn-ipv6.csv", elapsed = 461ms
stalwart  | 2026-07-18T07:27:54Z INFO Downloading external resource (resource.download-external) details = "Downloaded ASN/Geo data", url = "https://cdn.jsdelivr.net/npm/@ip-location-db/geolite2-geo-whois-asn-country/geolite2-geo-whois-asn-country-ipv4.csv", elapsed = 475ms
stalwart  | 2026-07-18T07:27:54Z INFO Downloading external resource (resource.download-external) details = "Downloaded ASN/Geo data", url = "https://cdn.jsdelivr.net/npm/@ip-location-db/geolite2-geo-whois-asn-country/geolite2-geo-whois-asn-country-ipv6.csv", elapsed = 539ms
stalwart  | 2026-07-18T07:28:10Z INFO SMTP EHLO command (smtp.ehlo) listenerId = "test2", localPort = 587, remoteIp = 192.168.1.4, remotePort = 55456, domain = "we-guess.mozilla.org"
stalwart  | 2026-07-18T07:28:10Z WARN No TLS certificates available (tls.no-certificates-available) total = 0

zeeZ · July 17, 2026, 7:33pm

dns-persist-01 hasn’t gone live with any CA yet. There’s still changes being made to the draft.

You can try it out on LE staging, but you’ll have to wait for their announcements to actually be able to use it.

TheSpeedCubing · July 18, 2026, 7:39am

Hello, I changed to DNS-01 instead, but the same problem persists.
(I’ve updated the infos)

It’s still generating _validation-persist. TXT records
Theres no any logs related to ACME

TheSpeedCubing · July 18, 2026, 10:39am

Ok, I found the solution in my case.

There’s a + Create task at the top right of the Tasks/Scheduled, there’s a Perform ACME certificate renewal for a domain.

After doing so, a certificate was created.

Topic		Replies	Views
Not able to retrieve certificates through Let's encrypt ACME (behind caddy) - worked around Issues no-ai	7	188	June 15, 2026
ACME-DNS provider for DNS-AUTH01 of ACME certificates setup? Questions	4	74	June 3, 2026
Issues getting TLS cert Issues	3	125	May 19, 2026
TLS certs not available Issues	5	125	May 9, 2026
Acquiring Let's Encrypt TLS certificate for diverging hostname via DNS-01 challenge Questions	2	33	July 12, 2026