Acquiring Let's Encrypt TLS certificate for diverging hostname via DNS-01 challenge

Questions
1

Your question

I am trying to follow the migration guide to migrate from 0.15.x to 0.16.x. I am currently setting up the new 0.16.x instance. My setup with the 0.15.x server was that its hostname was mx2.example.net and it was serving example.com and example.org as maildomains (note the different TLDs to illustrate separate domains). Stalwart was successfully acquiring a TLS certificate for mx2.example.net via ACME with Let’s Encrypt using Cloudflare’s DNS API.
When trying to replicate this setup with 0.16.x and reading the documentation, I understand that performing the DNS-01 ACME challenge requires configuring a domain object for the respective domain (mx2.example.net) and enabling automatic DNS management.
However, I don’t want to receive mail under mx2.example.net and I also do not require any of the automatic DNS management for this domain since it does not receive any mail. The only remotely useful record would be SPF and TLSA. However during migration when having the intermediate proxy, I need to handle SPF manually and do not want to handle TLSA, where certificates vary. All other records that are mail related should also not be set. When enabling automatic DNS management, the UI does not allow me to deselect all possible records. One record needs to be set.

Since I did not find any related issue, I am assuming that my setup is rather unorthodox and I would be happy to learn what I am doing wrong and which setup would be better, or I would love to learn how I can configure automatic TLS certificate management without enabling any DNS record which I believe to require during the migration phase.

Stalwart version: 0.16.10 (Docker)

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

The DNS-01 flow only ever writes the transient _acme-challenge TXT record for the validation; enabling automatic DNS management for the hostname does not publish MX, SPF, TLSA or anything else unless those record types are actually in the domain’s publish list. The “one record must be selected” you hit is a form minimum in the web UI, not a server requirement, and it won’t cause mail records to be published. The domain object also doesn’t need to receive mail; a domain with no mail routing can still hold automatic certificate management.

That said, for a server hostname that isn’t a mail domain, the simplest path is usually TLS-ALPN-01 (the default challenge) if port 443 is publicly reachable, or HTTP-01 on port 80. Both get a Let’s Encrypt cert with no DNS provider and no records at all. Use DNS-01 only if you specifically need it (wildcard, or no reachable port), and then only the challenge TXT is written. Docs: Challenge Types | Stalwart.

3

HTTP-01 and TLS-ALPN-01 were not available during migration, since I am (intermediately) operating two mailservers under the same hostname.

The important information was that enforcing a minimum of one DNS record was a UI limitation. This means that I can craft the correct JMAP call to achieve the desired outcome, thanks.