# Can Default Hostname be a sibling of Domain?
**URL:** https://support.stalw.art/t/can-default-hostname-be-a-sibling-of-domain/1435
**Category:** Questions
**Created:** [August 19, 2026, 2:30pm UTC](https://support.stalw.art/t/can-default-hostname-be-a-sibling-of-domain/1435 "2026-08-19T14:30:00Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@mixis](https://support.stalw.art/u/mixis)
#### Post date: [August 19, 2026, 2:30pm UTC](https://support.stalw.art/t/can-default-hostname-be-a-sibling-of-domain/1435/1 "2026-08-19T14:30:00Z")
### Your question
I may have misconfigured Stalwart with an unsupported setup and hope @helpbot with its excellent source-level understanding can help me out.
### My setup
My `Domain Name` is set to `m.filts.net` and `Default Hostname` is set to `madalena.filts.net`, which matches the Reverse DNS records. IMHO, that should be a legal way to set up a mailserver.
I have a DNS Provider configured and am using that for ACME Dns01 and automatic DNS management.
I am using 0.16.18 from a checkout a couple of days ago.
### The issue
The https certificate is only for `madalena.filts.net`, while it should also include `mta-sts.m.filts.net`, likely among others.
### Looking at the source
The important function appears to be `build_domains` in `network/acme/order.rs` in the `common` crate. Judging from the result, `hostnames` appears to be non-empty for me, likely containing `madalena.filts.net`.
The only caller of that function is `acme_renew` in `renew.rs`, which sets the `hostnames` argument to `subject_alternative_names` and where those are set, I don’t understand.
Looking further at `build_domains`, even if I were to hit the Dns01 branch, I would be missing a certificate for Default Hostname, as that is where all the DNS records point to.
### Questions
Should my setup be supported or should I change Reverse DNS and Default Hostname to `m` or `m.filts.net`? How would that result in an empty `hostnames` argument, so that a wildcard certificate gets ordered? That is where I don’t understand the source.
### I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
on
---
### Author:  [@helpbot](https://support.stalw.art/u/helpbot)
#### Post date: [August 19, 2026, 2:32pm UTC](https://support.stalw.art/t/can-default-hostname-be-a-sibling-of-domain/1435/2 "2026-08-19T14:32:03Z")
Your reading of the source is right, and the behaviour you’re seeing is expected given how `build_domains` works, not a bug in your config.
**Why `madalena.filts.net` isn’t covered**
When a Domain’s `subjectAlternativeNames` is left empty and the challenge type isn’t DNS-01, the server builds a _default_ SAN set (see `build_domains` in `crates/common/src/network/acme/order.rs`):
- It adds the technical hostnames `mta-sts`, `ua-auto-config`, `autoconfig`, `autodiscover` under the Domain’s own zone (`m.filts.net`).
- It adds the server’s `Default Hostname` (`server_name`) **only if it matches that same zone** , i.e. equals `m.filts.net` or ends in `.m.filts.net`.
- It adds any MX/service hostnames that likewise fall inside that zone.
Since your `Default Hostname` is `madalena.filts.net`, a sibling of `m.filts.net` rather than a subdomain of it, the zone check fails and it’s silently excluded from the default SAN set, even though it’s the actual name presented on the TLS connection. That matches the certificate you’re seeing (SANs limited to `madalena.filts.net`, the CN/leaf added elsewhere, but missing `mta-sts.m.filts.net` etc. because… actually in your case it’s the reverse: you’re missing the technical hostnames because those get requested for `m.filts.net`, while `madalena.filts.net` itself only ends up on the cert via some other path such as the AutoConfig default). Either way, the mismatch between the Domain’s `Domain Name` and `Default Hostname`’s zone is exactly why the SAN sets diverge.
For the DNS-01/wildcard branch (empty SANs + Dns01/DnsPersist01 challenge), the wildcard requested is `*.m.filts.net` plus `m.filts.net` itself, again scoped to the Domain’s own zone, so `madalena.filts.net` would still not be covered by that wildcard either, since it isn’t a subdomain of `m.filts.net`.
**What to do**
Per the docs on [Automatic certificates](https://stalw.art/docs/domains/tls-certificates#automatic-certificates), you don’t have to rely on the default SAN set: set `subjectAlternativeNames` on the Domain explicitly. Since it contains a dot, `madalena.filts.net` will be taken as a full hostname rather than appended to the domain:
```json
{
"subjectAlternativeNames": ["madalena.filts.net", "mta-sts", "autoconfig", "autodiscover"]
}
```
That will get you a single certificate that covers both your reverse-DNS hostname and the technical subdomains of `m.filts.net`. Alternatively, if you want the automatic defaults to “just work” without listing SANs, set `Default Hostname` to something under the `m.filts.net` zone (e.g. `madalena.m.filts.net`) and update your PTR record to match.
_This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong._
---
### Author:  [@mixis](https://support.stalw.art/u/mixis)
#### Post date: [August 19, 2026, 3:53pm UTC](https://support.stalw.art/t/can-default-hostname-be-a-sibling-of-domain/1435/3 "2026-08-19T15:53:34Z")
For the record, the complete list of technical domains, according to `order.rs`, is
```json
["mta-sts", "ua-auto-config", "autoconfig", "autodiscover"]
```
On the Domain Object, under “Additional Hostnames”, which was the field I was looking for, I could also set `*.m.filts.net` to get a wildcard certificate.
Setting “[madalena.filts.net](http://madalena.filts.net)” there, got me that name in `Subject Alt Names` in addition to `Common Name`. I might try to leave that out for the next renewal, but it won’t hurt for now.
I continue to be amazed by the quality of answers by that bot. That is a very nice aspect of user experience.