Issue Description
Keys generated at bootstrap, while the domain’s DNS management is Manual, are created Active with nextTransitionAt = null, because the transition is only set inside the branch that publishes through a DNS updater (crates/services/src/task_manager/dkim.rs). When DNS management is later switched to Automatic, only a DnsManagement task is scheduled; it publishes the existing keys’ TXT records but never assigns them a transition. A DkimManagement task is scheduled only when dkimManagement itself becomes Automatic (crates/jmap/src/registry/mapping/domain.rs L102-136), which does not happen when it already was Automatic. rotation_due() returns None for a null transition, so these keys are never rotated, retired or deleted, while the domain shows DKIM management as Automatic. The rotation documentation does not cover this case.
Expected Behavior
When automatic DNS management with DKIM publication is enabled, automatically generated keys belonging to a domain with automatic DKIM management should receive a valid lifecycle schedule, and a DkimManagement task should be scheduled.
Actual Behavior
Both keys stay Active with nextTransitionAt = null, and x:Task contains no DkimManagement task; the keys are never rotated while the domain shows DKIM management as Automatic.
Reproduction Steps
- Bootstrap with “Generate DKIM keys” enabled and DNS management Manual; the domain’s DKIM management is Automatic.
- Leaving DKIM management unchanged (Automatic), switch the domain’s DNS management to Automatic (e.g. Cloudflare) with DKIM in the records to publish.
- A DnsManagement task is scheduled to publish the DKIM TXT records, but x:DkimSignature/get shows nextTransitionAt = null on both keys and x:Task/query lists no DkimManagement task.
Stalwart Version
v0.16.x
Installation Method
Binary (Linux)
Database Backend
RocksDB
Blob Storage
RocksDB
Search Engine
Internal
Directory Backend
Internal
I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.
on
I have searched this support forum (open and closed topics) and confirm this is not a duplicate.
on
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
on