DMARC configuration including tags and reporting

Questions
1

Your question

I currently have a working, manualy managed, DMARC DNS setup but would like to move the DNS DMARC portion to Stalwart (managed via Dynamic Updates, RFC 2136).

Sofar I have DMARC set to strict at Settings → MTA → Inbound → Sender Authentication → DMARC Verification.

Some of the reporting I found at Management → Domains → Domains → Reports but that does not give me an option to set different receivers for say TLS-RPT vs DMARC. Which I currently currently sending both to different email addresses.

At Management → Domains → Domains → DNS → Select Options: DMARC I found howe to add DMARC to rfc2136 DONS configuration.

But still I cn’t find anywhere to configure other tags like v, p, sp or pct. Where are all the parts hidden to do complete DMARC + DNS 2136 config?

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

I now have enough to give a clear, grounded answer. The key finding is on the Domain object: reportAddressUri is a single field covering DMARC, TLS-RPT, and CAA reports together, and there are no separate fields for DMARC policy tags like p, sp, pct. The DMARC DNS record content (policy, percentage, subdomain policy, etc.) is auto-generated by Stalwart from its own internal settings – you cannot tweak those individual tags through the WebUI domain editor.

Here is what the documentation actually says about your specific questions:

DMARC policy tags (v, p, sp, pct) and the RFC 2136 DNS record

Stalwart auto-generates the DMARC DNS TXT record content when it publishes via RFC 2136 dynamic updates. The Domain object does not expose individual DMARC DNS tag fields (p=, sp=, pct=, etc.) – the record is built internally from the server’s own authentication settings. There is no documented way to customise the individual DMARC policy tags in the auto-published record through the WebUI or JMAP API at this time.

Your practical options are:

  1. Keep DMARC manual: exclude dmarc from the domain’s publishRecords list (under Management > Domains > Domains, DNS Management settings). Stalwart will still show you the expected zone file content via dnsZoneFile, and you copy/manage that record yourself with your preferred policy tags.
  2. Override manually after publication: let Stalwart publish the base record, then override it directly in your DNS zone.

Separate report addresses for DMARC vs TLS-RPT

The Domain object has a single field, reportAddressUri (WebUI: Management > Domains > Domains, “Report Address URI”), which defaults to mailto:postmaster. This one address is used for all incoming reports – DMARC aggregate (rua), DMARC failure (ruf), and TLS-RPT together. There is no per-protocol split at the domain level. The outgoing DMARC aggregate and failure report generation (i.e. what Stalwart sends to others) is configured separately at Settings > MTA > Reports > DMARC, but those are for reports Stalwart sends out, not for configuring where your domain receives reports.

Relevant docs:

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

@helpbot (and whoever has a response)
So what are those own authentication settings for the individual DMARC DNS tag fields (p=, sp=, pct=, etc.) then?
Because if stalwart uses RFC defaults it isn’t exactly the most secure?

adkim: default is “r” relaxed mode)
aspf: default is “r” relaxed mode.)
fo: default is “0”: Generate a DMARC failure report if all underlying authentication mechanisms fail to produce an aligned “pass” result.

And how is rua vs ruf handled? Is all that the single address configured at Management → Domains → Domains → Reports?
Can I at least enter multiple email addresses here?

4

First a clarification, the “DMARC Verification” setting under Sender Authentication controls inbound checking of mail you receive; it doesn’t set the DMARC record you publish. Those are separate things.

For the published record, Stalwart’s generated DMARC entry is fixed as v=DMARC1; p=reject; rua=: the other tags (p/sp/pct/adkim/aspf/fo, and a separate ruf) aren’t configurable, and only aggregate (rua) is emitted. The single reportAddressUri per domain feeds DMARC, TLS-RPT and CAA together, so you can’t point DMARC and TLS-RPT at different addresses there. If you need a richer or custom DMARC record, publish it yourself rather than through the built-in DNS record generator. Full-tag support and split report addresses are a fair feature request which you can submit to “Feature Ideas”.