Issue Description
Stalwart skips DMARC verification when no MAIL FROM SPF result is available.
This means a message with an aligned, passing DKIM signature cannot pass DMARC if MAIL FROM SPF is disabled, unavailable, or the message uses a null reverse path.
Seen with Google SMTP TLS reports from noreply-smtp-tls-reporting [at] google [dot] com. They used a null MAIL FROM and had an aligned DKIM signature for google [dot] com, but Stalwart skipped DMARC because SPF was NA.
Fix and test:
The fix passes an SPF none result into DMARC verification. It does not create an SPF pass.
Please let me know if this bug fix be acceptable.
Expected Behavior
DMARC should still evaluate DKIM alignment. Missing SPF should count as no SPF pass, not skip DMARC entirely.
Actual Behavior
DKIM passes, but no DMARC result or policy is produced.
Reproduction Steps
- Disable MAIL FROM SPF verification or send with MAIL FROM:<>.
- Send a DKIM-signed message whose From domain is aligned.
- Check the authentication results.
Relevant Log Output
DKIM: pass
SPF: NA
DMARC: no result
Stalwart Version
v0.16.x
Installation Method
Docker
Database Backend
RocksDB
Blob Storage
RocksDB
Search Engine
Internal
Directory Backend
LDAP
I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.
on
I have searched this support forum (open and closed topics) and confirm this is not a duplicate.
on
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
on