Your question
I am trying to enable DANE on my stalwart mailserver installation but I am confused on how to do that.
Stalwart is currently validating DANE when sending an email to a third party, however I also want to enable DANE for my domain. Is there a configuration guide on how to do that?
Thanks for your help,
BR
Wolfgang
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
on
Now let’s read the full DANE doc page for the actual instructions.
To let remote servers validate DANE against your domain, you don’t configure anything on the sending policy side (that’s for validating others). Instead, Stalwart automatically generates TLSA records for the TLS certificates it uses on your server. You just need to publish these in your DNS.
To get the exact records to publish, go to WebUI > Management > Directory > Domains, select your domain, and you’ll see the auto-generated TLSA records ready to add to your DNS zone (typically _25._tcp.<hostname> for port 25). If you’re using automated DNS management, Stalwart can publish these records for you automatically.
Once those TLSA records are live and DNSSEC-signed on your zone, remote servers sending to your domain will be able to validate your certificate via DANE. See the DANE docs and DNS records reference for more detail.
This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.
ok I understand.
I’ve now enable publishing TLSA records via automatic DNS management.
How long does it take until stalwart actually pushes the records to my dns provider? Restarting stalwart service after this configuration does not help.
Info for potential readers: disable automatic DNS management an reenable again pushes records immediately.
For future searches of this topic, if you modify DNS then you would create task to make the changes push out. Stalwart doesn’t automatically assume “now” for items such as DNS, DKIM, ACME, etc.
Since you disabled/re-enabled the management, it created that task for you.
Tasks → Scheduled → Create Task
Task Type: Perform DNS management for a domain
Record Types: Pick as required
Domain: Pick the domain
Due: You can leave empty and it will use “now”.
“Create”