Google sends the same DMARC report multiple times, each one gets imported

Questions
1

Your question

Hi,

Google redelivers the same DMARC aggregate report several times (same Report-ID, same Message-ID, separate SMTP sessions ~10 minutes apart). Stalwart handles the mailbox side correctly — only the first attempt gets ingested, the rest are skipped as already delivered.

But the report parser runs every time, so I end up with one message in the mailbox and up to 6 identical entries under Reports → Inbound DMARC Reports.

Today, for two domains, spread over 50 minutes:

12:08:53 domain-a 10061014495829950899
12:17:46 domain-a 10061014495829950899
12:30:49 domain-a 10061014495829950899
12:35:57 domain-a 10061014495829950899
12:41:06 domain-a 10061014495829950899
12:58:29 domain-a 10061014495829950899

The reports are identical.

Meanwhile the delivery side does the right thing:

Message ingested ← first attempt only
Delivery completed ← later attempts, PREVIOUSLY_DELIVERED

Only Google does this here, GMX and SES never redeliver. I checked my own side first: acceptance takes 3–5 seconds, my nginx stream proxy logs TCP 200 with full bytes returned, and TLS shutdown looks the same as gmail-smtp-in when I test both with openssl. So the redelivery seems to be Google-side and not something I can fix.

No data is lost, it’s just noisy in the report list. Running 0.16.19.

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

This matches what the code does: report parsing and storage happens independently of the mailbox-delivery dedup logic. When Stalwart accepts a report message via SMTP, analyze_report decompresses/parses the XML and always writes a new DmarcExternalReport entry to the report store, keyed by a freshly generated item ID rather than the report’s reportId/Report-ID. There is no deduplication against previously stored reports with the same report ID, so if the same aggregate report is delivered in several separate SMTP sessions, each session that gets past the mailbox-delivery layer (i.e. is accepted and processed) produces its own row under Reports → Inbound DMARC Reports, even though the mailbox correctly stores only one message.

Since redelivery is happening at Google’s end (separate SMTP sessions), and Stalwart currently has no dedup-by-report-ID for the reporting analysis path, there’s no configuration knob to suppress the duplicate report entries; this is a display/storage-only oddity and doesn’t affect delivered mail data. You can safely ignore the duplicate report rows, or the entries will eventually expire per the configured retention (report.analysis.store TTL described in the inbound reports docs).

See: Management | Stalwart

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

Fixed in v0.16.21 (yet to be released).