Handling DMARC/TLS Reports for Multiple Tenants / Lack of Global Postmaster

This one could be handled a couple ways, so I’ll outline what I believe is the issue and others could add their thoughts.

In order to process reports, they need to be sent to postmaster@domain.

Since you don’t have a default global postmaster catch-all, the system does not automatically receive email for postmaster, so you have to add it as an alias to a user on each domain OR add the alias postmaster@thatdomain to your main system administrator.

An upfront solution here would be to have a global postmaster@ with the toggle to forward to a specific user (like the master administrator) rather than the toggle that forwards to each individual user. I doubt our clients want reports showing up in their inbox.

To the cry of “Well why don’t you just put postmaster@yourmaindomain in the client DNS record so all the reports go to you”?

You can do this, but the protocol stops this action unless you add an additional DNS record field in the receiving domain DMARC, that says it’s OK to send reports from THIS domain to it.

That means manual DNS work for every domain, or Stalwart working this out .. IF you have control over that DNS. At that point it’s easier to go back to the global method.

Not to mention I’m sure Stalwart would overwrite that DMARC record the next time you perform a DNS task.

So at the moment we’re stuck with manually adding a postmaster@ alias for every domain we host. A system-wide postmaster catch-all, in my opinion, be the cleanest solution, maybe just as a toggle switch in the domain setup (Use global postmaster Y/N) - that way you could break out isolated cases.

Open to other suggestions!