The Stalwart server is deployed on a network without Internet access, using the existing infrastructure. First-level domain names consist of three characters. For example, the domain name for the active mail is mail.work.msq. The domain name for the Stalwart service is mail.devops.msq. On the “Create domain” page, when I enter mail.devops.msq, I get the error “Invalid domain name”. The same situation occurs on the Create provider (ACME) page: if I use a mailbox in the @work.msq domain, I get the error “Failed to create ACME account: Invalid request: Invalid contact email:” But in both cases, if I remove one letter or use a different two‑letter top‑level domain, the data is saved without an error. Could you please tell me if it’s possible to fix this error?
Stalwart Version
v0.16.x
Installation Method
Binary (Linux)
Database Backend
PostgreSQL
Blob Storage
Filesystem
Search Engine
Internal
Directory Backend
Internal
I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.
on
I have searched this support forum (open and closed topics) and confirm this is not a duplicate.
on
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
It isn’t the length. We accept a domain if its suffix is in the public suffix list, or if the top-level label is one of a small set reserved for private use: internal, lan, corp, intranet, private, home, local, localdomain, test, localhost. Your three-letter TLD is in neither, and when you drop a letter you land on a real country-code TLD, which is in the public suffix list. That’s the whole difference; two-letter TLDs are all ccTLDs.
For an isolated network, .internal is the one ICANN has formally reserved for exactly this, so something like mail.yourorg.internal will be accepted as-is. The same check runs on email addresses, which is why the ACME contact address was rejected as well.
If that namespace is fixed by infrastructure you can’t renumber, then making the list configurable is a reasonable thing to ask for and I’ll look at it. Separately, ACME won’t work on an air-gapped network whatever we do about domain validation, since no public CA is reachable. You want an internal CA or a manually installed certificate there.
Thanks for the reply, stalwart. ACME based on step-ca has already been deployed in our network and is being used successfully, there will be no problems with these. I will be waiting for the new version. Have a nice day and success in the development of the project.