Using Stalwart 0.16.16 docker image (on Kubernetes).
Network is dual stack (IPv4 and IPv6).
I will have different IP and names to receive mail (MX : smtp…com ) and to send mail (EHLO : outbound…com).
I have configured MTA → Outbound → Connection strategy EHLO proprely, and added the corresponding A / AAAA entry in my DNS.
However, in Domains ->View zone file, the SPF entry is wrong ( mydomain.com. IN TXT “v=spf1 mx -all” ) so I cannot enable automatic DNS configuration.
Is there a configuration somewhere I missed, or is it a bug / feature request ?
Thank you all !
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
Stalwart’s automatic SPF record generation is not tied to the EHLO hostname set in your Connection Strategy. Looking at the code that builds the DNS zone, the SPF TXT record for a domain is always generated as v=spf1 mx -all based on the domain’s configured MX hosts (Network settings → Mail Exchangers), regardless of any ehloHostname override you set on an MTA Outbound Connection Strategy. The connection strategy’s EHLO hostname only affects what’s said in the SMTP EHLO command during actual delivery, it isn’t fed back into SPF record generation.
So if your outbound hostname (outbound.….com) differs from your MX host (smtp.….com) and isn’t itself listed as an MX record for the domain, the auto-generated SPF policy won’t include it, and automatic DNS management won’t produce a correct policy for your split MX/EHLO setup. This looks like a real gap for split-horizon (different inbound MX vs outbound EHLO) deployments rather than something you’re missing in configuration; there’s currently no setting to add extra “ehlo” hosts into the generated SPF mechanism. In the meantime, you’d need to disable automatic SPF publishing for this domain and publish your SPF TXT record manually (e.g. v=spf1 mx a:outbound.….com -all or similar) alongside Stalwart’s other auto-managed records.
The SPF suggestion is generated from the MX list alone and is hardcoded to v=spf1 mx -all. It never looks at your outbound connection strategy, so for a setup where you send from a host that isn’t in the MX set it really is wrong, and you’re right not to turn on automatic DNS management for that domain yet.
What you want to publish is along the lines of v=spf1 mx a:outbound.example.com -all. The a: mechanism covers both A and AAAA records, so your dual-stack case is handled by that one mechanism without listing addresses. The thing to keep in mind is that SPF authorises the connecting IP address, not the EHLO name, so what matters is that your outbound v4 and v6 source addresses are covered by something in the record; the EHLO name only has to have matching forward and reverse DNS for other checks.
Don’t work around it by adding the sending host to your MX list. That would authorise the addresses, but it also publishes an MX record pointing at a host that shouldn’t be receiving mail.