Suppress DMARC Reporting for own domain

Questions
1

Your question

I’d like to suppress DMARC reporting (on MTA → Repots → DMARC, both authentication failure and aggregate) when I’m sending them for to my domain. My intention actually is to put conditions resulting in “false” for “send rate” and “never” for “frequency” when reporting is done for “my” domain.

Which would be the right variable to use? Found a few (like rcpt_domain) but unsure whether they would lead to the required result. I’d be very happy to get help on how to set up such a filter and the available variables/expressions.

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

Here is a precise answer based on the documentation.

Use rcpt_domain in your expressions - you have it right. Both aggregateSendFrequency and failureSendFrequency expose rcpt_domain (via MtaRcptToVariable and MtaRcptDomainVariable respectively), which is exactly the variable to match against your own domain.

Here is how to configure each field to suppress reporting when the report recipient is your own domain:

Aggregate - aggregateSendFrequency (disables sending):

{
  "if": "rcpt_domain = 'yourdomain.example'",
  "then": "disable",
  "else": "daily"
}

The valid values are hourly, daily, weekly, or disable to disable reporting entirely.

Failure - failureSendFrequency (sets rate to effectively never send):

This field controls a rate limit (e.g. [1, 1d] means 1 per day). To suppress it, use disable if supported, or you can set an extremely low rate. However, the cleaner option for aggregate is using disable. For failure reports, the docs indicate the accepted format is a rate like [1, 1d] - there is no disable keyword documented for this field specifically.

A practical approach for the failure report side would be to set the rate to something like [0, 1d] (0 per day) for your own domain - but this is not explicitly confirmed in the docs. For the most reliable suppression, disable on aggregateSendFrequency is clearly documented.

Both fields are configured under Settings > MTA > Reports > DMARC in the WebUI.

Key point: For aggregateSendFrequency, rcpt_domain is available and disable is a documented value. For failureSendFrequency, the same rcpt_domain variable is available but only rate values like [1, 1d] are shown in the docs - the behavior of disable there is not confirmed.

Reference docs: DmarcReportSettings and MtaRcptToVariable.

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

Proposed solution doesn’t work. Anybody else?

4

false and ‘never’ didn’t work either. Maybe the condition rcpt_domain == system(‘domain’) is wrong. Are those variables or the condition result logged somewhere? Could somebody please help.

5

The condition rcpt_domain == system(‘domain’) is right; the problem is the value you return. For aggregate reports the expression has to evaluate to one of the frequency constants, not false or never. Use disable (a bareword, no quotes) to turn them off, e.g.:

{“if”: “rcpt_domain == system(‘domain’)”, “then”: “disable”, “else”: “daily”}

The valid aggregate values are only hourly, daily, weekly and disable. Failure reports are separate: failureSendFrequency is a rate expressed as [count, period], so to suppress them for your own domain return [0, 1d] via the same if/else. rcpt_domain is a valid variable in both report expression contexts.