The configured DNS resolver cannot validate DNSSEC

Questions
1

Your question

Hello,

After a recent update I noticed this WARN in the logs:

source = "DnsResolver", id = 20080258862541, key = (null), reason = "The configured DNS resolver cannot validate DNSSEC. DANE has been disabled to avoid deferring mail. Ensure the resolver is DNSSEC-capable and reachable over TCP."

I double-checked, the OS-defined resolver (via /etc/resolv.conf) IPs DO answer to DNSSEC queries.

Stalwart is set to use System at DNS Resolver. Should I manually add the IPs to Custom? If yes, should I use 127.0.0.53 or the external IPs?

Thank you

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

Yes — you’ll need to switch to Custom and explicitly configure the protocol as TCP (or TLS) for your resolver IPs. Here’s why:

Stalwart doesn’t just trust your OS resolver’s DNSSEC “AD” flag — it runs its own validating DNS lookup (querying the root DNSKEY and checking the proof chain) using the hickory-resolver library. Before doing that, it checks two things:

  1. At least one of the configured name servers uses a non-UDP protocol (TCP or TLS) — this is required because large DNSSEC responses (RRSIG/DNSKEY records) often exceed the practical UDP size and can get truncated/dropped.
  2. A direct DNSKEY lookup for the root zone actually validates as secure.

When you select System, Stalwart reads /etc/resolv.conf via the OS resolver config, and that always produces UDP-only name server entries (resolv.conf has no way to express “use TCP”), so check #1 always fails — regardless of whether your actual resolver supports DNSSEC. That’s why you’re seeing this warning even though your resolver answers DNSSEC queries fine.

To fix it, switch DNS Resolver to Custom and add your resolver IP(s) with protocol set to Tcp (or Tls if your resolver supports DNS-over-TLS on port 853). You can use 127.0.0.53 if your local stub resolver (e.g. systemd-resolved) accepts TCP queries on that address — otherwise use the external IPs of a DNSSEC-validating recursive resolver you control or trust, as long as it’s reachable over TCP from the Stalwart host.

Reference: DnsResolver object reference (see the Custom variant and its DnsCustomResolver protocol field).

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

Are there any downsides on using CloudeFlare DNS from the presets?