Transmission problem to outlook.com

Questions
1

Your question

Hello, after setting up things for gmail, this works now.
but outlook still gives an error:

lookup error: DNS resolution error: DNS error: DNSSEC validation failed

what should I do to solve this?

2

Let me look at the resolver page fully to see variants (system, cloudflare, custom, etc.) and DNSSEC-related notes.

A “DNSSEC validation failed” lookup error usually surfaces from the DANE/TLSA lookup step, and it means the resolver Stalwart is using got a cryptographically invalid (bogus) DNSSEC response, most often for the recipient’s TLSA or MX records. Stalwart deliberately treats a bogus DNSSEC answer as a failure rather than silently ignoring it, to prevent downgrade attacks, so mail to that domain will be deferred rather than delivered insecurely.

To resolve it:

  1. Check which DNS resolver Stalwart is using, this is controlled by the DnsResolver singleton (Settings › Network › DNS › DNS Resolver in the WebUI). If you’re on System, verify the OS resolver is DNSSEC-validating and reachable; if it isn’t reliable, switching to a validating public resolver such as Cloudflare or Quad9 often clears up spurious bogus results.
  2. Confirm your server’s clock is accurate. Expired or not-yet-valid DNSSEC signatures are reported as bogus and are a very common cause of transient validation failures.
  3. Check the MtaTlsStrategy applied to outlook.com’s route: the dane field defaults to optional, which should fall back to normal STARTTLS if TLSA/DNSSEC can’t be validated. If it’s set to require, delivery will hard-fail on DNSSEC problems, consider whether that’s intended for this domain.

Docs: DNS Resolver and DANE

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

This problem could be related to MX lookup fails with "DNSSEC validation failed" for signed zone (mail.de, RSA/SHA-512) on 0.16.21, regardless of DANE setting if you are on version 0.16.21

4

yes, i’m on version 0.16.21 too.

5

Same symptom here on 0.16.21. In my case the resolver choice made no
difference and dane set to disable did not help either, the validation
runs regardless of that setting.

thornbux bisected it in the linked thread: 0.16.20 is fine, 0.16.21 is
not, the change is in hickory-resolver 0.26.1 to 0.26.2.

Rolling back to 0.16.20 is currently the only known workaround.

6

Same problem here, had to go back to 16.20.

7

Happening to me too, since the 16.21 update.

Proton domains are also affected.

8

It’s due to a hickory-resolver bug, rollback to the previous version or wait a few days until 0.16.22.

9

Version 0.16.22 did not fix the issue. I am having the exact same issue with Proton domains at the very least.