V0.16: Catch-All Issues

Questions
1

Your question

Context: I use Stalwart at home locally to self-host my personal mails. There are no other users. I have multiple domains, and use catcha-all to have an e-mail for every single service ([email protected], etc)

Previously all my domains were added as an aliases with @domain1.com, @domain2.com. This allowed me two things:

  1. Use it as a Catch-All for incoming mails, and mails were directly send to this mailbox, which means Mail Headers To: and Delivered-To were identical.
  2. Use any sender addresses. I could use [email protected], [email protected], [email protected] to send e-mails.

Now with 0.16 that changed.

  1. Catch All are now defined at domain level, not user level anymore. I can configure domain1.com to send all mails to [email protected] (for all domains the same recipient). This changes the Mail Headers. To: [email protected] & Delivered-To: [email protected]. Unsure, if this is noteworthy, or have any practically impacts.
  2. I cannot send from any domain anymore. I get the following error message in Thunderbird:

Sending of the message failed.
An error occurred while sending mail. The mail server responded: You are not allowed to send from this address.. Please verify that your email address is correct in your account settings and try again.

Any way to restore the old behavior. I think #1 doesn’t need to be restored, but I definitely want to send from any mail from my own domains.

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

The “You are not allowed to send from this address” error is caused by the mustMatchSender setting in the MTA AUTH Stage. Here’s the full picture:

Issue #2 (can’t send from arbitrary addresses) is the key one to fix. The mustMatchSender field on the MtaStageAuth singleton defaults to true, meaning the authenticated user’s email addresses must match the From: address being used. Since your secondary domain addresses (e.g. [email protected]) aren’t registered as email aliases on your account, the check fails.

You have two ways to fix this:

Option A (recommended for your use case): Add all your domain addresses as email aliases on your account. In the WebUI, go to your user account and add @domain1.com, @domain2.com, etc. as alias addresses. This is the cleanest approach and keeps the security check intact.

Option B: Disable mustMatchSender. If you want to send from truly any address without registering aliases, you can set mustMatchSender to false. In the WebUI, go to Settings â€ș MTA â€ș Session â€ș AUTH Stage and set the mustMatchSender expression to {"else": "false"}. You can also do it via the CLI:

stalwart-cli update MtaStageAuth --field mustMatchSender='{"else":"false"}'

Note: Option B allows your authenticated account to use any From: address, which is fine for a personal single-user setup but would be a security risk on a multi-user server.

Issue #1 (Delivered-To header) is cosmetic for your setup. The catch-all now operates at the domain level via catchAllAddress on each Domain object, routing unknown recipients to your main mailbox. This is by design and shouldn’t cause practical problems.

Relevant docs: MTA AUTH Stage reference and Catch-all addresses.

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

mustMatchSender allows me to send again with any mail. Any security implications? (especially in comparison how catch all aliases worked with 0.15?)

This is not possible. The local part cannot be empty.

4

This feels for me also little bit unsecure. if i set mustMatchSender to false, sounds like any authentificated user can send from any mail-address (not just a selected account).

5

This seems true. In my case though, it’s a single user instance, so ‘it would work’, but nevertheless not an ideal solution.

I’m still on 0.15 anyway.

6

The behavior changed in 0.16: aliases are now specific addresses rather than whole-domain wildcards, so adding @domain as an alias no longer lets you send as any address in it. With mustMatchSender on (the default), the sender has to be the account’s own address or one of its aliases.

If you only send from a handful of addresses, the clean fix is to add each as an alias on the account and leave mustMatchSender on. If you genuinely need open-ended “send as anything on my domain,” you can set mustMatchSender to false, but as wrenix notes that lets any authenticated user send from any address. Alternatively you could create a custom expression that uses lookup stores to verify who is allowed to send from that domain.

7

But why this change?

What’s the problem adding whole-domain wildcards as an alias for incoming and outcoming? It worked so awesome in 0.15, and was my favorite feature in Stalwart
 and now I cannot use it anymore.

It’s not just a couple of ‘aliases’ for me. I use one mail per service, f.ex. [email protected]. I got hundreds of these, and when I need to write an mail (support ticket), I also send from one of these. Adding an alias each time is not really a solution for me. I had to do this in Exchange, and it was annyoing.

8

Possibly to make room for the masked email feature?

9

This is a 0.16 change, aliases are now specific addresses rather than whole-domain wildcards, so adding @domain as an alias no longer grants send-as-anything. The send rejection you see is mustMatchSender (on by default): an authenticated account may only use its own address or an alias, otherwise 501 5.5.4. Setting mustMatchSender to false restores open sending, but then any authenticated user can send as any address, which is the security concern others raised.

Incoming catch-all still works, but it’s now domain-level via catchAllAddress, which is why Delivered-To changes to the catch-all mailbox. For sending from many per-service addresses on your own domain there’s no single-account feature in 0.16 today; the options are mustMatchSender=false, per-address aliases, or a custom mustMatchSender expression backed by a lookup store.

10

we know it you bot :sweat_smile: . you repeat yourself :enraged_face: .

we are all just unhappy with it.

because:

  1. it is a not in changelog added breaking change
  2. we use this feature and it was removed
  3. we like this feature

you mean it is possible to build a lookup as third option. how should it look like? Could yoz documentate it?