Stalwart: DANE And The Rest, Built In
Stalwart is a whole mail server in one binary: SMTP and IMAP and JMAP, SPF, DKIM, DMARC, ARC, DANE, MTA-STS, TLS reporting, a spam filter and the mail store, with no milter to wire up and no policy daemon to run beside it. This post holds it to the same house rules as the Postfix build and captures every reply in the lab. The rules all go on, but the story is in the detail: the settings live in a database rather than a file, the defaults as shipped accept plaintext and a tampered invoice, each rule lands in a different one of four configuration mechanisms, DKIM-fail rejection needs a Sieve script because the built-in check reports a tampered body as neutral, the unknown-sender check runs only after the whole message is in and fails open on a DNS error, and the MTA-STS sender bounces on the first attempt where the standard says it should defer. Built in is genuinely less to wire together. It is not the same as safe by default.