Self-hosting email means taking on deliverability monitoring that providers like Fastmail handle automatically. DMARC aggregate reports and SMTP TLS reports (RFC 7489 and RFC 8460) are the only external view of whether your DKIM signatures, SPF, and TLS are actually working at receivers — your own server's metrics only describe its own perspective. The author discovered a real-world failure: a DKIM signature that covered Message-ID was invalidated by the relay assigning its own, causing dkim=fail at every receiver while Stalwart logged success. To process DMARC reports properly, a daemon is needed to own a mailbox cursor, deduplicate reports, store per-source-IP detail, and export bounded aggregates to Prometheus. The architecture separates full detail storage from Prometheus labels due to high IP cardinality. Additional checks cover DKIM selector validity, DMARC pct= enforcement gaps, external rua= destination authorization, and MTA-STS policy drift. The daemon runs outside the mail VM so it can detect when the mail server itself goes dark.
Table of contents
What Stalwart tells youThe receivers already send you the answerWhy reading them needs a daemonWhat the first report correctedOne report is not a monitoring systemChecking what you publishWhere this leaves the dashboardQuestions this post answers
Why does my DKIM signature fail at receivers even though my mail server logs it as successfully signed?
A DKIM signature can be invalidated in transit if the relay modifies a header field covered by the signature. If the signature includes Message-ID and the relay assigns its own Message-ID on the way out, the signed content no longer matches what arrives. The mail server logs a signing success because it signed correctly — only the receiver can detect the mismatch, reporting dkim=fail with 'message has been altered'. Engineers debugging DKIM failures on self-hosted setups track these kinds of relay interactions on daily.dev.
Does a DKIM signature from my relay's domain count toward DMARC alignment for my From domain?
No. DMARC alignment requires the DKIM d= domain to match the domain in the From header. If a relay signs with its own domain (e.g., d=cloudflare-smtp.net) rather than your sending domain, that signature verifies correctly but contributes nothing to your DMARC result. Only a signature whose d= aligns with your From domain counts toward DMARC pass. Developers choosing or configuring outbound relays for self-hosted mail follow alignment edge cases like this on daily.dev.
Why is my DMARC rua= mailbox receiving no reports even though my record is correctly published?
When rua= points to a domain different from the one being reported on, receivers require a <reporting-domain>._report._dmarc.<rua-domain> TXT record to authorize the external destination. Without it, most large receivers silently send nothing. The result is an empty mailbox that is indistinguishable from a quiet sending week, making the missing authorization easy to overlook. Self-hosters verifying their DMARC setup end-to-end find these DNS authorization gotchas covered on daily.dev.