Stalwart September updates fix DMARC results and reports

What changed

Stalwart’s September 2026 releases correct DMARC results and the aggregate reports it generates. The changes matter to administrators and MSPs running Stalwart to evaluate incoming mail or produce reports for domain owners.

In 0.16.22, released on 13 September, messages without an aligned SPF or DKIM pass are logged as a DMARC failure when the sending domain publishes a policy. Previously, those results could appear as none. A temporary DNS error in an aligned authentication check now produces temperror instead of fail.

In 0.16.23, released on 21 September, the project fixes aggregate reports that contained two spf elements per record and corrects the report version value from 1 to 1.0.

Why the distinction matters

A missing authentication pass and a temporary lookup problem call for different investigations. Correct result labels help teams interpret their logs, while correctly formed XML helps reporting systems process the data. A receiving service may still apply its own delivery policy.

What to check

Review these fixes when upgrading an older Stalwart installation. Follow the release notes’ upgrade instructions for your current version, then test aligned and unaligned messages and inspect newly generated aggregate reports in your reporting system.

Keep these September release dates in deployment records. They describe implementation fixes in Stalwart, rather than a new DMARC standard or a general sender deadline.