jakob/stward
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions
1 release 1 tag
  • v0.1.0 6a9d4bdb70

    v0.1.0 Stable

    jakob released this 2026-07-08 08:27:13 +00:00 | 1 commits to main since this release

    Signed by jakob
    SSH key fingerprint: SHA256:UbTjEcCZlc6GzQWLCuDK3D//HESWD2xFPkzue9XMras

    v0.1.0 release description

    stward v0.1.0 — DNS verification and management for Stalwart

    First release. A CLI that reads a Stalwart mail server's intended DNS records over JMAP, checks them against the live authoritative nameservers, and manages what each domain publishes. Named for the steward who runs the whole estate — DNS is where it starts, not where it stops.

    What's in it

    • verify — parallel, retrying verification of every managed domain's records against live DNS, with a --trace mode that prints expected-vs-actual rdata and publish-aware filtering that suppresses false positives.
    • renew — triggers Stalwart's DNS reconcile task, scoped by record type and domain, with --dry-run.
    • dnssec — per-domain DS-record check reporting the signed/unsigned split and whether TLSA is safe to enable.
    • enable — turns record categories on in publishRecords and reconciles them in one two-phase operation, with TLSA gated behind a DNSSEC check.
    • dump — raw JMAP domain/schema inspection.

    Correctness details worth noting

    • Multi-line parenthesised RSA DKIM keys parse without truncation.
    • CAA comparison ignores non-significant separator whitespace (RFC 8659).
    • Record-set comparison is order-independent, so reordered TLSA/MX answers still match.

    Requirements: a Stalwart server URL and an API token (sysDomainUpdate needed for enable).

    Downloads