Email Logs

Last updated

Cross-domain view of mail flow through Stalwart. Reachable from Mail Deliverability → All Logs, and from Server Status → Mail card.

Columns

  • Timestamp
  • Direction (inbound / outbound)
  • From, To
  • Status (accepted, delivered, deferred, bounced, quarantined)
  • Size (bytes)
  • DKIM / SPF / DMARC verdicts
  • Server response code (SMTP)

Filters

  • Time range (last hour, 24 h, 7 d, custom)
  • Direction
  • Status
  • Domain (sender or recipient)
  • Free-text on subject (only available when full-text indexing is enabled at install time; default off for privacy)

What is shown vs. what is stored

The panel surfaces structured metadata only. Message bodies are not shown in the admin logs view; they live in mailbox storage and are accessible only via authenticated IMAP / JMAP / webmail by the owning mailbox.

Per-row drill-in

Click a row to see:

  • The full SMTP transcript (HELO, MAIL FROM, RCPT TO, DATA boundary, response codes).
  • DKIM verification details (selector, body hash match, signature validation result).
  • SPF lookup chain (DNS queries performed, final verdict).
  • DMARC alignment (header-from vs envelope-from, policy applied).
  • For inbound: any CrowdSec or AppSec decision that intervened.

Quarantined messages

Stalwart’s quarantine is visible in a separate tab. The admin may release, delete, or download the EML for forensic review. Async post-delivery YARA hits (M33.2) appear here with the matched rule and severity.

Retention

Logs default to 30 days. Configurable under Server Settings → Mail → Retention. Older entries are pruned by a daily timer.

CLI

Not currently exposed. Use journalctl -u stalwart-mail -f for live tail with all the same data in structured form.