· mail
smtp · 23ms p50
1 of 1,402

Daily delivery report · 4,217 inbound · 2,914 outbound

Stalwart Mail Server <noreply@orbit.zuerich>
to ops@orbit.zuerich, operator.tobi@orbit.zuerich · 17:30 · 14 KB
SPF passDKIM passDMARC pass

Stalwart daily mail report for orbit.zuerich — 2026-05-28.

Inbound

Total accepted: 4,217. Spam quarantined: 38 (0.9%). Blocked at envelope: 412 (DNSBL hits). Greylisted: 22.

Outbound

Total submitted: 2,953. DKIM-signed: 2,914 (98.7%) — non-signed are bounce/delivery-status. Delivered: 2,914. Perm failed: 3. Temp failed: 9.

Notable

  • 2 SPF fails on amazonses.com forwards — see DMARC aggregate
  • 1 outbound retry queue at 22min (recipient mta.heinrich-graf.ch deferred · 421)
  • DKIM rotation pending: heinrich-graf.ch · q2 ceremony tomorrow 11:00 CET
delivery-report-2026-05-28.pdf
2.1 KB · signed
Download
Reply
Reply all
Forward
Create Sieve rule
To task
stalwart-backed · per-tenant DKIM

Mail · 14 domains

Stalwart on the engine; orbit-mail UI on the shell. Per-tenant DKIM with Tier-C ceremony for rotation. SPF / DMARC / MTA-STS / TLS-RPT enforced via policy.

Reload
Inbound (24h)
4,217
2% spam blocked
Outbound (24h)
2,914
98.7% DKIM-signed
Bounces
12
3 perm · 9 temp
Quarantine
38
awaiting review

Policy posture

enforced
SPF
enforced
DKIM signing
all outbound
DMARC
p=quarantine pct=100
MTA-STS
v=STSv1 · enforce
TLS-RPT
tlsrpt@orbit.zuerich
ARC
enabled (forwarder)

Recent envelope events

10/min
17:52infoinbound_accepted · ops@orbit.zuerich ← invoice@switch.ch
17:51infooutbound_signed · k=walzpunkt-2026q1
17:48warnspam_quarantined · BL spamcop · score 7.2
17:38infosieve_routed · ops@ → ticket-mail
17:30infooutbound_delivered · 250 OK (gmail)
17:22erroroutbound_failed · 550 mailbox unavailable (yahoo)
14 domains across 14 tenants

Domains

Each domain has its own DKIM selector, SPF, DMARC report-to address. orbit-mail manages records via orbit-dns when both products serve the same tenant.

DomainTenantMXSPFDKIMDMARCMailboxes
orbit.zuerichOrbit AG10 mail.orbit.zuerich.oksigningp=quarantine14
orbit.chOrbit AG10 mail.orbit.zuerich.oksigningp=reject4
walzpunkt.chWalzpunkt v210 mail.orbit.zuerich.oksigningp=quarantine8
heinrich-graf.chHeinrich Graf—missingceremony pendingnone0
brain-melt.zoneBrain-Melt Lab10 mail.orbit.zuerich.oksigningp=none5
juniorforge.chJunior Forge10 mail.orbit.zuerich.oksigningp=quarantine2
82 mailboxes

Mailboxes

IMAP / JMAP behind Stalwart. Per-mailbox quota; messages stored encrypted with per-mailbox keys in KeyVault Tier B.

AddressTenantQuotaAliasesSieveLast login
operator.tobi@orbit.zuerich
primary · usr_01HX… · since 2024-09
Orbit AG
7.4 / 25 GB
3enabled2m ago
ops@orbit.zuerich
shared · 3 members
Orbit AG
12 / 50 GB
8enabledlive
dmarc@orbit.zuerich
automated · report aggregator
Orbit AG
4.1 / 10 GB
0enabledautomated
heinrich@walzpunkt.ch
primary
Walzpunkt v2
22.4 / 25 GB
2enabled1h ago
support@brain-melt.zone
shared · 5 members
Brain-Melt Lab
8.2 / 50 GB
12enabled14m ago
214 aliases · forward + catch-all

Aliases

Catch-all per domain, plus explicit forwards. Aliases resolve before Sieve fires.

FromToTenantTypeActivated
contact@orbit.zuerichops@orbit.zuerich, +salesOrbit AGforward2024-09-12
info@orbit.zuerichops@orbit.zuerichOrbit AGforward2024-09-12
dmarc-reports@orbit.zuerichdmarc@orbit.zuerichOrbit AGautomated2024-09-15
*@walzpunkt.chheinrich@walzpunkt.chWalzpunkt v2catch-all2025-09-13
support@brain-melt.zonesupport@brain-melt.zone (shared)Brain-Meltforward2025-02-04
sieve · per-mailbox rules

Sieve

Server-side mail filtering. Edits validated before save; activation atomic per mailbox.

Validate
Per-mailbox
ops@orbit.zuerich
8 rules
operator.tobi@orbit
2 rules
dmarc@orbit.zuerich
1 rule
heinrich@walzpunkt.ch
3 rules
# Sieve · ops@orbit.zuerich · v2026.05.28
require ["fileinto", "imap4flags", "regex", "envelope"];

# Trajectory webhook → ticket-mail folder
if header :is "X-Orbit-Source" "trajectory" {
    fileinto "ticket-mail";
    stop;
}

# GitHub-style webhook deliveries
if header :matches "From" "*@noreply.orbit.zuerich" {
    fileinto "automation";
    setflag "\\Seen";
}

# DMARC aggregate reports
if header :contains "Subject" "DMARC Aggregate" {
    fileinto "dmarc-reports";
}

# swissmail invoices → Finance
if allof (
    header :contains "From" "@switch.ch",
    header :contains "Subject" "Rechnung"
) {
    fileinto "finance";
}

keep;
global posture · per-domain overrides

Policy

SPF · DKIM · DMARC · MTA-STS · TLS-RPT. Posture is global with per-domain overrides; each toggle emits a policy_changed audit event.

SPF enforcement
v=spf1 mx ~all · soft fail · 14 domains covered
DKIM signing
all outbound · per-tenant selector · Tier-C rotation
DMARC report-to
dmarc@orbit.zuerich · ri=86400 · rua & ruf
MTA-STS enforce
v=STSv1 · enforce · mx orbit.zuerich · max_age=604800
TLS-RPT
v=TLSRPTv1 · rua=mailto:tlsrpt@orbit.zuerich
ARC seal forwarder
authenticated forwards keep upstream pass
Greylist new senders
15-min greylist for first-time senders to shared mailboxes
dkim · per-tenant selectors · Tier-C ceremony

DKIM rotation

A DKIM rotation publishes the new public key in DNS, waits for propagation, then flips the signing selector. The private half lives in KeyVault Tier C; rotation requires the NFC admin card.

orbit-2026q1._domainkey.orbit.zuerich
active
ED25519 · published 2026-01-02 · rotated next 2026-07-02
v=DKIM1; k=ed25519; p=MCowBQYDK2VwAyEAk+8mP3WJ4xJ4Y2u…
walzpunkt-2026q1._domainkey.walzpunkt.ch
active
ED25519 · published 2026-01-08 · rotated next 2026-07-08
v=DKIM1; k=ed25519; p=MCowBQYDK2VwAyEALxX9pQfMnVjW…
heinrich-2026q2._domainkey.heinrich-graf.ch
ceremony pending
awaiting Tier-C operator card · 6 days
Active ceremony · heinrich-graf.ch
1
Generate ED25519 keypair
private wrapped to Tier-C envelope · public RR ready
2
Tap admin card
awaiting tier-3 NFC tap · operator card uid required
3
Publish public key in DNS
TXT record via orbit-dns · selector heinrich-2026q2
4
Validate propagation
poll 5 resolvers · 10 min
5
Flip signing selector
orbit-mail starts signing with new key
6
Revoke old key
7-day grace window · audit emitted
inspect · message-id drilldown

Inspect message

Look up a specific delivery — see envelope, headers, SPF / DKIM / DMARC verdict, route, sieve fire, recipient state.

Envelope

delivered
From
operator.tobi@orbit.zuerich
To
heinrich@heinrich-graf.ch
Subject
Welcome to Orbit
Date
2026-05-28 17:30:14 +0200
Size
14.2 KB
Route
orbit.zuerich → mta.heinrich-graf.ch

Auth verdict

pass
SPF
pass
DKIM
pass · k=orbit-2026q1
DMARC
pass
MTA-STS
enforced
TLS
TLSv1.3 · X25519
Pipeline trace
17:30:14infosubmission · accepted from operator.tobi via Station
17:30:14logsieve · no match · keep
17:30:14infodkim_signed · k=orbit-2026q1 ed25519
17:30:14infoqueued · queue=outbound · attempt 1
17:30:15infosmtp_out · 250 2.6.0 OK (mta.heinrich-graf.ch)
mail_audit_log

Audit

Per-mailbox / per-domain mutations + DKIM rotations + policy changes.

TimeEventSubjectActor
17:42mailbox_createdheinrich@walzpunkt.choperator.tobi
17:30policy_changedorbit.zuerich · dmarc p=quarantine→p=rejectoperator.tobi
17:14dkim_rotation_startedheinrich-graf.ch · q2 ceremonyoperator.tobi
12:00alias_createdcontact@orbit.zuerichoperator.tobi
add domain

Add mail domain

Domain
Tenant
Auto-provision
MX → mail.orbit.zuerichSPF recordDKIM (Tier-C ceremony)DMARC p=quarantine
Cancel
mailbox · mb_01HY…

ops@orbit.zuerich

Quota
24%
12 / 50 GB
Inbound (24h)
214
Members
3
Members · shared
operator.tobi
owner
astra.kepler
read-write
automation@orbit
send-as
Folders
INBOXSentDraftsTrashticket-mailautomationfinancedmarc-reports
Sieve
8 rules · enabled
Delete
Close
new mailbox

Create mailbox

Address
Type
personalsharedautomated
Quota
Cancel
new alias

Add alias

From
To
Type
forwardcatch-all
Cancel
tier-c ceremony

Rotate DKIM key

Requires a tier-3 admin card. Old key remains valid for a 7-day grace window.

Domain
New selector
Card prompt
Tap your tier-3 admin card
awaiting · 38s timeout
Cancel

New message

From
operator.tobi@orbit.zuerich · dkim k=orbit-2026q1
To
Subject
Save draft