agents.dardev.net is DarDev's third Stalwart outbound subdomain dedicated to programmatic SMTP—Cursor agents, CI notifications, ops bots, and the agent-mail Python package. It shares mta.dardev.net with send.dardev.net and sales.dardev.net but is explicitly not a webmail domain: no Roundcube login, no human inbox browsing, no marketing list From addresses.
Separating bot mail protects product newsletter reputation on send and sales outreach engagement metrics on sales. When a script mis-fires hundreds of messages, receivers evaluate DMARC alignment against agents.dardev.net—not the domain your customers subscribed to on Listmonk.
Three domains, one MTA
All three subdomains terminate on Stalwart in Docker on dardev-vps. PTR at OVH points 51.75.205.103 to mta.dardev.net. Each label has independent SPF TXT, DKIM selector mail._domainkey.agents, DMARC quarantine, and optional BIMI default._bimi on GoDaddy—the three-outbound-domains-send-sales-agents guide is the canonical reference.
- send.dardev.net — Listmonk campaigns, product TX, news digests, Roundcube mailboxes
- sales.dardev.net — CRM-orchestrated outreach, rep mailboxes, Roundcube
- agents.dardev.net — bot@ and service accounts, SMTP submit only, no webmail
Root @dardev.net remains Zoho MX for staff you@dardev.net mail. None of the Stalwart subdomains replace that inbound path—why-send-dardev-subdomain explains the split.
Why SMTP-only, not webmail
Roundcube at webmail.dardev.net configures mail_domain for send.dardev.net and sales.dardev.net in custom.inc.php. agents accounts are excluded intentionally. Bots do not need IMAP, sieve filters, or CardDAV—only authenticated submission on port 587 STARTTLS or 465 SSL to stalwart internally.
Security posture improves: sales reps never share SMTP passwords with CI jobs. Compromise of a bot credential does not grant access to sales@sales.dardev.net inbox sync or CRM reply tracking.
Bootstrap and DNS
Operators register agents.dardev.net in Stalwart Management → Domains, then run bootstrap scripts such as stalwart_agents_bootstrap.py and setup_agents_domain.py to publish GoDaddy records. MX points to mta.dardev.net. SPF includes the VPS ip4 and mx mechanisms matching send and sales templates. DKIM TXT exports from Stalwart after key generation.
validate_agents_dns.py confirms propagation before first production send. DMARC should reach quarantine policy before high volume—dmarc-quarantine-bimi-prerequisite applies per subdomain. BIMI logo URL can mirror send and sales when trademark and VMC requirements are met.
Typical accounts and clients
Primary service account: bot@agents.dardev.net for agent-mail package defaults. Additional bot accounts may exist per integration—each gets unique password in VPS env or secrets store, never in git.
- agent-mail CLI and SDK — templated notifications
- Fabric deploy notify hooks — completion summaries to staff
- GitHub Actions — failure alerts with action links
- Future platform-bus agent runners — structured SMTP without Listmonk
Example recipient in docs: you@example.com. Production staff lists use internal distribution addresses monitored in Zoho or send mailboxes—not agents inboxes, because none exist for reading.
Volume and reputation isolation
Automation volume is spikier than curated newsletters. A loop bug can enqueue hundreds of messages before an operator stops the job. Isolating agents prevents those spikes from depressing engagement scores on news@send.dardev.net warmup profile—mail-warmup-send-profile documents single-sender pacing for product mail.
Gmail and Microsoft still evaluate IP reputation shared across subdomains, but DMARC alignment and From domain complaints bucket separately in receiver analytics. Keep agents From stable—bot@agents.dardev.net with consistent display name DarDev Agent.
What not to route through agents
- Listmonk marketing campaigns — use send.dardev.net
- 20.tn or Services cold outreach with CRM timeline — use sales.dardev.net per playbook
- Executive 1:1 customer threads — use @dardev.net on Zoho
- Opt-in confirmation mail with subscription legal requirements — use Listmonk TX on send
- Bulk imports or thousands of recipients — wrong tool; agents is low-volume notify
The agent-mail-programmatic-notifications guide covers CLI, SDK, and template variables for the supported path. Ops Console does not configure agents SMTP—authoritative credentials live in Stalwart accounts and deployment env per ops-orchestrates-never-configures-mail.
Credential rotation and ops hygiene
Rotate bot@agents.dardev.net password in Stalwart before updating VPS env and CI secret stores. Document rotation in internal runbooks only—never in news drafts or public repos. Separate bot credentials per environment: staging bots should not reuse production passwords even when DNS labels look similar on test hosts.
Monitor agents send volume via Stalwart queue metrics and M19 metering tiles in Ops Metrics when enabled. Sudden spikes warrant script inspection before receivers throttle the shared IP. Pair agents alerts with agent-mail templated notifications to you@example.com smoke addresses during deploy validation.
Verification checklist
After DNS or Stalwart domain changes: dig +short agents.dardev.net TXT for SPF, query mail._domainkey.agents.dardev.net for DKIM, confirm _dmarc.agents.dardev.net publishes quarantine. Send seed message from bot@ to Gmail and Microsoft test inboxes; verify Authentication-Results show spf=pass, dkim=pass, dmarc=pass aligned to agents.dardev.net.
Confirm Roundcube login rejects or does not list agents mailboxes—expected behavior. inside-unified-mailer-stack maps how bus jobs, Listmonk, and Stalwart interact across channels without conflating identities.
Can I add agents to Roundcube mail_domain?
Technically possible but against policy. agents is programmatic only; webmail expansion blurs credential boundaries we designed out.
Does agents share DKIM keys with send?
No. Each subdomain has its own DKIM selector and TXT in GoDaddy, generated per domain in Stalwart.
Why not use noreply@send for bots?
Shared domain mixes human-curated newsletter reputation with unpredictable script volume. agents isolates failure domains.
Is inbound mail delivered to agents addresses?
MX may point at mta.dardev.net for alignment, but bots rarely receive replies. Design notifications with action_url to Ops or CRM instead of reply-to bot inboxes.
How does this relate to BIMI?
Same logo and DMARC quarantine prerequisites per subdomain. BIMI inbox logo is optional polish after authentication is stable—bimi-self-hosted-stalwart-guide covers steps.
