Stalwart

Last reviewed Aug 26, 2026 · 780 words

Stalwart is the first mail server I would tell a first-timer to install, and the reason is what it removes: no Postfix plus Dovecot plus Rspamd plus a webmail container held together with a 400-line compose file. One Rust binary does SMTP, IMAP, JMAP, Sieve filtering, spam and phishing detection, DKIM, SPF, DMARC and ARC, automatic TLS via ACME, and a web admin panel, on 512 MB of RAM. It does not remove the part of self-hosted email that is actually hard, which is convincing Gmail and Outlook to accept your mail, and that is covered below because it is the part that decides whether you should do this at all.

Read the deliverability warning before the install

Every message you send from a residential IP or a cheap VPS range starts life with a reputation of zero or worse. Port 25 outbound is blocked by most home ISPs and by several cloud providers until you ask. You will need a static IP with a matching reverse DNS record, an SPF record, a DKIM key that Stalwart generates for you, a DMARC policy, and weeks of patient low volume before large providers trust you. None of that is Stalwart's fault, and Stalwart's built-in checks make configuring it easier than any legacy stack, but the honest self-hosted email piece exists because people skip this paragraph. Receiving mail is easy. Sending is the commitment.

The install is 1 container and a printed password

services:
  stalwart:
    image: stalwartlabs/stalwart:latest
    ports:
      - "25:25"
      - "465:465"
      - "587:587"
      - "143:143"
      - "993:993"
      - "8080:8080"
    volumes:
      - ./stalwart:/opt/stalwart
    restart: unless-stopped

On first start it prints the admin username and a generated password to the container log; grab it with docker logs stalwart before it scrolls away. Port 8080 is the web admin and JMAP endpoint; put it behind Caddy on a hostname like mail.example.com and Stalwart's own ACME integration can handle the certificates for the mail ports too. Older tutorials reference the previous image name stalwartlabs/mail-server; at last check the project had consolidated on stalwartlabs/stalwart, so check the tag you are pulling.

Everything lives under /opt/stalwart: etc/config.toml, and the data directory holding the default RocksDB store. That directory is your backup unit; stop the container or use the built-in export before copying it, because RocksDB does not love being snapshotted mid-write.

Storage backends: keep RocksDB unless you know why not

Stalwart separates 4 stores (data, blobs, full-text index, lookup) and lets each sit on RocksDB, SQLite, PostgreSQL, MySQL, FoundationDB, or S3-compatible object storage for blobs. For a family or small-team server, the default RocksDB for everything is the fastest and least fiddly. The moment to reach for Postgres plus S3 is when you want the mail store on a database you already back up, or a multi-node deployment, which almost nobody self-hosting for 10 people needs. Accounts can come from the internal directory, LDAP, SQL, or an OpenID Connect provider such as Authentik, which is how you give your household single sign-on for mail.

JMAP is the future, IMAP is the present

Stalwart's JMAP support is its most-cited feature and the least useful today. JMAP is the modern JSON replacement for IMAP and is a delight to program against, but the catalogue's "JMAP ecosystem still small" con is precise: the clients are Fastmail's own, a few web apps, and the Thunderbird support is still maturing. Your phone and desktop clients will speak IMAP on 993 and submit on 465 or 587, and Stalwart serves those with full extension support, server-side Sieve rules and fast full-text search. Newer releases also added CalDAV and CardDAV, which turns it into a contacts and calendar server as well; check the release notes for the version you install.

What I'd do

Family or micro-business mail for fewer than 20 mailboxes: Stalwart on a VPS with a clean IP, reverse DNS set before the first send, DKIM published on day 1, DMARC at p=none for a month then p=quarantine. Keep RocksDB, back up /opt/stalwart nightly, put the admin panel behind Caddy with SSO. Relay outbound through a paid SMTP service for the first 3 months if deliverability stalls; Stalwart supports smart-host routing for exactly this. If the goal is leaving Google Workspace and you are not willing to babysit reputation, browse the email category for a hosted-relay hybrid instead of pretending the hard part does not exist.