Stalwart email server software: anyone know anything?
Has anyone on this list got hands-on experience with Stalwart email server software? https://stalw.art/ It's an entire email stack written in Rust. Replaces Postfix, Dovecot, OpenDKIM, fail-2-ban, Mailman (has a built-in mailing list, no need for the nightmare that is MM anymore), supports CalDAV, CardDAV, WebDAV, JMAP, IMAP, POP3, anti-spam, Sieve, etc. Web site's really fast, even the management console run from inside a Docker container is fast, well designed, well laid out. It's appealing to shed the 1,000+ options for Postfix, even more for Dovecot, plus all the ancillary tools required to run email. On the other hand, Postfix & Dovecot are what I know - and learned at great cost (time & frustration), and are where the jobs are. What brought me to this is, looking for a way to offer contacts & calendar syncing along with email hosting. NextCloud was my first choice, but trying to get the AIO (All In One) to support multiple domains in one instance is not well supported as best I can tell.
Is this another closed source solution with a community edition? I am very wary of those having worked at VMware when they bought Zimbra and seen how ugly things can get. Which begs the question, is there anyone comparing those solutions? Off the top of my head: zimbra, carbonio, openexchange, zarafa, citadel. And do I dare add Lotus and GroupWise? :) On Sat, Jan 10, 2026 at 21:17 Ron via Talk <talk@lists.gtalug.org> wrote:
Has anyone on this list got hands-on experience with Stalwart email server software?
It's an entire email stack written in Rust. Replaces Postfix, Dovecot, OpenDKIM, fail-2-ban, Mailman (has a built-in mailing list, no need for the nightmare that is MM anymore), supports CalDAV, CardDAV, WebDAV, JMAP, IMAP, POP3, anti-spam, Sieve, etc.
Web site's really fast, even the management console run from inside a Docker container is fast, well designed, well laid out.
It's appealing to shed the 1,000+ options for Postfix, even more for Dovecot, plus all the ancillary tools required to run email.
On the other hand, Postfix & Dovecot are what I know - and learned at great cost (time & frustration), and are where the jobs are.
What brought me to this is, looking for a way to offer contacts & calendar syncing along with email hosting.
NextCloud was my first choice, but trying to get the AIO (All In One) to support multiple domains in one instance is not well supported as best I can tell.
------------------------------------ Description: GTALUG Talk Unsubscribe via Talk-unsubscribe@lists.gtalug.org Start a new thread: talk@lists.gtalug.org This message archived at https://lists.gtalug.org/archives/list/talk@lists.gtalug.org/message/TEF2S34...
Nick Accad via Talk wrote on 2026-01-11 06:06:
Is this another closed source solution with a community edition?
I think of it as an open source solution with some paid-for features only really useful when running at commercial scale. A seemingly reasonable way to earn a living producing software.
Which begs the question, is there anyone comparing those solutions? Off the top of my head: zimbra, carbonio, openexchange, zarafa, citadel. I haven't even heard of most of those, and the one(s) I have don't seem to have any significant market share.
It's hard to say whether Stalwart has / will gain "momentum", but they say they're feature complete now, and it's a *highly* polished product. Need to know whether I can export messages in case I decide to move back to Postfix / Dovecot (there is an export command for the CLI tool, but it speaks of JMAP - would have to test if it can export to IMAP in MailDir format). Also, I have a script that uses inotify to trigger another script to rewrite new files (messages) in a specific folder, and resubmit them to IMAP with a meaningful subject. I don't know if that can be implemented in Stalwart. Gonna have to do some testing...
I will throw it in an LXC and see how it plays out. Your script sounds like it is independent of the server software, I cannot see a reason for it not to work. In the meantime, have you considered Mailcow? I have been running it for a couple of years, some tweaking here and there and it serves my needs. It is not a complete re-write, but rather, a web interface in front of postfix/dovecot/rspamd/...etc, no integrated mailing list, but I never needed that. Another question comes to mind, why is everyone so focused on Postfix? Back when I cared I ran Exim everywhere, it is much more capable and the configuration actually makes sense. Anyone remember QPopper? :) On Sun, Jan 11, 2026 at 5:14 PM Ron via Talk <talk@lists.gtalug.org> wrote:
Nick Accad via Talk wrote on 2026-01-11 06:06:
Is this another closed source solution with a community edition?
I think of it as an open source solution with some paid-for features only really useful when running at commercial scale.
A seemingly reasonable way to earn a living producing software.
Which begs the question, is there anyone comparing those solutions? Off the top of my head: zimbra, carbonio, openexchange, zarafa, citadel. I haven't even heard of most of those, and the one(s) I have don't seem to have any significant market share.
It's hard to say whether Stalwart has / will gain "momentum", but they say they're feature complete now, and it's a *highly* polished product.
Need to know whether I can export messages in case I decide to move back to Postfix / Dovecot (there is an export command for the CLI tool, but it speaks of JMAP - would have to test if it can export to IMAP in MailDir format).
Also, I have a script that uses inotify to trigger another script to rewrite new files (messages) in a specific folder, and resubmit them to IMAP with a meaningful subject.
I don't know if that can be implemented in Stalwart.
Gonna have to do some testing...
------------------------------------ Description: GTALUG Talk Unsubscribe via Talk-unsubscribe@lists.gtalug.org Start a new thread: talk@lists.gtalug.org This message archived at https://lists.gtalug.org/archives/list/talk@lists.gtalug.org/message/3H32VSG...
Ron via Talk said on Sat, 10 Jan 2026 18:16:39 -0800
Has anyone on this list got hands-on experience with Stalwart email server software?
It's an entire email stack written in Rust. Replaces Postfix, Dovecot, OpenDKIM, fail-2-ban, Mailman (has a built-in mailing list, no need for the nightmare that is MM anymore), supports CalDAV, CardDAV, WebDAV, JMAP, IMAP, POP3, anti-spam, Sieve, etc.
I want to hear about this too. My entire email usage depends on Dovecot, and Dovecot 2.4.x has jumped the shark in order to offer a proprietary product not in competition with their free software, so this would be a great time for me to replace the once absolutely perfect Dovecot. SteveT Steve Litt http://444domains.com
Steve Litt via Talk wrote on 2026-01-12 13:23:
I want to hear about this too. My entire email usage depends on Dovecot, and Dovecot 2.4.x has jumped the shark in order to offer a proprietary product not in competition with their free software
What changes are you referring to? I've just looked over this page: https://doc.dovecot.org/main/installation/upgrade/2.3-to-2.4.html#removed-fe... and I'm seeing some things I like, some I don't know about, some that may bite me, but nothing about removing features that I use. Global ACLs are a PITA, and they're changing how to implement ACLs, so the ability isn't gone, just different. IMAP SETQUOTA is going away, but user_db / pass_db (userdb_quota_rule=) is where I set those anyway. Don't think it'll affect me? The "Backends and Plugins" section will require careful parsing at some point.
Ron via Talk said on Mon, 12 Jan 2026 19:16:34 -0800
Steve Litt via Talk wrote on 2026-01-12 13:23:
I want to hear about this too. My entire email usage depends on Dovecot, and Dovecot 2.4.x has jumped the shark in order to offer a proprietary product not in competition with their free software
What changes are you referring to?
I've just looked over this page:
https://doc.dovecot.org/main/installation/upgrade/2.3-to-2.4.html#removed-fe...
and I'm seeing some things I like, some I don't know about, some that may bite me, but nothing about removing features that I use.
They're big-iron features for big networks, not things an individual would use.
Global ACLs are a PITA, and they're changing how to implement ACLs, so the ability isn't gone, just different.
Yes. I suspect that other than the removed features, which don't apply to my usage, Dovecot can still do everything it used to. Problem is, getting the config right is an undertaking when doing it on a live system where you don't have the option of experimentation. And it was much worse early on when Void Linux switched to 2.4.x many months ago. One day my email just stopped working. It took some time to narrow it down to Dovecot. I figured "well, how hard can it be to make a few changes in the config file?" Well, it was murder, because most things are different: Even keywords. Since then, I've seen distro after distro upgrade to 2.4.x, with many of their users going through the same thing I did. And it doesn't help that because Dovecot was so stable and robust in the past, once I got a working config in 2012 I pretty much left it alone, so I know little about Dovecot, because until now, it just worked(tm). It also didn't help that they made these massive changes with a minor version (right of the decimal point). They should have called it 3.0 and should have publicized the hell out of what was coming down the pike so people were ready when their distro upgraded. I've still got my Dovecot pinned to 2.3.21.1 because I haven't busted loose enough time to run an experimental 2.4.x in a Qemu VM guest, and I'm not going to screw up my live email system again. And of course I have a bad taste in my mouth from the whole thing, and wonder what massive changes the Dovecot folks will make next, so I'm looking for alternatives. SteveT Steve Litt http://444domains.com
I got it up and running in a tiny LXC (Debian 13, 2G RAM, 1CPU and 4G disk), took about 10 minutes So far, it looks solid, I am yet to enable JMAP and I'm not sure I really need it for a POC. The "Enterprise" options (Tenants, AI stuff, ...etc,) are not really crippling it, https://stalw.art/compare/ I am still trying to figure out how to setup SMTP relays, and if there is a way to run fetchmail natively a la Mailcow. Any questions or test requests, let me know -nick On Mon, Jan 12, 2026 at 10:16 PM Ron via Talk <talk@lists.gtalug.org> wrote:
Steve Litt via Talk wrote on 2026-01-12 13:23:
I want to hear about this too. My entire email usage depends on Dovecot, and Dovecot 2.4.x has jumped the shark in order to offer a proprietary product not in competition with their free software
What changes are you referring to?
I've just looked over this page:
https://doc.dovecot.org/main/installation/upgrade/2.3-to-2.4.html#removed-fe...
and I'm seeing some things I like, some I don't know about, some that may bite me, but nothing about removing features that I use.
Global ACLs are a PITA, and they're changing how to implement ACLs, so the ability isn't gone, just different.
IMAP SETQUOTA is going away, but user_db / pass_db (userdb_quota_rule=) is where I set those anyway. Don't think it'll affect me?
The "Backends and Plugins" section will require careful parsing at some point.
------------------------------------ Description: GTALUG Talk Unsubscribe via Talk-unsubscribe@lists.gtalug.org Start a new thread: talk@lists.gtalug.org This message archived at https://lists.gtalug.org/archives/list/talk@lists.gtalug.org/message/B6ZREZW...
Nick Accad via Talk wrote on 2026-01-13 06:44:
Any questions or test requests, let me know
If you can manage to get locked out (IP blocked) from the interface, *then* figure out a way back in, I'd be grateful to hear how. For the record, here's what I've done to lock myself out: Create a calendar called "my-cal-curl": (I have a script for this, and run it on a VPS, not localhost) proto=http host=... port=... user=$a_valid_user_account_login_name curl --request "MKCALENDAR" \ --header "Content-Type: application/xml" \ --header "Authorization: Basic ${userpwd64}" \ --data '<?xml version="1.0" encoding="UTF-8"?> <C:mkcalendar xmlns:D="DAV:" xmlns:C="urn:ietf:params:xml:ns:caldav"> <D:set> <D:prop> <D:displayname>My Calendar</D:displayname> <C:calendar-description xml:lang="en"> Personal calendar </C:calendar-description> <C:supported-calendar-component-set> <C:comp name="VEVENT"/> <C:comp name="VTODO"/> </C:supported-calendar-component-set> </D:prop> </D:set> </C:mkcalendar>' \ ${proto}://${host}:${port}/dav/cal/${user}/my-cal-curl Then, list the calendars found (default and new one): curl --silent --show-error --include --request "PROPFIND" \ --header "Content-Type: application/xml" \ --header "Authorization: Basic ${userpwd64}" \ --data '<?xml version="1.0" encoding="UTF-8"?> <D:propfind xmlns:D="DAV:"> <D:prop> <D:displayname/> <D:getetag/> </D:prop> </D:propfind>' \ ${proto}://${host}:${port}/dav/cal/${user}/ The "list calendars" snippet above works on VPS and on localhost. BUT, trying to subscribe to (or find) any calendars inside Thunderbird fails. Next thing I know, I'm locked out: even the `curl` stops working. Can't load the admin page in a browser. And, despite tweaking the config.toml file, can't find a setting to undo the IP block. Log file shows: INFO Blocked IP address (security.ip-blocked) listenerId = "http", localPort =... Very frustrated. Off to search GitHub issues. (Their AI bot is pretty slick - searches the source code, gives answers, but I'm unable to get them to work.)
Ron via Talk wrote on 2026-01-14 01:15:
If you can manage to get locked out (IP blocked) from the interface, *then* figure out a way back in, I'd be grateful to hear how.
So, here's how (needs the admin password): stalwart-cli --url 127.0.0.1:8080 list-config | grep $my.ip Should show something like server.blocked-ip.1.2.3.4 stalwart-cli --url 127.0.0.1:8080 delete-config.1.2.3.4 I'm having no success adding allow list items in the toml file with keys like: server.allow-ip allow-ip [Server] allow-ip There's a reload-config, but it doesn't seem to add entries made to toml file, so I'm not sure how things work together yet: stalwart-cli --url 127.0.0.1:8080 reload-config Ah, in the admin interface, Settings > Security > Allowed IPs, where I added my IP. There's also Spam filter > Lists > Trusted domains. Now, stalwart-cli ... list-config | grep $my_ip shows a new entry: lookup.trusted-domains.1.2.3.4 Probably don't want an IP in there. Quite detailed documentation here: https://stalw.art/docs/server/auto-ban/ Still, I cannot get Thunderbird to talk CalDAV to Stalwart (yet). This part is also frustrating BUT now I'm NOT locked out after a few tries.
participants (3)
-
Nick Accad -
Ron -
Steve Litt