1. Project Overview & Quickstart (stalwartlabs/stalwart)
Secure, scalable mail & collaboration server with comprehensive protocol support π‘οΈ (IMAP, JMAP, SMTP, CalDAV, CardDAV, WebDAV)
Features
Stalwart is an open-source mail & collaboration server with JMAP, IMAP4, POP3, SMTP, CalDAV, CardDAV and WebDAV support and a wide range of modern features. It is written in Rust and designed to be secure, fast, robust and scalable.
Key features:
- Email server with complete protocol support:
- JMAP:
- JMAP for Mail server.
- JMAP for Sieve Scripts.
- WebSocket, Blob Management and Quotas extensions.
- IMAP:
- IMAP4rev2 and IMAP4rev1 server.
- ManageSieve server.
- Numerous extensions supported.
- POP3:
- POP3 server.
- STLS and SASL support as well as other extensions.
- SMTP:
- SMTP server with built-in DMARC, DKIMv2, DKIMv1, SPF and ARC support for message authentication.
- Strong transport security through DANE, MTA-STS and SMTP TLS reporting.
- Automated DKIM key rotation and management.
- Inbound throttling and filtering with granular configuration rules, sieve scripting, MTA hooks and milter integration.
- Distributed virtual queues with delayed delivery, priority delivery, quotas, routing rules and throttling support.
- Envelope rewriting and message modification.
- JMAP:
- Collaboration server:
- Calendaring and scheduling:
- CalDAV and CalDAV Scheduling support.
- JMAP for Calendars support.
- Contact management:
- CardDAV support.
- JMAP for Contacts support.
- File storage:
- WebDAV support.
- JMAP for File Storage support.
- Sharing with fine-grained access controls:
- WebDAV ACL support.
- JMAP Sharing support.
- Calendaring and scheduling:
- Spam and Phishing built-in filter:
- Comprehensive set of filtering rules on par with popular solutions.
- LLM-driven spam filtering and message analysis.
- Statistical spam classifier with collaborative filtering, automatic training capabilities and address book integration.
- DNS Blocklists (DNSBLs) checking of IP addresses, domains, and hashes.
- Collaborative digest-based spam filtering with Pyzor.
- Phishing protection against homographic URL attacks, sender spoofing and other techniques.
- Trusted reply tracking to recognize and prioritize genuine e-mail replies.
- Sender reputation monitoring by IP address, ASN, domain and email address.
- Greylisting to temporarily defer unknown senders.
- Spam traps to set up decoy email addresses that catch and analyze spam.
- Flexible:
- Pluggable storage backends with RocksDB, FoundationDB, PostgreSQL, mySQL, SQLite, S3-Compatible, Azure and Redis support.
- Full-text search available in 17 languages using the built-in search engine or via Meilisearch, ElasticSearch, OpenSearch, PostgreSQL or mySQL backends.
- Sieve scripting language with support for all registered extensions.
- Email aliases, mailing lists, subaddressing and catch-all addresses support.
- Automated DNS management.
- Automatic account configuration and discovery with autoconfig and autodiscover.
- Multi-tenancy support with domain and tenant isolation.
- Disk quotas per user and tenant.
- Secure and robust:
- Encryption at rest with S/MIME or OpenPGP.
- Automatic TLS certificate provisioning with ACME using
TLS-ALPN-01,DNS-01,DNS-PERSIST-01orHTTP-01challenges. - Automated blocking of IP addresses that attack, abuse or scan the server for exploits.
- Rate limiting.
- Security audited (read the report).
- Memory safe (thanks to Rust).
- Scalable and fault-tolerant:
- Designed to handle growth seamlessly, from small setups to large-scale deployments of thousands of nodes.
- Built with fault tolerance and high availability in mind, recovers from hardware or software failures with minimal operational impact.
- Peer-to-peer cluster coordination or with Kafka, Redpanda, NATS or Redis.
- Kubernetes, Apache Mesos and Docker Swarm support for automated scaling and container orchestration.
- Read replicas, sharded blob storage and in-memory data stores for high performance and low latency.
- Authentication and Authorization:
- OpenID Connect authentication.
- OAuth 2.0 authorization with authorization code and device authorization flows.
- LDAP, OIDC, SQL or built-in authentication backend support.
- Two-factor authentication with Time-based One-Time Passwords (
2FA-TOTP) - Application passwords (App Passwords).
- Roles and permissions.
- Access Control Lists (ACLs).
- Observability:
- Logging and tracing with OpenTelemetry, journald, log files and console support.
- Metrics with OpenTelemetry and Prometheus integration.
- Webhooks for event-driven automation.
- Alerts with email and webhook notifications.
- Live tracing and metrics.
- Web-based administration:
- Dashboard with real-time statistics and monitoring.
- Account, domain, group and mailing list management.
- SMTP queue management for messages and outbound DMARC and TLS reports.
- Report visualization interface for received DMARC, TLS-RPT and Failure (ARF) reports.
- Configuration of every aspect of the mail server.
- Log viewer with search and filtering capabilities.
- Self-service portal for password reset and encryption-at-rest key management.
Screenshots
Presentation
Want a deeper dive? Need to explain to your boss why Stalwart is the perfect fit? Whether you're evaluating options, making a case to your team, or simply curious about how it all works under the hood, these slides walk you through the key features, architecture, and benefits of Stalwart. Browse the slides to see what makes it stand out.
Get Started
Install Stalwart on your server by following the instructions for your platform:
All documentation is available at stalw.art/docs.
Support
If you are having problems running Stalwart, found a bug, or just have a question, please head to the Stalwart Support Portal at support.stalw.art.
Additionally, you may purchase an Enterprise License to obtain priority support from Stalwart Labs LLC, including response-time commitments and a private Priority Support area on the portal.
Contributing
We welcome contributions, but to keep the project maintainable there are a few things to know before opening a pull request. Because of the high volume of low-quality, AI-generated submissions, pull requests are limited to a list of vouched contributors; to be added, post at support.stalw.art describing the change you would like to submit, together with a link to the proposed change. At this stage only bug fixes and translations are accepted, and new features are not, unless they involve just a few lines of code.
For the full guidelines, please read CONTRIBUTING.md.
Roadmap
Stalwart has reached an exciting point in its journey, itβs now feature complete. All the core functionality and open standard email and collaboration protocols that we set out to support are in place. In other words, Stalwart already does everything youβd expect from a modern, standards-compliant mail and collaboration platform.
The next major milestone is all about refinement: finalizing the database schema and focusing on performance optimizations to ensure everything runs as efficiently and reliably as possible. Once thatβs done, weβll be ready to roll out version 1.0.
Of course, development doesnβt stop there. The community has contributed hundreds of great ideas for improvements and new features, everything from subtle usability tweaks to entirely new integrations. You can see the full list of proposals over on our GitHub issues. If thereβs something youβd like to see prioritized, just give it a thumbs up as we plan to implement enhancements based on the communityβs votes.
Sponsorship
Your support is crucial in helping us continue to improve the project, add new features, and maintain the highest level of quality. By becoming a sponsor, you help fund the development and future of Stalwart. As a thank-you, sponsors who contribute $5 per month or more will automatically receive a Enterprise edition license. And, sponsors who contribute $30 per month or more, also have access to Premium Support from Stalwart Labs.
Funding
Part of the development of this project was funded through:
- NGI0 Entrust Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 101069594.
- NGI Zero Core, a fund established by NLnet with financial support from the European Commission's programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 101092990.
If you find the project useful you can help by becoming a sponsor. Thank you!
License
This project is dual-licensed under the GNU Affero General Public License v3.0 (AGPL-3.0; as published by the Free Software Foundation) and the Stalwart Enterprise License v2 (SELv2):
- The GNU Affero General Public License v3.0 is a free software license that ensures your freedom to use, modify, and distribute the software, with the condition that any modified versions of the software must also be distributed under the same license.
- The Stalwart Enterprise License v2 (SELv2) is a proprietary license designed for commercial use. It offers additional features and greater flexibility for businesses that do not wish to comply with the AGPL-3.0 license requirements.
Each file in this project contains a license notice at the top, indicating the applicable license(s). The license notice follows the REUSE guidelines to ensure clarity and consistency. The full text of each license is available in the LICENSES directory.
Copyright
Copyright (C) 2020, Stalwart Labs LLC
2. Official Technical Reference & Guides (stalwartlabs/website)
Stalwart Website
The marketing site, documentation, and blog for Stalwart.
Built with Astro 6 and
Starlight; deployed as a static site to
Cloudflare Pages.
Stack
- Marketing pages (
/,/pricing,/about,/legal/*, etc.) are Astro
pages driven by YAML/Markdown content collections under
src/content/pages/ and src/content/legal/. - Documentation (
/docs/...) is rendered by Starlight from
src/content/docs/docs/. The previous release line
lives at src/content/docs/docs/0.15/ and is
served at/docs/0.15/.... - Blog (
/blog,/blog/) is thestarlight-blogplugin reading
posts from src/content/docs/blog/. - Search is Pagefind, the offline static-site
search baked into Starlight. The index is rebuilt on everynpm run build.
No third-party service or API key needed. - Per-post OG images are generated by
astro-og-canvasat/og/blog/<slug>.pngand referenced from<meta property="og:image">on
each blog post. - View Transitions (smooth cross-page nav) are enabled site-wide via
Astro's<ClientRouter />.
Local development
Requirements: Node.js 20+ (set in package.json engines).
npm install # one-time, installs Astro + Starlight + plugins
npm run dev # http://127.0.0.1:8787 with hot reloadnpm run dev watches every Markdown, Astro and YAML file. Edits reload in the
browser within a second; structural changes (new files, frontmatter schema
changes) may require a manual reload.
Other useful scripts:
npm run build # production build to dist/, runs link validation
npm run preview # serve dist/ at http://127.0.0.1:8787 to verifyAuthoring docs
Drop new pages into src/content/docs/docs/<section>/.md. Frontmatter
must include at least a title:. Optional helpful fields:
---
title: My new page
sidebar:
order: 5 # position within the parent group
badge: New # appears in the sidebar
---To rename a directory's sidebar label or change ordering, drop a _meta.yml
into that directory (starlight-auto-sidebar docs):
label: Storage settings
order: 5Admonitions (notes, tips, warnings) use the same triple-colon syntax as
before:
:::tip Enterprise feature
This feature ships with the Enterprise edition.
:::Internal doc links use absolute paths without the .md suffix:[Storage](/docs/storage/overview).
Authoring blog posts
Add src/content/docs/blog/.mdx (or a folder with index.mdx if
the post has its own assets). Required frontmatter:
---
title: Post title
date: 2026-05-01
authors: [mdecimus] # keys are defined in astro.config.mjs starlightBlog config
tags: [release, jmap]
excerpt: |
One paragraph teaser shown on the index, in tag pages, and in the RSS feed.
---Reading time is computed automatically.
Deployment (Cloudflare Pages)
The site is a static export. Cloudflare Pages picks up the Astro project
automatically; the only config needed in the dashboard is:
- Build command:
npm run build - Build output directory:
dist - Node version:
20(or newer)
wrangler.toml declares the same so wrangler pages deploy
works locally or from CI.
Static asset behaviour and redirects are controlled by:
- public/_headers: cache-control and security headers
- public/_redirects: Docusaurus-era URL redirects
- public/robots.txt: AI/search crawler policy
- public/llms.txt: curated machine-readable doc index
To deploy from your laptop (one-off):
npm run build
npx wrangler pages deploy dist --project-name stalwart-websiteRepository layout
.
βββ astro.config.mjs # Astro + Starlight integration config
βββ src/
β βββ content.config.ts # Astro content collection schemas
β βββ content/
β β βββ docs/
β β β βββ docs/ # current docs -> /docs/...
β β β βββ docs/0.15/ # archived 0.15 -> /docs/0.15/...
β β β βββ blog/ # blog posts -> /blog/...
β β βββ pages/ # marketing pages (YAML)
β β βββ legal/ # long-form legal pages (Markdown)
β βββ components/ # Astro components shared by marketing + docs
β β βββ Header.astro # marketing nav
β β βββ Footer.astro # marketing footer
β β βββ StarlightHeader.astro # Starlight Header override -> Header
β β βββ StarlightFooter.astro # Starlight Footer override -> Footer
β β βββ VersionPicker.astro # docs version dropdown
β βββ layouts/ # marketing layouts (Base, LongForm)
β βββ pages/ # marketing dynamic routes
β βββ styles/ # global tokens and Starlight overrides
βββ public/ # static assets copied as-is to dist/
βββ scripts/ # one-off migration scripts (kept for reference)Things to know
- The
links-validatorplugin runs at the end ofnpm run buildand fails
the build on broken internal links. Pre-existing broken links in/docs/0.15/**are excluded (seeastro.config.mjs); fix-forward only. - Mermaid diagrams (
```mermaid) are converted to client-rendered SVG
via themermaidnpm package; the script is bundled into Starlight pages
only. - The
.old/directory is the archived Docusaurus tree, kept out of git via.gitignoreuntil you choose to delete it.