Stalwart is an open-source mail & collaboration server with JMAP, IMAP4, POP3, SMTP, CalDAV, CardDAV and WebDAV support and a wide range of modern features. It is written in Rust and designed to be secure, fast, robust and scalable.

Key features:

• Email server with complete protocol support:
  • JMAP:
    • JMAP for Mail server.
    • JMAP for Sieve Scripts.
    • JMAP Object Metadata for e-mails, mailboxes, calendars, contacts, files and Sieve scripts.
    • WebSocket, Blob Management and Quotas extensions.
  • IMAP:
    • IMAP4rev2 and IMAP4rev1 server.
    • ManageSieve server.
    • Numerous extensions supported.
  • POP3:
    • POP3 server.
    • STLS and SASL support as well as other extensions.
  • SMTP:
    • SMTP server with built-in DMARC, DKIMv2 (including post-quantum signatures), DKIMv1, SPF and ARC support for message authentication.
    • Strong transport security through DANE, MTA-STS and SMTP TLS reporting.
    • Automated DKIM key rotation and management.
    • Inbound throttling and filtering with granular configuration rules, sieve scripting, MTA hooks and milter integration.
    • Distributed virtual queues with delayed delivery, priority delivery, quotas, routing rules and throttling support.
    • Envelope rewriting and message modification.
• Collaboration server:
  • Calendaring and scheduling:
    • CalDAV and CalDAV Scheduling support.
    • JMAP for Calendars support.
  • Contact management:
    • CardDAV support.
    • JMAP for Contacts support.
  • File storage:
    • WebDAV support.
    • JMAP for File Storage support.
  • Sharing with fine-grained access controls:
    • WebDAV ACL support.
    • JMAP Sharing support.
• Spam and Phishing built-in filter:
  • Comprehensive set of filtering rules on par with popular solutions.
  • AI spam classifier with support for OpenAI-compatible, Anthropic, Google Gemini and Ollama models.
  • Statistical spam classifier with collaborative filtering, automatic training capabilities and address book integration.
  • DNS Blocklists (DNSBLs) checking of IP addresses, domains, and hashes.
  • Collaborative digest-based spam filtering with Pyzor.
  • Phishing protection against homographic URL attacks, sender spoofing and other techniques.
  • Trusted reply tracking to recognize and prioritize genuine e-mail replies.
  • Sender reputation monitoring by IP address, ASN, domain and email address.
  • Greylisting to temporarily defer unknown senders.
  • Spam traps to set up decoy email addresses that catch and analyze spam.
• Flexible:
  • Pluggable storage backends with RocksDB, FoundationDB, PostgreSQL, mySQL, SQLite, S3-Compatible, Azure and Redis support.
  • Full-text search available in 17 languages using the built-in search engine or via Meilisearch, ElasticSearch, OpenSearch, PostgreSQL or mySQL backends.
  • Text extraction and indexing of PDF, Microsoft Office, OpenDocument, EPUB and RTF documents.
  • Sieve scripting language with support for all registered extensions.
  • Email aliases, mailing lists, subaddressing and catch-all addresses support.
  • Automated DNS management.
  • Automatic account configuration and discovery with PACC, autoconfig and autodiscover.
  • Multi-tenancy support with domain and tenant isolation.
  • Disk quotas per user and tenant.
• Encryption with OpenPGP and S/MIME:
  • Encryption at rest of each user's mailbox with their own OpenPGP key or S/MIME certificate.
  • Encryption gateway that encrypts outgoing mail for remote recipients, with opportunistic or required policies and no software needed on the sender's side.
  • Recipient key discovery from Web Key Directory, keys.openpgp.org, HKP keyservers and DNSSEC-validated OPENPGPKEY and SMIMEA records.
  • Key harvesting from S/MIME signatures and Autocrypt headers of authenticated incoming mail.
  • S/MIME certificate validation with bundled root certificates, custom trust anchors and revocation lists.
  • Post-quantum encryption with ML-KEM for both OpenPGP (RFC 9980) and S/MIME (RFC 9936).
  • OpenPGP v4 and v6 keys with RSA, ECDH (NIST P-256, P-384, P-521, Curve25519), X25519 and X448, and AES-OCB or AES-GCM authenticated encryption (RFC 9580).
  • S/MIME with RSA (PKCS #1 v1.5 and RSA-OAEP), ECDH (NIST P-256, P-384, P-521), X25519 and X448 certificates, and AES-CBC or AES-GCM content encryption.
  • Header protection with Subject hiding.
• Secure and robust:
  • Automatic TLS certificate provisioning with ACME using TLS-ALPN-01, DNS-01, DNS-PERSIST-01 or HTTP-01 challenges.
  • Automated blocking of IP addresses that attack, abuse or scan the server for exploits.
  • SSRF protection for outbound requests.
  • Rate limiting.
  • Security audited (read the report).
  • Memory safe (thanks to Rust).
• Scalable and fault-tolerant:
  • Designed to handle growth seamlessly, from small setups to large-scale deployments of thousands of nodes.
  • Built with fault tolerance and high availability in mind, recovers from hardware or software failures with minimal operational impact.
  • Peer-to-peer cluster coordination or with Kafka, Redpanda, NATS or Redis.
  • Kubernetes, Apache Mesos and Docker Swarm support for automated scaling and container orchestration.
  • Read replicas, sharded blob storage and in-memory data stores for high performance and low latency.
  • Tiered caching with snapshots that can be swapped to disk, Redis or the blob store.
• Authentication and Authorization:
  • OpenID Connect authentication.
  • OAuth 2.0 authorization with authorization code and device authorization flows.
  • OAuth scopes, connected applications management and Client ID Metadata Documents.
  • LDAP, OIDC, SQL or built-in authentication backend support.
  • System for Cross-domain Identity Management (SCIM) v2 for automated provisioning.
  • Two-factor authentication with Time-based One-Time Passwords (2FA-TOTP)
  • Application passwords (App Passwords).
  • Roles and permissions.
  • Access Control Lists (ACLs).
• Observability:
  • Logging and tracing with OpenTelemetry, journald, log files and console support.
  • Metrics with OpenTelemetry and Prometheus integration.
  • Webhooks for event-driven automation.
  • Alerts with email and webhook notifications.
  • Live tracing and metrics.
• Web-based administration:
  • Dashboard with real-time statistics and monitoring.
  • Account, domain, group and mailing list management.
  • SMTP queue management for messages and outbound DMARC and TLS reports.
  • Report visualization interface for received DMARC, TLS-RPT and Failure (ARF) reports.
  • Configuration of every aspect of the mail server.
  • Log viewer with search and filtering capabilities.
  • Self-service portal for password reset and encryption-at-rest key management.

Whether you are evaluating options, presenting Stalwart to your team or your boss, or just curious about how it works under the hood, the slides walk you through its key features, architecture and benefits.

Install Stalwart on your server by following the instructions for your platform:

• Linux / MacOS / FreeBSD
• Windows
• Docker

All documentation is available at stalw.art/docs.

If you run into a problem, find a bug or have a question, head to the Stalwart Support Portal. It is free for everyone, and our team answers.

Organizations that need more can purchase an Enterprise license for priority support from Stalwart Labs LLC, with response-time commitments and a private Priority Support area on the portal.

About 85% of Stalwart's features are free and open source under the AGPL-3.0. The rest make up the Enterprise edition, and are mostly features that matter to large organizations and hosting providers running Stalwart at scale, such as multi-tenancy, SCIM provisioning, sharded storage and live telemetry. The full breakdown is on the comparison page.

Stalwart is built by a full-time professional team, not as a side project, and open source sponsorship covers only a small fraction of what that costs. Enterprise subscriptions pay for the work that every Stalwart user benefits from:

• The engineers who maintain and extend the Community edition, with a new release every week.
• Security fixes within 24 hours of a report, and an independent security audit every time a large part of Stalwart is rewritten.
• Free community support at support.stalw.art.
• Stress tests and benchmarks on dozens of cloud servers at a time across many regions.
• Work on email standards at the IETF, where we are the authors of multiple Internet-Drafts in progress.

The Community edition is complete and open source, and it will stay that way:

• Stalwart remains licensed under the AGPL-3.0.
• No existing open source feature will ever be moved to the Enterprise edition.
• Most new features go to the Community edition.

If you find Stalwart useful, there are two ways to help keep it free. If your organization needs Enterprise features, subscribe to the Enterprise edition. Otherwise, you can become a sponsor on OpenCollective: sponsors who contribute $5 per month or more automatically receive an Enterprise license, and those who contribute $30 per month or more also get access to Premium Support from Stalwart Labs. Thank you!

Contributions are welcome, with a few rules that keep the project maintainable:

• Because of the high volume of low-quality, AI-generated submissions, only vouched contributors can open pull requests. To be added to the list, post at support.stalw.art describing the change you would like to submit, with a link to it.
• For now, only bug fixes and translations are accepted. New features are not, unless they are just a few lines of code.

The full guidelines are in CONTRIBUTING.md. You can also help without writing code: report bugs, answer questions on the support portal, or tell others about Stalwart.

Part of the development of this project was funded through:

• NGI0 Entrust Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 101069594.
• NGI Zero Core, a fund established by NLnet with financial support from the European Commission's programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 101092990.

This project is dual-licensed under the GNU Affero General Public License v3.0 (AGPL-3.0; as published by the Free Software Foundation) and the Stalwart Enterprise License v2 (SELv2):

• The GNU Affero General Public License v3.0 is a free software license that ensures your freedom to use, modify, and distribute the software, with the condition that any modified versions of the software must also be distributed under the same license.
• The Stalwart Enterprise License v2 (SELv2) is a proprietary license designed for commercial use. It offers additional features and greater flexibility for businesses that do not wish to comply with the AGPL-3.0 license requirements.

Each file in this project contains a license notice at the top, indicating the applicable license(s). The license notice follows the REUSE guidelines to ensure clarity and consistency. The full text of each license is available in the LICENSES directory.

Copyright (C) 2020, Stalwart Labs LLC