Get Stalwart
All-in-one mail & collaboration server

Upgrade your email with Stalwart.

One server for your email, calendars, contacts and shared files, with spam and phishing protection built in. Every standard protocol your clients already speak (JMAP, IMAP, POP3, SMTP, CalDAV, CardDAV and WebDAV) supported natively.

Get started
  • Open source
  • Rust-native
admin.stalw.art / Dashboard / Overview
Stalwart admin dashboard overview with received, sent and pending messages, server memory, a 24-hour message chart, clean mail ratio and rejection rankingStalwart admin dashboard overview with received, sent and pending messages, server memory, a 24-hour message chart, clean mail ratio and rejection ranking
Stalwart at a glance

One server instead of five.

All-in-one solution

Replace the legacy stack with one platform.

Running mail used to mean stitching together half a dozen separate components (an MTA, a message store, a spam filter, a calendar server, a contacts server, a file server) each with its own configuration quirks.

Stalwart collapses all of that into one platform: fewer services to deploy, one configuration to learn, one place to look when something needs attention, and a smaller attack surface.

Enhanced security

Email security from the wire to the mailbox.

Security is a default in Stalwart, not an add-on.

Mail in transit between servers stays encrypted and verified end to end, with DANE, MTA-STS and TLS reporting; TLS certificates renew themselves over ACME so nothing breaks at expiry; mailboxes at rest can be encrypted with the user's own S/MIME certificate or OpenPGP key, so even an operator with disk access cannot read them; and the encryption gateway encrypts outgoing mail for every recipient whose key it can find, with post-quantum algorithms when the key supports them.

  • Encryption at rest with S/MIME or OpenPGP, including post-quantum ML-KEM keys.
  • Encryption gateway with automatic recipient key discovery.
  • Blob store encryption for messages and files kept on S3, Azure or other object storage.
  • Strong transport security through DANE, MTA-STS, and TLS reporting.
  • Automatic TLS provisioning over ACME.
  • Automated DKIM key generation, rotation, and DNS publication.
  • Granular ACLs, rate limiting, and automatic IP banning.
  • Memory-safe implementation in Rust.
  • Independently security-audited.
Fits your existing stack

Works with your existing infrastructure.

From a single-node setup to a multi-tenant hosting platform, Stalwart fits the storage, search, external directory and DNS infrastructure you already run, instead of asking you to replace it.

Mix and match the backends below to match the deployment you have, not the one a vendor would prefer.

admin.stalw.art / Dashboard / Storage
Stalwart storage dashboard with data store and blob store read and write latency over the last 24 hoursStalwart storage dashboard with data store and blob store read and write latency over the last 24 hours
  • Pluggable storage: RocksDB, FoundationDB, PostgreSQL, MySQL, SQLite, S3, Azure Blob, Redis.
  • Full-text search in 17 languages, internal or via Meilisearch, ElasticSearch, OpenSearch, PostgreSQL, including the text of PDF and Office attachments and stored files.
  • LDAP, OIDC, SQL, or built-in auth, with passkeys, 2FA, app passwords, and API keys.
  • Automated DNS management on Cloudflare, Route53, Google Cloud DNS, and more.
  • Sieve scripting plus Stalwart's expression language.
  • Web administration plus a CLI.
Unified collaboration

Calendars, contacts and file storage in the same server.

Collaboration is part of the core product, not a sidecar.

The same sign-in, the same access controls, the same disk quotas and the same monitoring cover mail, calendars, contacts and files. One backup covers all of it; one audit log records all of it.

  • Calendar event scheduling with attendee invitations and free/busy lookup.
  • Contact management with CardDAV and JMAP for Contacts.
  • File storage and secure sharing over WebDAV and JMAP for File Storage.
  • iMIP email notifications for invitations and updates.
  • Fine-grained sharing through WebDAV ACL and JMAP Sharing.
  • Auto-discovery for desktop and mobile clients.
Spam & phishing filter

Built-in protection against attacks.

The spam and phishing filter ships inside the same product as the SMTP server, so unwanted mail is scored and rejected before it reaches the mailbox, with no extra daemon to deploy.

Reports, trusted-reply tracking and sender reputation live in the same admin surface as the rest of the server, so an operator never has to chase a problem across two products.

admin.stalw.art / Dashboard / Security
Stalwart security dashboard with blocked threats, banned IPs, authentication failures and a fail-to-ban chartStalwart security dashboard with blocked threats, banned IPs, authentication failures and a fail-to-ban chart
  • Built-in DMARC, DKIM and SPF for sender authentication.
  • Statistical classifier with automatic training.
  • Optional LLM-driven message analysis.
  • DNSBL checking of IP addresses, domains, URLs, and hashes.
  • Phishing protection against homograph URL attacks, sender spoofing, and other techniques.
  • Trusted reply tracking and sender reputation by IP, ASN, domain, and email.
  • Greylisting, spam traps, and Pyzor digest filtering.
  • Milter and HTTP-based MTA Hooks for SpamAssassin, RSPAMD, and external scanners.
Built to scale

Built to scale to millions of mailboxes.

Stalwart was designed for clustering from day one, not retrofitted.

Any node can serve any protocol, Stalwart Keep handles coordination and short-lived state, and capacity grows by adding nodes, so the same product that handles a small organisation today handles a hosting platform tomorrow.

  • High availability, load balancing and fault tolerance.
  • Kubernetes, Apache Mesos, and Docker Swarm orchestration.
  • Distributed MTA queue with delayed delivery, priority, quotas, routing, and throttling.
  • Read replicas, sharded blob storage and in-memory data stores.
  • Stalwart Keep for cluster coordination, locks and rate-limit counters in one service.
  • Alternative coordination through NATS, Redis, Apache Kafka, Redpanda or peer-to-peer Zenoh.