Google Workspace is easy until it is not: per-seat pricing, a support ticket to fix SPF, and your inbox living in a jurisdiction you never chose. Running your own mail used to mean gluing Postfix, Dovecot, Rspamd, and a calendar stack together while praying upgrades do not brick Sunday morning.
Stalwart (~15k stars, AGPL-3.0) is a Rust all-in-one mail and collaboration server: JMAP, IMAP, POP3, SMTP, CalDAV, CardDAV, and WebDAV in one binary (or container), with a web admin UI that actually lets you manage queues, domains, and users without living in config files.
What Stalwart replaces
Instead of a patchwork of daemons, you get one project that speaks modern and legacy clients:
- Mail — JMAP (plus Sieve over JMAP), IMAP4rev2, POP3, SMTP with built-in SPF, DKIM, DMARC, and ARC handling, MTA-STS, DANE, greylisting, sieve scripts, milter hooks
- Calendar and contacts — CalDAV scheduling, CardDAV, JMAP calendars/contacts
- Files — WebDAV with ACLs and JMAP file storage on the roadmap
- Spam and abuse — DNSBLs, statistical classifier, Pyzor, phishing heuristics, reputation tracking, optional LLM-assisted filtering
- Auth — built-in directory, LDAP, OIDC, OAuth device flows, 2FA-TOTP, SCIM provisioning, app passwords
Storage is pluggable (RocksDB by default, PostgreSQL, S3-compatible backends, and more). Full-text search can stay internal or plug into Meilisearch, OpenSearch, or Postgres. For operators who outgrow a single box, there is clustering coordination via Kafka, NATS, Redis, or peer-to-peer — plus Kubernetes and Swarm notes in the docs.
Why self-host mail in 2026?
Data sovereignty. Municipalities, law firms, clinics, and anyone under PIPEDA pressure often need to say where mail is stored and who can subpoena it. A VPS in Canada with disks you control beats "trust us, it is in a region."
One bill, many mailboxes. Family domains, small agencies, and internal tools email do not map cleanly to per-user SaaS pricing.
Protocol freedom. JMAP-first clients (Thunderbird, etc.) get a fast sync path; everyone else still has IMAP. You are not locked into a single vendor's web UI.
Honest caveat: self-hosted mail is not a weekend hobby if you ignore DNS. You need correct MX, reverse DNS, SPF, DKIM, DMARC, and a provider that allows outbound port 25 (or a relay). Stalwart automates a lot of TLS (ACME with DNS-01) and DKIM rotation, but reputation still belongs to you.
How people run it
Three common paths:
Official install script — downloads the latest release tarball, creates a stalwart system user, and drops a systemd unit. Good for a dedicated mail VM.
Docker — documented at stalw.art; published images track releases. Mount a data volume, publish 443 (HTTPS admin + JMAP), 587/465 (submission), and 25 only if your host allows it.
From source — Rust toolchain for contributors; production users usually stick to releases.
First boot walks you through the web admin on port 8080 (or HTTPS once certs exist). Plan 2 GB RAM minimum for a small domain, more if you enable heavy spam ML, full-text search backends, or cluster nodes.
Who should (and should not) run Stalwart
Good fit: custom domains for a team that outgrew forwarding rules, privacy-focused orgs, integrators who want LDAP/OIDC and SCIM beside IMAP, homelabbers who want calendars without Google.
Skip it: solo users who only need Gmail; anyone unwilling to maintain DNS and monitor blacklists; shared hosting without SMTP egress.
We do not run your mail for you, but we do run the metal: static IPs, rDNS requests, firewall baselines, and snapshot backups on Canadian VPS hosting. Pair that with Docker or a bare VM depending on how you want to isolate Stalwart from the rest of the stack.
Tell us mailbox count, whether you need outbound relay, and if LDAP/OIDC is in play — we will size the server and leave port 25 policy clear before you cut over MX records.
