devopspack.com
Stalwart + Bulwark: Self-Hosted Email That Doesn't Require a PhD to Run
Running your own email server has a reputation that's hard to shake. Postfix, Dovecot, Rspamd, OpenDKIM, a dozen configuration files in different formats, a fragile chain of daemons that each fail in their own creative ways — and all of it between you and a working inbox. The conventional wisdom is "don't self-host email." Most people follow it.
Stalwart is the project that's making that advice worth reconsidering. It's a single Rust binary that replaces the entire traditional email stack. No Postfix, no Dovecot, no Rspamd, no separate DKIM daemon. One process handles SMTP, IMAP, JMAP, spam filtering, CalDAV, CardDAV, and WebDAV — and it does it in about 100MB of RAM.
Pair it with Bulwark — a modern JMAP webmail client built specifically for Stalwart — and you have a complete self-hosted email platform that looks and feels like it was built in 2026, not 1996.
## The email self-hosting problem
The traditional self-hosted email stack is a chain of interdependent components, each with its own configuration language, log format, and failure modes:
* **Postfix** — SMTP daemon for sending and receiving
* **Dovecot** — IMAP/POP3 daemon for mail retrieval
* **Rspamd or SpamAssassin** — spam filter
* **OpenDKIM** — DKIM signing
* **Roundcube or SOGo** — webmail UI with its own database
* **Certbot** — TLS certificate management
* **MySQL or PostgreSQL** — backing database for multiple components
The whole stack consumes 1.5GB+ of RAM on a dedicated server. Configuration spans multiple files with incompatible syntax. Debugging a delivery failure means correlating logs from three different daemons with three different time formats. Setting up DKIM, DMARC, and SPF correctly requires careful manual coordination.
Stalwart collapses all of this into one binary.
## What Stalwart is
Stalwart is an all-in-one, open-source mail and collaboration server written in Rust. It supports JMAP, IMAP4, POP3, SMTP, CalDAV, CardDAV, and WebDAV — all in a single binary, with a single configuration system and a single web admin UI. It runs in roughly 100MB of RAM compared to 1.5GB+ for the traditional stack. It has 12,700+ GitHub stars and is actively maintained by Stalwart Labs.
The license is AGPL-3.0 for the Community Edition — genuinely open source. Running unmodified Stalwart internally doesn't trigger any AGPL source disclosure requirement; the copyleft condition only applies when you redistribute modified versions or offer them as a network service. An Enterprise Edition adds AI-assisted spam filtering via LLM, account archiving, live telemetry, and white-label multi-tenant features.
Stalwart's Community Edition is not feature-limited. No mailbox count limits, no domain limits, no feature gating on core email functionality. You get the full server — DKIM, spam filtering, CalDAV, CardDAV, WebDAV, and JMAP — for free.
## What makes Stalwart different
### One binary, everything included
The single-binary architecture isn't just operationally convenient — it changes what's possible. The same sign-in, the same access controls, the same disk quotas, and the same monitoring cover mail, calendars, contacts, and files. One backup covers all of it; one audit log records all of it.
### JMAP — the modern email protocol
This is the most technically interesting aspect of Stalwart. JMAP (RFC 8620/8621) is the Internet Engineering Task Force's modern replacement for IMAP, standardized in 2019. Where IMAP was designed in 1986 for slow, unreliable connections, JMAP is designed for the modern web: HTTP/2, JSON, push notifications, batch operations, and server-side state tracking.
In practice, JMAP means: the server tells your client when something changes, rather than your client polling every 30 seconds. Mark-read, move, and fetch operations batch into a single HTTP call instead of a multi-round-trip IMAP conversation. Threading is computed server-side, not reassembled on every page load. For a webmail client, JMAP is what makes the interface feel instant rather than sluggish.
### Security built in
Stalwart handles DANE, MTA-STS, and TLS reporting for transport security. TLS certificates renew automatically via ACME. Mailboxes at rest can be encrypted with the user's S/MIME certificate or OpenPGP key, so even an operator with disk access cannot read them. DKIM key rotation is automated — the server generates new keys, publishes them in DNS, and waits for propagation before activating them. No manual key rotation cronjob.
### Built-in spam filtering
A statistical spam classifier with collaborative filtering, DNS blocklist checking, greylisting, spam traps, and sender reputation monitoring ships inside the same binary as the SMTP server. Unwanted mail is scored and rejected before it reaches the mailbox, with no extra daemon to deploy. No separate SpamAssassin or Rspamd process, no milter integration to configure.
### Resource efficiency
A $5/month VPS can handle hundreds of mailboxes with Stalwart, compared to $6/user/month for Google Workspace or $12.50/user/month for Microsoft 365. The 100MB memory footprint means Stalwart fits alongside other services on a modest server — it doesn't need its own dedicated machine.
## Self-hosting Stalwart
Docker Compose is the simplest path. The entire stack is one container:
services:
stalwart-mail:
image: stalwartlabs/mail-server:latest
container_name: stalwart-mail
restart: unless-stopped
ports:
- "25:25" # SMTP
- "587:587" # SMTP submission
- "465:465" # SMTPS
- "143:143" # IMAP
- "993:993" # IMAPS
- "4190:4190" # ManageSieve
- "8080:8080" # Web admin UI
volumes:
- ./data:/opt/stalwart-mail/data
- ./config:/opt/stalwart-mail/etc
On first run, admin credentials are generated and printed to the container logs. Navigate to `http://your-server:8080`, log in, and the web admin UI walks you through the rest: domain setup, DKIM configuration, user creation, and spam filtering rules.
Put Traefik in front for HTTPS on the admin UI (port 8080). Note that the mail ports themselves (25, 587, 465, 143, 993) need direct exposure — they can't go through a standard HTTP reverse proxy.
Before going live: configure your DNS records (MX, SPF, DKIM, DMARC), check that your server's IP isn't on any blacklists (MXToolbox), and ensure your VPS provider allows outbound port 25 — many cloud providers block it by default and require a support ticket to enable.
## What Bulwark is
Bulwark is a modern, self-hosted webmail suite that speaks JMAP natively and pairs with Stalwart. It bundles mail, calendar, contacts, and files behind a single login — the four apps most self-hosters end up wanting together — with a web-based setup wizard, OAuth2/OIDC SSO, and an admin dashboard.
Bulwark is the answer to the webmail problem. Roundcube works, but it looks like 2008 and connects to IMAP — which means it misses everything JMAP enables: push notifications, instant sync, server-side threading. Stalwart's built-in webmail is minimal. Bulwark is what a JMAP-first webmail looks like when built with modern tooling (Next.js, TypeScript, AGPL-3.0).
It has 705+ GitHub stars with active development — last release was June 30, 2026, with 32 releases shipped at a cadence of one every two days.
### Bulwark features
* **Mail** — threaded conversations, unified inbox, full-text search, Sieve filters, S/MIME, templates, multiple identities
* **Calendar** — month, week, day, and agenda views, drag-to-reschedule, recurring events, iMIP invitations, CalDAV subscriptions
* **Contacts** — multiple address books, groups, vCard import/export, composer autocomplete
* **Files** — Stalwart's JMAP FileNode storage with previews and folder upload
* **Setup wizard** — first-launch web UI for JMAP, OAuth, branding, and admin credentials — no .env.local editing
* **Plugin system** — typed extension API for adding buttons, sidebars, keyboard shortcuts, and calendar integrations (Jitsi Meet plugin ships by default)
* **Mobile app** — React Native (Expo) client for iOS and Android with FCM push notifications
### Self-hosting Bulwark
services:
bulwark:
image: ghcr.io/bulwarkmail/webmail:latest
container_name: bulwark
restart: unless-stopped
ports:
- "3000:3000"
volumes:
- ./bulwark-data:/app/data
Navigate to `http://your-server:3000` on first launch — the setup wizard asks for your JMAP server URL (your Stalwart instance), configures OAuth2 against Stalwart, and sets the admin password. No config file editing required. Put Traefik in front for HTTPS and a clean domain like `mail.example.com`.
## The complete stack
Running both together gives you a complete email platform under your own domain:
* **stalw.art** — handles all email protocols (SMTP/IMAP/JMAP), spam filtering, CalDAV/CardDAV, DKIM/DMARC, TLS
* **Bulwark** — modern webmail UI at `mail.example.com` with calendar, contacts, and files
* **Traefik** — HTTPS for the Bulwark webmail interface and Stalwart admin UI
Your users get an email address at your domain, a webmail interface that feels modern, calendar and contacts sync via CalDAV/CardDAV with any standard client (Thunderbird, Apple Mail, Outlook, Android), and mobile apps. All of it runs on a $5-10/month VPS.
## Stalwart vs the alternatives
**vs Mailcow** — Mailcow is the most popular self-hosted email suite and has the largest community. It's a well-maintained Docker Compose stack combining Postfix, Dovecot, Rspamd, SOGo, and Nginx — all the traditional components, packaged together with a polished management UI. Mailcow is more mature with better documentation for common setups. Stalwart wins on resource efficiency (100MB vs 1.5GB+), architectural simplicity (one binary vs 8+ containers), and JMAP support. For a new deployment in 2026, Stalwart is the technically superior choice. For a team that wants the most documented, battle-tested option with a large support community, Mailcow's maturity is worth considering.
**vs Postfix + Dovecot + Rspamd** — the traditional stack has 20+ years of production use, enormous documentation, and the widest possible expertise pool. If you're an experienced sysadmin who knows these tools, they're not going away. Stalwart's advantage is for teams who want email self-hosting without becoming email protocol experts.
**vs Google Workspace / Microsoft 365** — the obvious comparison. At $6-12.50/user/month, a 10-person team pays $720-1,500/year. Stalwart self-hosted on a $6/month VPS: $72/year. The math is compelling, but the operational responsibility is real — you own deliverability, backups, and uptime.
## Honest caveats
Email deliverability is the hard part of self-hosting email, and Stalwart doesn't change this. Getting your emails to land in recipients' inboxes rather than their spam folders requires:
* A clean IP reputation (not previously used for spam)
* Correct SPF, DKIM, and DMARC records
* A valid PTR (reverse DNS) record matching your sending domain
* A VPS provider that allows outbound port 25
Stalwart automates DKIM rotation and makes the DNS setup easier, but it can't help with a bad IP reputation or a provider that blocks port 25. Check MXToolbox before sending to anyone important.
Stalwart is approaching version 1.0 but isn't there yet. The core functionality is feature-complete; the team is now focused on finalizing the database schema and performance optimizations before the 1.0 release. For production use, run regular backups and follow the release notes — schema changes between versions require migration steps.
## Who it's for
**Good fit:**
* Developers, small teams, and agencies who want email under their own domain with full data ownership
* Organizations with GDPR or data sovereignty requirements that rule out Google and Microsoft
* Self-hosters who already run other infrastructure and want email to fit naturally into their stack
* Teams that find Mailcow's resource footprint too heavy for a modest VPS
* Anyone who wants calendar and contacts sync alongside email without a separate Nextcloud deployment
**Not the right fit:**
* Teams who need zero operational responsibility — use Fastmail, Protonmail, or Migadu
* Large organizations needing enterprise-grade support SLAs without the Enterprise Edition
* Deployments where email deliverability is mission-critical from day one — the learning curve for getting deliverability right is real
## My take
Stalwart is the most interesting development in self-hosted email in years. The single-binary architecture doesn't just simplify deployment — it changes the failure surface. Instead of debugging a multi-daemon chain, you're looking at one process with one log. Instead of maintaining compatible versions of half a dozen components, you run one binary and update it. The 100MB RAM footprint means you can add email to a server that's already running a dozen other tools without provisioning dedicated infrastructure.
Bulwark is the piece that makes the full stack compelling rather than just functional. Roundcube on IMAP is fine; Bulwark on JMAP is fast. The distinction matters when your webmail is how you actually read email — push notifications instead of polling, instant thread updates, one-click calendar invites from your email, all running on your own hardware.
The combination puts a complete Google Workspace alternative on your own server: email, calendar, contacts, and file storage, at a fraction of per-seat costs. If you're already running Traefik, Gitea, Plane, and Mattermost on a self-hosted server — and if you've been reading this blog you probably are — adding Stalwart + Bulwark completes the picture.
* * *
PIPOLINE · DEVOPS CONSULTING
### Need help setting up Stalwart + Bulwark?
Getting self-hosted email right — Stalwart deployment, DNS configuration (MX, SPF, DKIM, DMARC), PTR record setup, deliverability verification, Bulwark webmail configuration with OAuth, and Traefik for HTTPS — has more ways to go wrong than almost any other self-hosted service. I can handle the full setup and verify deliverability before you send your first email. You get a working self-hosted email stack without the usual war stories.
Get in touch at pipoline.com →
