[{"data":1,"prerenderedAt":129},["ShallowReactive",2],{"seo-verification":3,"blog-hosting-stalwart-mail-server-on-a-vps-complete-guide-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":12,"excerpt":13,"readTime":14,"views":15,"isPinned":16,"publishedAt":17,"category":18,"categories":23,"featuredImage":25,"bgImage":26,"posterImage":27,"relatedSolution":25,"intro":28,"sections":29,"ctaTitle":83,"ctaBody":84,"ctaButton":85,"ctaUrl":86,"relatedPosts":87},298,"hosting-stalwart-mail-server-on-a-vps-complete-guide",{"fr":10,"en":8,"ar":11},"heberger-stalwart-vps","استضافة-stalwart-mail-server-على-vps-دليل-شامل","Hosting Stalwart Mail Server on a VPS: Complete Guide","Install Stalwart Mail Server on a VPS: a single Go binary for SMTP, IMAP, JMAP and native multi-tenancy to manage multiple client domains without Docker.",10,0,false,"2026-08-24T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":21},11,"Business Email","emails","bg-cyan-500\u002F10 text-cyan-400",[24],{"id":19,"name":20,"slug":21,"color":22,"icon":21},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fheberger-stalwart-vps-poster.svg","A single Go binary — SMTP, IMAP, JMAP, CalDAV, CardDAV and WebAdmin — to operate email for multiple client domains from one VPS, without a multi-container Docker stack. For an agency managing ten separate domains, Mailcow demands heavy resources: at least 6 GB of RAM, multiple containers, complex multi-domain configuration. Stalwart Mail Server takes a different approach: one instance, a statically compiled Go binary, and a native multi-tenant engine that isolates domains and mailboxes without duplicating infrastructure. With around 14,000 stars on GitHub and an active stable release (v0.16.18, August 2026), the project has moved past the experimental stage.",[30,34,45,48,70,73,77,80],{"type":31,"title":32,"body":33},"h2","Why Stalwart for a multi-domain client fleet","Managing email for multiple clients runs into the same obstacle: every popular solution forces either a separate instance per domain or a shared setup with only partial isolation. Stalwart was built from the ground up for multi-tenancy: a domain is a first-class object in its data model, not a configuration variant. Adding a client means creating a domain through the API or the web interface — no binary swap, no container restart, no risk of data bleed between clients.\n\nFor an agency managing 5 to 50 clients, this is the difference between infrastructure that grows linearly (one extra instance per client) and infrastructure that scales flat — one VPS, one instance, N clients.",{"type":35,"title":36,"items":37},"ul","What Stalwart brings in practice",[38,39,40,41,42,43,44],"**Single binary, no Docker required** — one statically compiled Go file, no system dependencies, deployable directly on any Linux distribution.","**Native multi-tenancy** — domains, mailboxes, aliases and quotas managed as objects, with strict data isolation between clients.","**JMAP (RFC 8620) as a first-class protocol** — the modern email synchronisation protocol, alongside classic IMAP4 and POP3.","**Built-in WebAdmin** — HTTPS administration interface on port 8080, no third-party tool to deploy.","**JMAP API for automation** — scriptable domain and account creation, suited to agency client onboarding workflows.","**Native ACME\u002FLet's Encrypt support** — automatic TLS renewal without Certbot or a mandatory reverse proxy.","**AGPL-3.0 licence** — verifiable source code, no proprietary dependency for the community edition.",{"type":31,"title":46,"body":47},"Prerequisites before installation","Stalwart is significantly lighter than Mailcow. For light usage (1 to 5 domains, a few dozen mailboxes), plan for **1 vCPU and 1 GB of RAM**. For a fleet of several dozen active client domains, **2 vCPU and 2 GB of RAM** is the recommended configuration — the figure cited in the official documentation for multi-domain use.\n\nOn the network side, four inbound ports must be open: **25** (SMTP, MX reception), **465** (SMTPS\u002Fsubmission), **993** (IMAPS) and **443** (HTTPS — WebAdmin and JMAP). Port **4190** is needed for Sieve (server-side filters). Your VPS must have a **dedicated IPv4** and a **configured rDNS** pointing to the server hostname — essential for deliverability. Finally, a **domain name** with DNS zone access is required to set MX, SPF, DKIM and DMARC records.",{"type":49,"title":50,"steps":51},"steps","Installing Stalwart Mail Server",[52,55,58,61,64,67],{"title":53,"body":54},"Download the binary","Connect to your VPS via SSH. Download the latest stable release from the official repository:\n\n```bash\ncurl -fsSL https:\u002F\u002Fgithub.com\u002Fstalwartlabs\u002Fstalwart\u002Freleases\u002Flatest\u002Fdownload\u002Fstalwart-linux-x86_64.tar.gz | tar -xz -C \u002Fusr\u002Flocal\u002Fbin\u002F\nchmod +x \u002Fusr\u002Flocal\u002Fbin\u002Fstalwart\n```\n\nFor an ARM server (Ampere, AWS Graviton), replace `x86_64` with `aarch64`.",{"title":56,"body":57},"Run the installation wizard","Stalwart includes an interactive wizard that configures data directories, generates initial TLS certificates and creates the first admin account:\n\n```bash\nsudo stalwart --init\n```\n\nThe wizard asks for the server hostname (e.g. `mail.your-domain.com`), the data path (default `\u002Fopt\u002Fstalwart-mail`), TLS mode (ACME recommended) and the admin password. After init, configuration files are placed in `\u002Fopt\u002Fstalwart-mail\u002Fetc\u002F`.",{"title":59,"body":60},"Create the systemd unit","To make Stalwart start automatically, create the service unit:\n\n```bash\nsudo tee \u002Fetc\u002Fsystemd\u002Fsystem\u002Fstalwart-mail.service \u003C\u003C 'EOF'\n[Unit]\nDescription=Stalwart Mail Server\nAfter=network.target\n\n[Service]\nType=simple\nExecStart=\u002Fusr\u002Flocal\u002Fbin\u002Fstalwart --config \u002Fopt\u002Fstalwart-mail\u002Fetc\u002Fconfig.toml\nRestart=on-failure\nUser=stalwart\n\n[Install]\nWantedBy=multi-user.target\nEOF\nsudo systemctl daemon-reload && sudo systemctl enable --now stalwart-mail\n```\n\nCreate the dedicated user first: `sudo useradd -r -s \u002Fbin\u002Ffalse stalwart && sudo chown -R stalwart \u002Fopt\u002Fstalwart-mail`.",{"title":62,"body":63},"Open ports in the firewall","On Ubuntu\u002FDebian with UFW:\n\n```bash\nsudo ufw allow 25\u002Ftcp comment 'SMTP'\nsudo ufw allow 465\u002Ftcp comment 'SMTPS'\nsudo ufw allow 993\u002Ftcp comment 'IMAPS'\nsudo ufw allow 443\u002Ftcp comment 'HTTPS WebAdmin\u002FJMAP'\nsudo ufw allow 4190\u002Ftcp comment 'Sieve'\nsudo ufw reload\n```\n\nIf your VPS is behind a cloud firewall (Hetzner, OVH…), replicate these rules in the control panel.",{"title":65,"body":66},"Add the first domain via WebAdmin","Open `https:\u002F\u002Fmail.your-domain.com:8080` in your browser and log in with the admin account created in step 2. Under **Management → Domains**, click **Add Domain**, enter `your-domain.com` and confirm. Stalwart automatically generates the DNS records to set (MX, SPF, DKIM, DMARC) and displays them in the interface — copy them into your DNS zone.",{"title":68,"body":69},"Create mailboxes and verify","Under **Management → Accounts**, create a user account and assign it to the domain you added. Test reception with:\n\n```bash\nswaks --to user@your-domain.com --server mail.your-domain.com --port 25\n```\n\nThen test IMAP connectivity from Thunderbird or any mail client — server `mail.your-domain.com`, port 993, SSL\u002FTLS. For an additional client, repeat step 5 with a new domain: no service restart is needed.",{"type":31,"title":71,"body":72},"Post-installation configuration","**Reverse proxy.** If you want to route WebAdmin and JMAP through Nginx (to share port 443 with other services), configure a `stream` block for mail protocols (25, 465, 993) and an HTTPS `server` block for `\u002Fjmap` and WebAdmin. Stalwart also accepts direct connections without a proxy — the choice depends on your architecture.\n\n**Backup.** Stalwart data lives in `\u002Fopt\u002Fstalwart-mail\u002Fdata\u002F`. A daily snapshot of that directory — compressed and transferred off-site — is sufficient for a full restore. With the `{{vps.power.name}}` plan from ServOrbit, weekly backups are included; enable daily backups for an RPO suited to email workloads.\n\n**Additional domains.** Each client domain is added through the WebAdmin or the JMAP API. The `stalwart` binary also exposes a CLI subcommand for batch operations — useful for automated onboarding of new clients.",{"type":74,"title":75,"body":76},"tip","Hardening: restrict WebAdmin access","WebAdmin listens on `0.0.0.0:8080` by default. In production, restrict access to your admin IPs:\n\n```bash\nsudo ufw deny 8080\nsudo ufw allow from \u003Cyour-admin-ip> to any port 8080\n```\n\nAlso enable two-factor authentication (TOTP) for the admin account under **Security → Authentication** in WebAdmin. For remote access over an untrusted network, prefer an SSH tunnel rather than exposing port 8080 directly.",{"type":31,"title":78,"body":79},"Troubleshooting common errors","**`Literal exceeds the maximum request size of X bytes`** (IMAP). This message appears when Thunderbird or an IMAP client attempts to upload a large attachment via the APPEND command. Stalwart drops the connection, then the client parses the remaining data stream as IMAP commands. Raise the limit in `\u002Fopt\u002Fstalwart-mail\u002Fetc\u002Fconfig.toml` at the `imap.request.max-size` key and restart the service.\n\n**DKIM record rejected by registrar.** If your DNS provider (Vultr, some registrars) fails to create the DKIM RSA key because it exceeds 255 characters, split it into two quoted segments in the TXT value: `\"v=DKIM1; k=rsa; p=MIIBIj...\" \"AQAB...\"`. Stalwart concatenates them on read.\n\n**Punycode domain rejected at creation.** Versions before v0.16 rejected internationalised domains already encoded as A-labels (e.g. `xn--mysite-o2a.com`). Enter the domain in Unicode (`mysité.com`) and let Stalwart handle the conversion.\n\n**Service fails to start after upgrade.** Check that your configuration file is compatible with the new version: `stalwart --check-config \u002Fopt\u002Fstalwart-mail\u002Fetc\u002Fconfig.toml`. Configuration schema migrations are documented in the release notes on GitHub.\n\n**IMAP connections refused from a mobile client.** Verify that the TLS certificate is valid and not expired (`openssl s_client -connect mail.your-domain.com:993`) and that port 993 is open in both UFW and the VPS network firewall.",{"type":31,"title":81,"body":82},"Going further","Stalwart covers mail infrastructure — reception, sending and storage. For your emails to land in the inbox rather than spam, SPF, DKIM and DMARC records must be correctly set and tested: see \u003Ca href=\"\u002Fblog\u002Fspf-dkim-dmarc-delivrabilite-emails-pro\">our guide on professional email deliverability\u003C\u002Fa>.\n\nIf your cPanel fleet sends transactional email (order confirmations, alerts) and you want to centralise outbound without moving mailboxes, \u003Ca href=\"\u002Fblog\u002Fsmtp-relay-vps-emails-transactionnels-clients\">the Postfix SMTP relay guide\u003C\u002Fa> covers that complementary architecture. For agencies migrating a client portfolio from Google Workspace or Microsoft 365 to self-hosted servers, \u003Ca href=\"\u002Fblog\u002Fheberger-serveur-email-vps-mailcow\">the Mailcow article\u003C\u002Fa> details IMAP migration steps.","A VPS for your multi-client mail server","A `{{vps.power.name}}` VPS (2 vCPU \u002F 2 GB RAM) handles a fleet of several dozen client domains with Stalwart — root access, OS choice, dedicated IPv4 included.","View VPS Cloud plans","\u002Fvps-cloud",[88,102,116],{"id":89,"slug":90,"slugs":91,"title":94,"excerpt":95,"readTime":19,"views":96,"isPinned":16,"publishedAt":97,"category":98,"categories":99,"featuredImage":25,"bgImage":26,"posterImage":101,"relatedSolution":25},238,"hosting-your-own-email-server-on-a-vps-with-mailcow",{"fr":92,"en":90,"ar":93},"heberger-serveur-email-vps-mailcow","استضافة-خادم-البريد-الإلكتروني-على-vps-باستخدام-mailcow","Hosting Your Own Email Server on a VPS with Mailcow","Deploy Mailcow on a Linux VPS to run your own sovereign email server: installation, deliverability and migration from Google Workspace.",1,"2026-08-08T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":21},[100],{"id":19,"name":20,"slug":21,"color":22,"icon":21},"\u002Fblog\u002Fcovers\u002Fheberger-serveur-email-vps-mailcow-poster.svg",{"id":103,"slug":104,"slugs":105,"title":108,"excerpt":109,"readTime":110,"views":15,"isPinned":16,"publishedAt":111,"category":112,"categories":113,"featuredImage":25,"bgImage":26,"posterImage":115,"relatedSolution":25},199,"spf-dkim-dmarc-passing-the-5000-email-threshold",{"fr":106,"en":104,"ar":107},"spf-dkim-dmarc-delivrabilite-emails-pro","spf-وdkim-وdmarc-تجاوز-عتبة-5000-رسالة","SPF, DKIM, DMARC: passing the 5,000-email threshold","Gmail and Outlook reject senders without aligned SPF, DKIM and DMARC with an SMTP 550 error. Here is how to configure all three records.",4,"2026-08-01T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":21},[114],{"id":19,"name":20,"slug":21,"color":22,"icon":21},"\u002Fblog\u002Fcovers\u002Fspf-dkim-dmarc-delivrabilite-emails-pro-poster.svg",{"id":117,"slug":118,"slugs":119,"title":122,"excerpt":123,"readTime":14,"views":15,"isPinned":16,"publishedAt":124,"category":125,"categories":126,"featuredImage":25,"bgImage":26,"posterImage":128,"relatedSolution":25},280,"postfix-smtp-relay-on-vps-client-transactional-emails",{"fr":120,"en":118,"ar":121},"smtp-relay-vps-emails-transactionnels-clients","إعداد-postfix-smtp-relay-على-vps-لبريد-المواقع","Postfix SMTP Relay on VPS: Client Transactional Emails","Set up Postfix as an SMTP relay on a ServOrbit VPS: dedicated IPv4, SPF, DKIM and DMARC aligned for your entire cPanel client portfolio in under an hour.","2026-08-18T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":21},[127],{"id":19,"name":20,"slug":21,"color":22,"icon":21},"\u002Fblog\u002Fcovers\u002Fsmtp-relay-vps-emails-transactionnels-clients-poster.svg",1787661797176]