[{"data":1,"prerenderedAt":168},["ShallowReactive",2],{"seo-verification":3,"blog-stalwart-mail-server-smtp-imap-and-jmap-in-a-single-rust-binary-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":13,"excerpt":14,"readTime":15,"views":16,"isPinned":17,"publishedAt":18,"category":19,"categories":24,"featuredImage":26,"bgImage":27,"posterImage":28,"relatedSolution":26,"intro":29,"sections":30,"ctaTitle":129,"ctaBody":130,"ctaButton":131,"ctaUrl":132,"relatedPosts":133},327,"stalwart-mail-server-smtp-imap-and-jmap-in-a-single-rust-binary",{"fr":10,"en":8,"ar":11,"es":12},"stalwart-mail-server-vps","stalwart-mail-server-على-vps-خادم-بريد-متكامل-بلغة-rust","stalwart-mail-server-smtp-imap-y-jmap-en-un-unico-binario-rust","Stalwart Mail Server: SMTP, IMAP and JMAP in a single Rust binary","Deploy Stalwart Mail Server on a VPS: full email server in Rust, native SPF\u002FDKIM\u002FDMARC, single binary without a complex multi-container Docker stack.",8,0,false,"2026-09-04T00:00:00+00:00",{"id":20,"name":21,"slug":22,"color":23,"icon":22},11,"Business Email","emails","bg-cyan-500\u002F10 text-cyan-400",[25],{"id":20,"name":21,"slug":22,"color":23,"icon":22},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fstalwart-mail-server-vps-poster.svg","Stalwart Mail Server is an AGPL-3.0 email server written in Rust that combines SMTP, IMAP, JMAP, ManageSieve and a WebAdmin interface in a single binary. Since November 2025, Gmail has been strictly rejecting emails that do not comply with SPF\u002FDKIM\u002FDMARC — and Microsoft Outlook since May 2025. On a dedicated VPS with a clean IP and ports 25, 465, 587 and 993 open, Stalwart covers all these requirements natively.",[31,35,45,48,58,61,83,87,123,126],{"type":32,"title":33,"body":34},"h2","Why a self-hosted email server on VPS in 2026","Major email providers — Gmail and Outlook foremost — have tightened their authentication rules. Gmail activated strict rejection of non-compliant senders in November 2025; Microsoft Outlook followed in May 2025 for volumes exceeding 5,000 messages per day. An email sent without properly configured SPF, DKIM and DMARC now ends up in spam or bounces.\n\nFor agencies and developers managing multiple client domains, a self-hosted email server on a VPS offers a concrete advantage: centralised infrastructure, controlled IP reputation, and full control over DNS authentication records. The cost of a degraded IP reputation — weeks of warm-up, or even a blacklist — justifies investing in a rigorous configuration from the very first send.",{"type":36,"title":37,"items":38},"ul","What Stalwart brings compared to a classic stack",[39,40,41,42,43,44],"**Single binary**: SMTP, IMAP4, POP3, JMAP, ManageSieve and WebAdmin in a single process — no multi-container Docker Compose to orchestrate.","**Written in Rust**: memory safety by design, low RAM footprint, fast startup.","**SPF, DKIM and DMARC built in**: inbound verification and outbound signing configurable from the WebAdmin interface, without third-party plugins.","**JMAP**: modern protocol that reduces client latency compared to IMAP alone — supported natively by Stalwart.","**AGPL-3.0**: auditable code, no dependency on a proprietary cloud service.","**Integrated WebAdmin**: manage domains, accounts, filtering rules and DMARC reports from a browser.",{"type":32,"title":46,"body":47},"Prerequisites before you start","Stalwart runs on any 64-bit Linux VPS. For stable production use, plan for **at least 2 vCPU and 2 GB of RAM** — the binary itself is lightweight, but SMTP queue management and IMAP indexing consume memory under load.\n\nTwo blocking points to check before installation:\n\n**Port 25 must be open outbound.** Many hosting providers block this port on entry-level VPS plans to limit spam. Verify with your provider that outbound port 25 is unblocked — without it, Stalwart can receive mail but cannot send to other servers.\n\n**The VPS IP must have a correct PTR (reverse DNS record).** A missing or inconsistent PTR is one of the primary causes of rejection by major email providers. Most VPS hosting providers allow you to set this PTR from their control panel.",{"type":36,"title":49,"items":50},"Prerequisites checklist",[51,52,53,54,55,56,57],"64-bit Linux VPS (Debian 12 or Ubuntu 22.04 recommended), minimum 2 vCPU \u002F 2 GB RAM.","Dedicated IP — never a shared IP for a production email server.","PTR DNS configured on the VPS IP: must match the mail server hostname.","Outbound port 25 unblocked by the hosting provider (verify before ordering).","Ports 465 (SMTPS), 587 (submission), 993 (IMAPS) and 143 (IMAP) open in the firewall.","A domain name with access to DNS record management (adding TXT records for SPF, DKIM, DMARC).","A valid TLS certificate — Let's Encrypt via ACME is natively supported by Stalwart.",{"type":32,"title":59,"body":60},"Installing Stalwart on a VPS","Stalwart provides an official installation script that downloads the precompiled binary, creates a dedicated system user, installs a systemd service and guides the initial configuration in interactive mode.",{"type":62,"title":63,"steps":64},"steps","Step-by-step deployment",[65,68,71,74,77,80],{"title":66,"body":67},"Download and run the installation script","Connect to the VPS as root or with `sudo`, then run the official script:\n\n```bash\ncurl -fsSL https:\u002F\u002Fget.stalw.art\u002Finstall.sh | sudo bash\n```\n\nThe script detects the architecture, downloads the binary for the latest stable release (v0.16.19 at the time of writing), creates the `stalwart-mail` user, installs the binary to `\u002Fusr\u002Flocal\u002Fbin\u002Fstalwart-mail` and generates the initial configuration in `\u002Fetc\u002Fstalwart\u002F`.",{"title":69,"body":70},"Configure the domain and SMTP settings","The script launches an interactive assistant. Enter the primary domain name (`mail.yourdomain.com`), the sending domain and the mailbox storage path. The configuration is written in TOML to `\u002Fetc\u002Fstalwart\u002Fconfig.toml`.\n\nTo enable Let's Encrypt, make sure port 443 is accessible and that the DNS record `mail.yourdomain.com` points to the VPS IP before running the script.",{"title":72,"body":73},"Start the service and check the logs","```bash\nsudo systemctl enable --now stalwart-mail\nsudo systemctl status stalwart-mail\njournalctl -u stalwart-mail -f\n```\n\nThe service listens on the configured ports. The logs indicate whether the TLS certificate was obtained and whether the SMTP and IMAP sockets are active.",{"title":75,"body":76},"Configure SPF, DKIM and DMARC in DNS","Log in to the WebAdmin (port 8080 by default, to be protected behind a reverse proxy or IP allowlist) and navigate to **Management → Domains**.\n\nStalwart generates the DKIM key and displays the DNS records to add. Publish in the DNS manager:\n\n```bash\n# SPF — authorise the VPS to send for the domain\nyourdomain.com. TXT \"v=spf1 mx a:mail.yourdomain.com ~all\"\n\n# DKIM — public key generated by Stalwart (value shown in WebAdmin)\ndefault._domainkey.yourdomain.com. TXT \"v=DKIM1; k=rsa; p=\u003Cpublic key>\"\n\n# DMARC — rejection policy with report address\n_dmarc.yourdomain.com. TXT \"v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com\"\n```\n\nStart with `p=none` (monitoring mode) for 48 to 72 hours, analyse the aggregate reports, then move to `p=quarantine` and then `p=reject`.",{"title":78,"body":79},"Create the first accounts and test sending","In the WebAdmin, create a domain and its associated user accounts. Test sending with `swaks` from the VPS:\n\n```bash\nswaks --to test@gmail.com --from contact@yourdomain.com \\\n  --server mail.yourdomain.com --port 587 \\\n  --auth LOGIN --auth-user contact@yourdomain.com\n```\n\nCheck the received message and its `Authentication-Results` header — it should show `spf=pass`, `dkim=pass` and `dmarc=pass`.",{"title":81,"body":82},"Protect the WebAdmin and harden the firewall","The WebAdmin must not be publicly exposed. Two options: restrict it to a management IP in the Stalwart configuration, or put it behind an nginx reverse proxy with basic authentication.\n\nOn the firewall side, only allow strictly necessary ports:\n\n```bash\n# Example with ufw\nufw allow 25\u002Ftcp    # Inbound SMTP\nufw allow 465\u002Ftcp   # SMTPS\nufw allow 587\u002Ftcp   # Submission\nufw allow 993\u002Ftcp   # IMAPS\nufw allow 143\u002Ftcp   # IMAP (if required)\nufw deny 8080\u002Ftcp   # WebAdmin — restricted access, not public\n```\n\nRefer to the Linux VPS hardening article for the complete firewall configuration and SSH key management.",{"type":84,"title":85,"body":86},"tip","IP reputation: the most overlooked factor","A technically perfect installation is not enough if the VPS IP is already listed in a negative reputation database (Spamhaus, Barracuda, SORBS). Before going live, check the IP on \u003Ca href=\"https:\u002F\u002Fmxtoolbox.com\u002Fblacklists.aspx\">MXToolbox Blacklists\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fcheck.spamhaus.org\u002F\">Spamhaus Checker\u003C\u002Fa>. If the IP is listed, open a delisting request with each database — a process that takes between 24 hours and two weeks depending on the list. Requesting a fresh IP from the hosting provider is sometimes faster.",{"type":88,"title":89,"headers":90,"rows":94},"comparison","Stalwart vs Mailcow: two approaches to self-hosted email",[91,92,93],"Criterion","Stalwart Mail Server","Mailcow",[95,99,103,107,111,115,119],[96,97,98],"Architecture","Single Rust binary (one process)","Multi-container Docker stack (Postfix, Dovecot, Rspamd, SOGo...)",[100,101,102],"Protocols","SMTP, IMAP4, POP3, JMAP, ManageSieve, CalDAV, CardDAV","SMTP, IMAP4, POP3, ManageSieve, CalDAV, CardDAV",[104,105,106],"Recommended minimum RAM","2 GB in production","4 to 6 GB recommended (multiple containers)",[108,109,110],"SPF\u002FDKIM\u002FDMARC","Built into the binary natively","Via Rspamd and OpenDKIM (separate configuration)",[112,113,114],"Admin interface","Integrated WebAdmin (HTTP, REST API)","SOGo + dedicated Mailcow interface",[116,117,118],"Licence","AGPL-3.0","MIT (but dependencies under various licences)",[120,121,122],"Maturity","Stable, v0.16.x, pre-1.0","Mature, deployed in production since 2016",{"type":32,"title":124,"body":125},"Common pitfalls to avoid","**Missing or inconsistent PTR.** This is the most frequent cause of silent rejection by Gmail and Outlook. The PTR must resolve to the hostname used in the SMTP `EHLO`, which must itself match the sending domain. Check with `dig -x \u003CVPS-IP>`.\n\n**Port 25 blocked by the hosting provider.** Some VPS providers block outbound port 25 by default to contain spam. Stalwart can still receive mail, but sending to external servers fails. Checking beforehand avoids discovering this block after installation.\n\n**Moving to `p=reject` on DMARC too quickly.** A restrictive DMARC policy applied without a prior monitoring period can block legitimate flows (newsletters, contact forms) if SPF or DKIM does not cover all sending paths. The first 48 to 72 hours in `p=none` with aggregate reports are essential.\n\n**Neglecting IP warm-up.** A fresh IP that suddenly sends hundreds of messages per day is flagged as suspicious by spam filters. Gradually increase volume over one to two weeks, starting with the most engaged recipients.",{"type":32,"title":127,"body":128},"Updates and maintenance","Stalwart publishes regular updates on its GitHub repository. v0.16.19 (August 2026) is the current stable version — the project targets v1.0 after finalising the database schema and performance optimisations.\n\nTo update the binary:\n\n```bash\nsudo systemctl stop stalwart-mail\nsudo curl -fsSL https:\u002F\u002Fget.stalw.art\u002Finstall.sh | sudo bash\nsudo systemctl start stalwart-mail\n```\n\nConfiguration files in `\u002Fetc\u002Fstalwart\u002F` and data in the storage directory are not overwritten by the update script. Keep a backup of your DKIM keys before any operation — losing the private DKIM key forces DNS record rotation and a propagation period.\n\nFollow releases at \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fstalwartlabs\u002Fstalwart\u002Freleases\">github.com\u002Fstalwartlabs\u002Fstalwart\u002Freleases\u003C\u002Fa> to be notified of security patches.","Deploy your email infrastructure on a VPS","Agencies managing multiple clients centralise their email infrastructure on a VPS rather than multiplying professional email accounts. ServOrbit offers VPS administration for the installation, configuration and ongoing maintenance of a Stalwart server in production.","View agency solutions","\u002Fsolutions\u002Fagences",[134,150],{"id":135,"slug":136,"slugs":137,"title":141,"excerpt":142,"readTime":143,"views":144,"isPinned":17,"publishedAt":145,"category":146,"categories":147,"featuredImage":26,"bgImage":27,"posterImage":149,"relatedSolution":26},238,"hosting-your-own-email-server-on-a-vps-with-mailcow",{"fr":138,"en":136,"ar":139,"es":140},"heberger-serveur-email-vps-mailcow","استضافة-خادم-البريد-الإلكتروني-على-vps-باستخدام-mailcow","alojar-servidor-correo-vps-mailcow","Hosting Your Own Email Server on a VPS with Mailcow","Deploy Mailcow on a Linux VPS to run your own sovereign email server: installation, deliverability and migration from Google Workspace.",13,1,"2026-08-08T00:00:00+00:00",{"id":20,"name":21,"slug":22,"color":23,"icon":22},[148],{"id":20,"name":21,"slug":22,"color":23,"icon":22},"\u002Fblog\u002Fcovers\u002Fheberger-serveur-email-vps-mailcow-poster.svg",{"id":151,"slug":152,"slugs":153,"title":157,"excerpt":158,"readTime":20,"views":144,"isPinned":17,"publishedAt":159,"category":160,"categories":165,"featuredImage":26,"bgImage":27,"posterImage":167,"relatedSolution":26},317,"linux-vps-hardening-checklist-for-agencies",{"fr":154,"en":152,"ar":155,"es":156},"linux-hardening-vps-checklist","قائمة-تصليب-خادم-لينكس-للوكالات-بعد-التسليم","hardening-linux-vps-checklist-para-agencias-tras-la-entrega","Linux VPS Hardening Checklist for Agencies","Reproducible Linux hardening checklist for agencies: auditd, sudo user, SSH key auth, UFW, fail2ban and root lockout — with per-client traceability.","2026-08-30T00:00:00+00:00",{"id":15,"name":161,"slug":162,"color":163,"icon":164},"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[166],{"id":15,"name":161,"slug":162,"color":163,"icon":164},"\u002Fblog\u002Fcovers\u002Flinux-hardening-vps-checklist-poster.svg",1788538500060]