Stalwart

Open source alternative to Microsoft 365, Google Workspace and Proton Mail Business

15.7K stars
AGPL-3.0
Active this week
Last commit 1 day ago

Last verified Nov 5, 2026

Host your own mail and collaboration server with JMAP, IMAP, SMTP, CalDAV, and CardDAV in a single Rust binary with built-in spam filtering.

Visit website GitHub15.7K Deploy on Hostinger

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who Stalwart is for#

Privacy-focused teams self-hosting email and calendars

Organizations that need mail and calendar data on infrastructure they own, with per-mailbox encryption so the host cannot read contents. Stalwart's OpenPGP and S/MIME encryption-at-rest setup satisfies data-residency and confidentiality requirements without depending on a third-party provider's privacy promises.

Skip if:

Your team is comfortable with a managed provider and has no data-residency or audit requirements. Self-hosting adds an operational burden: you manage TLS renewals, backups, and deliverability.

Small to mid-sized organizations replacing a fragmented mail stack

Teams currently running Postfix, Dovecot, and a separate spam filter gain operational simplicity by moving to one binary, one configuration, one admin panel, and one backup covering mail, calendars, contacts, and files. The same identity layer handles authentication for every collaboration surface.

Skip if:

Your organization is already on Microsoft 365 or Google Workspace and your IT team has no appetite for self-managed infrastructure. The per-seat cost of commercial mail services may be lower than the operational time required to run your own mail server.

ISPs and hosting providers building multi-tenant mail services

Stalwart's enterprise edition adds multi-tenancy with domain and tenant isolation, plus SCIM provisioning for automated user management. The clustering model (any node serves any protocol, horizontal scaling by adding nodes) fits a mail hosting service's deployment pattern.

Skip if:

You need multi-tenancy but are not prepared to subscribe to the enterprise edition. The community edition has no multi-tenancy support; running multiple domains for separate organizations requires separate instances.

Developers building JMAP-native email applications

JMAP delivers real-time email sync over HTTP with push notifications, without polling. Stalwart implements the full JMAP specification including extensions for Calendars, Contacts, and File Storage, giving developers a local test target for JMAP client development without the constraints of a hosted API.

Skip if:

Your client only needs IMAP. Any modern IMAP server works; JMAP is worth the complexity only if your app needs push sync or the richer JMAP data model.

the problem

The problem it solves#

Running self-hosted email used to mean stitching together a half-dozen separate services: a mail transfer agent, a message store, a spam filter, a calendar server, a contacts server, and a file sharing component. Each one ships with its own configuration format, upgrade cycle, and failure mode. Getting all of them to authenticate against the same directory, share the same TLS certificates, and feed into a single admin view is weeks of integration work before the first user can log in.

The situation compounds at scale. Adding high availability means replicating each component separately, often with incompatible clustering approaches. Deliverability tuning (DMARC, DKIM rotation, reputation management) lives in one system while the spam filter lives in another. When something breaks in the pipeline, the failure can originate in any of those five or six services, and tracing it means correlating logs across all of them.

how Stalwart solves it

How it solves it#

JMAP and IMAP4 email server in one binary

Serves JMAP for instant multi-device sync, IMAP4rev2 and IMAP4rev1 for every existing client, POP3, and SMTP with DMARC, DKIM, SPF, and ARC authentication in a single process. No separate MTA, relay, or message store to configure.

Built-in calendars, contacts, and file storage

CalDAV and CardDAV serve existing desktop and mobile clients, with JMAP equivalents for new apps. File storage and sharing over WebDAV and JMAP for File Storage. All collaboration surfaces share one identity layer, one set of access controls, one disk quota, and one backup target.

Anti-spam filter built into the SMTP server

A statistical classifier, DNS blocklists, sender reputation tracking, greylisting, and optional AI-driven analysis (OpenAI-compatible, Anthropic, Gemini, Ollama) run inside the same process as the SMTP server. Unwanted mail is scored and rejected at SMTP time before reaching the mailbox, with no extra daemon to deploy.

Per-mailbox encryption at rest

Each mailbox can be encrypted with the user's own OpenPGP key or S/MIME certificate, so even an operator with direct disk access cannot read its contents. An outgoing encryption gateway discovers recipient keys automatically over WKD, keyservers, and DNSSEC. Post-quantum ML-KEM keys are supported for both OpenPGP (RFC 9980) and S/MIME (RFC 9936).

Pluggable storage and authentication backends

Data store: RocksDB, FoundationDB, PostgreSQL, MySQL, SQLite. Blob store: S3-compatible storage, Azure Blob. Full-text search: built-in (17 languages) or Meilisearch, ElasticSearch, OpenSearch. Auth: LDAP, OIDC, SQL, or built-in with 2FA-TOTP and app passwords.

Cluster scaling without an external coordinator

Any node in the cluster can serve any protocol. Peer-to-peer coordination via Zenoh requires no external service; coordinator-based mode supports Kafka, Redpanda, NATS, or Redis. Kubernetes, Docker Swarm, and Apache Mesos orchestration are supported for automated scaling.

strengths · trade-offs

Strengths and trade-offs#

Strengths

Single binary covers the full mail and collaboration stackJMAP, IMAP, POP3, SMTP, CalDAV, CardDAV, WebDAV, spam filtering, and TLS all run in one process with one configuration file. Organizations that previously ran Postfix, Dovecot, Rspamd, Radicale, and Nextcloud separately eliminate those integration points. Fewer services means fewer upgrade paths, fewer failure modes, and one place to look when something needs attention.
Operator-transparent encryption at restPer-mailbox OpenPGP and S/MIME encryption means the server operator cannot read user mail at rest without the user's private key. Post-quantum ML-KEM support (RFC 9980 for OpenPGP, RFC 9936 for S/MIME) is ahead of most commercial mail services. Proton Mail Business offers a similar promise but only on its closed hosted infrastructure.
Independently security-audited Rust implementationWritten in memory-safe Rust, which eliminates entire classes of buffer-overflow and use-after-free vulnerabilities common in C-based mail servers like Postfix. The project publishes an independent security audit at stalw.art/blog/security-audit and targets a new audit each time a large section of code is rewritten.
Full JMAP support, including calendars and contactsJMAP (RFC 8621) delivers real-time push-based email sync. Stalwart implements the full spec including JMAP for Calendars, JMAP for Contacts, and JMAP for File Storage. Very few self-hosted mail servers implement JMAP at all; none implement the full collaboration extension set.

Trade-offs

-Enterprise features require a paid SELv2 subscriptionAbout 15% of Stalwart's features (multi-tenancy, SCIM provisioning, sharded storage, and live telemetry) are covered by the Stalwart Enterprise License v2 (SELv2) rather than AGPL-3.0. SELv2 allows self-hosting and internal commercial use but forbids redistributing Stalwart as a managed or hosted service to third parties. Organizations running only community edition features are unaffected.
-Self-managed deliverability and DNSRunning your own outbound mail means you own your IP reputation, DKIM rotation, and postmaster inbox. Stalwart automates DKIM key rotation and DNS record updates on Cloudflare, Route53, and Google Cloud DNS, but setting up PTR records and warming a new sending IP still requires manual operator work. Teams without experience managing outbound email deliverability should budget time for this.
-39 open issues in the tracker as of November 2026The issue tracker shows 39 open issues. The project ships at least weekly releases and addresses security reports within 24 hours, so the count reflects active development rather than stagnation. New adopters should review open issues that touch their chosen storage backend or protocol clients before deploying.

versus alternatives

Stalwart vs alternatives#

Stalwart vs Microsoft 365

Microsoft 365 bundles Exchange Online with a broader suite of enterprise applications (Teams, SharePoint, OneDrive, Office apps). The overlap with Stalwart is mail, calendar, and contacts; Microsoft 365 also includes productivity apps that Stalwart does not replace.

Feature	Stalwart	Microsoft 365
License	AGPL-3.0 (community) / SELv2 (enterprise)	Proprietary
Self-hosting	Yes	No
Data residency	Your own servers	Microsoft data centers
JMAP	Yes (full RFC 8621)	No
Encryption at rest	Per-mailbox, operator-transparent	At-rest encryption, operator-managed keys optional
Spam filtering	Built-in, no extra service	Exchange Online Protection (included)

Stalwart is the better choice when your organization needs data on its own infrastructure, wants per-mailbox encryption where the operator cannot read contents, or is migrating away from per-seat SaaS costs. Microsoft 365 is worth keeping when your team depends on the broader productivity suite (Office apps, Teams video calling, SharePoint) that Stalwart does not provide.

Stalwart vs Google Workspace

Google Workspace offers Gmail, Google Calendar, Google Drive, and Meet as a hosted service. The email and calendar layers overlap with Stalwart directly.

Feature	Stalwart	Google Workspace
License	AGPL-3.0 (community) / SELv2 (enterprise)	Proprietary
Self-hosting	Yes	No
Encryption at rest	Per-mailbox with user's own key	Google-managed encryption
CalDAV/CardDAV	Yes	Yes (read-only CardDAV)

Stalwart is the better fit for organizations with data-residency requirements, privacy policies that prohibit a cloud provider from scanning messages, or teams that have already self-hosted other infrastructure. Google Workspace is still the stronger choice when tightly integrated Google apps (Docs, Sheets, Meet) are central to the team's workflow and replacing them is out of scope.

Stalwart vs Proton Mail Business

Proton Mail Business provides encrypted hosted email with a focus on privacy. Both offer end-to-end encryption and privacy guarantees, but their deployment models differ.

Feature	Stalwart	Proton Mail Business
License	AGPL-3.0 (community) / SELv2 (enterprise)	Proprietary
Hosting model	Self-hosted on your servers	Hosted by Proton AG
Encryption at rest	Per-mailbox, operator-transparent	Zero-access encryption
CalDAV	Yes	Yes (Proton Calendar)

Stalwart gives you a Proton-style encryption model with the data physically on your own servers. For organizations that need their mail server inside their own network perimeter, that is a meaningful difference. Proton Mail Business is simpler to operate: no server to maintain, no TLS renewals to watch, no deliverability to manage. Teams without a dedicated server admin will find Proton Mail Business lower-friction than a self-hosted alternative.

install · quick start

Quick start#

bash

Download the pre-built Stalwart binary or container image for Linux, macOS, Windows, or FreeBSD from GitHub Releases: https://github.com/stalwartlabs/stalwart/releases/latest

tech stack · detected from GitHub

What it's built on#

Languages: PythonRust
Cache: Redis

frequently asked

FAQ#

Is Stalwart free for commercial use?

The community edition is AGPL-3.0 licensed and free for all use, including commercial. AGPL-3.0 requires that you share modifications if you run a modified version as a network service. The enterprise edition (multi-tenancy, SCIM provisioning, sharded storage, and live telemetry) requires a paid subscription under the Stalwart Enterprise License v2 (SELv2). SELv2 permits self-hosting and internal commercial use but forbids redistributing Stalwart as a managed or hosted service to third parties.

How does Stalwart handle spam without a separate daemon?

Spam filtering runs inside the same process as the SMTP server. It combines a statistical classifier with automatic training, DNS blocklists (covering IP addresses, domains, URLs, and hashes), sender reputation by IP, ASN, domain and email, greylisting, trusted-reply tracking, and optional LLM-driven analysis. Scoring and rejection happen at SMTP time before the message reaches the mailbox, with no separate Rspamd or SpamAssassin instance to deploy.

What storage backends does Stalwart support?

For structured data: RocksDB (default), FoundationDB, PostgreSQL, MySQL, and SQLite. For blob storage: S3-compatible object stores and Azure Blob Storage. For full-text search: a built-in engine covering 17 languages, or external backends including Meilisearch, ElasticSearch, OpenSearch, and PostgreSQL. Redis or Valkey can serve as the in-memory data store. You pick the combination that matches your existing infrastructure.

Can Stalwart scale beyond a single node?

Yes. The clustering design is peer-to-peer by default using Zenoh: any node can serve any protocol, no external coordinator is required, and you add capacity by adding nodes. For coordinator-based clustering Stalwart supports Apache Kafka, Redpanda, NATS, and Redis. Kubernetes, Docker Swarm, and Apache Mesos orchestration are documented. The enterprise edition adds sharded blob storage for the highest-throughput setups.

Does Stalwart require the enterprise edition for self-hosting?

No. The community edition under AGPL-3.0 covers the full protocol set (JMAP, IMAP, POP3, SMTP, CalDAV, CardDAV, WebDAV), spam filtering, encryption at rest, automatic TLS, authentication via LDAP/OIDC/SQL, clustering, and the web admin panel. The enterprise edition adds features mainly useful at scale or for managed hosting: multi-tenancy, SCIM provisioning, sharded storage, and live telemetry. About 85% of the codebase ships under the community edition license.

also worth a look

Similar open-source tools#

Docker Mailserver

Alternative toGoogle Workspace

Postfix/Dovecot mail server in Docker, configured with plain files.

19,715 GitHub stars
Licence MIT

Galae Email

Alternative toZoho Mail

Self-hosted email server stack forked from Mailcow

9 GitHub stars
Licence GPL-3.0

OpenCloud

Alternative toBox

File sync for organizations with data sovereignty and S3 storage

6,269 GitHub stars
Licence Apache-2.0

LibreOffice

Alternative toMicrosoft 365

Free office suite with Writer, Calc, and Impress on any platform

4,596 GitHub stars
Licence GPL-3.0

Mailflare

Alternative toFastmail

Self-hosted email inbox for custom domains on Cloudflare

5,552 GitHub stars
Licence AGPL-3.0

Mattermost

Alternative toSlack

Team messaging for security-sensitive teams with air-gap support

39,524 GitHub stars

by category

Open source tools in these categories#

154

Self-host Stalwart on a Hostinger VPS

Keep it running 24/7, even when your laptop is off. A Hostinger VPS gives it a server of its own.

01
Choose a plan
Starts from $6.49/mo
02
Apply
Extra 10% off yearly plans
03
Install Stalwart
On a server that stays on
04
Start building
Focus on the app, not the server

Deploy on Hostinger

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

12,889 GitHub stars
Licence AGPL-3.0
#Email

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

7,028 GitHub stars
Licence Apache-2.0
#AI Agents

SnitchFeed

Live monitoring on LinkedIn, X, Reddit & more. Agentic social listening for startups.

Marketing & Growth

Advertise your product

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

Stalwart vs Microsoft 365

Feature	Stalwart	Microsoft 365
License	AGPL-3.0 (community) / SELv2 (enterprise)	Proprietary
Self-hosting	Yes	No
Data residency	Your own servers	Microsoft data centers
JMAP	Yes (full RFC 8621)	No
Encryption at rest	Per-mailbox, operator-transparent	At-rest encryption, operator-managed keys optional
Spam filtering	Built-in, no extra service	Exchange Online Protection (included)

Stalwart vs Google Workspace

Google Workspace offers Gmail, Google Calendar, Google Drive, and Meet as a hosted service. The email and calendar layers overlap with Stalwart directly.

Feature	Stalwart	Google Workspace
License	AGPL-3.0 (community) / SELv2 (enterprise)	Proprietary
Self-hosting	Yes	No
Encryption at rest	Per-mailbox with user's own key	Google-managed encryption
CalDAV/CardDAV	Yes	Yes (read-only CardDAV)

Stalwart vs Proton Mail Business

Proton Mail Business provides encrypted hosted email with a focus on privacy. Both offer end-to-end encryption and privacy guarantees, but their deployment models differ.

Feature	Stalwart	Proton Mail Business
License	AGPL-3.0 (community) / SELv2 (enterprise)	Proprietary
Hosting model	Self-hosted on your servers	Hosted by Proton AG
Encryption at rest	Per-mailbox, operator-transparent	Zero-access encryption
CalDAV	Yes	Yes (Proton Calendar)

Who Stalwart is for#

Privacy-focused teams self-hosting email and calendars

Skip if:

Small to mid-sized organizations replacing a fragmented mail stack

Skip if:

ISPs and hosting providers building multi-tenant mail services

Skip if:

Developers building JMAP-native email applications

Skip if:

The problem it solves#

How it solves it#

JMAP and IMAP4 email server in one binary

Built-in calendars, contacts, and file storage

Anti-spam filter built into the SMTP server

Per-mailbox encryption at rest

Pluggable storage and authentication backends

Cluster scaling without an external coordinator

Strengths and trade-offs#

Strengths

Trade-offs

Stalwart vs alternatives#

Stalwart vs Microsoft 365

Stalwart vs Google Workspace

Stalwart vs Proton Mail Business

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Communication & Collaboration

Backend Development

Security & Monitoring

Find open source alternatives to paid software

Who Stalwart is for#

Privacy-focused teams self-hosting email and calendars

Skip if:

Small to mid-sized organizations replacing a fragmented mail stack

Skip if:

ISPs and hosting providers building multi-tenant mail services

Skip if:

Developers building JMAP-native email applications

Skip if:

The problem it solves#

How it solves it#

JMAP and IMAP4 email server in one binary

Built-in calendars, contacts, and file storage

Anti-spam filter built into the SMTP server

Per-mailbox encryption at rest

Pluggable storage and authentication backends

Cluster scaling without an external coordinator

Strengths and trade-offs#

Strengths

Trade-offs

Stalwart vs alternatives#

Stalwart vs Microsoft 365

Stalwart vs Google Workspace

Stalwart vs Proton Mail Business

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Communication & Collaboration

Backend Development

Security & Monitoring

Find open source alternatives to paid software