LoginSign Up
← Back to all sparks
S

Stalwart

COMMS
Velocity5.0

Open-source all-in-one mail and collaboration server supporting SMTP, IMAP, and JMAP.

stalw.art ↗

Stalwart races to implement the newest email standards across its all-in-one server

email-serverstandards-complianceemail-authenticationjmapsecurityself-hosted
◆Current state
Stalwart is an open-source, all-in-one mail and collaboration server (SMTP/IMAP/JMAP/CalDAV) shipping a fast 0.16.x point-release train. Recent releases are dominated by standards implementation and protocol-conformance work, layered over steady security hardening and a long tail of targeted bug fixes.
◆Where it's heading
The product is doubling down on being the most standards-complete self-hosted mail server: early DKIM2 and DMARCbis authentication, IDN support, encryption-at-rest for S/MIME, and a sustained push to pass the JMAP test suite. Security hardening runs alongside — DANE downgrade-attack defenses, auto-ban fixes, binary attestation on every build.
◆Prediction
Expect continued rapid 0.16.x releases advancing draft email-authentication standards and JMAP conformance; a larger 0.17 or 1.0 milestone becomes likely once the JMAP suite fully passes and the DKIM2/DMARCbis drafts stabilize.

◆Recent moves

  1. 3d ago

    DKIM2 and DMARCbis email-authentication support

    v0.16.12 adds DKIM2 (IETF draft) and a full DMARCbis implementation (RFC 9989/9990/9991), keeping Stalwart at the front of email-authentication standards. The bulk of the release is hardening: DANE downgrade-attack defenses, OIDC and PostgreSQL fixes, and an EMFILE back-off that stops the listener from pegging every CPU core.

    View source ↗
  2. 14d ago

    Encryption-at-rest for S/MIME, Redis Sentinel backend

    v0.16.11 adds encryption-at-rest (AES-256-GCM and ChaCha20-Poly1305) for S/MIME and Redis Sentinel support as an in-memory store and cluster coordinator, broadening deployment and HA options alongside JMAP and webhook fixes. Fits the arc of maturing Stalwart for larger, security-conscious deployments.

    View source ↗
  3. 18d ago

    IDN support and JMAP test-suite conformance

    v0.16.10 adds International Domain Name support, OAuth public-client and IMAP object-id profiles, and a large batch of JMAP conformance fixes that pass the jmap-test-suite. This is the clearest signal of the standards-completeness strategy driving the release train.

    View source ↗