Stalwart fits into the infrastructure your team already operates, so adopting it is a configuration choice, not a migration. Plug in your existing identity provider, storage, search engine, DNS provider, observability stack and content-filtering tools, then point any standards-compliant mail or calendar client at the server.
User authentication and authorization can be handled by Stalwart's built-in directory or delegated to an external identity provider.
OAuth 2.0 (device flow and authorization code) and OpenID Connect are supported as first-class authentication mechanisms, with per-client scopes and a list of connected applications that users can review and revoke.
The data store keeps structured metadata such as mailboxes, message metadata, ACLs, calendars and contacts.
Each backend has different scaling characteristics.
The blob store holds message bodies, attachments, Sieve scripts and WebDAV files.
Stalwart supports the S3 API, Azure Blob and the local filesystem.
Full-text search can run inside Stalwart or be delegated to a dedicated search engine.
The internal engine indexes 17 languages with bloom filters; dedicated engines absorb the indexing load when the data store is busy.
Coordination synchronises state across cluster nodes (mailbox events, blocked IPs, certificate renewals, push notifications).
Stalwart Keep is the recommended coordinator, and also serves as the in-memory store. Stalwart can also use one of four message backends, or peer-to-peer Zenoh.
With automated DNS management enabled, Stalwart publishes and refreshes MX, SPF, DKIM, DMARC, SRV, CAA, TLSA, MTA-STS, TLS-RPT, autoconfig and autodiscover records directly against a configured DNS provider.
The most popular providers are supported out of the box, and self-hosted authoritative servers can be driven via RFC 2136 dynamic updates.
Telemetry covers metrics, logs, traces and event-driven webhooks.
Stalwart can ship data to OpenTelemetry collectors, expose a Prometheus endpoint, and post webhooks to any HTTP endpoint.
The orchestrator manages node lifecycle and scaling; the cluster coordination layer keeps nodes in sync.
Stalwart's built-in spam filter (statistical classifier, DNSBL, phishing protection, sender reputation, greylisting and spam traps) can be combined with external anti-spam systems through Milter or MTA Hooks.
The Enterprise edition uses language models in the spam classifier and in Sieve scripts for content analysis.
Each provider is supported through its own API, and every model has its own rate limit, concurrency cap and timeout, so hosted and self-hosted models can be mixed in the same deployment.
Stalwart speaks every standard mail protocol, so any RFC-compliant client works.
Automatic account configuration is supported through the IETF UA Autoconfig and Microsoft Autodiscover V2.
CalDAV with scheduling, CardDAV and WebDAV are all supported, alongside the JMAP equivalents.
Autoconfig and assisted resource discovery work for CalDAV, CardDAV and WebDAV.