Stalwart

What it's good for#

Stalwart gives you mailboxes at your own address, and everything that goes with them: sending and receiving, folders, spam filtering, calendars and address books that sync to your phone. It's one app, and LibrePortal sets it up for you, so the first time you open it you see a configured mail server rather than a setup wizard.

It comes with a question you answer once, and can change later: who is it for?

• Private: mail, calendars and contacts for the people on your own network (and your VPN). Mail between your own accounts works normally, but nothing is exchanged with the internet. No domain, no DNS, and nothing to go wrong with deliverability. A good choice for a household calendar and a family address book, or for trying Stalwart out.
• Public: a real internet mail server that sends to and receives from Gmail, Outlook and everyone else. It needs a domain, and more of your attention.

If you don't choose, LibrePortal picks for you when it installs: Public if Traefik is installed (which in practice means you have a domain pointing here), Private if not. Either way, the answer is written down, and Mail Exposure on the Tools tab switches between them later in both directions.

Before you go public#

Running your own internet mail is very doable, but it's worth knowing what you're taking on:

• Port 25 has to be open both ways. Other mail servers deliver to you on port 25, and you deliver to them on it. Many VPS providers block outgoing port 25 until you ask them to open it, and most home internet connections block it for good. The install checks and tells you.
• Reverse DNS (PTR) for your server's address should be your mail hostname, mail.example.com. You set it in your VPS provider's control panel, not in your domain's DNS.
• DNS records: MX, SPF, DKIM and DMARC at your domain. The install prints the exact records, with your real DKIM keys, and Show DNS Records on the Tools tab prints them again whenever you need them.
• Reputation takes time. Even with everything right, big providers are wary of a brand-new server and may put your first mail in spam for a few weeks. That's not a fault in the setup, and no installer can skip it.

Signing in#

Stalwart has two web pages on the same address, which you open with the Admin Interface button (mail.example.com with a domain):

• /admin, the admin console, for the server itself: domains, accounts, the mail queue and reports. Sign in as admin with the password from the Login Details shown when the install finished; press Welcome on the app's page to see it again.
• /account, for everyday users to change their own password, set up filters and turn on an out-of-office reply.

The install also creates one real mailbox, postmaster@ your domain, because the DMARC and TLS reports other servers send you are addressed there and would bounce without it. Its password is in the same Login Details, as First Mailbox Password. If you change that password later, in a mail app or the admin console, LibrePortal doesn't see the change, and the card keeps showing the old one.

Then add an account for each person in the admin console. The admin login is for running the server, not for reading mail.

Reading your mail#

The easy way is SnappyMail, the webmail app. Stalwart offers it as a companion when you install it, and SnappyMail connects itself to every domain Stalwart handles, so you just sign in with your full email address and mailbox password. Once it's installed, Stalwart's page has an Open webmail button.

Any ordinary mail app works too: Thunderbird, the mail app built into your phone, FairEmail or K-9 Mail on Android. With a domain, many find the settings themselves from your email address. If yours asks, the server is mail.example.com for both incoming and outgoing mail, and:

The username is your full email address. On a private server, use the server's address on your network, 192.168.1.50, instead of mail.example.com. The certificate is then Stalwart's own, and each mail app asks you once whether to trust it.

Calendars and contacts sync over CalDAV and CardDAV, from the same address as the web pages. On Android, DAVx⁵ is the usual app for this; iPhones and Thunderbird can add a CalDAV or CardDAV account directly. Sign in with your email address and password.

More than one domain#

Stalwart can carry mail for several domains on the one server, say your family name and a small business. Each gets its own DKIM keys, a postmaster@ address and a SnappyMail sign-in, all on the one mail hostname.

• Add a Mail Domain on the Tools tab does it straight away, with no reinstall. Tick Also add it to this server's domains if it isn't one of the domains in Admin → Network yet.
• Mail Domains shows the list, and whether SnappyMail follows each one.
• Stop Managing a Mail Domain takes one off LibrePortal's list. It deletes nothing: the mailboxes and keys stay in Stalwart.
• Re-apply Mail Domains puts Stalwart and SnappyMail back in line with the list. It's safe to run any time.

Then add each new domain's DNS records, from Show DNS Records. Only the first domain needs the A record and the PTR; the others just point their MX at the same mail hostname.

Moving your mail in#

Mail Migration on the Tools tab brings existing mailboxes over from Gmail, Outlook or any provider that offers IMAP. It copies every folder with its flags and dates, lets you check each mailbox arrived, and then helps you switch your domain's DNS over. Running it again only copies what's new, so a last pass after the switch catches anything that arrived in between. Your provider may ask for an app password rather than your normal one.

Good to know#

• Certificates. With Traefik, the mail ports use Traefik's certificate for your mail hostname. Sync Mail Certificate copies it across, and it also does that every day on its own.
• Ports are fixed. Mail ports have to be the standard numbers, because other servers and mail apps expect them: 25, 465, 587 and 993. IMAP with STARTTLS (143), POP3 (995) and ManageSieve (4190) are off until you switch them on. If a mail app says the server refused it on 587, run Repair Mail Ports.
• Paperless. Paperless-ngx can collect attachments from a Stalwart mailbox. You set that up in Paperless, on its Mail page.
• Updates. Fixes to Stalwart 0.16 arrive automatically. Moving to a new release line, like 0.17, is a deliberate step, because Stalwart is still settling its storage before 1.0.
• Backups stop Stalwart for a few seconds, so the message store is copied in a consistent state. Mail sent to you in those seconds waits and is retried, which is what mail servers do.
• Timezone. Installs made before 0.4.7 run Stalwart on UTC whatever the server's timezone, because of a mistake in its setup. Installs from 0.4.7 get the server's timezone. To fix an older install, press Update Configuration on its Config tab once LibrePortal is on 0.4.7: that sets it up again from the corrected template, and your mail stays where it is.