LoginSign Up
← Back to all sparks
S

Stalwart

COMMS
Velocity5.0

Open-source all-in-one mail and collaboration server supporting SMTP, IMAP, and JMAP.

stalw.art ↗

Stalwart is chasing mail RFCs and its own storage layer at the same time

mail-serverjmapimaprfc-compliancerocksdbself-hosted
◆Current state
Stalwart ships roughly weekly, and the releases divide cleanly between standards implementation and correctness work. v0.16.18 turns toward resource control — bounds on decompressed inbound DMARC and TLS report size, a cap on RocksDB block-cache memory, column families tuned per access pattern, and a queue scheduler that stops rescanning from the earliest pending event. The preceding releases added IMAP UIDONLY, UIDBATCHES and MESSAGELIMIT, plus JMAP email push and VAPID.
◆Where it's heading
Two threads run through every release. One is RFC coverage across IMAP, JMAP, CalDAV and WebDAV, implemented close to the specification including drafts. The other is a long tail of protocol-conformance fixes, many of them cases where JMAP and IMAP disagreed about the same state. The newest release adds a third: memory and scheduling limits, which is what a server codebase starts doing when deployments get large enough for defaults to hurt.
◆Prediction
Expect continued RFC additions across the JMAP and IMAP surfaces, with more of the storage-tuning work that v0.16.18 started as RocksDB deployments scale.

◆Recent moves

  1. 1d ago

    Resource limits arrive for inbound reports and RocksDB caches

    The first release in this window focused on bounding resource use rather than adding protocol surface: a size cap on decompressed DMARC and TLS reports, a shared RocksDB block-cache limit, per-access-pattern column family tuning, and a queue scheduler that coalesces delivery completions instead of rescanning. It also moves the ASN and GeoIP data sources off unmaintained npm packages.

    View source ↗
  2. 8d ago

    IMAP gains UIDONLY, UIDBATCHES and message-limit extensions

    Three IMAP extensions land together — UIDBATCHES, UIDONLY, and MESSAGELIMIT with SAVELIMIT — alongside WebDAV range requests. Typical of Stalwart's pattern of implementing recent RFCs well ahead of most competing servers.

    View source ↗
  3. 16d ago

    JMAP delivery push arrives; strict relays stop rejecting calendar mail

    JMAP email delivery push notifications from an IETF draft, plus a fix for calendar notification messages that embedded the logo as a single 4247-octet line and were rejected by strict SMTP relays. The push work continues the notification thread running through several releases.

    View source ↗
  4. 23d ago

    Fix-only release: JMAP semantics and a credential escalation

    No additions, only corrections — several JMAP methods behaving contrary to specification, and a privilege issue where scoped credentials holding API key permissions could regain their account's full rights. The volume of conformance fixes is the cost of implementing drafts early.

    View source ↗
  5. 29d ago

    VAPID lands for JMAP Web Push

    VAPID support for JMAP Web Push, plus a set of push-subscription fixes covering encoding, key padding and stale subscriptions. Part of the same notification arc that JMAP delivery push extended two releases later.

    View source ↗
  6. 1mo ago

    FreeBSD support, plus OAuth scopes for IMAP, SMTP and Sieve

    FreeBSD joins the supported platforms, and OAuth access tokens accept imap, smtp, pop3 and sieve as resource indicators. The platform addition widens the self-hosting audience that is Stalwart's core constituency.

    View source ↗