Fonoster
Fonoster ships four releases in a day to make linking a Twilio number a single step.
Comparison · Comms
Dovecot vs Stalwart
A side-by-side editorial comparison of Dovecot and Stalwart — release velocity, themes, recent moves, and the top alternatives to consider.
Dovecot vs Stalwart: at a glance
What is Dovecot?
Dovecot's 2.4 branch is being hardened release by release after a breaking rewrite.
Dovecot is the IMAP and POP3 server behind a large share of the world's mailboxes. The 2.4 branch opened in January 2025 with a deliberately incompatible release — configuration files must be rewritten, the plugin section is gone, and several long-standing features were removed outright — and every release since has been consolidation on top of it. The pattern is consistent: each point release leads with critical CVE fixes, then lists incremental changes. The latest, 2.4.5, carries twelve CVEs alongside post-quantum ML-KEM support, full-text phrase searching and a throttling response code.
What is Stalwart?
Stalwart adds full SCIM v2 provisioning and 24-language calendar support as its standards coverage extends further than most commercial mail servers.
Stalwart is maintaining a weekly-or-faster release cadence, with alternating feature releases and dense bug-fix releases. The v0.16.20 release landed full SCIM v2 (Enterprise) including cursor-based pagination and the IPSIE lifecycle profile, conference links in calendar invites, and 24 new calendar interface translations. Below the feature line, the project is steadily closing correctness gaps across JMAP, CalDAV, IMAP, and MTA — many of them edge-case RFC compliance issues.
Dovecot vs Stalwart: editorial side-by-side
Dovecot
2.5COMMS
Dovecot's 2.4 branch is being hardened release by release after a breaking rewrite.
◆ Current state
Dovecot is the IMAP and POP3 server behind a large share of the world's mailboxes. The 2.4 branch opened in January 2025 with a deliberately incompatible release — configuration files must be rewritten, the plugin section is gone, and several long-standing features were removed outright — and every release since has been consolidation on top of it. The pattern is consistent: each point release leads with critical CVE fixes, then lists incremental changes. The latest, 2.4.5, carries twelve CVEs alongside post-quantum ML-KEM support, full-text phrase searching and a throttling response code.
◆ Where it's heading
Two things are being worked at once. Security is the visible half, and the volume is striking — resource-exhaustion and parser issues in IMAP THREAD, LIST and ID, a CRIME-style compression side channel, an authentication bypass through XCLIENT forwarding. The quieter half is that fixes are increasingly gated behind version declarations: the THREAD fix needs a new index format enabled only by raising dovecot_storage_version. That mechanism, introduced with 2.4.0, is now doing real work, letting operators take format changes on their own schedule.
◆ Prediction
Experimental flags for mail UTF-8 and IMAP4rev2 have carried unchanged through every 2.4 release so far; the next branch-defining move is one of those graduating to default rather than another security round.
Stalwart
6.3COMMS
Stalwart adds full SCIM v2 provisioning and 24-language calendar support as its standards coverage extends further than most commercial mail servers.
◆ Current state
Stalwart is maintaining a weekly-or-faster release cadence, with alternating feature releases and dense bug-fix releases. The v0.16.20 release landed full SCIM v2 (Enterprise) including cursor-based pagination and the IPSIE lifecycle profile, conference links in calendar invites, and 24 new calendar interface translations. Below the feature line, the project is steadily closing correctness gaps across JMAP, CalDAV, IMAP, and MTA — many of them edge-case RFC compliance issues.
◆ Where it's heading
Stalwart is building toward parity with commercial enterprise mail servers on identity federation and provisioning (SCIM v2, VAPID for web push, DMARCbis/DKIM2 already landed). The pace of RFC implementation is unusually aggressive for an open-source project; the combination of JMAP, CalDAV, IMAP UIDONLY/UIDBATCHES, and SCIM v2 positions it as a viable self-hosted alternative for organizations that need standards compliance without vendor lock-in.
◆ Prediction
WebAuthn/passkey-based authentication and improved multi-tenant administration tooling are the most likely next capability additions, given the current trajectory toward enterprise identity management.
Alternatives to Dovecot and Stalwart
Other Comms products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Dovecot or Stalwart.
Element
Element 1.12.33 ships: simpler recovery keys, mandatory verification, no libolm migration.
Tawk.to
tawk.to's widget 4.4.0 turns to keyboard and screen-reader fixes after a run of form work.
Krisp
Krisp 2.83.4 brings Voice Translation into conference calls and lightens Accent Conversion.
Pixelfed
Pixelfed 0.15.2 ships the PHP RCE patches and turns cached timelines on for everyone.
Salesmsg
Salesmsg Reviews can now trigger follow-ups automatically based on a customer's latest rating.
See all Dovecot alternatives → · See all Stalwart alternatives →
Recent activity from Dovecot and Stalwart
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
- 1mo agoStalwartv0.16.21
- 2mo agoStalwartv0.16.20 ⚡
- 2mo agoDovecotTwelve CVEs fixed; ML-KEM and full-text phrase search arrive
- 2mo agoStalwartv0.16.19
- 2mo agoStalwartv0.16.18
- 2mo agoStalwartv0.16.17
- 2mo agoStalwartv0.16.16
- 5mo agoDovecotCVE fixes in variable expansion and CRAM-SHA authentication
- 6mo agoDovecotCVE fixes for base64 auth DoS and decode2text
- 1y agoDovecotAuth cache key collision fixed; libpcre2 becomes a dependency
- 1y agoDovecot2.4 branch signing key rotates; packages break 2.3 configs
- 1y agoDovecotDovecot 2.4 lands: configs must be rewritten, director removed ⚡
Frequently asked questions
What is the difference between Dovecot and Stalwart?
They serve adjacent needs but don't currently overlap on shipped themes. Stalwart is currently shipping more aggressively (velocity 6.3 vs 2.5), with 0 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Is Dovecot better than Stalwart?
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Stalwart is currently shipping more aggressively (velocity 6.3 vs 2.5), with 0 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Comms products to evaluate alongside.
What are the best alternatives to Dovecot?
Top Dovecot alternatives in Comms are ranked by recent ship velocity. Browse the "Dovecot alternatives" section above for the current picks, or visit /alternatives/dovecot for the full list with editorial commentary on each.
What are the best alternatives to Stalwart?
Top Stalwart alternatives in Comms are ranked by recent ship velocity. Browse the "Stalwart alternatives" section above for the current picks, or visit /alternatives/stalwart for the full list with editorial commentary on each.