LoginSign Up
← Back to all sparks
S

Stalwart

COMMS
Velocity5.0

Open-source all-in-one mail and collaboration server supporting SMTP, IMAP, and JMAP.

stalw.art ↗

Stalwart keeps chasing standards nobody has implemented yet — DKIM2, DMARCbis, now JMAP email push.

mail-serverjmapemail-authenticationstandards-implementationself-hostedpush-notifications
◆Current state
Stalwart is a single-binary mail and collaboration server covering JMAP, IMAP, SMTP, CalDAV and CardDAV. The 0.16.x line ships roughly weekly and its additions cluster in one place: implementing IETF drafts and fresh RFCs ahead of the field, while a long tail of JMAP conformance and MTA edge-case fixes runs underneath. The latest release adds JMAP email delivery push notifications, completing a push stack built across the last three releases.
◆Where it's heading
The push story is the clearest arc: Web Push payload and subscription fixes in 0.16.10, VAPID per RFC 9749 in 0.16.14, and the emailpush draft in 0.16.16. Parallel to it, 0.16.12 landed DKIM2 and the DMARCbis trio, and the fix lists keep narrowing toward strict-spec behaviour — DMARC alignment reporting, SMTP line-length limits, BDAT error codes. Stalwart is positioning as the reference implementation of modern mail standards rather than competing on features.
◆Prediction
Expect the JMAP push work to keep filling in — subscription lifecycle, delivery semantics — alongside continued DKIM2 and DMARCbis refinement as those drafts move. The fix cadence suggests operational hardening around clustering and Redis locking is the other near-term thread.

◆Recent moves

  1. 5d ago

    v0.16.16 — JMAP email push, plus Redis lock and SMTP relay fixes

    Adds JMAP email delivery push notifications per the emailpush draft, closing the push stack that VAPID support opened in 0.16.14. The fix list is unusually operational — a Redis lock leak that stranded queues after a worker died, and an SMTP line-length bug that made calendar invitations unrelayable through strict relays.

    View source ↗
  2. 12d ago

    v0.16.15 — JMAP, MTA, and auth privilege fixes

    A fixes-only release, but the entries are spec-conformance work rather than crashes: Email/copy semantics, calendar event UID and DTSTAMP generation, public-suffix recipient domains. One auth fix closes a privilege path where scoped API-key credentials could recover full account rights.

    View source ↗
  3. 18d ago

    v0.16.14 — VAPID Web Push plus push and calendar fixes

    Adds VAPID for JMAP Web Push per RFC 9749, the middle step in the push arc. The accompanying fixes clean up push subscription handling and calendar recurrence across DST.

    View source ↗
  4. 26d ago

    v0.16.13 — FreeBSD support and OAuth/JMAP fixes

    FreeBSD support broadens where Stalwart can be deployed, which matters for a self-hosted server whose users skew toward BSD-friendly infrastructure. The rest is OAuth resource indicators and DNS management cleanup.

    View source ↗
  5. 1mo ago

    v0.16.12 — DKIM2 and DMARCbis email-authentication support

    The standards-first thesis in one release: DKIM2 from the current IETF draft, plus DMARCbis and its aggregate and failure reporting RFCs. Underneath, a DANE fix that treats DNSSEC bogus results as temporary failures to block downgrade attacks.

    View source ↗
  6. 1mo ago

    v0.16.11 — S/MIME encryption-at-rest and Redis Sentinel backend

    Encryption-at-rest gains AES-256-GCM and ChaCha20-Poly1305 for S/MIME, and Redis Sentinel becomes a supported in-memory store and cluster coordinator. Both are deployment-shape additions for operators running Stalwart beyond a single node.

    View source ↗