Mailu vs Stalwart
Two of the lighter ways to self-host email, built on opposite foundations. Mailu packages Postfix, Dovecot and Rspamd as a small Docker Compose stack with webmail, an admin UI and a REST API, set up through a web wizard. Stalwart rewrites every protocol from scratch in one Rust binary, adding JMAP, built-in groupware and clustering, and it's still pre-1.0. Neither ships a transactional sending API. If that's the gap, we're a third option, covered below.
At a glance
Side-by-side, current as of October 2026 (Mailu 2024.06.61, Stalwart v0.16.25).
| Mailu | Stalwart | |
|---|---|---|
| Architecture | Docker Compose stack, generated by a web setup wizard | One Rust binary, every protocol in one process |
| Mail engine | Postfix · Dovecot · Rspamd | Written from scratch |
| Version | 2024.06 series, still receiving patch releases | Pre-1.0 (v0.16.x) |
| Runs on | Linux with Docker; Kubernetes via a community Helm chart | Linux, macOS, FreeBSD, Windows, or Docker |
| RAM minimum | 1 GB + 1 GB swap; 3 GB + 1 GB swap with ClamAV | ~1 GB for 5–10 users (~100 MB idle) |
| Protocols | SMTP · IMAP · POP3; CalDAV/CardDAV via optional Radicale | SMTP · IMAP · POP3 · JMAP · CalDAV · CardDAV · WebDAV |
| Webmail | Roundcube or SnappyMail | Not bundled |
| Exchange ActiveSync | No | No |
| Antispam | Rspamd (autolearn, greylisting, DMARC) | Built-in filter (classifier, Pyzor; LLM on Enterprise) |
| Antivirus | Optional ClamAV container | Via milter (run ClamAV yourself) |
| Admin API | REST API covering everything the admin UI does | Management API (JMAP-based) |
| Clustering / HA | Single host | Built in (multi-node, Kubernetes, Swarm) |
| Directory / SSO | Built-in accounts | LDAP, OIDC, SQL; SCIM on Enterprise |
| Transactional sending API | No (SMTP submission) | No (JMAP submission + event webhooks) |
| Upgrades | Read the changelog, pull new images, recreate | Manual; minor releases may need config changes or migrations |
| Automatic rollback | No | No |
| License | MIT | AGPL-3.0 + proprietary Enterprise license |
| Pricing | Free | Free; Enterprise is a per-mailbox subscription |
How they differ
Proven components vs a clean rewrite
Mailu doesn't implement mail protocols itself: it wraps Postfix, Dovecot and Rspamd, components with long production histories, in small purpose-built containers behind an nginx front end, with Redis for state. Stalwart implements SMTP, IMAP, POP3, JMAP and the DAV protocols itself, in memory-safe Rust, as a single binary with a published security audit. That gives a coherent design and very modest resource use; the cost is a younger codebase that is still pre-1.0, with its roadmap's next milestone being to finalise the database schema.
Setup and footprint
Both are light by mail-server standards. Mailu's documented minimum is 1 GB of RAM plus 1 GB of swap without antivirus, or 3 GB with ClamAV enabled. You configure it through a web setup wizard that generates a docker-compose.yml and amailu.env, choosing optional pieces such as antivirus, webmail, CalDAV and full-text search. Stalwart idles at around 100 MB and documents 1 GB as comfortable for 5 to 10 users. It installs as a single binary on Linux, macOS, FreeBSD or Windows, or as a Docker container, and is configured from its web admin.
Protocols, webmail and groupware
Stalwart is the more protocol-complete server: JMAP for mail, calendars and contacts, plus CalDAV, CardDAV and WebDAV, all built in. Mailu covers SMTP, IMAP and POP3, and adds calendar and contacts through an optional Radicale container.
In the browser the balance flips. Mailu bundles a webmail, Roundcube or SnappyMail, so users can read mail on day one. Stalwart's web interface is for administration and account self-service, not reading mail, so you add a webmail yourself or rely on desktop and mobile clients. Neither speaks Exchange ActiveSync.
Filtering
Mailu ships Rspamd with autolearn, greylisting and DMARC/SPF checks, plus optional ClamAV and oletools for malicious-attachment scanning. Stalwart has its own built-in spam filter with a statistical classifier, Pyzor and spam traps (LLM analysis is an Enterprise feature); antivirus means running ClamAV yourself and connecting it as a milter.
Scale, identity and APIs
Stalwart is built to scale out: native clustering, Kubernetes or Swarm, pluggable storage (RocksDB, PostgreSQL, MySQL, SQLite, FoundationDB, S3-compatible, Azure), and LDAP, OIDC or SQL directories. Read replicas, sharded storage, SCIM and multi-tenancy are Enterprise features. Mailu is a single-host Compose stack; a community Helm chart exists for Kubernetes, though its own docs say it is looking for maintainers. Both have an admin API: Mailu's REST API covers everything its admin UI does, with a built-in Swagger UI.
Upgrades
Mailu upgrades by checking the changelog for compose and environment changes, then pulling new images and recreating the containers. Stalwart's documentation says there is no automated upgrade tool yet: patch releases are safe, but minor releases may require configuration changes or data migrations, so it recommends reading the release notes first and upgrading only when necessary. Neither takes a pre-update snapshot, runs a health-check gate or rolls back on failure.
Licensing and cost
Mailu is MIT-licensed throughout, with no paid edition. Stalwart is dual-licensed: the AGPL-3.0 core is free, and a proprietary Enterprise edition, priced per mailbox, adds multi-tenancy, SCIM provisioning, LLM spam filtering, mail undelete, read replicas and sharded storage, live telemetry and priority support.
Programmatic sending
Neither is a transactional sending platform. Mailu's API manages configuration, and applications send through SMTP submission as a real mailbox. Stalwart's JMAP can submit mail and its webhooks report events, but your application integrates against a mail protocol. There are no domain-scoped sending keys, per-domain rate limits or delivery analytics in either.
Who each is best for
Choose Mailu if
- You want the proven Postfix, Dovecot and Rspamd core in a small Docker stack.
- Your users need webmail on day one.
- You want an MIT-licensed stack configured through a web wizard.
- You're running a single host and don't need clustering.
Choose Stalwart if
- You want JMAP, or CalDAV/CardDAV/WebDAV built into the server itself.
- You need clustering, LDAP/OIDC directories or a specific storage backend.
- You want to run outside Docker, or on macOS, FreeBSD or Windows.
- You're comfortable with pre-1.0 software and reading release notes before each upgrade.
The third option: Vectis Mail
If what's missing from both is a transactional sending API, or an update you don't have to supervise, that's the gap Vectis Mail is built to close. It runs the same proven Postfix and Dovecot core as Mailu, with Rspamd by default, installed by one guided command:
- Runs on Ubuntu 24.04 LTS from 2 GB of RAM without ClamAV (4 GB recommended), in 10 containers by default.
- Domains, mailboxes, aliases and API keys managed from an admin dashboard or the REST API, taking effect immediately with no restarts.
- A 40+ endpoint REST API: transactional sending (single and batch, with attachments), HMAC-signed inbound webhooks, domain-scoped API keys with per-domain rate limits, and analytics.
- Atomic 6-phase updates (snapshot, migrate, pull, deploy, health-check, complete) with automatic rollback, and
vectis verifyto prove the box runs exactly what was published.
To be equally clear about where Vectis Mail doesn't fit: it's Docker-only and single-node, and it doesn't ship JMAP, calendar, contacts or ActiveSync today. If groupware or a multi-node cluster is the core requirement, it isn't your answer. See the dedicated Vectis Mail vs Stalwart comparison, and the best self-hosted email servers guide for where Mailu fits in the wider landscape.
Frequently asked questions
Is Mailu or Stalwart better?
They suit different priorities. Mailu packages proven components (Postfix, Dovecot, Rspamd) as a lightweight Docker Compose stack with webmail, an admin UI and a REST API, configured through a web setup wizard and MIT-licensed. Stalwart reimplements every protocol in one Rust binary, adding JMAP, built-in CalDAV/CardDAV/WebDAV and native clustering, but it is still pre-1.0 and ships no webmail. Choose Mailu for a small, conventional, proven stack; choose Stalwart for JMAP, built-in groupware or multi-node scale.
How much RAM do Mailu and Stalwart need?
Both are light. Mailu's documented minimum is 1 GB of RAM plus 1 GB of swap without antivirus, or 3 GB plus 1 GB of swap with ClamAV. Stalwart idles at roughly 100 MB, and its documentation says 1 GB is generally sufficient for 5 to 10 users; antivirus means running ClamAV separately as a milter, which needs its own memory.
Do Mailu and Stalwart support calendar and contacts?
Both can. Stalwart has CalDAV, CardDAV and WebDAV built in, plus JMAP for calendars and contacts. Mailu offers calendar and contacts through an optional Radicale container you enable at setup. Neither supports Exchange ActiveSync.
Is Stalwart production-ready?
Stalwart describes itself as feature complete, but it is still pre-1.0 (v0.16.25 as of October 2026). Its own upgrade documentation says there is no automated upgrade tool yet: minor releases may require configuration changes or data migrations, so it recommends reading the release notes and upgrading only when necessary.
Does either have a transactional sending API?
Not in the SendGrid sense. Mailu's REST API manages configuration (domains, users, aliases), and applications send through SMTP submission as a real mailbox. Stalwart offers JMAP, which can submit mail, plus event webhooks. Neither offers domain-scoped sending keys, per-domain rate limits or delivery analytics. Vectis Mail is a self-hosted platform built to add that sending API alongside mailbox hosting.
Related comparisons
More head-to-heads, and how Vectis Mail compares.
Vectis Mail vs Stalwart →
The proven Postfix/Dovecot/Rspamd engine, a transactional API and self-rolling-back updates vs a from-scratch Rust rewrite.
Stalwart vs Mailcow →
Rust all-in-one vs a proven 18-service Docker stack.
Mailcow vs Mail-in-a-Box →
Docker groupware vs a one-command box on 1 GB of RAM.
Best self-hosted email servers (2026) →
The whole landscape by buyer type, including both of these, compared side by side.