Stalwart Mail Server - All-in-One SMTP/IMAP/JMAP on EC2

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Why Stalwart on AWS

Stalwart replaces the traditional multi-daemon mail stack (Postfix + Dovecot + SpamAssassin + OpenDKIM) with a single, memory-efficient Rust binary. Fewer moving parts mean a smaller attack surface, faster patching, and no Perl or Python dependencies to maintain. The embedded RocksDB datastore eliminates the need for a separate MySQL or PostgreSQL instance, cutting both cost and operational complexity.

This AMI delivers Stalwart fully installed and configured so a complete private mail platform is running within minutes of launch. The current release available is Stalwart 0.16.

## Who This Is For

• Startups and SMBs replacing hosted email providers to reduce per-mailbox costs while retaining full control over data residency.
• DevOps teams consolidating mail infrastructure into a single service that is easy to automate and monitor.
• Compliance-driven organizations that require on-premises or VPC-hosted email to meet data sovereignty requirements.

## Application Stack

The Stalwart server runs as a hardened systemd service with its RocksDB datastore (mail spool, accounts, message blobs and full-text index) on a dedicated, resizable EBS volume. Mail protocols listen on the standard ports - SMTP 25, submission 587, submission over TLS 465 and IMAP over TLS 993 - while the web admin console and JMAP interface are served on port 80 through an nginx reverse proxy. A self-signed TLS certificate is generated per instance for the mail listeners and the guide covers replacing it with a Let's Encrypt certificate via Stalwart's built-in ACME support.

## Secure By Default

No default or shared credentials ship in the image. On the first boot of your instance a one-shot service generates a unique administrator password, regenerates the TLS private key, and writes the login to a root-only file. The admin console and management API reject unauthenticated access. Because Stalwart is a single compiled binary with no interpreted language runtimes, the overall attack surface is significantly reduced compared to traditional stacks.

## Key Capabilities

• SMTP - Inbound delivery, submission and outbound relaying with queue management
• IMAP4 and JMAP - Full mailbox access for any standards-compliant client
• Spam and phishing filter - Built-in filtering engine with configurable rules
• DKIM signing, SPF, DMARC and ARC verification - One-click key generation with DNS record output
• Sieve scripting - Server-side mail filtering rules
• Web administration console - Domain, account and queue management from the browser

## Important - Outbound Port 25 on EC2

AWS blocks outbound SMTP on port 25 by default for all new EC2 accounts. Receiving mail and IMAP access work out of the box. To send mail directly you can request the port 25 restriction removal from AWS support, or relay outbound mail through a smart host such as Amazon SES on port 587. The user guide walks through both options step by step.

## Get Started

Sign in to the web admin console, add your first domain - Stalwart generates the DKIM keys and shows you the exact DNS records to publish - create mailboxes, and connect any IMAP or JMAP mail client. Need help with DNS, DKIM, or SES relay configuration? cloudimg engineers can walk you through a guided setup session after purchase.

## cloudimg Support

24/7 technical support by email and live chat for deployment, domain and DNS setup, DKIM/SPF/DMARC configuration, TLS certificates, Amazon SES relaying and upgrades. Critical issues receive a one-hour average response time.

Stalwart is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.