Upgrade & Recovery procedures

Pin the Stalwart image to a tested version:

Certificate renewal runbook

Certificate handling is the most important recurring operational concern in this architecture.

Storage and backup strategy

The lightweight deployment uses RocksDB and local Docker volumes.

Understanding SPF, DKIM, and DMARC

These systems authenticate outgoing mail.

Troubleshooting lessons

Symptom:

Phase 15: Test the complete deployment

Send from an external account to:

Phase 14: Connect a mail client

Use the full email address as the username.

Phase 13: Add calendars and contacts

Stalwart already provides CalDAV and CardDAV through its HTTP service.

Phase 12: Configure MTA-STS and TLS reporting

MTA-STS tells other mail servers that your SMTP service should use encrypted transport and identifies the valid MX hostname.

Phase 11: Mail-client discovery

Add:

Phase 10: Publish DNS records

After the mailbox and listeners are ready, publish the MX and authentication records.

Phase 9: Create mailboxes, aliases, and catch-all delivery

Do not use the administrator account as a daily mailbox.

Phase 8: Configure outbound delivery correctly

Navigate to:

Phase 7: Configure reverse DNS

Normal DNS maps a hostname to an IP address:

Phase 6: Configure and verify listeners

The minimum recommended listeners are: Listener Protocol Binding Implicit TLS smtp SMTP [::]:25 No submissions SMTP [::]:465 Yes submission SMTP [::]:587 No imaps IMAP [::]:993 Yes http HTTP [::]:8080

Phase 5: Share Dokploy’s certificate with Stalwart

Dokploy’s certificate currently protects:

Phase 4: Configure reverse-proxy behavior

Navigate to:

Phase 3: Complete the Stalwart setup wizard

On first startup, Stalwart enters bootstrap mode and prints temporary administrator credentials in its logs.

Phase 2: Create the public DNS and Dokploy route

In your DNS provider, add: