Jul 25, 2026OverviewSelf-hosting email is not difficult because of the mail-server container itself. The complexity comes from coordinating several independent systems correctly:BBeendiid Caydiid
Jul 25, 2026Phase 0: Prepare the VPSBefore deploying Stalwart, verify that no old forwarding container, Postfix service, Exim service, or previous mail experiment is occupying the required ports.BBeendiid Caydiid
Jul 25, 2026Phase 1: Deploy Stalwart in DokployCreate a new Docker Compose application in Dokploy. Use this initial Compose file: services: stalwart-mail: image: stalwartlabs/stalwart:v0.16 restart: unless-stopped environment: STALWART_PUBLIC_URL:BBeendiid Caydiid
Jul 25, 2026Phase 2: Create the public DNS and Dokploy routeIn your DNS provider, add:BBeendiid Caydiid
Jul 25, 2026Phase 3: Complete the Stalwart setup wizardOn first startup, Stalwart enters bootstrap mode and prints temporary administrator credentials in its logs.BBeendiid Caydiid
Jul 25, 2026Phase 5: Share Dokploy’s certificate with StalwartDokploy’s certificate currently protects:BBeendiid Caydiid
Jul 25, 2026Phase 6: Configure and verify listenersThe minimum recommended listeners are: Listener Protocol Binding Implicit TLS smtp SMTP [::]:25 No submissions SMTP [::]:465 Yes submission SMTP [::]:587 No imaps IMAP [::]:993 Yes http HTTP [::]:8080BBeendiid Caydiid
Jul 25, 2026Phase 7: Configure reverse DNSNormal DNS maps a hostname to an IP address:BBeendiid Caydiid
Jul 25, 2026Phase 9: Create mailboxes, aliases, and catch-all deliveryDo not use the administrator account as a daily mailbox.BBeendiid Caydiid
Jul 25, 2026Phase 10: Publish DNS recordsAfter the mailbox and listeners are ready, publish the MX and authentication records.BBeendiid Caydiid
Jul 25, 2026Phase 12: Configure MTA-STS and TLS reportingMTA-STS tells other mail servers that your SMTP service should use encrypted transport and identifies the valid MX hostname.BBeendiid Caydiid
Jul 25, 2026Phase 13: Add calendars and contactsStalwart already provides CalDAV and CardDAV through its HTTP service.BBeendiid Caydiid
Jul 25, 2026Phase 14: Connect a mail clientUse the full email address as the username.BBeendiid Caydiid
Jul 25, 2026Understanding SPF, DKIM, and DMARCThese systems authenticate outgoing mail.BBeendiid Caydiid
Jul 25, 2026Storage and backup strategyThe lightweight deployment uses RocksDB and local Docker volumes.BBeendiid Caydiid
Jul 25, 2026Certificate renewal runbookCertificate handling is the most important recurring operational concern in this architecture.BBeendiid Caydiid
Jul 25, 2026Upgrade & Recovery proceduresPin the Stalwart image to a tested version:BBeendiid Caydiid
