Phase 6: Configure and verify listeners

The minimum recommended listeners are:

Port 587 requires its own Stalwart listener

Publishing this in Docker:

- "587:587"

does not automatically make Stalwart listen on port 587.

If external connections return:

Connection refused

check:

Settings
→ Network
→ Listeners

Create a listener:

Name: submission
Protocol: SMTP
Bind address: [::]:587
Implicit TLS: Disabled

Port 587 starts as normal SMTP and upgrades using STARTTLS.

Port 465 starts inside TLS, so implicit TLS must be enabled there.

Verify host port publication

Run on the VPS:

sudo ss -lntp | grep -E ':(25|465|587|993)\b'

Check Docker:

docker ps --format 'table {{.Names}}\t{{.Ports}}' |
grep -E '25->|465->|587->|993->'

Expected mappings include:

0.0.0.0:25->25/tcp
0.0.0.0:465->465/tcp
0.0.0.0:587->587/tcp
0.0.0.0:993->993/tcp

Verify externally

From another machine:

nc -vz -w 10 mail.example.com 465
nc -vz -w 10 mail.example.com 587
nc -vz -w 10 mail.example.com 993

Test port 587 properly:

openssl s_client \
  -starttls smtp \
  -connect mail.example.com:587 \
  -servername mail.example.com \
  -crlf

A residential internet provider may block outbound port 25. A failed port-25 test from home does not necessarily mean the VPS is unreachable.

Use one of these instead:

• Another VPS

• An external SMTP-testing service

• A real incoming message

• Server logs showing an external SMTP connection