Final checklist

The deployment is complete when the following are true:

[ ] mail.example.com resolves to the VPS IPv4
[ ] VPS IPv4 PTR resolves to mail.example.com
[ ] MX points example.com to mail.example.com
[ ] SMTP port 25 receives internet mail
[ ] SMTP port 465 presents a trusted certificate
[ ] SMTP port 587 supports STARTTLS
[ ] IMAP port 993 presents a trusted certificate
[ ] SMTP greeting uses mail.example.com
[ ] Source IP list is empty in Docker bridge mode
[ ] MX route uses v4Only when Docker IPv6 is unavailable
[ ] Root SPF record resolves
[ ] Mail-host SPF record resolves
[ ] DKIM records resolve
[ ] DMARC exists in monitoring mode
[ ] MTA-STS policy returns HTTP 200
[ ] TLS reporting record resolves
[ ] Autoconfig returns correct client settings
[ ] Primary mailbox receives mail
[ ] Aliases receive mail
[ ] Catch-all receives unknown recipients
[ ] Outgoing mail reaches multiple providers
[ ] SPF passes
[ ] DKIM passes
[ ] DMARC passes
[ ] CalDAV works
[ ] CardDAV works
[ ] Offsite backups are scheduled
[ ] A test restore has been completed
[ ] Certificate renewal monitoring is scheduled
[ ] Administrator 2FA is enabled
[ ] DMARC reports are being reviewed
[ ] External storage migration is documented

The functional deployment ends when incoming and outgoing mail work correctly.

The operational work then becomes:

1. Maintain offsite backups.

2. Test restoration periodically.

3. Monitor certificate expiration and reload renewed certificates.

4. Review DMARC reports.

5. Upgrade Stalwart carefully.

6. Migrate structured data and mail blobs off the VPS when the mailbox becomes important.