Phase 0: Prepare the VPS

0.1 Confirm that ports are available

Before deploying Stalwart, verify that no old forwarding container, Postfix service, Exim service, or previous mail experiment is occupying the required ports.

Run on the VPS:

sudo ss -lntp | grep -E ':(25|465|587|993)\b'

If nothing is returned, the ports are available.

Check Docker containers too:

docker ps --format 'table {{.Names}}\t{{.Ports}}' |
grep -E '25->|465->|587->|993->'

Remove or stop anything already using these ports.

Only one service can own each host port.

0.2 Test outbound SMTP port 25

Many hosting companies restrict outbound port 25 to reduce spam.

Test IPv4 connectivity from the VPS:

openssl s_client \
  -4 \
  -starttls smtp \
  -connect gmail-smtp-in.l.google.com:25 \
  -crlf \
  -brief

A successful result looks similar to:

CONNECTION ESTABLISHED
Protocol version: TLSv1.3
Verification: OK
250 SMTPUTF8

If the connection times out, investigate:

• VPS-provider SMTP restrictions

• Local firewall rules

• Network-level restrictions

• Account-level abuse controls

Do not continue until the VPS can reach external mail servers on port 25.

0.3 Check firewall systems

Inspect the firewall configuration:

sudo ufw status verbose
sudo iptables -nvL
sudo nft list ruleset

Be aware that Docker-published ports may bypass ordinary UFW input rules because Docker installs its own forwarding and NAT rules.