Phase 4: Configure reverse-proxy behavior

Navigate to:

Settings
→ Network
→ HTTP
→ General

Enable:

Obtain remote IP from Forwarded header

This lets Stalwart see the original client IP sent by Traefik instead of seeing only the reverse proxy’s internal address.

Then go to:

Settings
→ Network
→ HTTP
→ Security

Configure:

Enable HTTP Strict Transport Security: Enabled
Permissive CORS policy: Disabled

Do not enable Proxy Protocol for this setup.

HTTP traffic uses forwarded HTTP headers. SMTP and IMAP connect directly to Stalwart and do not pass through Traefik.