Version 0.16.20 puts seven protocols in one server
Stalwart 0.16.20 handles SMTP, IMAP, JMAP, POP3, CalDAV, CardDAV, and WebDAV in one Rust codebase. It also has a spam filter, web administration, OAuth, OIDC, LDAP and SQL directories, several storage backends, metrics, tracing, queues, and clustering. Consolidation is the appeal: one configuration model can cover email, calendars, contacts, shared files, authentication, and delivery policy.
Consolidation also enlarges the failure domain. A bad storage choice can affect mail and calendars, while an authentication outage can reach every client protocol. The project offers RocksDB for a small node and external databases, object stores, search engines, caches, and cluster coordination for larger deployments. Each extra backend needs its own backup, credentials, monitoring, latency budget, and tested restoration path. One binary reduces package sprawl, not operational responsibility.
The 1,710-file workspace exceeded both 900-second caps
Our checkout contained 1,710 files, about 444,830 source lines, and 23.7 MB before compilation. Cargo installed 797 packages in 45 seconds. The repository has 8 CI workflow files, a Dockerfile, and a tests directory. This is a large multi-crate server rather than a small mail daemon, and a cold Rust build has to compile storage, protocol, cryptography, HTTP, and service layers.
For deployment, the published binary or container is the practical route. Source contributors still need a fast machine, persistent Cargo caches, and enough time to reproduce CI. Our 3-CPU, 12 GB sandbox did not run out of memory or print a compiler error. It simply did not finish either long command before the lab stopped it, which is different from a failed build and still important for planning.
What happened when we ran it
Our sandbox installed commit 6d5c658 in 45 seconds, resolving 797 Rust packages. The build then timed out at 900 seconds. A separate test command also timed out at 900 seconds. We used an unprivileged lab-rust:1 container with 3 CPUs, 12 GB of RAM, and no secrets. No completed binary, passed test count, or failed test count came out of those capped commands.
The final test lines were compiling email, http_proto, dav, smtp, imap, pop3, services, migration, jmap, scim, http, and managesieve, all at version 0.16.20. The tail contains no assertion failure and no compiler diagnostic. It supports one narrow conclusion: a clean source test run needs more than 15 minutes on this machine. It says nothing about runtime throughput or protocol correctness after a successful build.
Five setup screens do not finish the mail job
The Docker setup wizard has 5 screens for identity, storage, account directory, logging, and DNS management. The image exposes examples for 10 ports and persists configuration plus data in separate volumes. A one-time administrator password appears in the container logs, and the docs warn that it is shown only once. Bind-mounted directories must be writable by UID 2000.
A public deployment then needs MX, DKIM, SPF, DMARC, client-discovery, and optional MTA-STS or TLSA records. Port 25 must receive server mail; 443 carries administration, JMAP, OAuth, ACME, discovery, and MTA-STS. The security guide recommends disabling unused listeners, including plain IMAP on 143, optional POP3 ports, and bootstrap HTTP on 8080. Stalwart can publish DNS automatically, but the operator must verify the records and remote delivery.
The first WebUI bundle is downloaded from GitHub. If outbound HTTPS is blocked, the requirements page says /admin and /account return 404 until the bundle is staged elsewhere or the download succeeds. That detail matters in restricted networks. Certificate issuance also needs ACME access, and mail authentication performs public DNS lookups. An isolated server can run, but several advertised conveniences need explicit egress allowances.
The v0.16 migration can stop calendars and contacts
The v0.16 upgrade guide calls its management and configuration layer completely incompatible with earlier releases. Operators coming from v0.15 must export settings, stop the old server, back up the database, start v0.16 in recovery mode, apply converted configuration, and recalculate quotas. Every cluster node must stop before migration because an old node can write obsolete records and corrupt shared state.
User data stays in place, but account names become full email addresses and DAV URLs change with an encoded @. CalDAV, CardDAV, and WebDAV clients therefore need new paths. The guide also says the old REST management API is replaced by JMAP and warns against deleting migrated Account objects during partial recovery because deletion schedules stored mail, calendars, and contacts for removal. That is a migration to rehearse on a copy.
Two licenses and one contributor gate narrow adoption
The repository uses AGPL-3.0 plus the proprietary Stalwart Enterprise License v2, with file-level notices deciding which terms apply. Release v0.16.20 labels SCIM v2 as Enterprise. A business should map required features to the edition before building automation around them, then decide whether AGPL obligations or an enterprise agreement fit its distribution and modification model.
GitHub reported 14,439 stars, 69 combined open issues and pull requests, a release on 2026-08-30, and another push on 2026-08-31. That is current maintenance. Outside contributions face a tighter gate: pull requests require prior vouching, accepted work is mainly fixes and translations, and contributors must sign the stated fiduciary agreement. Operators get an active product; would-be feature authors should expect discussion before code.