Stalwart vs Dovecot 2.4 CE: A Head-to-Head Mail Server Evaluation on Kubernetes

Software-Testing, das sich bezahlt macht: Ein Feldbericht aus drei Codebasen

Evidenzbasierte Testing-Praxis aus Produktions-Codebasen — property-basierte Invarianten, gezielte Fehlerinjektion, Contract-Tests, benchmark-verifizierte Performance und Qualitäts-Gates, die durchgesetzt werden, nicht nur versprochen.

k3s Disaster-Recovery-Testing und Edge-Patterns

Umfassende DR-Test- und Edge-spezifische Patterns für k3s — Failover-Validierung, geplante Snapshots, Multi-Cluster-Recovery und RPO/RTO-Planung.

TL;DR: We evaluated Stalwart v0.16.6 and Dovecot 2.4 CE as mail server backends for a large multi-tenant organization on Kubernetes. Stalwart wins on FTS performance (3-13× faster), memory efficiency (2.4× less), protocol breadth (11 vs 3), and native HA. Dovecot wins on pure IMAP speed (63ms vs 98ms for basic ops) and ecosystem maturity.

The choice between Dovecot and Stalwart comes down to a trade-off between proven stability and modern architecture. Dovecot has been the IMAP standard for two decades, deployed on millions of servers with predictable behaviour. Stalwart is a Rust-based all-in-one solution that replaces the traditional Postfix + Dovecot + spam filter stack with a single binary.

Why This Evaluation?

The organization runs Dovecot 2.3 CE in production for tens of thousands of users across multiple clusters. Dovecot 2.4 CE removed two critical HA features — Director (user routing) and Replicator (mailbox sync) — pushing them to unsupported community plugins. We needed to evaluate whether Stalwart, a modern Rust-based mail server with native clustering, could serve as a replacement.

Evaluation Setup

Both systems were deployed on a single Kubernetes cluster with standard persistent storage classes. Each stack got its own namespace with identical-grade resources.

Architecture Contrast

Dovecot follows the separation-of-concerns model: Postfix for SMTP delivery, Dovecot for IMAP/POP3 access, and independent spam filters like SpamAssassin or Rspamd. This modularity allows you to replace components independently but requires coordination between six different processes. Configuration means editing separate files in /etc/dovecot/ and /etc/postfix/, troubleshooting involves scattered logs, and understanding how each component talks to the others.

Stalwart consolidates SMTP, IMAP, POP3, JMAP, CalDAV, CardDAV, WebDAV, spam filtering, and a web admin interface into one Rust binary. The architecture is intentionally monolithic: when email stops flowing, you check one process, not six. This reduces operational complexity but locks you into the Stalwart ecosystem.

Benchmark Results

IMAP Performance (Fair Comparison)

Same protocol, same commands, same measurement methodology.

Dovecot's 20+ years of IMAP optimization shows in basic operations. Its maildir handling and connection management are finely tuned. Stalwart's IMAP implementation is competitive but not as optimized — yet.

JMAP: The Protocol Advantage

Stalwart's native JMAP API is a fundamentally different approach from IMAP. Where IMAP requires multiple round-trips (LOGIN → SELECT → FETCH), JMAP batches everything into a single request.

JMAP is 120-170× faster than IMAP for equivalent operations. This isn't a server speed advantage — it's a protocol architecture advantage. JMAP eliminates the round-trip overhead that has plagued IMAP for decades.

Full-Text Search

This is where the gap widens most dramatically:

Stalwart's FTS is 3-13× faster regardless of protocol or mailbox size. Dovecot's flatcurve FTS is stable at scale (warm queries don't degrade), but the baseline is significantly slower.

Resource Usage

Stalwart uses 2.4× less memory despite bundling more protocols. MySQL is the single largest memory consumer in the Dovecot stack at 413 MiB — more than the entire Stalwart stack combined.

SMTP Delivery

The 5-second delay on Stalwart's port 25 is intentional anti-spam behavior. Authenticated submission (JMAP or SMTP-AUTH) delivers in ~50ms.

Scalability

Dovecot scales horizontally through separate IMAP backend processes. Each backend serves a set of clients, and you add more backends as concurrency increases. The theoretical maximum is client_limit * process_limit, usually configured for 40k-100k connections per server. In practice, Dovecot has been tested to 10 million IMAP sessions on a single server using proxy architectures, though this requires multiple IP addresses to avoid TCP port exhaustion.

Stalwart scales differently. It supports clustering natively using peer-to-peer coordination or external coordinators (Kafka, NATS, Redis). Any node in a Stalwart cluster can serve any protocol—IMAP, SMTP, JMAP, or WebDAV—without needing separate load balancers. The distributed SMTP queue allows concurrent processing across multiple instances. This simplifies large deployments because you add nodes and capacity grows automatically, but it requires coordinating state across servers.

For horizontal scaling, both options are viable. Dovecot's multi-process model is battle-tested across thousands of deployments. Stalwart's integrated clustering is newer but designed specifically for large-scale deployments from day one.

High Availability

Dovecot achieves high availability through proxy-based architectures. Deployments typically run a pool of IMAP proxies that balance load across backend storage servers. If a backend fails, the transparent proxy layer reroutes traffic. Postfix continues accepting and queueing mail even if Dovecot is down, providing queue separation.

Stalwart's high availability is built-in. The clustering model allows any node to serve any protocol, and the distributed state replication handles failures automatically. Fault tolerance is partition-tolerant, so if network partitions occur within a cluster, the system continues operating with minimal manual intervention. You still need external DNS and TLS infrastructure (Stalwart handles ACME natively), but the mail layer itself is self-coordinating.

The trade-off is operational control. With Dovecot, you design and maintain the high-availability architecture yourself. With Stalwart, you configure clustering parameters and the system handles the complex coordination. This is easier for most teams, but it means you're trusting Stalwart's implementation of distributed systems unless you purchase an Enterprise license to inspect the source.

Protocol Support

Dovecot's JMAP support comes through the imap-jmap plugin, which adds JMAP on top of the IMAP protocol. This works but adds translation overhead. Stalwart implements JMAP natively, which provides the dramatic performance advantages shown in the benchmarks above.

For traditional IMAP clients—Outlook, Thunderbird, Apple Mail—both servers work identically. The difference shows in modern clients that prefer JMAP. Fastmail, ProtonMail, and newer desktop clients can use JMAP to sync more efficiently than IMAP, especially over high-latency connections.

Operational Differences

Migration Considerations

Migrating from Dovecot to Stalwart is not a drop-in replacement. Key differences:

Configuration model: Dovecot has a steep learning curve with multiple configuration files (dovecot.conf, dovecot-sql.conf.ext, conf.d/ directories, per-user Sieve scripts). Stalwart uses a single configuration file and a web admin interface for most operations. You can still edit config files directly, but the web UI encourages a GUI-first approach.

Authentication: Dovecot uses separate passdb and userdb backends, with caching via auth_cache_size. Stalwart supports LDAP, SQL, internal databases, OIDC, OAuth2, and API keys, with the same authentication layer across all protocols. If you're moving from Dovecot's SQL auth to Stalwart's internal auth, you'll need to export and re-import accounts.

Mailbox migration: Both support Maildir, which simplifies data migration. Copy the Maildir hierarchy directly, then reindex. Stalwart's multiple backend options (RocksDB, FoundationDB, PostgreSQL) mean you may want to migrate from filesystem-based mailboxes to an indexed database, but this is optional.

Sieve rules: Both support RFC 5228 ManageSieve. Stalwart adds JMAP for Sieve Scripts, which is a draft extension but allows users to edit filter rules from modern clients. Dovecot's Sieve implementation is more mature with extensive field testing across multiple releases.

Spam filtering: Dovecot integrates with SpamAssassin or Rspamd via milter protocol. Stalwart includes a built-in spam and phishing filter with statistical classification, DNSBL checking, and optional LLM-driven analysis. You can disable Stalwart's built-in filter and use Rspamd via milter, but then you're back to running a separate spam filter process.

The most disruptive change is architectural: Dovecot's separation allows you to upgrade components independently. If Stalwart has a bug that causes IMAP crashes, your whole mail server stops. If Dovecot's IMAP crashes, SMTP and spam filtering continue working. High-availability setups mitigate this, but the point stands: modularity provides fault isolation.

Community and Ecosystem

Dovecot has been the de facto standard since the early 2000s. The community is large and mature, with extensive documentation covering edge cases, configuration patterns, and migration guides. If you hit a weird problem with Dovecot, someone has probably documented the solution on the mailing list archives or a forum post within the last decade. Installation guides exist for every Unix-like distribution.

Stalwart's community is growing but smaller. Hundreds of contributors on GitHub, active Discord and Reddit presences, and a rapidly improving documentation site. The release cadence is much faster than Dovecot's (weekly updates vs major releases every 1-2 years). However, if you encounter a niche issue in Stalwart, you may be on your own while the team investigates. The complexity of Rust means fewer people can patch bugs even with source access.

For commercial deployments, both approaches offer support models. Dovecot Pro (commercial offering) provides priority support and enterprise features. Stalwart Labs sells Enterprise licenses on a per-mailbox subscription basis, with premium support options. If you need guaranteed SLAs or legal indemnification, both options exist.

Known Limitations

1. FoundationDB blocked by CPU — The virtualized environment lacks AVX/AVX2/FMA CPU instructions required by FDB 7.1+. Stalwart HA testing limited to single-node PostgreSQL.
2. Dovecot 2.4 CE removed Director/Replicator — HA requires unsupported Lua + Wormhole plugins. The CE vision is explicitly "single node email backend server."
3. Single-node evaluation — No HA failover timing was possible. Results at 10k+ scale may differ.
4. localhost benchmarks — All measurements on localhost; network overhead not captured.

When to Choose Dovecot

Dovecot is the right choice when:

• You need maximum predictability. Two decades of production deployment means you know exactly how it behaves under load, and edge cases are well-documented.
• You already have a working Postfix + Dovecot + spam filter stack. The migration cost and risk outweigh the benefits of replacing a functioning system.
• Best raw IMAP performance matters. Benchmarks show Dovecot is 28-36% faster on basic IMAP operations (63ms vs 98ms).
• You require granular control over components. Maybe you use Postfix's advanced routing, integrate with a proprietary spam filter, or have specialised Sieve rules that depend on specific Dovecot extensions.
• You're on legacy infrastructure. Dovecot runs on any Unix-like system from the last 15 years, including RPM-based distros where you might not have up-to-date Rust toolchains.
• Your team prefers community-driven troubleshooting over vendor support. With Dovecot, you can search mailing list archives and find answers from people who have seen your exact issue.

Dovecot's maturity also means the configuration is stable. The dovecot.conf format evolves slowly, major releases are carefully tested, and backward compatibility is taken seriously. If you upgrade Dovecot every 2-3 years, you won't find your configuration broken by incompatible changes.

When to Choose Stalwart

Stalwart is the right choice when:

• You're deploying a new mail server from scratch or considering a migration. The all-in-one nature means you can have a complete system running in 30 minutes instead of stitching together Postfix, Dovecot, spam filters, and webmail.
• Full-text search performance is critical. Benchmarks show Stalwart is 3-13× faster on FTS queries regardless of protocol or mailbox size.
• Memory efficiency matters. Stalwart's stack uses 185 MiB vs Dovecot's 441 MiB — 2.4× less memory despite bundling more protocols.
• JMAP support matters for your use case. Modern mail clients and webmail frontends can sync more efficiently over JMAP, with sub-millisecond API responses vs 63-98ms for IMAP.
• You need native collaboration features. CalDAV, CardDAV, and WebDAV come built-in, with access controls and sharing managed from the same admin interface as email.
• Native HA is a requirement. Stalwart's coordinator-less clustering provides built-in user routing, mailbox sync, and distributed SMTP queuing without external plugins.
• Your team prefers a modern architecture over modular complexity. One binary, one configuration file, one web UI, one set of logs.
• You want to deploy at scale without designing proxy architectures. Stalwart's clustering supports horizontal scaling natively.
• You're comfortable with AGPL-3.0 licensing or willing to purchase an Enterprise license. The open-source version is fully functional, but commercial deployments of AGPL-3.0 software have legal implications.

Stalwart's rapid development cycle is also an advantage. Features like native JMAP, built-in TLS certificate provisioning, and AI-powered spam filtering arrive weeks or months before they would in the traditional stack. If staying current with email protocols matters to you, Stalwart ships innovations faster.

The Verdict

For a large multi-tenant environment requiring HA, CalDAV/CardDAV, and modern API access, Stalwart is the stronger candidate. Its native HA, broader protocol support, significantly faster FTS (3-13×), and lower resource footprint (2.4× less memory) outweigh Dovecot's advantages in raw IMAP speed and ecosystem maturity.

For existing Dovecot installations, the calculus is different. Migration requires rearchitecting your mail infrastructure, learning a new configuration model, and accepting AGPL-3.0 or licensing costs. Dovecot works. Migrating it introduces risk without clear benefit unless you need specific Stalwart features that Dovecot cannot provide via plugins or add-ons.

The critical risk is the FoundationDB CPU compatibility issue — ensure your K8s nodes support AVX instructions before committing to a Stalwart HA deployment.

Hybrid approaches exist — run Dovecot as IMAP with Postfix for SMTP, and add Stalwart's JMAP server to provide modern sync. But this defeats the simplicity argument and combines the operational complexity of both stacks.

The trade-off ultimately comes down to your team's expertise and your operational tolerance. If you have deep Dovecot knowledge and a working deployment, stay put. If you're building from scratch or your team prefers modern tooling over established patterns, Stalwart represents the future of self-hosted email infrastructure.

Evaluation conducted May 2026 on a Kubernetes cluster with standard persistent storage, cert-manager TLS, and MinIO S3. All benchmarks are sequential single-user from localhost unless otherwise noted.