Links

Installation guide for Docker

Docker

/srv/stalwart/docker-compose.yml

services:
  stalwart:
    image: stalwartlabs/stalwart:latest
    container_name: stalwart
    restart: unless-stopped
    volumes:
      - /srv/stalwart/data:/opt/stalwart
      - /etc/letsencrypt:/etc/letsencrypt:ro
    ports:
      - "25:25"
      - "465:465"
      - "587:587"
      - "993:993"
      - "4190:4190"
      - "127.0.0.1:8080:8080"
    environment:
      - TZ=Europe/Paris
    cap_add:
      - NET_BIND_SERVICE

/etc/nginx/sites-available/stalwart.conf

server {
    listen 80;
    server_name mail.bananeatomic.fr;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name mail.bananeatomic.fr;

    ssl_certificate     /etc/letsencrypt/live/bananeatomic.fr/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/bananeatomic.fr/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# start the service
docker compose -f /srv/stalwart/docker-compose.yml up -d

# get the admin password
docker compose -f /srv/stalwart/docker-compose.yml logs stalwart | grep -i password

Configuration

Change the admin password

# hash the new password
openssl passwd -6

/srv/stalwart/data/etc/config.toml

authentication.fallback-admin.secret = "HASHED PASSWORD"

# restart the service
docker compose -f /srv/stalwart/docker-compose.yml restart stalwart

Settings

Settings → Server → Network → Hostname = mail.bananeatomic.fr
Settings → Security → Allowed IPs → 172.20.0.0/16
Management → Directory → Domain → Create domain → Domain name = bananeatomic.fr ⇒ then it displays the DNS records to add
Management → Directory → Accounts → Create account

Email alias

Management → Directory → Accounts → select the account where to add the alias
Email → Email aliases → Add item

Setting up DNS

Type de champs	Sous-domaine	Cible	Description
MX		10 bananeatomic.fr.	10 is the priority of the email server against the others
DKIM or TXT	202603e._domainkey	v=DKIM1; k=ed25519; h=sha256; p=xxx
DKIM or TXT	202603r._domainkey	v=DKIM1; k=rsa; h=sha256; p=yyy
SPF or TXT		v=spf1 mx ra=postmaster -all	mx autoriser les serveurs MX de bananeatomic.fr à envoyer des emails -all fail pour les autres hôtes qui envoient du courrier de bananeatomic.fr
DMARC or TXT	_dmarc	v=DMARC1; p=reject; sp=reject; aspf=s;	p règle pour le domaine (none, quarantine, reject), que faire si les vérifications SPF ou DKIM échouent sp règle pour les sous-domaines aspf mode d'alignement (relaxed: autorise les sous-domaines à matcher, strict)
TXT	_smtp._tls	v=TLSRPTv1; rua=mailto:postmaster@bananeatomic.fr	permet de recevoir des rapports des problèmes TLS du serveur
CNAME	autoconfig	mail.bananeatomic.fr
CNAME	autodiscover	mail.bananeatomic.fr

# test
dig TXT 202603e._domainkey.bananeatomic.fr
dig TXT 202603r._domainkey.bananeatomic.fr
dig MX bananeatomic.fr
dig TXT bananeatomic.fr

ufw

ufw allow 25/tcp comment 'SMTP tcp 25'
ufw allow 465/tcp comment 'SMTPS tcp 465'
ufw allow 587/tcp comment 'SMTP STARTTLS tcp 587'
ufw allow 993/tcp comment 'IMAP TLS tcp 993'

Logs

# docker service logs
docker compose -f /srv/stalwart/docker-compose.yml logs stalwart --tail=50

# stalwart logs
ls /srv/stalwart/data/logs/
tail -50 /srv/stalwart/data/logs/stalwart.log.2026-03-29

SMTP2GO

As the port 25 is blocked by Orange the internet provider, it is not possible to send emails.
A solution is to use a relay service like smtp2go

/srv/stalwart/data/etc/config.toml

[queue.strategy]
route = [ { if = "is_local_domain('', rcpt_domain)", then = "'local'" },
          { else = "'smtp2go'" } ]

[queue.route."smtp2go"]
type = "relay"
address = "mail.smtp2go.com"
port = 465
protocol = "smtp"

[queue.route."smtp2go".tls]
implicit = true
allow-invalid-certs = false

[queue.route."smtp2go".auth]
username = "LOGIN_SMTP2GO"
secret = "PWD_SMTP2GO"