Stalwart 1.0 Beats Postfix and Dovecot in 35 of 38 Vendor Tests, and Moves New Features Into a Private Repo

Stalwart Labs released version 1.0.0 of its Rust mail server on October 26, with a new database layout that no 0.16.x install can upgrade to in place. The release notes also say new features and test suites are now developed in a private repository before each release.

The changes are listed in the v1.0.0 release notes, dated 2026-10-26. The performance figures come from a blog post by Mauro D., the project maintainer. Every benchmark number below is vendor-supplied. The post says its scripts, configurations and raw results sit in a benchmarks repository that anyone with an Azure account can rerun.

What the 35-of-38 comparison measures

The post compares Stalwart with Postfix 3.11 and Dovecot 2.4 on identical Azure servers: 8 AMD EPYC Zen 5 vCPUs, 32 GiB of RAM and local NVMe storage. The test data was 1,000 mailboxes plus three mailboxes of up to 250,000 messages. Stalwart was faster in 35 of 38 headline comparisons.

Operation	Stalwart 1.0	Comparison server
IMAP login with full TLS	5.1 ms	28 ms (Dovecot)
Full-text search, 250,000-message mailbox	3.75 ms	136 ms (Dovecot)
IDLE notification	3.3 ms	about 500 ms (Dovecot)
SMTP acceptance rate	5,445 messages/s	723 messages/s (Postfix)

The three losses are all Dovecot wins on a single operation: marking every message in a mailbox as read at once. The post lists them rather than burying them.

1. Stalwart 1.05445 messages/s
2. Postfix 3.11723 messages/s

Source: Stalwart blog, Stalwart v1.0, 2026-10-26, accessed 2026-10-27

The comparison is a stack against a single process. Postfix handles SMTP and Dovecot handles IMAP, while Stalwart does both. One Hacker News commenter, lunargamma676, put the appeal that way: "it's one process instead of postfix plus dovecot plus rspamd glued together". Another, dalvrosa, replied that simplicity matters more than speed.

Author-run numbers need that caveat everywhere. The site has already covered PaperPilot's 4.5 ms PDF figure, which its own table contradicted, and WorldTUI's 80 of 106 score on a shell test its author wrote.

Wietse Venema, pictured, created Postfix, the server Stalwart's SMTP numbers are measured against.

Why v0.16 installs cannot upgrade in place

The post says the migration tool, stalwart-migrate, requires v0.16.27 or later. That release shipped October 18, so operators on older 0.16.x builds update first. The tool converts settings, copies data into a new v1.0 store and leaves the old store untouched. Later runs copy only changes, so downtime is limited to a short final run after v0.16 stops.

IMAP and JMAP identifiers are preserved. OAuth users must sign in again, and the full-text index rebuilds in the background. Installs on v0.15 or earlier use a migration proxy and a tool called Vandelay to move accounts one at a time.

Two other changes can break a working setup. Clusters now require a Redis-based in-memory store. The OAuth Profile for Open Public Clients is fully enforced, so external OIDC providers that do not conform may stop working with mail clients such as Apple Mail. The post says compatibility settings exist for those providers and that they weaken security checks.

The AGPL-3.0 source stays public, but features start in private

The release notes say the source code of every release stays public under AGPL-3.0. They add that test suites and new features are now built in a private repository before release. The repository page describes a dual licence: AGPL-3.0 plus the proprietary Stalwart Enterprise License v2, with about 85% of features free under the AGPL.

Version 1.0 lists AI models and an AI spam classifier as Enterprise features. The repository names multi-tenancy, SCIM provisioning, sharded storage and live telemetry as earlier Enterprise examples. The blog post does not discuss the licence change, and the 20-comment Hacker News thread, which reached 64 points, did not raise it. Two commenters said they bought licences to support the project.

The repository showed 15.4k stars on October 27. The next checkable item is the benchmarks repository: the 35-of-38 result stands or falls on whether a third party reruns it.