Stalwart vs Mailcow in 2026: 180 MB vs 2.4 GB of RAM, and Which Fits Your VPS

Stalwart vs mailcow comes down to RAM and webmail: Stalwart is the better pick for a small VPS whose users read mail in apps, and mailcow is better when users want webmail in the browser and you can give it 6 to 8 GB of RAM. In the same 2 vCPU, 3 GB Debian 13 test container on 18 October 2026, Stalwart 0.16.26 idled at about 180 MB of RAM and mailcow 2026-09a at 2.4 GB. Stalwart took in 1,000 test messages in 66 seconds. mailcow, squeezed into half the 6 GiB its docs ask for, needed 282 seconds as shipped, or 122 seconds with ClamAV, its virus scanner, switched off. In return, mailcow gives you webmail, Exchange ActiveSync and virus scanning out of the box. The first table picks one of our VPS hosting plans for each case.

Key facts, checked on 18 October 2026:

• Current releases: Stalwart v0.16.26 of 11 October 2026 (Stalwart releases) and mailcow 2026-09a of 6 October 2026 (mailcow releases).
• mailcow asks for at least 6 GiB of RAM plus 1 GiB of swap, recommends 8 GiB for about 5 to 10 users, and does not support LXC or OpenVZ containers (mailcow system requirements).
• Stalwart's docs give about 100 MB at idle and 1 GB of RAM for 5 to 10 users (Stalwart requirements).
• Stalwart is dual-licensed under AGPL-3.0 and a proprietary Enterprise licence (Stalwart licence notice), and its Community edition is free "with no mailbox limit" (Stalwart pricing). mailcow is GPL-3.0.
• Gmail has required SPF or DKIM, valid forward and reverse DNS and TLS from every sender since 1 February 2024 (Google sender guidelines).

Stalwart or mailcow: which should you pick?

The best self-hosted mail server for 2026 depends on how your users read their mail. If you are still unsure whether to run mail yourself, our guide answers should you self-host email with a go or no-go checklist. The cases we see most:

Every city runs either server, so the city follows your users. VPS plans share their vCPUs with other customers, and VDS plans have dedicated ones (VPS vs VDS comparison). A mail server idles most of the day, so shared vCPUs suit Stalwart. You can upgrade later from the client area with a short reboot.

What is the difference between Stalwart and mailcow?

Stalwart is an open-source mail server written in Rust that runs SMTP, IMAP, POP3, JMAP, CalDAV, CardDAV and a spam filter as one program. mailcow bundles long-established mail programs into 18 Docker containers: Postfix moves mail between servers, Dovecot stores it for IMAP, Rspamd filters spam, ClamAV scans for viruses, SOGo provides webmail and MariaDB holds the settings.

JMAP is a newer protocol than IMAP that syncs mail, calendars and contacts over HTTPS. CalDAV and CardDAV are the standard calendar and contact sync protocols. Exchange ActiveSync is Microsoft's protocol for the same job on phones.

Stalwart vs mailcow RAM and speed: what we measured on one server

Both ran, one at a time, in a Debian 13 container limited to 2 vCPUs and 3 GB of RAM on our Amsterdam test server (AMD EPYC 7742). The test client, swaks, sent 1,000 messages of about 4 KB through port 465 with a login, 8 at a time, from inside the same container. RAM "in use" is what free -m showed for the whole container. mailcow supports KVM, which our plans use, but not LXC containers like our lab, so read its columns as a memory measurement only.

The default mailcow was cramped in 3 GB. No process was killed, but the container hit its memory limit more than 300,000 times during the run and had to reclaim memory each time. That, plus the CPU time ClamAV spent scanning every message, explains most of the slow run and the 8 failures. Switching ClamAV off saved about 740 MB at idle and cut the run time by more than half.

Our earlier test on a 16 GB server, in the mailcow setup guide, showed a similar 2.3 GB at idle, 1 GB of it ClamAV. For other apps, see our RAM requirements for self-hosted apps.

On 1 vCPU and 1 GB, the size of our VPS Nano, Stalwart took 129.9 seconds for the same 1,000 messages, none failed, and the Stalwart process peaked at 237 MiB. Nano's 20 GB disk is the tighter limit for years of attachments, so we suggest Micro.

Stalwart's default limits refused our first test

Our first Stalwart run refused 975 of 1,000 messages. Stalwart ships two inbound limits that also apply to logged-in users: 5 per second from one IP address, and 25 messages per hour from one sender domain to one recipient. We disabled them for the load tests only. The second one bites in real life: if a shop script mails every order to orders@, message 26 within the hour is refused. Raise that limit rather than removing it; in stalwart-cli the two rules are MtaInboundThrottle objects.

Features compared: webmail, calendars, ActiveSync and spam

"Lab" marks what we confirmed ourselves.

Sources: Stalwart's feature page, mailcow's documentation and our lab. A milter is a plug-in interface that lets an outside program, such as a virus scanner, check each message. MTA-STS and DANE make other mail servers use encryption when they deliver to you.

Some comparisons still say Stalwart has no calendars or contacts, but both arrived in version 0.12 in May 2025. mailcow's ActiveSync helps phones more than Windows offices: its Outlook page says ActiveSync "is no longer functional" with Outlook 2019 and later.

Which has better spam filtering?

mailcow's Rspamd has the longer track record and learns from the messages users move in and out of Junk. Stalwart's built-in filter sent our SPF-failing test message to Junk Mail, but we did not compare catch rates on real spam, so that only shows the filter works. Its AI spam classifier is an Enterprise feature.

Webmail is the gap people notice first

Stalwart's roadmap calls a webmail client planned but "not currently our immediate priority", with work expected after 1.0. Until then, add Roundcube or another webmail program yourself, or use apps. Our guide to leaving Microsoft 365 covers the rest of an office suite.

Is Stalwart free? Licences and the Enterprise edition

Yes, for almost everyone. A company running either server for its own staff owes nothing under either licence. Duties start only when you change the code: GPL-3.0 when you distribute a modified copy, AGPL-3.0 already when users reach a modified Stalwart over the network.

Stalwart's Enterprise edition adds multi-tenancy (separate customers on one server), archiving and undelete, an AI spam classifier, SCIM provisioning (accounts created from an identity provider) and read replicas (comparison page), plus masked addresses (Enterprise page). On 18 October 2026 its pricing page started it at 25 mailboxes and €2.00 per mailbox per year. A small office will not need it. mailcow has no paid edition.

Is Stalwart production-ready? Updates and security

Stalwart is still version 0.x, and its FAQ warns that data layout and configuration may change before 1.0. Version 0.16.0 of 20 April 2026 brought breaking changes, including a rewritten web interface, and 0.16.19 needed manual database column changes for MySQL and MariaDB users. mailcow ships about monthly; 2026-07a fixed nginx flaw CVE-2026-42533 with a request to update as soon as possible.

Since September 2025, GitHub lists six mailcow advisories, all published on 16 April 2026 and one rated critical, and three Stalwart advisories, two rated high. Stalwart reports that a 2023 audit by Radically Open Security found no vulnerabilities (audit post). On 18 October 2026 Stalwart's GitHub repository had about 15,100 stars and mailcow's about 13,600, and both had been updated on 15 October.

Our view: Stalwart suits a small office whose admin reads the release notes before each update. If nobody will, mailcow's long-established parts are the safer choice. Whichever you run, patch within days.

How to install Stalwart mail server on Debian 13

We ran these exact steps on a fresh Debian 13 container on 18 October 2026. Replace YOUR_DOMAIN with your domain; the server will be mail.YOUR_DOMAIN. Set up SSH keys first, as in our guide on how to secure a Debian 13 VPS, then open the firewall:

# as root
apt update
apt install -y ufw curl xz-utils
ufw allow 22/tcp
ufw allow 25,443,465,993/tcp
ufw --force enable
ufw status

Expect Status: active with 22/tcp and 25,443,465,993/tcp allowed. We use port 22 by number because ufw allow OpenSSH failed in our minimal image with Could not find a profile matching 'OpenSSH'. Port 25 receives mail, 465 sends from your apps, 993 is IMAP, and 443 serves the web admin, JMAP and calendars. Now install Stalwart and read the one-time password:

# as root
curl --proto '=https' --tlsv1.2 -sSf https://get.stalw.art/install.sh -o install.sh
sh install.sh
journalctl -u stalwart -n 200 | grep -A8 'bootstrap mode'

The installer finished in under 3 seconds with Installation complete!. The journal shows username: admin and a password: line, printed once; copy it. The official instructions continue in a browser wizard on port 8080. We used stalwart-cli on the server instead, so port 8080 never faces the internet. Its installer needs xz-utils; without it, the install stopped with xz: Cannot exec.

# as root
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/stalwartlabs/cli/releases/latest/download/stalwart-cli-installer.sh -o cli-installer.sh
sh cli-installer.sh
. "$HOME/.cargo/env"
export STALWART_URL=http://127.0.0.1:8080 STALWART_USER=admin
read -rs STALWART_PASSWORD
export STALWART_PASSWORD
stalwart-cli update Bootstrap --json '{"serverHostname":"mail.YOUR_DOMAIN","defaultDomain":"YOUR_DOMAIN"}'

After read -rs, paste the one-time password and press Enter; nothing shows on screen. The last command prints Updated Bootstrap singleton, username: "admin@YOUR_DOMAIN" and a secret:, your permanent admin password. Save it. By default Stalwart then requests a Let's Encrypt certificate, which needs mail.YOUR_DOMAIN pointing at the server and port 443 open; our lab had no public domain, so we added "requestTlsCertificate":false. Restart and check the ports:

# as root
systemctl restart stalwart
ss -tlnp | grep stalwart

You should see seven LISTEN lines for stalwart: 25, 443, 465, 993, 995, 4190 and 8080. The firewall keeps 8080 closed to the internet. Now create a mailbox and print the DNS records:

# as root, in the same shell
export STALWART_USER=admin@YOUR_DOMAIN
read -rs STALWART_PASSWORD
export STALWART_PASSWORD
stalwart-cli query Domain
stalwart-cli create account/user --json '{"name":"anna","domainId":"b","credentials":{"0":{"@type":"Password","secret":"USE-A-LONG-PASSWORD"}}}'
stalwart-cli get Domain b

This time paste the permanent secret. query Domain shows your domain's Id, b on both our installs. The create command answers Created Account c, and anna could log in over IMAP at once, with Sent Items, Junk Mail and the other folders ready. The last command ends with a Zone File: MX, SPF, two DKIM keys, DMARC, MTA-STS, TLS reporting and SRV records. Copy them to your DNS host, with two changes:

• The suggested DMARC record says p=reject. Start with p=none, read the reports for a few weeks, then tighten it, as our guide to mail server DNS records explains.
• Stalwart's DKIM docs say automatic key rotation, every 90 days by default, needs automatic DNS management through your DNS provider's API. With DNS on manual, as in our lab, rerun stalwart-cli get Domain b after each update and publish any DKIM record you do not have yet. Version 0.16.25 of 5 October 2026 fixed three DKIM rotation bugs, so stay current.

Once the certificate is in place, the web admin is at https://mail.YOUR_DOMAIN/admin. Mail apps send through port 465, because 587 was off in our install.

Running mailcow on a 4 GB VPS

Follow our mailcow installation guide, including its 1 GiB swap file. mailcow's generate_config.sh offers to disable ClamAV only on servers with 2.5 GiB or less, so on 4 GB you switch it off yourself. Treat this as a workaround, not a supported setup: it sits below mailcow's 6 GiB minimum, and we measured it in a 3 GB container, not on a 4 GB VPS.

# as root, in /opt/mailcow-dockerized
sed -i 's/^SKIP_CLAMD=n/SKIP_CLAMD=y/' mailcow.conf
docker compose up -d

Docker recreates the clamd, php-fpm and watchdog containers and prints Started for each. Rspamd still filters spam, but attachments are no longer scanned for viruses.

Reaching Gmail and Outlook: the same work for both

Both servers signed our test mail with DKIM automatically. Whether Gmail and Outlook accept it depends on the server around them:

• Reverse DNS (PTR) maps your IP address back to mail.YOUR_DOMAIN. On RS Computers you set it in the client area, or ask us on Telegram.
• Outbound port 25 is blocked on new RS Computers servers and opened on request through Telegram. Ask before you install.
• SPF lists the servers allowed to send for your domain, DKIM signs each message, and DMARC tells receivers what to do when checks fail. Publish all three; Yahoo also wants valid reverse DNS from every sender (Yahoo sender requirements).

Keep newsletters off your mail server's IP; our listmonk newsletter guide covers sending through a relay. For a blog that sends member newsletters, see Ghost on a VPS vs Ghost(Pro).

Can you migrate from mailcow to Stalwart?

Yes, mailbox by mailbox; there is no converter between the two. The usual tool is imapsync, which copies mail between IMAP servers and can run again at cutover. mailcow builds it in as "sync jobs" for the other direction. Calendars and contacts move as .ics and .vcf exports. Test one account and a few large attachments before you switch the MX record, the DNS entry that tells other servers where to deliver your mail. We did not run a migration in this lab.

Which city: Amsterdam, Dublin or Prishtina

Distance matters less for mail than for websites, but webmail feels it. In our own ping.pe test on 6 October 2026, Frankfurt and London reached our Amsterdam server in 6.6 and 6.7 ms. Dublin suits offices in Ireland and the UK, and Prishtina suits teams in Kosovo and the wider Balkans, with Skopje about 3 ms away on our own network. All plans are KVM virtual machines, which mailcow supports. Availability by city is on the VPS plans page.

Frequently asked questions

Is Stalwart better than mailcow?

For a small server, yes. In our 18 October 2026 test on 2 vCPUs and 3 GB of RAM, Stalwart 0.16.26 idled at about 180 MB against 2.4 GB for mailcow 2026-09a, and took in 1,000 messages in 66 seconds against 282. mailcow is better if you need webmail, ActiveSync or a virus scanner out of the box.

How much RAM does Stalwart need compared with mailcow?

Stalwart's docs say about 100 MB idle and 1 GB for 5 to 10 users; we measured 192 MiB for the process and under 300 MiB at peak. mailcow's docs ask for 6 GiB plus 1 GiB of swap; it idled at 2.4 GB in our test, or 1.7 GB without ClamAV.

Does Stalwart have webmail?

No. Stalwart 0.16.26 has a web admin interface but no webmail, and its roadmap places a webmail client after version 1.0. Use mail apps over IMAP, JMAP, CalDAV and CardDAV, or add a webmail program such as Roundcube.

Can mailcow run on a 4 GB VPS?

Probably, with ClamAV switched off. In our 18 October 2026 test container, mailcow 2026-09a without ClamAV used 1.7 GB at idle and 1.9 GB at peak. That is below its documented minimum of 6 GiB plus 1 GiB of swap, and we did not test a real 4 GB server, so leave headroom. As shipped, mailcow hit a 3 GB memory limit in the same test.

What is a good mailcow alternative for a small VPS?

Stalwart: one program with SMTP, IMAP, POP3, JMAP, CalDAV, CardDAV and a spam filter, idling under 200 MB of RAM in our 18 October 2026 test. You give up mailcow's webmail, ActiveSync and virus scanner.

Choose by the mail app your users open

If your users live in phone and desktop mail apps, Stalwart on a VPS Micro or Mini is the lighter, faster server. If they expect webmail with a calendar, mailcow on a VDS Small is the better fit. RS Computers runs KVM servers in Amsterdam, Dublin and Prishtina with NVMe, unmetered traffic and their own IPv4 and IPv6 addresses, so no other customer sends mail from your IP. Compare the VPS hosting plans, then message us on Telegram to open port 25 and set your reverse DNS. If you would rather have us set it up, we quote that per job.

← All articles