shouldiuse.io

Categories

VERDICT

Stalw Review

Depends

Should I use Stalw?

Stalwart Mail & Collaboration Server - stalw.art

· 1 month ago

Strong fit if you have ops skills and want a free, all-in-one self-hosted mail stack. Non-technical teams should buy hosted email like Google Workspace instead.

Confidence

Medium. Based on 13 usable public sources; many search results were unrelated noise and no named enterprise customers were found.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo evidence reviewed
  • Security posture

Pricing

Free

Open source

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Paid editionsNot listed in sources reviewed

Best for

  • Self-hosters
  • Privacy-focused small orgs
  • Teams replacing hosted Gmail with owned infra
  • Open-source-first shops

Not for

  • Non-technical teams without a sysadmin
  • Anyone wanting hosted Gmail simplicity
  • Businesses that can't manage IP reputation and deliverability
  • One-person shops that just need working email

Gotchas - check before you buy

high

Guess: email migration and IP reputation take weeks; plan deliverability warm-up.

medium

Multiple paid editions differ; read the compare page before committing.

medium

Commercial support scope unclear; community runs on Reddit and forums.

medium

Known 2026 DoS CVEs mean you must patch promptly or stay exposed.

Pros and cons

Pros

  • All-in-one: email, calendar, contacts, files on one server
  • Open-source core, free to self-host
  • Positive shout-outs from the self-hosting community
  • Publishes security advisories openly
  • One-click Railway deployment available

Cons

  • Recent denial-of-service vulnerabilities disclosed in 2026
  • Self-hosting email demands real ops and deliverability skills
  • Support appears community-run; paid support details thin

Sources & method

- 13 sources - Known 2026 denial-of-service vulnerabilities; advisories disclosed openly and a security page exists.

official x6review x4security x3
  • Out-of-Memory Denial of Service via Malformed Nested Input, Official GitHub advisory GHSA-jm95-876q-c9gw, published Feb 2026.
  • CVE-2026-26312 — denial-of-service vulnerability, Listed against stalw/stalwart in public CVE databases.
  • Dependency vulnerability report for Stalwart binary, User-raised report on official support forum, Jul 2026.

Key stats

  • Value for money: 4/5

    Rating

  • Free

    Starting price

  • 13

    Sources

  • Analyzed

  • Value for money: 4/5. Free open-source core; paid editions optional
  • Ease of use: 3/5. Admin dashboard included, but self-hosting email is hard
  • Feature depth: 4/5. Mail, calendar, contacts, files in one server
  • Support quality. No evidence reviewed
  • Security posture: 3/5. Transparent advisories, but real 2026 DoS CVEs
  • Yes Free tier Open-source core on GitHub
  • London, UK Headquarters Per official site footer
  • 2+ Known CVEs DoS vulnerabilities, 2026
  • One-click Deploy option Railway template available

Pricing

Open source

Free

  • Self-host the full mail server
  • Community support

Paid editions

Not listed in sources reviewed

  • Multiple editions per compare page
  • Pricing FAQ available

Security

Known 2026 denial-of-service vulnerabilities; advisories disclosed openly and a security page exists.

  • Out-of-Memory Denial of Service via Malformed Nested InputOfficial GitHub advisory GHSA-jm95-876q-c9gw, published Feb 2026.⁷
  • CVE-2026-26312 — denial-of-service vulnerabilityListed against stalw/stalwart in public CVE databases.⁸
  • Dependency vulnerability report for Stalwart binaryUser-raised report on official support forum, Jul 2026.⁹

What users say

Self-hosting communities praise it warmly, but large-scale review data is essentially absent.

“Just a shout-out to self-hosting email server StalWart.”
Reddit, r/selfhosted
“Calendars, Contacts and Files in Stalwart”
Hacker News discussion
Full analysis

Based on 13 usable public sources; many search results were unrelated noise and no named enterprise customers were found.

Powerful open-source all-in-one mail server — great if you run your own servers; overkill if you just want working email.

Methodology

Based on 13 usable public sources; many search results were unrelated noise and no named enterprise customers were found.

Read how a report is made.

Sources

  1. Stalwart Mail & Collaboration Serverstalw.art
    official
  2. Pricing | Stalwart Labsstalw.art
    official
  3. Compare editions | Stalwart Labsstalw.art
    official
  4. Product security pagestalw.art
    official
  5. stalwartlabs/stalwart on GitHubgithub.com
    official
  6. Deploy & Host Stalwart Mail Server — Railwayrailway.com
    official
  7. Out-of-Memory Denial of Service advisory (GHSA-jm95-876q-c9gw)github.com
    security
  8. CVE-2026-26312 — stalw / stalwartopencve.alliance.unm.edu
    security
  9. Vulnerability report for Stalwart Binarysupport.stalw.art
    security
  10. Just a shout-out to self-hosting email server StalWartreddit.com
    review
  11. Calendars, Contacts and Files in Stalwartnews.ycombinator.com
    review
  12. Mailcow vs Postal vs Stalwart: Which Self-Hosted Emailmailflowauthority.com
    review
  13. r/stalwartlabsreddit.com
    review

Add this review to your site

This check for Stalw says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends Stalw Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.