Choosing an email architecture is one of the pivotal decisions in enterprise IT infrastructure planning. Alongside widely adopted cloud-based SaaS services, open-source solutions and hybrid models represent a significant share of the market. They allow organizations to precisely tailor the environment to internal security policies, industry-specific requirements, and data sovereignty mandates.
The mail software ecosystem encompasses diverse projects: from integrated containerized suites and well-established, specialized daemons to modern servers built on newer programming languages and client-side cryptographic tools.
The following paper presents the characteristics, architecture, and application areas of selected open-source technologies: Stalwart, Mailcow, Dovecot (including Dovecot Pro), Roundcube, and the Mailvelope browser extension.
Mail System Architecture: Division of Roles and Components
A proper evaluation of individual technologies requires distinguishing the specific roles they fulfill across the full mail stack:
- MTA (Mail Transfer Agent): Responsible for routing and exchanging mail between servers via the SMTP protocol.
- MDA / Mailbox Server (Mail Delivery Agent / IMAP / POP3 / JMAP): Manages the physical storage of messages in the filesystem structure and makes them accessible to mail clients.
- Antispam and Antivirus Filters: Modules that verify sender reputation, analyze headers, and scan message content.
- Webmail / Groupware: The presentation layer providing a graphical user interface within a web browser.
- Authentication and Encryption Layer: Domain-level standards (SPF, DKIM, DMARC) and optional content encryption protocols (e.g., OpenPGP).
Stalwart – Unified Architecture and the JMAP Standard
Stalwart represents a new generation of mail servers designed as a single, consolidated component written in Rust. Unlike modular architectures that link several independent daemons, Stalwart integrates core functions within a single unified application.
Key technological features:
- Rust Programming Language: The use of Rust ensures high levels of compile-time memory safety.
- JMAP Protocol Implementation: Beyond standard IMAP4rev2 and POP3 support, Stalwart natively implements the JMAP standard (JSON Meta Application Protocol, RFC 8620/8621), designed as a modern alternative to IMAP that optimizes data transfer over variable-bandwidth networks.
- Integrated Functionality: The server features built-in SMTP support, SPF, DKIM, and DMARC verification engines, as well as a native antispam rule engine.
- Resource Efficiency: The condensed architecture translates into minimal system overhead, enabling deployment even on hardware with modest specifications.
Mailcow: dockerized – An Integrated Containerized Environment
Mailcow (mailcow: dockerized) is a popular application suite that bundles well-established, traditional mail components into a cohesive environment managed via Docker and Docker Compose.
The stack incorporates Postfix (as the MTA), Dovecot (as the IMAP/POP3 server), Rspamd (antispam system), ClamAV (antivirus engine), an Nginx reverse proxy with automated ACME/Let's Encrypt certificate management, and the SOGo groupware interface.
Solution characteristics:
- Comprehensive Administration Panel: Enables centralized management of domains, mailboxes, aliases, password policies, quarantine, and routing rules through an intuitive web GUI.
- Process Automation: Containerization streamlines the update cycle for individual modules and standardizes backup and disaster recovery procedures.
- Multi-feature Groupware: SOGo integration delivers out-of-the-box support for email alongside calendar and contact sharing via CalDAV, CardDAV, and ActiveSync protocols.
- Infrastructure Requirements: Running multiple containers in parallel alongside heavy content-scanning engines requires adequate system memory (a minimum of 4 GB RAM is recommended).
Dovecot and Dovecot Pro – Message Storage and Access Layer
Dovecot is one of the most widely deployed IMAP/POP3 servers globally. The project focuses strictly on the data storage layer (MDA) and client communication, prioritizing full RFC compliance and rapid indexing.
Depending on the scale of the deployment, this technology is available in two editions:
- Dovecot Community (Open Source): The open-source version, commonly used in single-server and distributed deployments. It supports traditional mailbox formats (mbox, Maildir) as well as optimized proprietary formats (sdbox, mdbox). It includes full support for Sieve scripts (server-side mail filtering).
- Dovecot Pro (Commercial Edition, Open-Xchange): Geared toward enterprise environments, telecommunication operators, and large-scale hosting providers. It offers active-active clustering, advanced real-time replication mechanisms, and native integration with object storage systems (such as S3 or Ceph).
Roundcube – Independent Webmail Interface
Roundcube is a specialized, browser-based email client (Webmail) written in PHP. Rather than functioning as a standalone mail server, it acts as the presentation layer, communicating directly with backend IMAP and SMTP servers.
Technology profile:
- Plugin Architecture: A modular architecture allows administrators to extend functionality by adding features such as calendar integration, Sieve rule editing, password management, and two-factor authentication (2FA).
- Deployment Flexibility: Can be integrated with any IMAP-compliant mail server and deployed on standard web server stacks (e.g., Nginx, Apache).
- User Interface: The default "Elastic" skin provides a fully responsive layout tailored for both desktop and mobile displays.
Mailvelope – Browser-Based End-to-End Encryption
The integrity and confidentiality of electronic correspondence can be significantly enhanced using End-to-End Encryption (E2EE). Mailvelope is an open-source browser extension implementing the OpenPGP standard.
Operating principle and use cases:
- Client-Side Encryption: All cryptographic operations—key generation, encryption, decryption, and digital signing—occur locally on the end user's workstation.
- Server Independence: Because message contents are encrypted prior to transmission, the mail server (regardless of underlying software) processes only an opaque ciphertext payload, preventing intermediary interception or inspection.
- Webmail Integration: Mailvelope integrates seamlessly into message composition and viewing forms across popular webmail platforms, including Roundcube and various groupware suites.
Comparative Overview of Mail Technologies
The table below summarizes the purpose, role, and technical specifications of each solution within a mail infrastructure:
- Stalwart
- Structural Role: Complete All-in-One mail server
- Core Language / Environment: Rust
- Deployment Model: Standalone binary or container
- Typical Use Case: Modern deployments requiring native JMAP protocol support and a compact single-binary architecture
- Mailcow
- Structural Role: Integrated mail service suite
- Core Language / Environment: Docker (combining Postfix, Dovecot, SOGo, etc.)
- Deployment Model: Containerized environment
- Typical Use Case: Corporate environments requiring a centralized web GUI for streamlined administration
- Dovecot (CE / Pro)
- Structural Role: Mailbox server and IMAP/POP3 daemon
- Core Language / Environment: C, C++
- Deployment Model: System packages or clustered instances
- Typical Use Case: Highly scalable mail backends—ranging from single servers to tier-1 telecom infrastructure
- Roundcube
- Structural Role: Browser-based email client (Webmail)
- Core Language / Environment: PHP, JavaScript
- Deployment Model: Standard web server with PHP runtime
- Typical Use Case: Accessible end-user web interface for IMAP-backed environments
- Mailvelope
- Structural Role: OpenPGP cryptographic module
- Core Language / Environment: JavaScript
- Deployment Model: Web browser extension
- Typical Use Case: Secure communication workflows requiring client-side end-to-end encryption (E2EE)
Sender Verification Standards and Domain Configuration
Regardless of the selected software stack, reliable email delivery on the modern internet requires configuring industry-standard domain authentication mechanisms:
- PTR Record (Reverse DNS): Alignment between the sending server's IP address and its fully qualified domain name (FQDN) is a baseline requirement for inbound acceptance by remote antispam filters.
- SPF (Sender Policy Framework): A DNS record specifying which mail servers are authorized to send mail on behalf of a given domain.
- DKIM (DomainKeys Identified Mail): Cryptographically signs email headers and body contents, allowing recipients to verify that the message was not altered in transit.
- DMARC (Domain-based Message Authentication, Reporting, and Conformance): Defines enforcement policies for messages that fail SPF or DKIM checks and establishes aggregate/forensic reporting channels.
- MTA-STS and DANE: Standards designed to enforce secure TLS encryption between transferring mail servers, mitigating downgrade and man-in-the-middle (MitM) attacks.
Aligning Technologies with Organizational Needs
Selecting the optimal solution depends on project requirements, available resources, and internal IT team competencies:
- Organizations seeking an out-of-the-box, integrated mail and calendar suite with a unified administrative GUI typically favor containerized packages such as Mailcow.
- Teams prioritizing resource efficiency, minimal footprint, single-binary architecture, and the modern JMAP protocol should consider deploying Stalwart.
- For large-scale or modular enterprise designs, layering specialized daemons remains the proven standard, relying on Dovecot for robust mailbox and storage management.
- Web-based access can be delivered via the mature Roundcube client, which can be augmented with Mailvelope whenever heightened confidentiality and end-to-end encryption are mandatory.