A hosting panel for Stalwart Mail on Debian 13

Stalwart Mail is one of the strongest single-binary mail servers in the open-source world — SMTP, IMAP, and JMAP in one process, actively maintained, AGPL-licensed. What it doesn’t come with is a hosting-management layer: mailboxes provisioned per-user, DKIM keys rotated on a schedule, a webmail UI, deliverability reports surfaced somewhere you’d actually look. This post covers how Jabali Panel wraps Stalwart 0.16.0 to provide that layer on Debian 13.

One binary instead of a stack

The traditional self-hosted mail stack pairs Postfix (MTA), Dovecot (IMAP), OpenDKIM or rspamd, and ClamAV — each with its own configuration syntax, log format, and update cadence. Stalwart 0.16.0 replaces that with one process: SMTP submission, MTA, IMAP, JMAP, and mailbox storage in one binary, one stalwart-mail.service systemd unit, one log stream.

Jabali Panel wraps Stalwart with automated provisioning. Adding a domain with mail enabled triggers, in this order:

1. Generate a DKIM keypair (private key stored in the panel database)
2. Publish the DNS record set into the hosted PowerDNS zone: MX, mail A, SPF, DMARC, MTA-STS, DKIM TXT
3. Write the MTA-STS policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt
4. Register the domain in Stalwart’s config so it accepts mail for it

No manual edits to zone files, no separate mail config, no postmap runs. By the time the form submit redirects, the domain is ready to receive mail.

Ports

Port	Protocol	TLS
25	SMTP (inbound MX)	STARTTLS
465	SMTP submission	Implicit TLS
587	SMTP submission	STARTTLS
993	IMAP	Implicit TLS
443	JMAP over HTTPS	HTTPS (Let’s Encrypt)

Roundcube webmail runs at https://<primary-mail-domain>/mail/ with one-click SSO from the panel — no separate Roundcube login. POP3 (ports 110/995) is opt-in and disabled by default.

Deliverability, with a dashboard

Modern receivers (Gmail, Microsoft, Yahoo, Proton) require DKIM-signed mail, valid SPF, monitored DMARC, and MTA-STS. Jabali Panel configures all four automatically on domain create and surfaces the state at /jabali-admin/mail/deliverability.

DKIM with key rotation

The panel generates an initial DKIM keypair when mail is enabled on a domain. The Rotate DKIM button:

1. Generates a new keypair
2. Publishes the new public key at a new selector
3. Retires the old selector after a configurable grace period (default 7 days)

The grace period matters: mail signed with the old key while it was live keeps validating for those 7 days. Without the grace, receivers see signatures against a selector that no longer exists and flag your mail as suspicious.

SPF, DMARC, MTA-STS — automatic

The SPF record is published on domain-with-mail create. DMARC policy is published (default p=quarantine; adjustable). MTA-STS gets both the TXT record and the policy file over HTTPS.

Stalwart itself ingests the inbound reports:

• DMARC aggregate reports — parsed into a compliant / non-compliant / unknown breakdown by sending IP per domain. This is the only sane way to debug why one specific Gmail user isn’t receiving your mail.
• TLS-RPT — receivers report TLS negotiation failures back to your domain; visible per-domain in the dashboard.
• MTA-STS-RPT — same, for policy fetch failures.

Rotate DKIM specifically for compromise

The Rotate button is the fastest way to respond to a suspected key leak (backup exposed, unauthorized login on the mail-config surface). It doesn’t require SSH, doesn’t require editing zone files by hand, and doesn’t break mail delivery mid-rotation.

Mail client auto-configuration

The panel serves the three standard discovery formats so users type only an email address into the client’s setup wizard:

Client	URL
Apple Mail / iOS	/.well-known/mobileconfig?email=<addr> (signed with the panel’s LE cert so iOS accepts it without a warning)
Thunderbird	autoconfig.<domain>/mail/config-v1.1.xml
Outlook	autodiscover.<domain>/autodiscover/autodiscover.xml

Each response is generated from the panel database, so if you change the panel hostname (say, moving to a new server), the discovery responses update automatically — no configuration to edit.

Per-user mail features

Each hosted user’s Mail section exposes:

• Mailboxes — create, edit, delete; per-mailbox quotas; force first-login password reset
• Forwarders — per-mailbox forwarding to one or more external addresses, optionally retaining a local copy
• Catch-all routing — domain-level routing to a chosen mailbox, :drop (silently discard), or :reject (553 to the sender)
• Autoresponders — vacation messages with a start/end date window
• Outbound disclaimers — per-domain text or HTML appended to outbound mail
• Shared folders — IMAP shared folders with per-user ACLs for team mailboxes (sales@, support@)

Everything is written declaratively via the UI. The reconciler converges Stalwart’s actual state to the panel database on every change — the JMAP API is the surface the agent writes to.

Migration

Existing mail from cPanel, DirectAdmin, HestiaCP, or WHM is ingested via /jabali-admin/migrations. Mailbox contents move over IMAP; DKIM keys import as-is so outbound signing doesn’t break. Mailbox passwords are the one thing that don’t transfer — cPanel uses Dovecot CRAM-MD5 hashes which Stalwart’s Argon2id store can’t ingest — so the migration generates fresh passwords per mailbox and prints them in the report. See the cPanel migration guide for the full playbook.

Try it

Install on a fresh Debian 13 VPS, add your first domain in the panel, and by the time the page reloads the DKIM record is published, MTA-STS is live, and the deliverability dashboard is ready. The installation guide covers the panel-hostname DNS prep + reverse-DNS recommendations for outbound deliverability. The demo panel shows the deliverability dashboard live.

For the broader case for self-hosted mail (Stalwart vs Postfix+Dovecot, deliverability compliance in 2026), see Self-hosted mail server with Stalwart and Jabali Panel.