Stalwart, the Rust-written mail and collaboration server, has shipped version 1.0 — its first stable release, and the first whose database layout the project says it intends to keep. Existing installations cannot get there by swapping a binary.
The release, reported by heise online on Monday, is less a feature drop than a settling of accounts with the 0.x era. Version 1.0 changes both the database layout and parts of the configuration schema, so the project ships a command-line tool, `stalwart-migrate`, that copies settings and data into a new, empty store. It insists on version 0.16.27 as the starting point. The first copy can run while the old server keeps serving; later passes pick up only what changed, and only the final reconciliation needs the old instance stopped. Account and message identifiers, IMAP UIDs and modification sequences survive the move, so clients do not re-download mail they already hold. OAuth users must sign in again, and the full-text index rebuilds in the background. Organisations that cannot take the jump in one go get a second path: a migration proxy plus a tool called Vandelay for moving accounts one at a time.
The performance work is the substance of the announcement. Stalwart's rewritten `mail-parser` library and a new encoding library, `encodify`, use SIMD and SWAR techniques — checking several bytes per instruction, with SWAR leaning on ordinary registers instead of vector instructions. The protocol parsers, the spam filter's tokeniser and the evaluation of filter and routing expressions were reworked on the same principle. On the storage side, the server cuts database round-trips, compresses objects with zstd and dictionaries tuned separately for mail, calendar and contact data, and keeps message indexes in a compact in-memory cache. Large accounts get their own cache region with a memory budget; snapshots can live on local disk, in Redis or in blob storage.
The vendor benchmark is unusually specific: identical Azure machines with eight AMD EPYC vCPUs, 32 GB of RAM and local NVMe, against Postfix 3.11.7 and Dovecot 2.4.5. Stalwart came out ahead in 35 of 38 comparisons. A full-text search across 250,000 messages took 3.75 milliseconds instead of 136. All three Dovecot wins involved marking every message as read. The project publishes the benchmark repository with scripts and raw data, and it documents limitations, including differences in how the two stacks flush to disk — which is the honest thing to do, and also the reason the headline "fastest mail server in the world" deserves an asterisk until someone outside the project replicates it on other hardware and other mailbox shapes.
Search itself got broader. Stalwart now extracts and indexes text from PDF, Office and OpenDocument files, EPUB and RTF, both in attachments and in its file storage, so a query can find a clause inside an attached contract that never appears in the message body. Size and complexity caps limit what document processing can consume. The built-in engine stores word positions and therefore supports phrase queries; indexing jobs run through a bounded background queue, can be retried, and indexes can be rebuilt. IMAP METADATA arrives too.
Administrators have real work at upgrade time. Stalwart now fully enforces the still-standardising "OAuth Profile for Open Public Clients", so external OIDC providers must comply; compatibility switches can relax individual checks but cannot substitute for a provider that lacks the profile. Clusters need a Redis-backed in-memory store, while single servers get a built-in local one. DKIM2 gains hybrid signatures combining the post-quantum ML-DSA-44 with Ed25519. Users can revoke an application's access to their account, outgoing HTTP requests are protected against server-side request forgery, and secondary LDAP servers allow failover. The commercial Enterprise edition adds connections to several AI model providers and an AI spam classifier.
One change has nothing to do with code quality and everything to do with how the project is run: Stalwart will keep its test suites in a private repository and develop new features privately before release. Source code for each release stays free under AGPL-3.0. For self-hosters that is a trade — less visible process, same licence on the artefact — and for anyone who was following development in the open, it is the end of that.
