inbuxa: a Stalwart fork where every "enterprise" feature is in the free install

If you self-host mail for more than yourself, you know the moment: the server is great, then you need multi-tenancy, SCIM provisioning from Entra ID, or undelete for the colleague who emptied the wrong folder. And that's where the license key starts.

inbuxa takes a different route. It's a fork of the Stalwart mail server, and every one of those features ships in the one AGPL-3.0 edition. There's no license key, no per-seat fee, no paid tier, and nothing phones home.

Disclosure: I'm not part of Coffey Labs, but I've contributed several pull requests to inbuxa and to the Bulwark webmail client. I run Windows and Linux infrastructure for a living, and this is the mail server I wish I'd had years ago.

TL;DR

One Rust binary for JMAP, IMAP, POP3, SMTP, CalDAV, CardDAV, WebDAV, Sieve/ManageSieve
Admin console and webmail are separate programs that sign in with OAuth over JMAP. The mail host serves no web UI at all.
Included: multi-tenancy, masked addresses, undelete, SCIM 2.0, per-domain directories (LDAP/SQL/OIDC), branding, monitoring with live tracing, scale-out storage
Also included, beyond Stalwart's public feature list: DLP, journaling, legal holds, a tamper-evident audit log, locked accounts, shared mailboxes
License: AGPL-3.0, one edition
Try it: demo.inbuxa.org · Docs: docs.inbuxa.org

Why fork a good mail server?

Stalwart is excellent software, and inbuxa's author, John Coffey, says so openly: he ran it in production. In his launch post he gives three reasons for forking anyway:

Security. No web interface on the mail host. /admin and /account return 404, and even the first boot runs entirely over JMAP.
Topology. Server, console and webmail really are separate, so each can sit on a different machine or network. You can't get that by patching a monolith.
Feature gating. The features you need to host mail for other people (multi-tenancy, directory integration, provisioning, audit, monitoring, scale-out storage) shouldn't sit behind a paywall.

The fork went public on 20 September 2026. inbuxa's own mail moved over in a 78-second cutover window with no rollback.

The suite

Component	What it does
inbuxa Server	JMAP, IMAP, SMTP, POP3 and DAV, plus storage, delivery, spam filtering and the admin API, in one Rust binary or container image
inbuxa Admin	Tenants, domains, accounts, queue, certificates, metrics, live delivery tracing, guided jobs such as DNS publishing. Its screens are generated from the server's own description of its settings.
inbuxa Webmail	Mail, calendar, contacts and files on desktop and mobile, with helpdesk account management. Built on ihasmail.
inbuxa installer	Sets up all three, completes first boot and writes your DNS records
inbuxa-migrate	Moves accounts from IMAP, JMAP, DAV, Maildir, Google Takeout, Exchange or Stalwart

The deployment model deserves a closer look. Only port 25 has to be reachable from everywhere. The console and webmail can sit behind an allowlist or on a private network, from one box up to a three-way split for multi-tenant setups. If your admin UI has ever shown up in a Shodan search, you'll see why that matters.

What's in the box

All of this works in a standard install, with no license check:

Multi-tenancy: per-tenant domains, accounts, admins and resource limits, with tenants isolated from each other
Masked addresses you can cut off one by one
Undelete for mail, files, events, contacts and filters, with a configurable retention period
SCIM 2.0 provisioning from Entra ID, Okta, Keycloak and others
Per-domain sign-in: each domain can have its own LDAP, SQL or OpenID Connect directory
Branding: logos and email templates at server, tenant or domain level
Observability: traced and retained deliveries, searchable metrics history, alerts
Email authentication: per-domain DKIM, SPF/DKIM/DMARC checks, automatic Let's Encrypt certificates, generated DNS records
Scaling: read replicas and distributed message storage

Compliance features you won't find on Stalwart's feature list

This is where inbuxa goes past being "Stalwart Enterprise for free." It adds features that schools, SMBs and regulated organizations ask for:

Data loss prevention with 49 identifier detectors (card numbers, ID numbers, keys, custom terms), which can warn, hold for review or block
Journaling, with optional archiving to an outside system
Legal holds, exportable as a verifiable ZIP
Audit log of admin changes, checked for tampering
Locked accounts that keep receiving mail while a colleague takes over
Legacy protocols you can switch off per tenant or server-wide, plus a security to-do list in the console
A GDPR-oriented data inventory in the docs

More than a rebranded fork

Forking takes an afternoon. A fork that strangers can install, trust with their mail and still upgrade a year later takes a lot more. Coffey Labs published the numbers as of 26 October 2026:

77 fixes to inherited code (PKCE handling, DNSSEC/TLSA rechecks, audit logging for cross-account access, cluster role changes without restarts, better search on PostgreSQL and MySQL, and more)
128 reworked inherited features, five of them performance improvements
5,329 tests: 3,449 new, 1,880 inherited, 1,725 of which run unchanged
433 documentation pages, covering install, operations and migration
About 123k lines of new server code, 81k in the console, 108k in the webmail
43 server releases so far

Coffey Labs runs its own mail on a three-node inbuxa cluster and deploys every release there first.

Clean-room, and documented

This is the part I trust most. The nine features that only exist in Stalwart's separately licensed edition were rebuilt clean-room from written specs that were committed before the implementation started. You can read them in the repo under docs/spec/features/, alongside strip reports in docs/fork/strip-reports/. Upstream copyright notices are kept, and changed files say so in their headers.

The server and console are AGPL-3.0-only, the same as upstream. The webmail is AGPL-3.0-or-later. inbuxa is not affiliated with or endorsed by Stalwart Labs LLC, which owns the Stalwart trademark.

AI: one feature, off by default

You won't find an AI buzzword on every screen. There's one AI feature: the spam filter can use a language model as one signal, and a Sieve function can query a model. It's off by default and designed for a local, auditable model. It only sees the subject and text, doesn't log that content, and skips models that are slow or failing. If you point it at a remote endpoint, mail content leaves your network, and the docs say so plainly.

Bring your own webmail: Bulwark

Prefer Bulwark, the popular JMAP webmail built for Stalwart? It works with inbuxa too, and as of early November it supports inbuxa's extensions natively. I wrote two pull requests for it, and both were merged into main on 7 November 2026:

#1522: account security management. inbuxa advertises its account security controls under its own JMAP capability, urn:inbuxa:jmap:registry, while Stalwart uses urn:stalwart:jmap. Bulwark used to know only the Stalwart one. Now it picks the namespace from the capabilities the account advertises, never from the server's name or branding. So the Security settings, including API keys and mobile QR pairing, now work against inbuxa.
#1534: masked addresses. This adds a new section under Settings → Security where you can list, create, describe, enable, disable and delete masked addresses. Deleting one requires an address-specific confirmation. The same UI works on both servers.

That second one shows the whole point of inbuxa nicely. On Stalwart, masked addresses are an Enterprise feature, so Bulwark hides the section on Community-edition servers, which is what most Stalwart installs run. On inbuxa the same feature is just there.

Because everything goes over JMAP and OAuth, there's nothing to configure: no separate credentials and no extra backend.

Try it

Local trial (the whole suite on one machine, on loopback):

inbuxa survey # check the host first inbuxa install --local --domain example.test --install-deps --yes

Container image:

docker pull registry.coffeylabs.org/inbuxa/inbuxa-server:2026.11.11

From source:

cargo build --release -p inbuxa

A server with no configuration starts in bootstrap mode. The setup wizard in inbuxa Admin then takes care of the admin account, first domain, DKIM keys, ACME certificates and first mailbox, all over JMAP. The quick start puts a single-machine install for a household or small office at about half an hour.

If you'd rather look around first, the demo has 16 domains and 241 accounts with made-up traffic.

Coming from Stalwart?

inbuxa inherits Stalwart's data format, so moving a Stalwart 0.16 server is an export and import, not a conversion. Accounts, passwords, sessions, certificates, tenants and mail all come across. The migration guide lists which install steps you can skip, which is most of them. Keep the old install around for rollback, because mail store upgrades are one-way.

There are also guides for Postfix + Dovecot, iRedMail, Zimbra, Exchange Server and Open-Xchange.

The honest part

It's young. The fork is two months old, and Coffey Labs describes adoption as "a handful of adopters." Test it before you put it in production, as you would any mail server.
It's a small company. Coffey Labs LLC builds it. There's no foundation and no formal governance model yet. The author has publicly committed to not abandoning the project.
AI-assisted development. The project says openly that parts of the code and site were written with AI help, and that a person reviews every contribution.
It's not for everyone. The inbuxa site itself recommends Mailcow, Mailu, Mail-in-a-Box or mox if you only host mail for yourself or a few domains. If your organization depends on Office co-editing or Exchange-only features, a hosted suite may still suit you better.

But if you host mail for a school, a company, a club or several tenants, and you're tired of hitting license walls, inbuxa is worth an afternoon.