Models

Account                 Defines a user or group account for authentication and email access.
AccountPassword         Password-based authentication credential. [singleton]
AccountSettings         Configures default account settings for locale and encryption. [singleton]
AcmeProvider            Defines an ACME provider for automatic TLS certificate management.
Action                  Defines server management actions such as reloads, troubleshooting and cache operations.
AddressBook             Configures address book and contact storage settings. [singleton]
AiModel                 Defines an AI model endpoint for LLM-based features.
Alert                   Defines an alert rule triggered by metric conditions.
AllowedIp               Defines an allowed IP address or network range.
ApiKey                  API key credential for programmatic access.
AppPassword             App password credential for programmatic access.
Application             Defines a web application served by the server.
ArchivedItem            Represents an archived item that can be restored.
ArfExternalReport       Stores an ARF feedback report received from an external source.
Asn                     Configures ASN and geolocation data sources for IP address lookups. [singleton]
Authentication          Configures authentication settings including password policies and default roles. [singleton]
BlobStore               Configures the blob storage backend for messages and files. [singleton]
BlockedIp               Defines a blocked IP address or network range.
Bootstrap               Initial setup shown the first time Stalwart starts. Configures the server's identity, storage, user accounts, logging, and DNS management. [singleton]
Cache                   Configures in-memory cache sizes for data, DNS records, and authorization tokens. [singleton]
Calendar                Configures calendar settings including iCalendar limits and default names. [singleton]
CalendarAlarm           Configures calendar alarm email notifications. [singleton]
CalendarScheduling      Configures calendar scheduling, iTIP messaging, and HTTP RSVP settings. [singleton]
Certificate             Defines a TLS certificate and its associated private key.
ClusterNode             Represents a node in the cluster
ClusterRole             Defines a cluster node role with enabled tasks and listeners.
Coordinator             Configures the cluster coordinator for inter-node communication. [singleton]
DataRetention           Configures data retention policies, expunge schedules, and archival settings. [singleton]
DataStore               Configures the primary data store backend. [singleton]
Directory               Defines an external directory for account authentication and lookups.
DkimReportSettings      Configures DKIM authentication failure report generation. [singleton]
DkimSignature           Defines a DKIM signature used to sign outgoing email messages.
DmarcExternalReport     Stores a DMARC aggregate report received from an external source.
DmarcInternalReport     Stores an outbound DMARC aggregate report pending delivery.
DmarcReportSettings     Configures DMARC aggregate and failure report generation. [singleton]
DnsResolver             Configures the DNS resolver used for domain lookups. [singleton]
DnsServer               Defines a DNS server for automatic record management.
Domain                  Defines an email domain and its DNS, DKIM, and TLS certificate settings.
DsnReportSettings       Configures Delivery Status Notification (DSN) report generation. [singleton]
Email                   Configures email message limits, encryption, compression, and default folder settings. [singleton]
Enterprise              Configures enterprise licensing and branding settings. [singleton]
EventTracingLevel       Defines a custom logging level override for a specific event type.
FileStorage             Configures file storage limits. [singleton]
Http                    Configures HTTP server settings including rate limiting, CORS, and security headers. [singleton]
HttpForm                Configures the contact form submission endpoint. [singleton]
HttpLookup              Defines an HTTP-based lookup list.
Imap                    Configures IMAP protocol settings including authentication, timeouts, and rate limits. [singleton]
InMemoryStore           Configures the in-memory cache and lookup store. [singleton]
Jmap                    Configures JMAP protocol limits for requests, uploads, and push notifications. [singleton]
Log                     Represents a server log entry.
MailingList             Defines a mailing list that distributes messages to a group of recipients.
MaskedEmail             Defines a masked email address for privacy protection.
MemoryLookupKey         Defines an in-memory lookup key for fast data access.
MemoryLookupKeyValue    Defines an in-memory lookup key-value pair.
Metric                  Stores a collected server metric data point.
Metrics                 Configures metrics collection and export via OpenTelemetry and Prometheus. [singleton]
MetricsStore            Configures the storage backend for metrics data. [singleton]
MtaConnectionStrategy   Defines a connection strategy for outbound message delivery.
MtaDeliverySchedule     Defines retry and notification intervals for message delivery.
MtaExtensions           Configures SMTP protocol extensions offered to clients. [singleton]
MtaHook                 Defines an MTA hook endpoint for message processing.
MtaInboundSession       Configures inbound SMTP session timeouts and transfer limits. [singleton]
MtaInboundThrottle      Defines an inbound rate limit rule for SMTP connections.
MtaMilter               Defines a Milter filter endpoint for message processing.
MtaOutboundStrategy     Configures outbound message delivery routing, scheduling, and TLS strategies. [singleton]
MtaOutboundThrottle     Defines an outbound rate limit rule for message delivery.
MtaQueueQuota           Defines a quota rule for message queues.
MtaRoute                Defines a routing rule for outbound message delivery.
MtaStageAuth            Configures SMTP authentication requirements and error handling. [singleton]
MtaStageConnect         Configures SMTP connection greeting and hostname settings. [singleton]
MtaStageData            Configures message processing rules for the SMTP DATA stage. [singleton]
MtaStageEhlo            Configures EHLO command requirements and validation. [singleton]
MtaStageMail            Configures MAIL FROM stage processing and sender validation. [singleton]
MtaStageRcpt            Configures RCPT TO stage processing and recipient validation. [singleton]
MtaSts                  Configures the MTA-STS policy for the server. [singleton]
MtaTlsStrategy          Defines a TLS security strategy for outbound connections.
MtaVirtualQueue         Defines a virtual queue for organizing outbound message delivery.
NetworkListener         Defines a network listener for accepting incoming connections.
OAuthClient             Defines a registered OAuth client application.
OidcProvider            Configures the OAuth and OpenID Connect provider settings. [singleton]
PublicKey               Defines a public key for email encryption (OpenPGP or S/MIME).
QueuedMessage           Represents a queued email message pending delivery.
ReportSettings          Configures inbound report analysis and outbound report settings. [singleton]
Role                    Defines a named set of permissions that can be assigned to accounts, groups, or tenants.
Search                  Configures full-text search indexing for emails, calendars, contacts, and tracing. [singleton]
SearchStore             Configures the full-text search backend. [singleton]
Security                Configures automatic IP banning rules for abuse, authentication failures, and port scanning. [singleton]
SenderAuth              Configures sender authentication verification including DKIM, SPF, DMARC, and ARC. [singleton]
Sharing                 Configures sharing settings for calendars, address books, and files. [singleton]
SieveSystemInterpreter  Configures the system-level Sieve script interpreter settings and limits. [singleton]
SieveSystemScript       Defines a system Sieve script executed by the server.
SieveUserInterpreter    Configures the user-level Sieve script interpreter settings and limits. [singleton]
SieveUserScript         Defines a global Sieve script available for user imports.
SpamClassifier          Configures the spam classifier model, training parameters, and auto-learning settings. [singleton]
SpamDnsblServer         Defines a DNSBL server used for spam filtering lookups.
SpamDnsblSettings       Configures DNSBL query limits for spam filtering. [singleton]
SpamFileExtension       Defines a file extension classification rule for spam filtering.
SpamLlm                 Configures the LLM-based spam classifier. [singleton]
SpamPyzor               Configures the Pyzor collaborative spam detection service. [singleton]
SpamRule                Defines a spam filter rule for message classification.
SpamSettings            Configures global spam filter thresholds, greylisting, and trust settings. [singleton]
SpamTag                 Defines a score or action assigned to a spam classification tag.
SpamTrainingSample      Stores an email sample used for spam classifier training.
SpfReportSettings       Configures SPF authentication failure report generation. [singleton]
StoreLookup             Defines an external store used for lookups.
SystemSettings          Configures core server settings including hostname, thread pool, and network services. [singleton]
Task                    Represents a background task scheduled for execution.
TaskManager             Configures task execution settings including retry strategies. [singleton]
Tenant                  Defines a tenant for multi-tenant environments with isolated resources and quotas.
TlsExternalReport       Stores a TLS aggregate report received from an external source.
TlsInternalReport       Stores an outbound TLS aggregate report pending delivery.
TlsReportSettings       Configures TLS aggregate report generation. [singleton]
Trace                   Stores a message delivery trace with associated events.
Tracer                  Defines a logging and tracing output method.
TracingStore            Configures the storage backend for tracing data. [singleton]
WebDav                  Configures WebDAV protocol settings including property limits and locking. [singleton]
WebHook                 Defines a webhook endpoint for event notifications.

Bootstrap

Bootstrap [singleton]
  Initial setup shown the first time Stalwart starts. Configures the server's identity, storage, user accounts, logging, and DNS management.

Fields:
    blobStore              object<BlobStore>  mutable
        Where the raw content of email messages, attachments, and other large files is stored.
        Leave as default to reuse the data store, or point to an object storage service such as S3 for larger deployments.
    dataStore              object<DataStore>  mutable
        Where structured data is kept: email metadata, calendars, contacts, mailbox state, and server settings.
        RocksDB is recommended for single-node installations; PostgreSQL, MySQL, SQLite, and FoundationDB are also supported.
    defaultDomain          string<string>  mutable
        The primary email domain this installation will serve, for example example.com.
        Additional domains can be added at any time after setup.
    directory              object<DirectoryBootstrap>  mutable
        Where user accounts and credentials come from.
        The internal directory is recommended for ease of setup and management through the WebUI, but external OIDC or LDAP directories can be used for single sign-on and user provisioning in larger organizations.
    dnsServer              object<DnsServerBootstrap>  mutable
        Optionally automate the DNS records your mail server needs (SPF, DKIM, DMARC, and more) by connecting to your DNS provider's API.
        Leave as manual unless your DNS is hosted by a supported provider; this can always be enabled later.
    generateDkimKeys       boolean  mutable
        Generate DKIM signing keys for the default domain. DKIM cryptographically signs outgoing mail and significantly improves the chances that messages reach the recipient's inbox instead of spam.
        Turn this off only if you plan to manage DKIM keys yourself.
    inMemoryStore          object<InMemoryStore>  mutable
        Where short-lived data lives: session caches, rate-limit counters, and temporary tokens.
        Leave as default to reuse the data store, or point to Redis for faster lookups and multi-node deployments.
    requestTlsCertificate  boolean  mutable
        Automatically obtain a free TLS certificate for the server hostname from Let's Encrypt using the ACME protocol, so clients can connect securely out of the box.
        Turn this off if you plan to install a certificate manually.
    searchStore            object<SearchStore>  mutable
        Where the full-text search index is kept, so users can search across message bodies and attachments.
        Leave as default to reuse the data store, or point to a dedicated search backend for larger deployments.
    secret                 string<secret>  server-set
        The password for the administrator account, generated by the server
    serverHostname         string<string>  mutable
        The public hostname this server answers to, for example mail.example.com.
        Used in SMTP greetings, outgoing message headers, and TLS certificate requests.
    tracer                 object<Tracer>  mutable
        Where the server writes log messages, traces, and diagnostic events.
        Defaults to log files on disk; remote destinations such as OpenTelemetry or webhooks can be added after setup.
    username               string<emailAddress>  server-set
        The email address of administrator, generated by the server

SystemSettings

SystemSettings [singleton]
  Configures core server settings including hostname, thread pool, and network services.

Fields:
    defaultCertificateId  id<Certificate>?  mutable
        Default TLS certificate to use when no SNI is provided by the client
    defaultDomainId       id<Domain>  mutable
        Default domain to use for authentication and reports.
    defaultHostname       string<string>  mutable
        The default hostname to use in SMTP greetings, MTA reports and other places where a hostname is needed but not specified.
    mailExchangers        list<MailExchanger>  mutable
        List of mail exchangers to publish in DNS MX records.
    maxConnections        number<unsignedInteger>  mutable
        The maximum number of concurrent connections the server will accept
    providerInfo          map<enum (see ProviderInfo), string<string>>  mutable
        Information about the provider to advertise in auto configuration services.
    proxyTrustedNetworks  set<string<ipNetwork>>  mutable
        Enable proxy protocol for connections from these networks
    services              map<enum (see ServiceProtocol), object<Service>>  mutable
        List of services to advertise in DNS and auto configuration services
    threadPoolSize        number<unsignedInteger>?  mutable
        The number of threads in the global thread pool for CPU intensive tasks. Defaults to the number of CPU cores