Monitoring Stalwart Mail Server with Vigilmon

Stalwart is a Rust-built, all-in-one mail server that replaces the traditional stack of Postfix + Dovecot + a spam filter with a single binary. It speaks SMTP, IMAP4, JMAP, POP3, ManageSieve, and more — which also means there are more components to monitor. Vigilmon gives you external uptime visibility across every Stalwart protocol port and its management interface so you know the moment any part of your mail stack goes silent.

What You'll Set Up

• HTTP monitor for the Stalwart management web UI
• TCP port checks for every Stalwart protocol (SMTP, IMAP, POP3, JMAP)
• Management API health check
• TLS certificate expiry alerts
• Alerting for your on-call team

Prerequisites

• Stalwart Mail Server installed and running
• Management UI accessible (default: https://yourdomain.com:8080 or https://mail.yourdomain.com)
• SMTP/IMAP/JMAP ports exposed
• A free Vigilmon account

Step 1: Monitor the Stalwart Management Web UI

Stalwart's management interface lets you configure domains, accounts, and spam filter rules. If it's unreachable, it usually means the Stalwart process itself has crashed.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter the URL: https://mail.yourdomain.com/manage (adjust to your Stalwart bind address and UI path).
4. Set Check interval to 2 minutes.
5. Set Expected HTTP status to 200.
6. Enable Monitor SSL certificate and set the expiry warning to 14 days.
7. Click Save.

Since Stalwart is a single process serving all protocols, a process crash takes down the management UI and every mail protocol simultaneously — making this a high-signal monitor.

Step 2: Monitor the Stalwart API Health Endpoint

Stalwart exposes a health check endpoint at /healthz (or /api/core/reload for some versions — check your release notes). This confirms the process is running and its internal state is consistent.

1. Add Monitor → HTTP / HTTPS.
2. URL: https://mail.yourdomain.com/healthz.
3. Set Expected HTTP status to 200.
4. Set Check interval to 1 minute.
5. Click Save.

Step 3: TCP Port Checks for Every Mail Protocol

Because Stalwart handles multiple protocols, monitor each port independently. A listening failure on one port could mean a bind conflict or per-protocol misconfiguration rather than a full crash.

Add a TCP Port monitor for each of the following:

| Protocol | Default Port | |---|---| | SMTP | 25 | | SMTP Submission | 587 | | SMTPS | 465 | | IMAP | 143 | | IMAPS | 993 | | POP3 | 110 | | POP3S | 995 | | JMAP / HTTP API | 8080 | | ManageSieve | 4190 |

For each port:

1. Add Monitor → TCP Port.
2. Host: mail.yourdomain.com, Port: the port number.
3. Set Check interval to 2 minutes.
4. Click Save.

You don't need to monitor every port — prioritise the protocols your users and applications actually rely on. SMTP (25/587) and IMAP (143/993) are the critical path for most deployments.

Step 4: SMTP Banner Check

Beyond a raw TCP connection, you can verify that the SMTP service is responding with a valid banner:

1. Add Monitor → TCP Port.
2. Host: mail.yourdomain.com, Port: 25.
3. Under Advanced, enable Check response and set the expected string to 220 (the SMTP greeting code).
4. Click Save.

A port that accepts a TCP connection but never sends a 220 banner means Stalwart is listening but the SMTP subsystem is hung — a rarer failure mode that a pure TCP check misses.

Step 5: JMAP API Availability Check

If your clients or applications use JMAP, monitor the JMAP API endpoint directly:

1. Add Monitor → HTTP / HTTPS.
2. URL: https://mail.yourdomain.com/.well-known/jmap.
3. Set Expected HTTP status to 200.
4. Under Advanced, set Expected body contains to "capabilities" (the JMAP session object always contains this key).
5. Set Check interval to 2 minutes.
6. Click Save.

A 404 or 500 on the JMAP discovery endpoint means no JMAP client can authenticate and sync.

Step 6: Configure Alert Channels

1. In Vigilmon, go to Alert Channels → Add Channel.
2. Choose Slack, Email, or Webhook.
3. Assign all Stalwart monitors to the channel.
4. Set Consecutive failures before alert to 2 to avoid noise from transient checks.

Because Stalwart is a single process, a crash will trigger alerts on several monitors simultaneously. Consider grouping them under a single Stalwart service label and configuring alert deduplication in your Slack or PagerDuty workflow.

Step 7: TLS Certificate Monitoring

Stalwart manages its own TLS using ACME/Let's Encrypt or manually provided certificates. A certificate expiry takes down IMAPS, SMTPS, and HTTPS simultaneously.

For each HTTPS or TLS-wrapped endpoint:

1. Open the monitor you created for that port.
2. Enable Monitor SSL certificate.
3. Set Alert when certificate expires in less than 14 days.
4. Click Save.

Stalwart's ACME renewal requires port 80 to be reachable for the HTTP-01 challenge — add a TCP monitor on port 80 if Stalwart handles its own ACME.

Summary

| Monitor | Target | What It Catches | |---|---|---| | Management UI | https://mail.yourdomain.com/manage | Process crash, full outage | | Health endpoint | /healthz | Internal state failure | | SMTP | :25 | MTA down | | Submission | :587 | Outbound email broken | | SMTPS | :465 | Secure SMTP down | | IMAP | :143 | Mail retrieval failure | | IMAPS | :993 | Secure IMAP down | | JMAP | /.well-known/jmap | JMAP client sync broken | | SMTP banner | :25 with 220 check | Hung SMTP subsystem | | SSL certificate | All TLS endpoints | Certificate expiry |

Stalwart's unified architecture makes it operationally lean — but a single process crash takes every protocol down at once. Vigilmon's external checks give you the seconds-level visibility you need to respond before users notice missing mail.

Get started free at vigilmon.online — no credit card, monitors start running in under a minute.