Webmail for an organisation that runs its own Stalwart.

Bulwark gives an IT department, a school, a public body or a hoster one browser client for everyone, signed in through their identity provider and set up the way the organisation decides.

Plan a rollout Try the demo

The User policy page of the admin console with several settings locked

What Stalwart does and what Bulwark adds.

Stalwart holds the accounts, groups and mailboxes, delivers mail, filters spam, and can be your OpenID Connect provider. Bulwark is what people open in the browser, plus the controls around it: sign-in, policies, signatures, branding and an admin console. It keeps no copy of the mail.

Sign in through your identity provider.

A Sign in with SSO button sends people to your OpenID Connect provider: Stalwart's own, or one such as Keycloak or Authentik. You can also hide the password form, or skip the login page and send people straight to the provider.

Authentication

The Bulwark login page with a button to sign in through the organisation's identity provider

Lock a setting, and users see who decided.

The user policy switches features off, locks 26 settings at a value and presets many more. Each domain or group can have its own policy, and the Effective policy view shows what one address gets and why.

Domains and groups

A setting in Bulwark locked by the administrator, labelled Set by your organisation

One signature for the whole domain.

Write the signature once with placeholders for name, job title and phone, add a disclaimer that goes below every message at sending, and give each group read-only templates.

Signatures

The composer with the organisation signature filled in with the sender's name, title and phone

Mail from outside is marked before anyone replies.

An External label sits on mail from other domains, and Bulwark asks before a message or an invitation leaves the organisation.

External mail

A message from another company with the External label next to the sender

Users restore mail they deleted for good.

With a Stalwart Enterprise licence and archiving turned on, people bring back mail they deleted for good, from Settings or from a link in Trash.

Recover deleted items

One switch stops Bulwark's outside connections.

Out of the box, Bulwark checks for updates, loads sender icons, and uses the project's push relay, extension directory and link Connector. Turn on No third-party traffic and all of that stops, and the page may only load from the hosts you configured, such as your Stalwart and office server. Usage stats stay off until an admin turns them on.

Third-party traffic

One Bulwark for many customers.

For hosters and service providers: branding follows the web address Bulwark is opened on, the login page picks the customer's Stalwart server from the address people type, and your panel can open a mailbox for support through a signed link.

Running Bulwark for customers

Also for organisations.

DelegatesGive a colleague access to mail, calendars and contacts in one step.Session limitsSign people out after idle time or a maximum session length.Audit logBulwark's own admin actions, with time, IP address and old and new values.S/MIMESign and encrypt with the S/MIME plugin; keys stay in the browser.AccessibilityPresets for every user, links to your statement, and templates for a BITV statement and the BFSG.Embedded in your portalBulwark inside another web app's frame, signed in through the same provider.KubernetesRuns from the same image; a community Helm chart exists.Security and updatesPublished advisories, and attestations on every release since 1.12.0.

What each part needs.

Bulwark runs against Stalwart 0.16.6 or 1.0. These parts need more.

Feature	Needs
Sign-in with OpenID Connect	The full edition, or Lite served by Stalwart, and a provider Stalwart accepts. Stalwart's own provider needs nothing extra; another one needs an OpenID directory in Stalwart, and several directories per domain need a Stalwart Enterprise licence.
Policies, signatures, templates, External label	Nothing extra. In Lite, a policy.json file you write.
Team templates and shared tag names	Stalwart 1.0
Recover deleted items	A Stalwart Enterprise licence with archiving turned on
S/MIME	The S/MIME plugin from the extension directory, and the full edition
Opening a mailbox from your panel	A Stalwart account with the Impersonate permission, and the full edition
Office editing	Collabora Online, ONLYOFFICE or EuroOffice, and the full edition
Branding per web address	The full edition
Delegates, free/busy and people pickers	On Stalwart 1.0, an admin turns on directory queries
Admin console	The full edition, not Lite

Start here.

Roll Bulwark outA checklist for Stalwart, Bulwark and the day people sign in.AuthenticationOpenID Connect, single sign-on only, and auto sign-in.Domains and groupsA policy per domain or group, and what one address gets.Running Bulwark for customersServers by domain, branding per address, and what replicas need.Security and updatesWhere fixes are announced and how to verify a download.Which way to run it?A one-minute quiz on Bulwark and Bulwark Lite.

Talk to us about support.

There is no paid support for Bulwark today. If your organisation would want it, tell us what you need: dev@bulwarkmail.org.