The EU Mail Stack: Bulwark + Stalwart + Proxmox Mail Gateway Instead of M365

Hosted Microsoft 365 is the path of least resistance for business mail — and, for a European SME, the path with the most quietly-swallowed compromises. The data lives in a US-operated cloud, the client is whatever Redmond ships, and "sovereignty" ends at the login screen. There is now a clean, modern alternative built entirely from open, self-hostable parts — and the one commercial anchor in it, Proxmox Mail Gateway, is EU-made. We run a stack like it ourselves; here is how the three pieces fit.

Three Layers, One Path

The stack maps directly onto what mail actually does, namely receive and filter, store, present:

• Proxmox Mail Gateway (PMG) sits at the edge. Every inbound message passes through it first: anti-spam, anti-virus, greylisting and policy rules run here, before anything touches a mailbox. It is the gate.
• Stalwart is the mail server behind the gate. It holds the mailboxes and speaks the modern protocol set: SMTP, IMAP, and crucially JMAP, the JSON-based successor to IMAP.
• Bulwark is the webmail client, built specifically for Stalwart over JMAP. It is the face the user actually sees.

Mail enters through PMG, clean mail lands in Stalwart, the user reads it in Bulwark. Each of the three layers has exactly one job: filter, store, display.

Why Bulwark Matters

Self-hosted webmail has, for years, meant an interface frozen somewhere around 2008. Bulwark is the part of this stack that finally moves that needle. Because it talks JMAP instead of IMAP, it gets one round-trip per click and server-side push: no constant polling, no spinner while the client re-fetches folders. Threading happens on the server; mail, calendar, contacts and files are unified; full-text search, S/MIME and Sieve filtering are all there. It is, in the project's own words, "webmail built for the 21st century", and it is AGPL-3.0, self-hostable, deployed via a two-service Docker Compose file behind a reverse proxy.

Why Stalwart and PMG Underneath

Bulwark is a client, not a server. It needs a mailbox to talk to, and Stalwart is the natural pairing. Stalwart is a modern, Rust-based mail server that speaks JMAP natively, which is exactly what makes Bulwark fast. We covered its case against Exchange in our Stalwart deep-dive; the short version is that it is a serious, production-grade mailbox layer.

Proxmox Mail Gateway is the piece that makes the whole thing safe to expose. Mail is a hostile channel; you do not want raw internet SMTP hitting your mailbox server. PMG is a mature, open filtering gateway, the same lineage as Proxmox VE and PBS, and it belongs in front of Stalwart, scrubbing spam and malware before delivery. Together the three form a full receive-filter-store-read pipeline with no proprietary layer anywhere in it.

The Honest Trade-offs

This is not a like-for-like Microsoft 365 clone. You are consciously not buying the bundled Office/Teams/SharePoint ecosystem. If your business is welded to that, this stack replaces only the mail slice. And self-hosting means you own the parts M365 hides: patching, backups, monitoring, deliverability (SPF, DKIM, DMARC, IP reputation). Running it yourself means patching, backups and availability are on you. But for an organisation that wants professional mail with a modern client, on its own infrastructure, under EU law, the three pieces slot together cleanly.

Our Take

Bulwark + Stalwart + PMG is the most convincing open, self-hosted answer to hosted M365 mail we have seen. PMG filters at the edge, Stalwart holds the mailboxes, Bulwark is the client: three open projects that each do one job well and compose into a stack you fully control. It is the same data-sovereignty stance we take on AI and where your data lives. The data never leaves your iron, the interface is up to date, not stuck in 2008, and every version running is one you chose. For an SME serious about data sovereignty, that combination is worth the operational weight it asks in return. If you want help scoping the migration, DNS, deliverability and all, that is exactly our line of work.