### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [1 ביולי, 2024, 5:41pm UTC](https://meta.discourse.org/t/fully-independent-email-with-discourse-and-stalwart-mail/314490/1 "2024-07-01T17:41:03Z")
> **troubleshooting**
>
> Continuing the discussion from [Stalwart-mail+Discourse: POP3 EOF reached (again)](https://meta.discourse.org/t/stalwart-mail-discourse-pop3-eof-reached-again/312287/2):
>
> Since @programmerjake is also exploring Discourse ↔ Stalwart-mail, I wanted to ask you whether you’re experiencing TLS errors on SMTPS:
>
> ```plaintext
> 2024-07-01T17:37:49.718793Z DEBUG common::listener: Failed to accept TLS connection: tls handshake eof context="tls" event="error" instance="smtps" protocol=Smtp remote.ip="128.140.68.114"
> 2024-07-01T17:37:49.899171Z DEBUG common::listener: Failed to accept TLS connection: tls handshake eof context="tls" event="error" instance="smtps" protocol=Smtp remote.ip="128.140.68.114"
>
> ```
>
> On Discourse’s side, there’s an error popup:
>
> `ERROR - Net::ReadTimeout with #`
>
> It seems to be related to Ruby’s OpenSSL library not supporting TLSv1.3, but this seems a bit far-fetched since it _should_ be working with TLSv1.2 anyway.
* * *
## Working installation
### Stalwart-mail \>= [v0.8.3](https://github.com/stalwartlabs/mail-server/releases/tag/v0.8.3)
That’s it, with this release, Stalwart-mail now supports both sending and receiving email with Discourse. 🎉
[Stalwart-mail](https://stalw.art/) is a single binary mail service that covers all your email needs without the clutter of configuration that we’ve been used to over decades with Postfix + Spamassassin + Dovecot + etc. Here, you setup your installation and have _everything_ ready to go, including full TLS automation with ACME and [LetsEncrypt](https://letsencrypt.org), SPF, DMARC, DKIM, ARC, DANE support out of the box (including reports from and to your domains), TLSA and other DNS records ready to go, auto-configuration and auto-discovery for easy mail client setup, shared folders (via “groups”), aliases, ManageSieve filters on all incoming and outgoing messages at various stages of the process, web administration, 2FA and TOTP support, OAUTH, and many more features. No need to externalize your email anymore!
1. Use a `submission` listener on port 587 for SMTP
1. **_disable_ implicit TLS** (means: use STARTTLS)
2. Ensure ignore client order is _disabled_ (either in the defaults or override TLS options of the listerner)
2. Enable a POP3 listener on port 995 with implicit TLS
### Discourse
Configure email normally using 587 for Submission (with STARTTLS) and 995 for POP3s with SSL/TLS.
---
### Author:  [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [1 ביולי, 2024, 7:57pm UTC](https://meta.discourse.org/t/fully-independent-email-with-discourse-and-stalwart-mail/314490/2 "2024-07-01T19:57:31Z")
So this is an open source alternative to Mailgun and the like? That is starting to look very attractive as most of those services are quite pricey for low volumes.
I take it that it requires its own (virtual) machine. It would be amazing if it could easily run on the same machine as Discourse.
Do you know if one instance of Stalwart Mail could service several Discourse instances?
---
### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [1 ביולי, 2024, 8:46pm UTC](https://meta.discourse.org/t/fully-independent-email-with-discourse-and-stalwart-mail/314490/3 "2024-07-01T20:46:04Z")
Yes, you can support multiple domains easily.
First you add a domain, then it gives you the DNS records to setup the MX (mail exchange). All your domains will be using the same MX.
It should be easy to run Stalwart-mail on the same machine as Discourse. Since both require TLS port 443, you would be using a proxy on that port to send to both services. But it does not make much sense to have one instance per Discourse, it’s better to separate the two, so you can scale up your email infrastructure easily, and cover more needs than just Discourse.
As an indication, I’ve been running Stalwart-mail on a CPX21 (4 GB RAM, 3 x86 AMD vCPUs, 80 GB storage) Hetzner VPS with about 30 accounts over a dozen domains, with full logs on, and it takes 564 MB RAM and 7 GB storage (most of them is the OS). Stalwart-mail claims 184 MB resident RAM (less than 5% of all RAM, and 1.2 GB virtual).
---
### Author:  [@programmerjake](https://meta.discourse.org/u/programmerjake)
#### Post date: [2 ביולי, 2024, 6:55am UTC](https://meta.discourse.org/t/fully-independent-email-with-discourse-and-stalwart-mail/314490/4 "2024-07-02T06:55:58Z")
> [@hellekin](#):
>
> On Discourse’s side, there’s an error popup:
>
> `ERROR - Net::ReadTimeout with #`
I’m using port 587 with STARTTLS and haven’t encountered any errors when testing just now…
also in Stalwart-mail’s logs it seems to be using TLSv1.3 and not running into any errors…I do have a slightly unusual config that I’m testing (using [pebble](https://github.com/letsencrypt/pebble) to run a local ACME server and using a `.test` domain name, but that probably isn’t enough to break/fix anything…)
I’m not using “Override TLS options” in the port 587 listener…
---
### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [31 בינואר, 2025, 9:24am UTC](https://meta.discourse.org/t/fully-independent-email-with-discourse-and-stalwart-mail/314490/5 "2025-01-31T09:24:47Z")
I’ve been using Stalwart-mail with discourse exclusively for the past months, and it works like a charm. I can now use both Submission (port 587 with STARTTLS) and Submissions (port 465 with TLS). No special configuration or setup involved.
Careful though, setting up a domain DNS records is a two-step process.
1. First, you add a domain name in the Directory. This gives you resource records to add in your DNS zone file.
2. Once your DNS is updated, you create a TLS provider for that domain. You should add the following hostnames: `mail`, `autoconfig`, `autodiscover`, and `mta-tls` (with your domain appended, e.g., `mail.example.org`).\[1\]
3. After a period (seconds to minutes), the internal ACME provider will pick up the changes and obtain TLS certificates. At this point, the domain configuration will have updated the records: pick the `_mta-tls` RR with the new id, and all the `_tlsa` records, add them to your zone file, and your good to go.
Stalwart-mail now comes with very powerful spam filter and integrated fail2ban functionality (banning IP addresses that failed authentication or requested bogus URIs).
* * *
1. note that for a minimal Stalwart-mail + Discourse setup, you probably don´t need `autoconfig` nor `autodiscover` since those are useful with IMAP clients.