Can we use stalwart with these features?

Questions
1

  1. Digital signing required for emails.

  2. OTP-based authentication required along with dongle/token-based solution.

  3. Sandboxing required for email attachments at gateway level; however, password-protected attachments may not be scanned and this limitation should be clearly highlighted.

  4. Quarantine email notification mechanism required for end users.

2

  1. Digital signing of email: yes. Per-user S/MIME signing and encryption is supported (stalw.art/docs/encryption/smime), and DKIM handles domain-level signing.

  2. OTP plus dongle/hardware-token login: not natively. Stalwart authenticates with passwords and app passwords and integrates with external identity providers over OAuth/OIDC, so MFA and hardware tokens would be handled by an upstream OIDC provider rather than inside Stalwart.

  3. Attachment sandboxing/detonation at the gateway: not provided. There’s spam filtering and you can shell out to an external AV scanner, but no sandbox or detonation; and a password-protected attachment can’t be scanned by any engine, which applies here too.

  4. End-user quarantine notifications: there’s no built-in quarantine-digest feature; spam is filed to Junk via Sieve. You could approximate a notification with custom Sieve or a webhook.

3

What external opensource components can we use to achieve all above requirements from customer? It will be great help if you can please name them. Thanks

4

Keycloak for IdP and for attachment scanning you can try ClamAV.