Here’s what the docs say on each of your questions:
1 & 2 – IPv6-only deployments
Stalwart natively supports IPv6. Listeners can be bound to IPv6-only addresses (e.g. [2001:db8::1]:25) or dual-stack via [::]:25. There are no known IPv6-specific caveats called out in the documentation. The server treats IPv6 and IPv4 addresses uniformly throughout.
3 – NAT44 + NAT46/SIIT-DC topology
The most important gotcha here is client IP visibility. When Stalwart sits behind any form of NAT or proxy, it will see the NAT device’s IP rather than the real client’s IP. This breaks:
- SPF/DMARC sender authentication (relies on the actual remote IP)
- Auto-banning and rate-limiting (the NAT IP gets banned instead of the actual bad actor, potentially locking out all users)
- Accurate logging
The fix is to use the Proxy Protocol (HAProxy protocol) so that the real client IP is forwarded through. Stalwart has first-class support for this on all listeners (SMTP, IMAP, POP3, HTTP). For inbound HTTP specifically, useXForwarded: true on the HTTP listener is an alternative when the proxy sends X-Forwarded-For headers. See the Proxy Protocol docs and the reverse proxy overview.
4 – IP allowlisting/blocklisting
Both BlockedIp and AllowedIp records accept a single IP address or a CIDR range (e.g. 2001:db8::/32), so they work equally well with IPv6 prefixes. AllowedIp entries bypass rate limits and auto-banning; BlockedIp entries reject at connection time. Both can be managed from the WebUI or CLI, and both support an optional expiry (expiresAt). The loopback addresses 127.0.0.1 and ::1 are allowed by default. See the General server settings docs.
5 – Outbound delivery
When Stalwart has multiple local addresses (e.g. both an RFC1918 IPv4 and a public IPv6), the kernel will pick one arbitrarily unless you explicitly configure sourceIps in an MtaConnectionStrategy. You should list exactly which source IPs to use for outbound SMTP, with matching ehloHostname values per address, to ensure correct EHLO advertisement and avoid deliverability issues. See the Connection strategy docs.
One further thing to be aware of: the DNS resolver caches A and AAAA records separately (dnsIpv4 / dnsIpv6 cache entries). If your DNS64 setup synthesizes AAAA records for IPv4-only destinations, Stalwart will use those synthesized addresses transparently – but this depends on your NAT64 infrastructure functioning correctly; Stalwart itself has no built-in DNS64/NAT64 awareness.
This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.