mailcow vs Mailu, Stalwart and Mail-in-a-Box: closing mailcow's gaps with one bundle

Why this comparison matters

If you are choosing a self-hosted mail stack in 2026, the shortlist usually looks the same: mailcow, Mailu, Stalwart and Mail-in-a-Box. All four give you a working mail server on your own hardware. The difference shows up after the first week, when real users arrive and you need registration, paid plans, programmatic mailbox access, attack detection and restorable backups.

This guide compares the four from an operator's point of view and then walks through the mailcow bundle, which adds those missing pieces to a single mailcow server under one license key.

mailcow vs Mailu, Stalwart and Mail-in-a-Box

A fair summary of where each option sits for people who run their own servers:

• Mail-in-a-Box is the most opinionated. It is designed to be a complete, turnkey box, which is great for a single admin and a handful of mailboxes, but it leaves little room for custom workflows around sign-up, billing or APIs.
• Mailu is a modular Docker Compose stack. You pick components and wire them together. That flexibility is its strength, and also the reason you end up maintaining more glue yourself.
• Stalwart is a modern all-in-one mail server with its own approach to configuration. It is worth evaluating if you want a single binary-style service, but the surrounding operator tooling is your responsibility.
• mailcow is the stack most self-hosters land on when they want a mature web UI, docker compose management, SOGo webmail and a large community. It is also the platform the MediaLab tools are built for, which is the practical reason this article focuses on it.

Where mailcow wins for operators is not a single feature but the combination: a real admin UI, a containerized stack you can reason about, and an ecosystem you can extend. What it does not ship out of the box is exactly what the bundle covers: self-service sign-up, paid plans, a mailbox REST API, attack detection with history, and scheduled encrypted backups with restore.

If you want the full feature list, see the product page.

Prerequisites

Before you start, confirm the following:

• mailcow-dockerized on Linux, with docker compose and systemd.
• mailcow Toolkit package 0.7.0 or newer. This package includes every tool of the bundle, so you install it once.
• Root access on the host, because you run install.sh.
• Outbound HTTPS to medialab.works, because the tools perform a license check.
• For Cashier, your own Stripe account.
• The tools are open source (GPL-3.0). What you subscribe to is new versions, updates and support for one mailcow server; you receive the complete source code.

A free 30-day trial of the bundle covers all six tools, and each tool can also be tried on its own.

Step 1: Install the mailcow Toolkit package

On the mailcow host, as root, install the package with its install.sh. Because the bundle ships inside the Toolkit package, this single installation gives you all six tools. After installation, open the mailcow admin UI and go to System > Updates (Toolkit).

Step 2: Enter one bundle key in every License card

In System > Updates (Toolkit) you will see one License card per tool. Enter the same bundle key in each card. That is the whole activation model: one key, six cards, one server.

If you add a new mailcow tool later, the current list is always on the mailcow tools page. New mailcow tools we publish are included while the subscription is active (for lifetime licenses, within the update window).

Step 3: Decide the installation order

The tools are independent, but a sensible order for a new server is:

1. mailcow Toolkit — SOGo as any mailbox without losing the admin session, mailcow updates from the admin UI, the DNS records of every domain (including Cloudflare) and the reverse DNS check.
2. Security for mailcow — start collecting attack history before you open registration.
3. Backup for mailcow — get a first verified backup before real mailboxes exist.
4. Sign-up for mailcow — a public registration page for a mailbox on your domains, or a domain administrator for the customer's own domains, after e-mail confirmation.
5. Cashier for mailcow — paid mailbox plans and domain packages through your Stripe account. Unpaid accounts are suspended, never deleted.
6. Mailbox API for mailcow — a REST API for any mailbox (read, send, organize), with signed webhooks for new mail and Telegram notifications.

Step 4: Daily admin with the Toolkit

Three Toolkit habits pay off immediately:

• SOGo as any mailbox. Open a user's SOGo session without losing your admin session, which makes support requests much faster to handle.
• Updates from the admin UI. Run mailcow updates from the admin interface instead of an SSH session.
• DNS for every domain. The Toolkit shows the DNS records of every domain, in Cloudflare too, and includes the reverse DNS check. Fix DNS before you debug mail delivery.

Step 5: Security beyond fail2ban

fail2ban blocks known bad actors, but it does not tell you a story. Security for mailcow adds attack detection with a history: slow and distributed brute force, password spraying, scans and compromised mailboxes. Bans go through mailcow's own fail2ban, and you get alerts.

That history is what turns a noisy log into a decision: which mailbox is being targeted, whether an attack is distributed across addresses, and whether a mailbox may already be compromised.

Step 6: Encrypted off-site backups

Backup for mailcow runs scheduled backups to a local folder and to Google Drive, with retention, verification and restore from the admin page. Verification matters more than the schedule: an unverified backup is a hope, not a plan. Restore from the admin page keeps the recovery path inside the UI when you are under pressure.

Step 7: Open sign-up and billing

With Security and Backup in place, turn on the customer-facing side:

• Sign-up for mailcow publishes a registration page. Customers can request a mailbox on your domains, or a domain administrator for their own domains, after e-mail confirmation.
• Cashier for mailcow sells paid mailbox plans and domain packages through your own Stripe account. Unpaid accounts are suspended, never deleted, so a failed payment is a billing event, not a data loss event.

Step 8: Automate with the Mailbox API

Mailbox API for mailcow exposes a REST API for any mailbox: read, send and organize. Signed webhooks for new mail plus Telegram notifications let you build intake pipelines, ticket bridges or alerting without touching IMAP directly.

Tips and troubleshooting

• License card stays unlicensed. Check that the host can reach medialab.works over HTTPS and that you entered the bundle key in each card, not only one.
• Tool missing after install. Confirm the Toolkit package is 0.7.0 or newer; older packages do not contain all six tools.
• Install fails. install.sh needs root on the host, and the stack must be mailcow-dockerized with docker compose and systemd.
• Cashier does not charge. Cashier uses your own Stripe account; without it, paid plans cannot run.
• Mail lands in spam after adding a domain. Run the reverse DNS check and review the DNS records the Toolkit shows for that domain before changing anything else.
• Do not delete unpaid accounts manually. Cashier suspends them by design; deletion is a separate decision you should make deliberately.
• Scope check. The bundle covers only the mailcow tools. Emby, Jellyfin and Nextcloud products have their own bundles.

More answers are in the knowledge base and the FAQ; if something does not match your setup, contact us.

Conclusion

Mailu, Stalwart and Mail-in-a-Box are all reasonable mail servers. mailcow's advantage for operators is the platform around the server, and the bundle closes the gaps that platform leaves open: sign-up, billing, a mailbox API, security history and verified encrypted backups, all on one mailcow server with one key. Install the Toolkit package, enter the same key in each License card, and add the tools in the order above. Start with the mailcow bundle page for the current tool list and trial details.