# ADR 0001 — Rust, not Go

**Status:** Accepted, 2026-09-02. Supersedes the Go + embed-Mox design in
[`../archive/ARCHITECTURE-go-embed-mox.md`](../archive/ARCHITECTURE-go-embed-mox.md).

## Context

The archived design chose Go in order to embed Mox (MIT) as a library, getting
~14,000 lines of production-tested mail correctness for free:

```
message 2,884   dkim 2,051   spf 1,560   smtpclient 2,012   junk 1,302
mtasts    703   dsn    771   dane   516   scram    796   sasl 327   …
```

The Rust ecosystem does not offer an equivalent. Stalwart is the only
production Rust mail server and its server crates are `AGPL-3.0-only OR
LicenseRef-SEL`, which we cannot use under Apache-2.0.

## What Rust actually costs

Stalwart Labs publishes its *primitives* permissively (Apache-2.0 OR MIT), and
those cover more than expected: `mail-parser` (MIME), `mail-auth` (DKIM1,
**DKIM2**, ARC, SPF, DMARC, ARF, TLS-RPT), `mail-builder`, `mail-send`,
`smtp-proto`. `hickory-resolver` covers DNS and DNSSEC.

What no permissive Rust crate provides, and we therefore write:

| | LOC (Mox equivalent) | Rust prior art |
|---|---|---|
| DANE | ~516 | **none on crates.io** |
| MTA-STS | ~703 | **none on crates.io** |
| SMTP server session loop | ~3,395 (`go-smtp`) | `smtp-proto` parses only |
| DSN | ~771 | none |
| Junk (beyond a toy) | ~1,302 | `bayespam` has no training persistence |
| iprev / DNSBL / rate limit | ~370 | `dnsbl` crate abandoned since 2021 |

**~5,500 lines of adversarial protocol code**, versus zero in Go.

## Decision

**Rust.** Accepted with eyes open.

## Consequences

Negative, and stated plainly so nobody is surprised later:

- v1 is roughly a quarter further out.
- DANE and MTA-STS move from *battle-tested* to *ours*, and both **fail
  silently**: a DANE bug downgrades TLS without erroring; an MTA-STS bug defers
  mail nobody sees. That tail does not close at ship — it closes after enough
  strangers' mail has flowed through it.
- Mitigation: every outcome in those crates is an explicit enum with no
  `Default` and no `bool`, so a caller cannot accidentally read "no policy" as
  "verified". See `mail_dane::DaneResult`.

Positive:

- We ship the first permissively licensed DANE and MTA-STS in Rust, and the
  first permissively licensed Rust mail server.
- `mail-auth` gives us DKIM2 and ARC, which Mox does not have.
- One language for the mail engine and the agent layer.

## Rejected alternative

**Go now, Rust later**, with the two crates published early to plant the flag
at low cost. Rejected: it puts the strategic position — "the permissive Rust
agent mail server" — behind a rewrite that would probably never be scheduled.