Useful Links

1. Diff to last release: v15.0.2...v15.1.0
2. Our Changelog

What's Changed

This release comes with various documentation improvements, a new configurable poll rate for the change-detector, and miscellaneous smaller bug fixes.

New Contributors

• @c960657 made their first contribution in #4434
• @litetex made their first contribution in #4450
• @aartoni made their first contribution in #4359
• @Blitz-Cloud made their first contribution in #4483
• @s0ftcorn made their first contribution in #4492
• @daks made their first contribution in #4513
• @SpeedyGonzaless made their first contribution in #4523
• @MahdiBaghbani made their first contribution in #4532
• @fim-sh made their first contribution in #4531
• @RoelSG made their first contribution in #4183
• @dmarks100 made their first contribution in #4541

Useful Links

1. Diff to last release: v15.0.1...v15.0.2
2. Our Changelog

What's Changed

This is a patch release that fixes a bug concerning GPG encryption and signing of e-mails.

Merged Pull Requests

• fix: ensure message content is not modified by header filter by @mpldr in #4429

Useful Links

1. Diff to last release: v15.0.0...v15.0.1
2. Our Changelog

What's Changed

This is a patch release to fix minor bugs reported after the release of v15.0.0. As always, take a brief look at the changelog (linked above).

New Contributors

• @Lasslos made their first contribution in #4402
• @tranquillity-codes made their first contribution in #4421

Useful Links

1. Diff to last release: v14.0.0...v15.0.0
2. Our Changelog

What's Changed

saslauthd mechanism support pam, shadow and mysql was removed. getmail6 was refactored. A deprecated file path check for an Rspamd configuration file was removed. Password confirmation was added to our CLI tool as well as a debug getmail command. The VERSION file was removed.

Please refer to our changelog (linked above) for a comprehensive list of changes.

New Contributors

• @beertje44 made their first contribution in #4070
• @Vetuska made their first contribution in #4165
• @GallowsDove made their first contribution in #4184
• @pitilux made their firs...

Useful Links

1. Diff to last release: v13.3.1...v14.0.0
2. Our Changelog

What's Changed

The most noteworthy change of this release is the update of the container's base image from Debian 11 ("Bullseye") to Debian 12 ("Bookworm"). This update alone involves breaking changes and requires a careful review when updating! Make sure to scan our changelog carefully.

Useful Links

1. Diff to last release: v13.3.0...v13.3.1
2. Our Changelog

What's Changed

This is a patch release fixing two important bugs in v13.3.0:

1. Dovecot: We now restrict the authentication mechanisms for PassDB configurations we manage (oauth2, passwd-file, ldap) (#3812). This prevents misleading auth failures from attempting to authenticate against a PassDB with incompatible auth mechanisms. When the new OAuth2 feature was enabled, it introduced false-positives with logged auth failures which triggered Fail2Ban to ban the IP.
2. Rspamd: We now ensure correct ownership (_rspamd:_rspamd) for the Rspamd DKIM directory and files (/tmp/docker-mailserver/rspamd/dkim/)

What's Changed

• fix(typo): comment on mailserver.env by @JamBalaya56562 in #3799
• fix: Ensure correct ownership for the Rspamd DKIM directory by @polarathene in #3813
• fix: Correctly support multiple Dovecot PassDBs by @polarathene in #3812
• docs: Minor revisions to Dovecot Sieve page by @polarathene in #3811
• chore: Raise awareness of v13 breaking change better (Proxy Protocol) by @polarathene in #3818

Useful Links

1. Diff to last release: v13.2.0...v13.3.0
2. Our Changelog

What's Changed

The main feature that can be found in this release is added very simple OAUTH2 support. DMS now supports authentication via OAuth2 (via XOAUTH2 or OAUTHBEARER SASL mechanisms) from capable services (like Roundcube). This does not replace the need for an ACCOUNT_PROVISIONER (FILE / LDAP), which is required for an account to receive or send mail.

Additionally, MTA-STS support for outbound mail was added to DMS. A bunch of smaller changes have made it into this release as well: Rspamd symbol scores for SPF, DKIM & DMARC have been adjusted to better align with RFC7489; smtputf8 has been disabled directly; scripts were improved (replacing wc -l with grep -c, etc.); and a bug fix for jaq on arm64 was added.

As is usual business, we worked on improving the documentation. Last but not least, the test suite saw bigger changes in the area of helper functions used during tests to send test e-mails.

Merged Pull Requests

• Rspamd: add custom symbol scores for SPF, DKIM & DMARC by @georglauterbach in #3726
• chore: Disable smtputf8 support in config directly by @polarathene in #3750
• tests: Replace wc -l with grep -c by @casperklein in #3752
• ci: .gitattributes - Ensure eol=lf for shell scripts by @polarathene in #3755
• docs: SpamAssassin ENV docs refactor by @polarathene in #3756
• Fix jaq: Download platform specific binary by @casperklein in #3766
• tests: normalizations by @georglauterbach in #3747
• feat: Auth - OAuth2 (Dovecot PassDB) by @thechubbypanda in #3480
• Tiny #3480 follow up: Add missing ENABLE_OAUTH2 var by @casperklein in #3775
• feat: Add MTA-STS support for outbound mail by @jsonn in #3592
• tests: small adjustments by @georglauterbach in #3772
• fix: Revert quoting SA_SPAM_SUBJECT in mailserver.env by @polarathene in #3767
• docs: Rspamd DKIM config simplify via path setting by @denisix in #3702
• fix: Ensure .svbin files are newer than .sieve source files by @polarathene in #3779
• docs: misc improvements by @georglauterbach in #3773
• chore: Add maintenance comment for sed usage by @polarathene in #3789
• tests: Revise process_check_restart.bats by @polarathene in #3780
• fix: Ensure setup dkim generates DKIM keys with ownership matching the parent directory by @ap-wtioit in #3783
• docs: Guidance for binding outbound SMTP with multiple interfaces available by @norrs in #3465
• docs: Add maintenance comment for main.cf:reject_unknown_sender_domain by @polarathene in #3793
• tests: Revise OAuth2 tests by @polarathene in #3795
• release: v13.3 by @georglauterbach in #3781

New Contributors

• @thechubbypanda made their first contribution in #3480
• @denisix made their first contribution in #3702
• @norrs made their first contribution in #3465

Useful Links

1. Diff to last release: v13.1.0...v13.2.0
2. Our Changelog

What's Changed

Most importantly, DMS is now protected by default against the security vulnerability called "SMTP smuggling". Moreover, we switched from raw netcat (nc) to swaks in our test suite - a change that is beneficial for upcoming changes and improvements to our test suite. Last but not least, the log path for Postgrey was corrected.

Merged Pull Requests

• fix: supervisor-app.conf - Correct the log location for postgrey by @polarathene in #3724
• tests: Use swaks instead of nc for sending mail by @georglauterbach in #3732
• security(Postfix): Protect against "SMTP Smuggling" attack by @georglauterbach in #3727
• Postfix: add smtpd_data_restrictions = reject_unauth_pipelining by @georglauterbach in #3744

Useful Links

1. Diff to last release: v13.0.1...v13.1.0
2. Our Changelog

What's Changed

Updated

• Internal
  • We now store the version that DMS is running on in the environment variable DMS_RELEASE and no longer in the file /VERSION. Moreover, the update check will use this to determine whether you are running :edge (to disable the update check if this is the case).
  • An option to run DMS locally was added, and the docs saw improvements (as usual).
  • The quota tests were adjusted and now conform to our new standards.
• Documentation
  • The troubleshooting documentation was enhanced.

Added

• Rspamd
  • The ARM64 build now also uses the official PPA, making the version even for ARM64 and AMD64.
• Dovecot
  • The environment variable ENABLE_IMAP was added, which works analogous to ENABLE_POP3.

Fixed

• Internal
  • A sed line for quota-related changes to Postfix's main.cf was not working as expected. This has been taken care of.

New Contributors

• @p3dda made their first contribution in #3686

This patch release fixes two bugs that Rspamd users encountered with the v13.0.0 release. Big thanks to the those that helped to identify these issues! ❤️

What's Changed

Fixed

• Internal:
  • The update check service now queries the latest GH release for a version tag (instead of from a VERSION file at the GH repo). This should provide more reliable update notifications (#3666)
• Rspamd:
  • The check for correct permission on the private key when signing e-mails with DKIM was flawed. The result was that a false warning was emitted (#3669)
  • When RSPAMD_CHECK_AUTHENTICATED=0, DKIM signing for outbound e-mail was disabled, which is undesirable (#3669). Make sure to check the documentation of RSPAMD_CHECK_AUTHENTICATED!

Full Changelog: v13.0.0...v13.0.1