mailcow 2026-05b → 2026-11
9 releases · 3 breaking changes · 13 security fixes · 0 advisories fixed
13security3breaking0deprecated24feature16fix
Breaking changes
- breaking Sync job API: add/syncjob needs a source_id, and the server fields (host1, port1, enc1, authmech1) are no longer accepted or returned. Existing jobs are migrated automatically. Action: If you create or read sync jobs through the API, update your client. Create a source with add/syncjob_source (or… in 2026-11
- breaking Request body limit: 64 MB for UI/API, NGINX_MAX_BODY_SIZE (default 128m) for SOGo/EAS/DAV. If it is below your Postfix message_size_limit, large mails can't be sent via SOGo webmail or ActiveSync. Action: If you raised the Postfix message size limit, set NGINX_MAX_BODY_SIZE in mailcow.conf above… in 2026-11
- breaking Custom nginx locations (data/conf/nginx/site..custom): they are now limited to 64 MB as well, before there was no limit. Apps you run under the mailcow host this way (e.g. Nextcloud or Gitea under a path) reject larger uploads with 413. Own server blocks in data/conf/nginx/.conf (e.g. Nextcloud on… in 2026-11
Security changes
- security SOGo 5.12.13, an upstream security release (notes) in 2026-11
- security Several security fixes in mailcow (details next week) in 2026-11
- security Fail2ban counts failed logins of all protocols (IMAP, POP3, SMTP, Sieve, EAS, DAV), 2FA rate limit in 2026-11
- security Fixes for the reworks: imapsync, logins/netfilter, groups, startup, hardening in 2026-11
- security [SOGo] Update to 5.12.13 in 2026-11
- security [PHP] Update base to Alpine 3.24, build PECL extensions from GitHub in 2026-10
- security [SOGo] Update to 5.12.12 in 2026-10
- security [Nginx] Update to 1.30.6 in 2026-10
- security [Rspamd] update to 4.1.4 in 2026-07a
- security Fix nginx CVE-2026-42533 in 2026-07a
- security Update actions/stale action to v11 in 2026-07a
- security Hardening mailcow in 2026-07a
- security fix unbound CVE-2026-33278 in 2026-05c
Every release in between
breakingSync job API: add/syncjob needs a source_id, and the server fields (host1, port1, enc1, authmech1) are no longer accepted or returned. Existing jobs are migrated automatically. Action: If you create or read sync jobs through the API, update your client. Create a source with add/syncjob_source (or…
breakingRequest body limit: 64 MB for UI/API, NGINX_MAX_BODY_SIZE (default 128m) for SOGo/EAS/DAV. If it is below your Postfix message_size_limit, large mails can't be sent via SOGo webmail or ActiveSync. Action: If you raised the Postfix message size limit, set NGINX_MAX_BODY_SIZE in mailcow.conf above…
breakingCustom nginx locations (data/conf/nginx/site..custom): they are now limited to 64 MB as well, before there was no limit. Apps you run under the mailcow host this way (e.g. Nextcloud or Gitea under a path) reject larger uploads with 413. Own server blocks in data/conf/nginx/.conf (e.g. Nextcloud on…
securitySOGo 5.12.13, an upstream security release (notes)
securitySeveral security fixes in mailcow (details next week)
securityFail2ban counts failed logins of all protocols (IMAP, POP3, SMTP, Sieve, EAS, DAV), 2FA rate limit
featureGroups with their own address work as distribution lists. Members can come from all domains you manage.
featureMembers can send as the group address and as other addresses of the group.
featureShare mailboxes with a group (IMAP, shown as Shared/), as well as SOGo calendars and address books. Members can be subscribed automatically.
featureShared mailboxes have no login of their own and are accessed through groups.
featureMailbox templates can be assigned per group, with a priority.
featureDomain admins manage the groups of their domains (new ACL "Mailbox groups").
featureGroups from the IdP are synced to mailcow groups, including their members.
featureOptional offboarding: if a user is disabled or deleted in the IdP, the mailbox login is disabled, but mail is still delivered. Off by default.
featureThe admin UI shows the sync status, conflicts and a preview.
featureSync sources: the server settings (host, port, encryption, authentication) are defined once and used by any number of jobs. A source can be available to everyone, to specific domains or to single users. Presets cover common providers.
featureOAuth2 (XOAUTH2) for Microsoft 365 and Google. Tokens are refreshed automatically, even while a job is running.
featureParallel jobs: several jobs run at the same time. The maximum and a bandwidth limit can be set in the admin UI.
featureThe certificate of the source server is verified (SSL and STARTTLS). The check can be turned off per source.
featureUpdated to imapsync 2.314.
featureAny number of API keys, each with a description, read-only or read-write access and its own IP allowlist.
featureKeys from mailcow.conf are shown as locked service keys.
feature[Web][Dovecot] Rework imapsync: sync sources, OAuth2, Python runner
feature[Web] Rework API keys: multiple keys + locked service keys from mailcow.conf
feature[Web][Dovecot][SOGo][DockerApi] Add mailbox groups, shared mailboxes and identity provider sync
feature[Netfilter] Rework: robust bans, no restart loops, identity provider outages are no failed logins
feature[Web] Add Netfilter unban all button
securityFixes for the reworks: imapsync, logins/netfilter, groups, startup, hardening
security[SOGo] Update to 5.12.13
otherUpdate Alpine Images to 3.24
other[Rspamd] Update to 4.2.3
other[ACME][Dockerapi][Dovecot][Olefy][PHP][Rspamd][SOGo][Unbound][Watchdog] Update image tags
other[Web] Update composer libraries
otherUpdate redis Docker tag to v7.4.12
otherUpdate dependency tianon/gosu to v1.20
other[Postfix] update postscreen_access.cidr
otherTranslations update from Weblate
security[PHP] Update base to Alpine 3.24, build PECL extensions from GitHub
security[SOGo] Update to 5.12.12
security[Nginx] Update to 1.30.6
featureFeat/update UI
otherTranslations update from Weblate
feature[Web] Add ACL + global switch to disable external alias goto
feature[Web] Add show/hide password toggle on login pages
fixFix #7150: passwd-verify.lua wipes auth cache during any nginx outage
fix[Web] use absolute RHS names in generated DNS zonefile
fix[Web] redirect deep links to the matching login page
fix[Web] show external sender addresses regardless of authsource
fix[Web] translate password errors in the forced password change modal
other[Unbound] Update to 1.26.1
other[SOGo] Update to 5.12.11
otherUpdate redis Docker tag to v7.4.11
otherpostfix-tlspol: upgrade to trixie + 1.11.0 update
otherTranslations update from Weblate
other[Postfix] update postscreen_access.cidr
other[postfix-tlspol] bump to v1.14.0
other[Rspamd] Update to 4.2.1
fixFixed typo (changing RESOVLER to RESOLVER).
other[Postfix] update postscreen_access.cidr
otherUpdate RSPAMD version to 4.1.0 in Dockerfile
other[Rspamd] Migrate metadata_exporter to multipart formatter
otherRefresh SOGo view after mailbox activation
fixFix force_tfa not available in mailbox template #7216
other[SOGo] Update to 5.12.9
otherEscape generated password in mobileconfig
other[Nignx] Update to 1.30.3
otherpostfix: migrate from bookworm to trixie
otherUpdate dependency composer/composer to v2.10.2
otherUpdate devops-infra/action-pull-request action to v1.2.1
otherUpdate actions/stale action to v10.4.0
otherUpdate devops-infra/action-pull-request action to v1.4.0
otherUpdate dependency php/pecl-mail-mailparse to v3.2.0
otherUpdate dependency composer/composer to v2.10.1
otherUpdate alpine Docker tag to v3.24
otherUpdate actions/checkout action to v7
otherUpdate devops-infra/action-pull-request action to v1.3.0
other[Postfix] update postscreen_access.cidr
otherTranslations update from Weblate
otherui, fail2ban fix german ban_list_info translation
otherRefined wording for displaying of active settings on quarantine page.
other[Redis] Update to 7.4.10
other[Clamd] Update to 1.4.6
other[SOGo] Update to 5.12.10
other[Web] Minor hardening across web UI and nginx
other[Dovecot] Remove legacy DeltaChat auto-filing sieve rule
other[Postfix] update postscreen_access.cidr
otherupdate README.md sponsors
otherTranslations update from Weblate
security[Rspamd] update to 4.1.4
securityFix nginx CVE-2026-42533
securityUpdate actions/stale action to v11
securityHardening mailcow
fixfix: restore subject display in quarantine overview
fix[Nginx] only bind IPv6 default_server when ENABLE_IPV6 is set
fix[Web] fix add/time_limited_alias silently discarding requests and validity
fix[Web] return sender_acl in get/mailbox API
fixfix: cors allowed origins settings validation
fix[Web] harden CORS origin matching and add Vary: Origin
fix[Web] Move mailcow update check to server side
fix[Web] Create default mailbox template with eas and dav access
fix[ACME] Skip mta-sts certificate request when MTA-STS is not active for a domain
other[Postfix] update postscreen_access.cidr
otherTranslations update from Weblate
other[Web] escape HTML in sieve filter edit view and queue manager
other[Nginx] Update to 1.30.2
securityfix unbound CVE-2026-33278
otherUpdate actions/stale action to v10.3.0
otherTranslations update from Weblate
otherUpdate devops-infra/action-pull-request action to v1.1.2
otherUpdate devops-infra/action-pull-request action to v1.1.3
otherUpdate devops-infra/action-pull-request action to v1.2.0