mailcow 2026-09a → 2026-11
3 releases · 3 breaking changes · 8 security fixes · 0 advisories fixed
8security3breaking0deprecated24feature5fix
Breaking changes
- breaking Sync job API: add/syncjob needs a source_id, and the server fields (host1, port1, enc1, authmech1) are no longer accepted or returned. Existing jobs are migrated automatically. Action: If you create or read sync jobs through the API, update your client. Create a source with add/syncjob_source (or… in 2026-11
- breaking Request body limit: 64 MB for UI/API, NGINX_MAX_BODY_SIZE (default 128m) for SOGo/EAS/DAV. If it is below your Postfix message_size_limit, large mails can't be sent via SOGo webmail or ActiveSync. Action: If you raised the Postfix message size limit, set NGINX_MAX_BODY_SIZE in mailcow.conf above… in 2026-11
- breaking Custom nginx locations (data/conf/nginx/site..custom): they are now limited to 64 MB as well, before there was no limit. Apps you run under the mailcow host this way (e.g. Nextcloud or Gitea under a path) reject larger uploads with 413. Own server blocks in data/conf/nginx/.conf (e.g. Nextcloud on… in 2026-11
Security changes
- security SOGo 5.12.13, an upstream security release (notes) in 2026-11
- security Several security fixes in mailcow (details next week) in 2026-11
- security Fail2ban counts failed logins of all protocols (IMAP, POP3, SMTP, Sieve, EAS, DAV), 2FA rate limit in 2026-11
- security Fixes for the reworks: imapsync, logins/netfilter, groups, startup, hardening in 2026-11
- security [SOGo] Update to 5.12.13 in 2026-11
- security [PHP] Update base to Alpine 3.24, build PECL extensions from GitHub in 2026-10
- security [SOGo] Update to 5.12.12 in 2026-10
- security [Nginx] Update to 1.30.6 in 2026-10
Every release in between
breakingSync job API: add/syncjob needs a source_id, and the server fields (host1, port1, enc1, authmech1) are no longer accepted or returned. Existing jobs are migrated automatically. Action: If you create or read sync jobs through the API, update your client. Create a source with add/syncjob_source (or…
breakingRequest body limit: 64 MB for UI/API, NGINX_MAX_BODY_SIZE (default 128m) for SOGo/EAS/DAV. If it is below your Postfix message_size_limit, large mails can't be sent via SOGo webmail or ActiveSync. Action: If you raised the Postfix message size limit, set NGINX_MAX_BODY_SIZE in mailcow.conf above…
breakingCustom nginx locations (data/conf/nginx/site..custom): they are now limited to 64 MB as well, before there was no limit. Apps you run under the mailcow host this way (e.g. Nextcloud or Gitea under a path) reject larger uploads with 413. Own server blocks in data/conf/nginx/.conf (e.g. Nextcloud on…
securitySOGo 5.12.13, an upstream security release (notes)
securitySeveral security fixes in mailcow (details next week)
securityFail2ban counts failed logins of all protocols (IMAP, POP3, SMTP, Sieve, EAS, DAV), 2FA rate limit
featureGroups with their own address work as distribution lists. Members can come from all domains you manage.
featureMembers can send as the group address and as other addresses of the group.
featureShare mailboxes with a group (IMAP, shown as Shared/), as well as SOGo calendars and address books. Members can be subscribed automatically.
featureShared mailboxes have no login of their own and are accessed through groups.
featureMailbox templates can be assigned per group, with a priority.
featureDomain admins manage the groups of their domains (new ACL "Mailbox groups").
featureGroups from the IdP are synced to mailcow groups, including their members.
featureOptional offboarding: if a user is disabled or deleted in the IdP, the mailbox login is disabled, but mail is still delivered. Off by default.
featureThe admin UI shows the sync status, conflicts and a preview.
featureSync sources: the server settings (host, port, encryption, authentication) are defined once and used by any number of jobs. A source can be available to everyone, to specific domains or to single users. Presets cover common providers.
featureOAuth2 (XOAUTH2) for Microsoft 365 and Google. Tokens are refreshed automatically, even while a job is running.
featureParallel jobs: several jobs run at the same time. The maximum and a bandwidth limit can be set in the admin UI.
featureThe certificate of the source server is verified (SSL and STARTTLS). The check can be turned off per source.
featureUpdated to imapsync 2.314.
featureAny number of API keys, each with a description, read-only or read-write access and its own IP allowlist.
featureKeys from mailcow.conf are shown as locked service keys.
feature[Web][Dovecot] Rework imapsync: sync sources, OAuth2, Python runner
feature[Web] Rework API keys: multiple keys + locked service keys from mailcow.conf
feature[Web][Dovecot][SOGo][DockerApi] Add mailbox groups, shared mailboxes and identity provider sync
feature[Netfilter] Rework: robust bans, no restart loops, identity provider outages are no failed logins
feature[Web] Add Netfilter unban all button
securityFixes for the reworks: imapsync, logins/netfilter, groups, startup, hardening
security[SOGo] Update to 5.12.13
otherUpdate Alpine Images to 3.24
other[Rspamd] Update to 4.2.3
other[ACME][Dockerapi][Dovecot][Olefy][PHP][Rspamd][SOGo][Unbound][Watchdog] Update image tags
other[Web] Update composer libraries
otherUpdate redis Docker tag to v7.4.12
otherUpdate dependency tianon/gosu to v1.20
other[Postfix] update postscreen_access.cidr
otherTranslations update from Weblate
security[PHP] Update base to Alpine 3.24, build PECL extensions from GitHub
security[SOGo] Update to 5.12.12
security[Nginx] Update to 1.30.6
featureFeat/update UI
otherTranslations update from Weblate
feature[Web] Add ACL + global switch to disable external alias goto
feature[Web] Add show/hide password toggle on login pages
fixFix #7150: passwd-verify.lua wipes auth cache during any nginx outage
fix[Web] use absolute RHS names in generated DNS zonefile
fix[Web] redirect deep links to the matching login page
fix[Web] show external sender addresses regardless of authsource
fix[Web] translate password errors in the forced password change modal
other[Unbound] Update to 1.26.1
other[SOGo] Update to 5.12.11
otherUpdate redis Docker tag to v7.4.11
otherpostfix-tlspol: upgrade to trixie + 1.11.0 update
otherTranslations update from Weblate
other[Postfix] update postscreen_access.cidr