[2.8.0] - 2026-09-24
Added
- Rate Limits - View sending activity and per-sender history, edit mailbox and domain limits individually or in bulk, and reset counters with an audit trail. Works independently of Mailbox Stats.
- MTA-STS checks - Validate domain records, policy files and MX coverage, with DNS change alerts. #83. Thanks to @q16marvin.
- Sieve delivery outcomes - Show discarded messages, destination folders, forwards and rejection reasons in message details. Requires the
dovecotraw log service. #65. Thanks to @mrclschstr and @Meeppoo. - Alias domains - Count alias traffic toward target mailboxes and check alias-domain DNS records. #92. Thanks to @Neocridas.
- Add pagination and total counts to DMARC and TLS report management. #155
Security
- OAuth browser binding - Login callbacks require the browser that started the flow; attempts expire after ten minutes and are single-use. #135. Thanks to @ShlomiPorush.
- Consistent login limits - Password checks share a failure counter and honor trusted-proxy settings; use
FORWARDED_ALLOW_IPSfor per-client limits behind a trusted proxy. #130. Thanks to @ShlomiPorush. - Safer CSV exports - Treat formula-like values as text while preserving numeric scores and suppression re-import compatibility. #137. Thanks to @ShlomiPorush.
- Safer report uploads - Update request parsing to reject oversized text fields and avoid blocking during temporary-file handling. #133. Thanks to @ShlomiPorush.
- Precise suppression matching - Anchor and escape recipient patterns so suppressing one address cannot block others; existing maps migrate automatically.
- Add configurable session and failed-login storage limits without evicting active sessions. #229
- Hide internal exception details in API errors and sensitive values in settings validation. #243
Performance
- More responsive requests - Move blocking database and file work into workers across imports, statistics, DNS checks, suppressions and maintenance.
- Lower export memory use - Read, prepare and serialize CSV data incrementally.
- Download CSV files through the browser without buffering the entire file in memory. #230
Fixes and maintenance
- Show a loading state on the first DMARC page load and log slow requests for diagnosis.
- Remove leftover Mailbox Stats and Rate Limits data when disabled, preserving shared data while either feature needs it.
- Restore the dashboard message timeline. Thanks to @Meeppoo for spotting it in the #65 branch.
- Classify mail between hosted domains as internal only when it also has a local origin.
- Catch up on live-log bursts and downtime by paging beyond the newest 1,000 lines.
- Track forwarded deliveries separately and link related deliveries in message details. #36. Thanks to @piperino721.
- Count each message once per mailbox using its most successful delivery. #36.
- Refresh deferred messages when late delivery logs arrive. #114.
- Restore the documented system summary and summary email endpoints. #237
- Keep summaries, MaxMind validation and application page loads responsive during I/O. #231
- Separate message correlation from scheduling for easier maintenance. #235
- Keep raw-log collection, retention and background maintenance responsive. #232
- Move message details into a dedicated frontend module. #233
- Process DMARC and TLS-RPT uploads without blocking other requests. #227
- Keep DMARC domain overviews responsive during database and DNS checks. #225
- Save manual suppressions without blocking other requests. #223
- Skip duplicate addresses within a suppression CSV import. #220
- Refresh container status without blocking other requests. #213
- Load domain lists and cached DNS results without blocking other requests. #211
- Load mailbox statistics without blocking other requests. #209
- Load quarantine rule previews without blocking other requests. #207
- Process automatic quarantine rules without blocking other requests. #205
- Read and save blacklist scans without blocking other requests. #203
- Synchronize suppression maps without blocking other requests or rewriting unchanged content. #201
- Keep requests responsive during deferred queue cleanup. #199
- Detect and save bounced-recipient suppressions without blocking other requests. #197
- Save manual DNS checks without blocking other requests. #195
- Save background DNS checks without blocking other requests. #193
- Synchronize monitored hosts without blocking other requests. #191
- Save GeoIP license status without blocking other requests. #189
- Synchronize alias statistics without blocking other requests. #187
- Synchronize mailbox statistics without blocking other requests. #185
- Synchronize alias-domain mappings without blocking other requests. #183
- Process Rspamd imports without blocking other requests. #181
- Process Postfix imports without blocking other requests. #179
- Process Netfilter imports without blocking requests or duplicating overlapping batches. #177
- Process Dovecot delivery updates without blocking other requests. #175
- Correlate messages without blocking other requests. #173
- Complete correlations with late Postfix logs without blocking other requests. #171
- Apply late message status updates without blocking other requests. #169
- Expire suppressions in one database update without blocking other requests. #167
- Read CSV export data in batches and release database sessions after downloads. #165
- Fetch only the database fields needed by CSV exports. #163
- Expire incomplete correlations in one database update without blocking requests. #161
- Prepare CSV rows incrementally to reduce memory usage. #159
- Keep requests responsive during BCC queue cleanup. #157
- Exclude raw report bodies from report-list queries. #153
- Fetch report counts in two queries instead of querying each report separately. #151
- Serialize CSV downloads in chunks to reduce memory usage. #149
- Run retention cleanup without blocking other requests. #147
- Keep requests responsive during database health checks. #145
- Prevent slow live-log viewers from delaying other viewers. #143
- Clean up expired sessions, login counters and abandoned OAuth states every minute. #141
- Return HTTP 503 when the database health check fails. #139
- Preserve non-English text in spreadsheet CSV downloads. #137