• Added a webhook action to rules. A signed JSON POST is sent when the rule matches an accepted email. The message body and headers are optional, each capped at 1 MB, and attachments are left out. After 5 failed deliveries the URL is paused for 1 hour and you are emailed. The signing secret is under More info on the rules page
• Added an option to append random characters when creating a custom alias, with a choice of length and letters, numbers, or both
• Password reset now signs out other browser sessions and deletes API keys
• API requests from a browser session now require 2FA when it is enabled
• API login now only accepts usernames that are allowed to log in
• Limited API two-factor attempts
• Added a warning before turning off the last 2FA method, so you are not left unable to sign in
• Inbound mail with a malformed From header is repaired, and mail with more than one From address is temporarily rejected
• Delivery reports for replies and sends are only trusted when the envelope sender is empty
• Inbound processing errors now ask Postfix to retry instead of bouncing the message
• Fixed one-click block sender so the address in the signed link cannot be replaced
• Fixed the API logout error response
• Fixed the new alias domain colour in dark mode
• Fixed alias and blocklist table headers wrapping onto two lines