mailcow/mailcow-dockerized 2026-11

🍂🐮 Moovember 2026 | Feature & Security Update: Mailbox Groups, imapsync Rework & SOGo 5.12.13

on GitHub

⚠️ Breaking Changes

• Sync job API: add/syncjob needs a source_id, and the server fields (host1, port1, enc1, authmech1) are no longer accepted or returned. Existing jobs are migrated automatically.
  Action: If you create or read sync jobs through the API, update your client. Create a source with add/syncjob_source (or look it up with get/syncjob_source/all) and pass its source_id.
• Request body limit: 64 MB for UI/API, NGINX_MAX_BODY_SIZE (default 128m) for SOGo/EAS/DAV. If it is below your Postfix message_size_limit, large mails can't be sent via SOGo webmail or ActiveSync.
  Action: If you raised the Postfix message size limit, set NGINX_MAX_BODY_SIZE in mailcow.conf above it and run docker compose up -d.
• Custom nginx locations (data/conf/nginx/site.*.custom): they are now limited to 64 MB as well, before there was no limit. Apps you run under the mailcow host this way (e.g. Nextcloud or Gitea under a path) reject larger uploads with 413. Own server blocks in data/conf/nginx/*.conf (e.g. Nextcloud on its own subdomain) are not affected.
  Action: Add client_max_body_size to your location (e.g. client_max_body_size 0; for no limit) and run docker compose restart nginx-mailcow.

🔐 Security

• SOGo 5.12.13, an upstream security release (notes)
• Several security fixes in mailcow (details next week)
• Fail2ban counts failed logins of all protocols (IMAP, POP3, SMTP, Sieve, EAS, DAV), 2FA rate limit

🚀 New Features

All new features are documented at https://docs.mailcow.email/.

Mailbox groups & shared mailboxes

• Groups with their own address work as distribution lists. Members can come from all domains you manage.
• Members can send as the group address and as other addresses of the group.
• Share mailboxes with a group (IMAP, shown as Shared/<mailbox>), as well as SOGo calendars and address books. Members can be subscribed automatically.
• Shared mailboxes have no login of their own and are accessed through groups.
• Mailbox templates can be assigned per group, with a priority.
• Domain admins manage the groups of their domains (new ACL "Mailbox groups").

Identity provider sync (Keycloak, LDAP/AD)

• Groups from the IdP are synced to mailcow groups, including their members.
• Optional offboarding: if a user is disabled or deleted in the IdP, the mailbox login is disabled, but mail is still delivered. Off by default.
• The admin UI shows the sync status, conflicts and a preview.

imapsync rework

• Sync sources: the server settings (host, port, encryption, authentication) are defined once and used by any number of jobs. A source can be available to everyone, to specific domains or to single users. Presets cover common providers.
• OAuth2 (XOAUTH2) for Microsoft 365 and Google. Tokens are refreshed automatically, even while a job is running.
• Parallel jobs: several jobs run at the same time. The maximum and a bandwidth limit can be set in the admin UI.
• The certificate of the source server is verified (SSL and STARTTLS). The check can be turned off per source.
• Updated to imapsync 2.314.

API keys

• Any number of API keys, each with a description, read-only or read-write access and its own IP allowlist.
• Keys from mailcow.conf are shown as locked service keys.

What's Changed

Features

• [Web][Dovecot] Rework imapsync: sync sources, OAuth2, Python runner by @FreddleSpl0it in #7546
• [Web] Rework API keys: multiple keys + locked service keys from mailcow.conf by @FreddleSpl0it in #7547
• [Web][Dovecot][SOGo][DockerApi] Add mailbox groups, shared mailboxes and identity provider sync by @FreddleSpl0it in #7566
• [Netfilter] Rework: robust bans, no restart loops, identity provider outages are no failed logins by @FreddleSpl0it in #7567
• [Web] Add Netfilter unban all button by @FreddleSpl0it in #7593

Fixes & Security

• Fixes for the reworks: imapsync, logins/netfilter, groups, startup, hardening by @FreddleSpl0it in #7589
• [SOGo] Update to 5.12.13 by @FreddleSpl0it in #7590

Updates

• Update Alpine Images to 3.24 by @FreddleSpl0it in #7563
• [Rspamd] Update to 4.2.3 by @FreddleSpl0it in #7569
• [ACME][Dockerapi][Dovecot][Olefy][PHP][Rspamd][SOGo][Unbound][Watchdog] Update image tags by @FreddleSpl0it in #7572
• [Web] Update composer libraries by @FreddleSpl0it in #7568
• Update redis Docker tag to v7.4.12 by @renovate[bot] in #7555
• Update dependency tianon/gosu to v1.20 by @renovate[bot] in #7551
• [Postfix] update postscreen_access.cidr by @milkmaker in #7584

Translations

• Translations update from Weblate by @milkmaker in #7542

Full Changelog: 2026-10...2026-11