stalwartlabs/stalwart v0.16.23

on GitHub

[0.16.23] - 2026-09-21

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• Expressions: bit_and function.

Changed

Fixed

• MTA:
  • A mailing list whose recipients include another mailing list is accepted at RCPT TO and then rejected at local delivery with 550 5.5.0 Mailbox not found.
  • DMARC aggregate reports carry two spf elements per record and the version element of a DMARC aggregate report is written as 1 instead of 1.0.
  • DSNs generated for an alias rewrite or a list expansion emit a doubled addr-type in Original-Recipient (rfc822;rfc822;user@example.org).
  • DSNs that cannot be written to the store are discarded, the recipients are flagged as notified and the original message is removed from the queue, losing both the bounce and the message.
• POP3:
  • TOP msg n counts the n lines from the first byte of the message instead of from the first byte of the body.
  • A message whose very first line begins with . is not byte-stuffed.
• Spam filter: Moving or copying a message from one account into another creates no training sample, so the classifier never learns from it.
• Sieve: envelope "orcpt" yields the bare address for an ORCPT supplied over SMTP. It now carries the addr-type prefix in every case, as required by RFC 6009.
• ACME: The _acme-challenge TXT records published for a DNS-01 authorization are never removed.
• DNS: The DNSSEC resolver queries a single nameserver at a time, working around a hickory-resolver race that cancels the TCP retry when two nameservers return a truncated response in parallel.
• Troubleshoot tool:
  • MX records are resolved through the DNSSEC-validating resolver, matching the resolver used by the delivery path.
  • A TLSA lookup that fails or returns bogus records stops the delivery attempt for that host, instead of continuing without DANE.
• OIDC: Bearer tokens that carry no email, preferred_username or upn claim are always authenticated against the default directory.
• Meilisearch: A confirmation timeout is treated as a failed write even when failOnTimeout is disabled, so an index whose batches take longer than pollInterval x maxRetries never completes an indexing task and resubmits the same batch indefinitely.
• WebUI: A failed update no longer takes an Application offline.
• FoundationDB: The cached read version is invalidated when any broadcast is received from another node.
• Redis:
  • On a cluster, the rate limiter and the blob upload quota issue INCR and EXPIRE as a MULTI/EXEC transaction, whose MOVED redirects collapse into a single EXECABORT that never refreshes the slot map.
  • A connection that fails because it is addressing the wrong server is returned to the pool and reused, since the recycle check only issues PING.

Check binary attestation here