10.3.0 (2026-10-29)
Summary
This release adds support for the OTP-Token header from the IETF draft draft-goto-otp-token, which lets mail clients and browsers offer a one-time passcode for autofill on the site it belongs to. It also fixes how a Content-ID header is encoded.
Who should upgrade
- Anyone sending one-time passcodes by email who wants them to be machine-readable.
- Anyone already setting an
OTP-Tokenheader throughheaders: before this release it went out MIME encoded and could not be parsed. - Anyone embedding images with a
cidthat holds a non-ASCII character or a quote.
Highlights
- New
otpmessage option:otp: { code: '123456', origin: 'https://example.com' }addsOTP-Token: "123456"; origin="https://example.com". The origin is reduced to its canonical form, only https (or http on a loopback host) is accepted, and invalid values fail the send with the newEOTPerror code. See Message configuration. - A custom
OTP-Tokenheader is no longer MIME word encoded. Line breaks and control characters are still removed. OTP-Tokenis included in the DKIM signature by default.- A
Content-IDheader, from an attachmentcidor set throughheaders, is now encoded as a message id rather than as text, so acidwith a non-ASCII character or a quote keeps matching thecid:URL in the HTML. - Groundmail added to the well-known services.
Features
- add the otp option for the OTP-Token header (7789e15)