Repository navigation
Releases: mjl-/mox
Releases · mjl-/mox
Release list
v0.0.17
Bug fixes
- webmail: Clicking Send reloads the page instead of sending. A few other forms
in the web interfaces likely have the same issue. The bug was introduced in
v0.0.16, which started bundling javascript files with esbuild, which changes
names of some functions, where those names were used to register event handler.
Reported by Zr40, thanks. (5569ba0)
Update procedure
Before upgrading, do a dry-run first.
- Make a temporary backup with the old mox version:
./mox-v0.0.16 backup data/tmp/testupgrade - Verify that all is well with the old version:
./mox-v0.0.16 verifydata data/tmp/testupgrade/data - Verify the state with the new version:
./mox-v0.0.17 verifydata data/tmp/testupgrade/data
With a successful dry-run, the upgrade should go smoothly. Make a new backup
again with ./mox-v0.0.16 backup data/tmp/backup (the previous backup was
modified by the dry-run, so couldn't be used to restore!), replace the binary
and restart. For further details, see
https://www.xmox.nl/faq/#hdr-how-do-i-upgrade-my-mox-installation
If you run into any problems, please create a bug report.
Downloading & compiling
v0.0.16
Security fixes
- smtpserver: reject submitted messages with multiple From headers/addresses.
authenticated users could submit messages with multiple From headers, the
first would be checked for permission against the account's configured
addresses, but an additional From header could be present with an entirely
different From header, and the last From header would be DKIM-signed by mox.
(PR #459, 5dd6ce7) - scram: fix parsing of trailing extensions in scram messages by properly
forwarding the state after parsing an extension. (#463, 86edfe7) - sendmail: refuse to execute anything except "sendmail" when invoked with egid
!= gid. If installed setgid moxsubmit (e.g. at /usr/sbin/sendmail as
documentation suggests), invoking the command as regular mox command could
previously reveal secrets in /etc/moxsubmit.conf, or overwrite the file.
(e1ce2a5)
New features
- Introbox, a mailbox where first-time correspondents (based on message-from
address) are delivered to instead of to the Inbox. With an introbox, spam
messages (including mail bombs) that make it through are still separated from
regular email from known correspondents. Not enabled by default, configure in
account settings. (PR #454, 9928c0a)
Improvements
- Add "Fail" email transport, that immediately fails delivery. Allows configs
that prevent outgoing deliveries (globally, per domain, or per account)
from/to certain domains. (#347, bb43848) - Add config option to disable rate limiting for the webserver, and take a
reverse proxy into account when finding the ip to use for webserver
ratelimting. (#346, f1259ee) - webmail: Add a "Flagged" button to the webmail refine bar. (#428,
82d94fc) - use ClientSettingsDomain for RFC6186 DNS SRV (automatic account
configuration) records if set, for easier future migrations (#366, PR #367,
39d161c) - webmail: automatically reload webmail within a few seconds after a server
update, and restore the "compose message" state so a user doesn't notice.
(200bcec) - add cli subcommand "mox config account addresses $account" for listing
addresses of an account, and "mox config address account $address" for
printing the account of an address. (02e1a20) - Add config option to disable TLS client auth during TLS handshakes. To work
around clients, like the gmail smtp client, that tries to authenticate with a
webpki-issued certificate (which mox doesn't recognize for authentication).
(#359, 833a67f) - webserver: for http logging, log ip from x-forwarded-for as "clientip" and
allow configuring autoconfig & mtasts endpoints as being forwarded. (#369, PR
#381, 864a8e2)
Bug fixes
- imapserver: fix checks that ensured imap commands were only allowed to be
executed in certain connection states. (PR #457, 1d1a358) - imapserver: imapserver: fix bug in uid handing around the select/examine
command, leading to "uid already present" error. (f38da6e) - imapserver: properly handle extra bytes after a STARTTLS command by using
bytes already read, instead of trying to read the number of buffered bytes
again from the connection, likely breaking the handshake. (e775a32) - smtpserver: don't try to read out of bounds of a dkim signature's short "b="
parameter, leading to connection abort (75ac24d) - When registering login attempts, use X-Forwarded-For header for finding the
IP address. (#338, baacdbc) - Make logging referrer of http requests work. (2e0eea8)
- Fix error "updating spam/ham count: key too large" when marking some messages
as ham/spam. (#386, 24750ff) - Don't cause internal server errors for static file requests for invalid
paths, eg containing %00. (86582e3) - Add mechanism to work around imap client protocol incompatibilities with a
per-account setting to disable imap extensions (capabilities) for sessions of
that account. (#388, 3d28c89) - webmail: when forwarding a message, use decoded headers in "forwarded
message" preamble, instead of encoded values. (#382, 50229d3) - webmail, webaccount: use autocomplete=email not type=email for input
elements, to make internationalized addresses work (#332, e4ff6c9) - webserver: don't force adding a trailing slash when forwarding.
(023a40e) - webhook payload did not contain actual error message for delivery errors.
(#435, 18ecfcd) - fix setting domains to do ACME verification for when ACME provider is shared
between multiple listeners. (PR #452, dbff807) - webmail: don't intercept cmd+key browser shortcuts. (PR #455, 87a14f7)
- smtpserver: fix parsing of AUTH= parameter without further data in MAIL FROM
account. (#462, 33c4bd8) - various small bug fixes
Update procedure
Before upgrading, do a dry-run first.
- Make a temporary backup with the old mox version:
./mox-v0.0.15 backup data/tmp/testupgrade - Verify that all is well with the old version:
./mox-v0.0.15 verifydata data/tmp/testupgrade/data - Verify the state with the new version:
./mox-v0.0.16 verifydata data/tmp/testupgrade/data
With a successful dry-run, the upgrade should go smoothly. Make a new backup
again with ./mox-v0.0.15 backup data/tmp/backup (the previous backup was
modified by the dry-run, so couldn't be used to restore!), replace the binary
and restart. For further details, see
https://www.xmox.nl/faq/#hdr-how-do-i-upgrade-my-mox-installation
If you run into any problems, please create a bug report.
Thanks
Thanks to everyone on irc/matrix/slack and the issue tracker for providing
feedback, asking & answering questions and/or providing code. Much appreciated!
An incomplete list:
ajaspers, allddd, asciimoo, benjojo, Emrion, FLuX, hilli, iwanofski, lupine,
mattfbacon, Michiel, monowii, oasilturk, omartijn, philenotfound, vojbarzz,
vooon, wheresalice, wneessen, xzeldon
If you have open bug reports/issues mentioned in this release, please verify
the issue is resolved and either close the issue or write a comment. Thanks!
Special thanks to NLnet foundation for sponsoring development.
It's been a long time since the previous release. If you have time to help out,
you could help answer questions on the communication channels including the
issues list, or if you would like to write code look at the issues or todo's in
the code. Thanks!
Downloading & compiling
v0.0.15
New features
- Implement IMAP NOTIFY extension from RFC 5465. Where IDLE is for monitoring a
single mailbox, NOTIFY allows monitoring many/all mailboxes in an account at
once. (8bab38e) - Implement IMAP UIDONLY extension, RFC 9586, greatly reducing data
accounting and memory use for IMAP connections (once clients support it).
(507ca73) - Implement IMAP MULTISEARCH extension, searching multiple mailboxes with a single
command. (479bf29) - Implement IMAP PREVIEW extension (RFC 8970), and store previews in
the message database. Automatically generated and stored on first request for
existing messages, or during delivery for new messages. (aa631c6,
6ab31c1, 3ac38aa) - Implement IMAP REPLACE extension, RFC 8508, used for replacing drafts
as they are typed. (92a87ac) - Implement MULTIAPPEND extension, RFC 3502, for appending multiple messages in
a single command, useful for importing messages into a mailbox. (78e0c02) - Implement IMAP METADATA extension, RFC 5464 (f30c44e,
2809136, #290) - Implement RFC 9590, returning metadata in the IMAP extended list
command (0ed820e) - Implement IMAP "INPROGRESS" response code (RFC 9585) for keepalive
and progress reportng during long search. (cc5e316) - Announce support for IMAP NAMESPACE extension in imap
capabilities line. (95d2002) - Implement IMAP WITHIN extension, RFC 5032, for additional search command
criteria. (5e4d80d) - Implement IMAP CREATE-SPECIAL-USE extension for the mailbox
create command, part of RFC 6154. (dcaa99a) - Implement IMAP SAVEDATE extension, RFC 8514. (7288e03)
- Keep track of login attempts, both successful and failures. Now shown in
account and admin interfaces. (1277d78) - Add config domain option for multiple localpart catch all separators, e.g.
both "+" and "-", for addresses you+anything@example.com and
you-anything@example.com. (#301, 9a8bb11) - Add account config option to prevent the account for setting their own custom
password, only allowing mox to generate a new password, and enable by default
for new accounts. Should prevent password reuse and users picking weak
passwords, but does not prevent password phishing. (#286, 3e53abc) - Add config options to disable a domain and to disable logins for an account.
(#175, 2d3d726) - Add account config option to reject incoming deliveries with an error during
the smtp transaction. Useful for rejecting deliveries to specific addresses when
a catchall is configured. (#156, 3e26953) - webmail: Add buttons to download a message as eml, and export 1 or more
messages as mbox/maildir in zip/tgz/tar, like for entire mailboxes.
(a5d74eb) - webmail: Add button to create a mailbox below another one, for convenience.
(ef77f58) - webmail: Add button to mark a mailbox and its children as read.
(ad26fd2)
Improvements
- Write base64 message parts with 76 data bytes on a line instead of 78, as
required by RFC 2045 (MIME). The 78 byte lines work as well, except that
SpamAssassin gives them a higher spam score.
(69d2699) - Change "mox backup $destdir" from storing only data files to $destdir to
storing them under $destdir/data and now also copying config files, to
$destdir/config. (#150, 76e96ee) - quickstart: Check if domain was registered recently using RDAP, and warn
about potential deliverability issues. (2f09976) - Hide version number from smtp banner and imap ID command response (when
unauthenticated), and web interfaces. (68729fa, 3a3a115, #322) - When adding a new domain, only set up RSA DKIM keys, not ed25519. The ed25519
key is causing admin confusion due to many other mail servers not recognizing
the keys and sending DMARC reports containing unhelpful DKIM verification
errors. (#299, 2fc75b5) - webmail: Reconnect automatically in more cases, changing the "stop
reconnection automatically" period from 10 minutes to 5 seconds. (5dcf674) - webmail: For "cid"/content-id's used in html, look for them in all other
parts, not just when there is a multipart/related in the message. Fixes
displaying messages sent by the gmail app, which sends messages with a MIME form
of multipart/mixed containing text/html and image/jpeg. We were only resolving
"cid"s in multipart/related, now we resolve them anywhere in the message. (#327,
462568d) - Add support for negotiating IMAP and SMTP on the HTTPS port 443 using TLS
ALPN "imap" and "smtp". Intended for future use with chatmail servers. (#255,
3c77e07) - imapserver: Return all the optional extensible fields for "fetch" attribute
"bodystructure", notably for content-disposition. Makes the gmail apps show
image attachments properly, instead of rendering the image bytes as (garbled)
text. This requires reparsing all messages, which is done automatically, in the
background, on first account open after the upgrade (2defbce, 31c2261,
0753325, #327, #217) - webmail: When composing, no longer remove the last remaining To address with
the ctrl+backspace shortcut. Too easy to trigger accidentally, almost never done
intentionally. (70aeddd) - Improve expunged message/UID tracking in IMAP sessions, track synchronization
history for mailboxes/annotations. We now delay removing message files from disk
until the last reference in any session goes away (e.g. after sending an IMAP
EXPUNGE/VANISHED response to all connected IMAP clients with the mailbox open).
(5779443) - When removing an account, wait until the last account reference has gone away
before removing the account files. We store intent to remove in the database,
until we get to it, possibly at next startup in case of sudden shutdown.
(ac4b006) - imapserver: Don't keep account write-locked during IMAP FETCH command, for
responsiveness during large mailbox syncs. (#128, b822533) - Add prometheus metrics for errors when getting certificates through ACME
(typically from let's encrypt), and add alerting rule. (e5e15a3) - webmail: When forwarding a message, include the
subject,date,from,reply-to,to,cc headers in the message (1c4bf89) - Also unicode-normalize usernames (email addresses) when logging into the
imapserver and webapps. (c7354cc) - When delivering over smtp, do not require the other server to announce the
8bitmime extension for 8-bit data unless in pedantic mode. (#287, 46c1693) - Do not use results from junk filter if we have less than 50 positive
classifications to base the decision on. Useful for new accounts, we don't want
to start rejecting incoming messages when there's too little information to
decide. (#64, 6aa2139) - Admin check: Do not raise error when forward-confirmed reverse dns does not
match hostname. Probably relatively common with setups involving NAT. (#239,
acc1c13) - Add config option to an account destination to reject messages that don't
pass a dmarc-like aligned spf/aligned dkim check. (6da5f8f) - cli: Add subcommand "mox admin imapserve $preauthaddress", for admins to open
a preauthenticated imap connection for an account, even if it is disabled for
logins (useful for migrations). (#175, 49e2eba) - webmail: In message view, under More, add button to open currently displayed
part (either text or html) as raw text (but decoded if in
base64/quoted-printable/etc). (008de1c) - cli: Add subcommand "mox config account list", printing all accounts and
whether they are disabled. (1b2b152) - For the web interfaces, ensure the effective configured http paths end in a
slash to prevent 404's and/or errors accessing the web interfaces, preventing
admin confusion. (#325, 3e128d7)
Bug fixes
- smtp: Add data reader fuzzer + fix OOB read. (f10bb2c)
- webmail: When completing a recipient address, quote the "name" if necessary
for proper interpretation. (#305, 1c58d38) - After queueing a message in the web api's, prevent context cancelation (e.g.
aborted http connections) from completing the operation in full. (b37faa0) - smtpserver: In localserve mode, don't reject messages "From" domain
"localhost" if localhost doesn't resolve to an IP through DNS. (d0b2414) - webserver: Don't raise a 500 server error for static file requests with
overlong names. (aa2b24d) - webmail: Fix parsing search filter "start:" and "end:".
(091faa8) - webmail: Fix dark mode, broken since v0.0.14. (#278, d08e0d3)
- webmail: Fix nil pointer dereference when searching for attachment types, eg
"a:spreadsheet" (#272, 0203dfa) - imapserver: Return proper response for FETCH of "BODY[1.MIME]" where 1 is a
message (39c21f8) - imapserver: Properly accept literal8 for APPEND, since we claim to implement
the BINARY extension (88a68e9) - In domain/dns self-check, for unused services, check in SRV records that port
is 0 like how we told users to configure it and fix checking for errors during
srv lookups, and show the value we got but didn't expect; show config snippet
for HostTLSRPT if it isn't configured; don't warn about reverse dns resolving to
multiple names. (9dff879, 3d0dc3a, 6f67812, 1d6f45e)
Update procedure
Before upgrading, do a dry-run first.
- Make a temporary backup with the old mox version:
mox-v0.0.14 backup data/tmp/testupgrade - Verify that all is well with the old version:
mox-v0.0.14 verifydata data/tmp/testupgrade - Verify the state with the new version:
mox-v0.0.15 verifydata data/tmp/testupgrade
With a successful dry-run, the upgrade should go smoothly. Make a new backup
again with `mox-v0.0.14 backup data/...
v0.0.14
New features
- Implement TLS client certificate authentication using their public keys (not
other certificate properties, so no name/expiration/constraint validation).
Accounts can add multiple TLS public keys, e.g. one for each mail client. For
use with SMTP/IMAP and the "external" SASL authentication mechanism. IMAP
"preauth" is enabled with TLS certificate authentication, but can be disabled
per key. (8804d6b)
Improvements
- quickstart: Write all output to a file "quickstart.log" for later reference
(2255ebc) - smtpserver: Add an option for the smtp delivery listener to enable/disable tls
session tickets. (issue #237, e59f894) - smtpserver: Add prometheus metric and alerting rule for failing starttls
handshakes for incoming deliveries. (related to issue #237, afb182c) - webmail: Split pasted address into multiple address, by commas. (PR #252,
501f594) - Clarify that "aliases" are more small-scale lists, not additional addresses
for an account. And make "public posting" the default for new aliases. (issue
#244, 0e338b0, cbe418e) - smtpserver: When doing slow writes due to spammy incoming delivery, try a bit
harder to prevent a timeout for the other side (if it is mox/itself!)
(5a14a5b) - quickstart: For -existing-webserver, also add tls key/cert placeholder for
mail.$domain. (5320ec1) - Do not try to get a tls cert for autoconfig. at startup if there is no
listener with autoconfig enabled. Reduces needless logging in setups that don't
use autoconfig. (35af7e3) - "mox retrain" command: Make the "account" parameter optional, retraining all
accounts when absent. (94fb48c) - webmail: Move config options for showing keyboard shortcuts and for showing
additional headers from localstorage to the settings popup, storing their values
on the server. (3f727cf) - webmail: Don't bind to shortcuts ctrl-l, ctrl-u and ctrl-I since they are
commonly used in browsers. (4d3c411) - webapi: Add Content-Disposition and Filename to the payload of incoming
webhooks (issue #258, 4279383) - Add ability to include custom CSS & JS in web interfaces (webmail, webaccount,
webadmin), and use css variables in webmail for easier customization.
(96d86ad, related to issue #114) - webmail: When marking message as unread, also clear its (non)junk flags
(1f604c6) - webaccount: Update text about opening apple mobileconfig profile files, it has
gotten harder to use in iOS18. (636bb91) - admin: Better handling of disabled MTA-STS during self-check. (7f5e108)
- admin: In self-check for SPF records against our IPs, don't try checking the
unspecified addresses (0.0.0.0 and ::), and warn if there are no explicitly
configured IPs. (726c093) - autoconfig: More RFC compliant SRV service not available DNS records (issue
#240, 3554880)
Bug fixes
- Fix verifying DANE-TA connections for outgoing email deliveries where the
DANE-TA record is not for the first certificate in the chain after the leaf
certifiate. (f7666d1) - junk filter: Fix adjusting word counts after train/untrain. (17baf9a)
- Log when mox root process cannot forward signals to unprivileged child and
give the mox.service permissions to send such signals. (32d4e9a) - webadmin: When loading page with webserver routes, internal services would
always be shown with "admin" as internal services, and saving the handler would
overwrite the correct setting. (issue #264, 965a2b4) - When opening an account by email address, such as during login attempts, and
the address is an alias, fail with proper error "no such credentials" instead of
with error "no such account" and printing a stack trace. (for issue #238,
3d4cd00) - webmail: Fix using the compose window/popup after saving a draft message
failed. (issue #256, ee48cf0) - webmail: Fix css to not show text on button (actually html "a" element for
links) for downloaded (visited) attachments in blue. (f7193bd)
Update procedure
After updating, run "mox retrain" to retrain the bayesian junk filter for all
accounts. Retraining an account with many messages can require quite some
working memory. Due to a bug (now fixed), reclassifying messages as (non)-junk
updated the scores of words incorrectly, sometimes resulting in very high
(non)-junk reputation of some words. The junk filter should perform better
after retraining.
If you are using the mox.service systemd unit file on Linux, you should add
"CAP_KILL" to CapabilityBoundingSet (and reload & restart the service) so
graceful shut downs are faster.
Before upgrading, do a dry-run first.
- Make a temporary backup with the old mox version:
mox-v0.0.13 backup data/tmp/testupgrade - Verify that all is well with the old version:
mox-v0.0.13 verifydata data/tmp/testupgrade - Verify the state with the new version:
mox-v0.0.14 verifydata data/tmp/testupgrade
With a successful dry-run, the upgrade should go smoothly. Make a new backup
with mox-v0.0.13 backup data/tmp/backup (the previous backup was modified by
the dry-run, so couldn't be used to restore!), replace the binary and restart.
For further details, see
https://www.xmox.nl/faq/#hdr-how-do-i-upgrade-my-mox-installation
If you run into any problems, please create a bug report.
Thanks
Thanks for all the contributions/bug reports/feedback/discussions, much
appreciated! Special thanks to: exander77, bwbroersma, Robby-, wneessen,
kiekerjan, robbo5000, morki, laura-lilly, ally9335, spectral369, mattfbacon,
mwyvr, s0ph0s-dog, soheilpro and many more!
Downloading & compiling
v0.0.13
This release fixes TLS interoperability with incoming deliveries from Microsoft
servers by disabling TLS session tickets. If you have MTA-STS and/or DANE
enabled, TLS is required for successful delivery, and updating to v0.0.13 is
required to receive messages from Microsoft again. TLS session tickets may be
enabled again in a future release, possibly per port/service.
Improvements
- In the IMAP server, for the "bodystructure" response item to a "FETCH"
command, add the content-type parameters for multiparts so IMAP clients will
get the MIME boundary without having to parse the message themselves. (issue
#217, 8fa197b) - Add an HTTP handler for the acme http-01 validiation mechanism to all plain
http (non-tls) webservers (ports), not only to the one listening on port 80.
(#issue 218, 0fbf241) - Properly link to matrix room so users can find it. (issue #226, 76f7b9e)
Bug fixes
- Disable session tickets for tls to workaround deliverability issues with
incoming email from Microsoft over smtp with starttls. Without this fix,
email from Microsoft is no long coming in. (issue #237, 22c8911) - In the SMTP server, when logging about problems with recipients, actually
show which recipients were present in the session. (issue #232,
598c5ea). - Webmail: During "send and archive", don't fail with error message when
message that is being responded to is already in archive folder. (issue #233,
879477a) - Webmail: if we don't have loaded account settings yet, abort loading the
popup after showing an error that the settings aren't available yet. (issue
#218, 0430572)
Update instructions
Before upgrading, do a dry-run first.
- Make a temporary backup with the old mox version:
mox-v0.0.12 backup data/tmp/testupgrade - Verify that all is well with the old version:
mox-v0.0.12 verifydata data/tmp/testupgrade - Verify the state with the new version:
mox-v0.0.13 verifydata data/tmp/testupgrade
With a successful dry-run, the upgrade should go smoothly. Make a new backup
with mox-v0.0.12 backup data/tmp/backup (the previous backup was modified by
the dry-run, so couldn't be used to restore!), replace the binary and restart.
For further details, see
https://www.xmox.nl/faq/#hdr-how-do-i-upgrade-my-mox-installation
If you run into any problems, please create a bug report.
Thanks
Thanks for all the contributions/bug reports/feedback/discussions, much
appreciated! Special thanks to mdavids, danieleggert, startup-001-steve,
snabb, mattfbacon, mgkirs, exander77.
Development on mox is funded through the NLnet NGI0 Entrust Fund,
https://nlnet.nl/entrust/, with financial support from the European
Commission's Next Generation Internet programme.
Downloading & compiling
v0.0.12
Improvements
- webmail: Change many inline styles to using css classes, and add dark mode.
(#163 by mattfbacon, a16c086) - webmail: In compose window, merge close & cancel button, and align buttons on
the right. (4d28a02) - mox backup: Add hint about systemd ReadWritePaths if hardlinking fails on
linux due to cross-device link. (#170 by rdelaage, 44a6927) - mox backup: Clarify behaviour with destination directory, and exit code.
(#172 by RobSlgm, 1fc8f16) - When removing account, remove its data directory instead of leaving it
around. (#162 by RobSlgm & x8x, 30ac690) - Give more helpful pointers for dns-related setup, such as troubleshooting dns
resolving, and multi-line dkim dns records. (#158, #164, vipas84, RobSlgm,
83004bb) - Improve http request handling for internal services (web interfaces) and
multiple domains. The handler for /admin/ is now only enabled on the listener
(machine) host name by default, no longer all hosted domains. The internal
handlers (for admin, account, webmail, webapi), can now also be explicitly
configured in the webserver section, for additional/custom endpoints to serve
those services on. (#160 by TragicLifeHu, 614576e) - During DNS self-check, if the SRV records with just a dot (for a non-existent
service), is missing, show as warning, not as error. (#184 by morki,
e350af7) - During DNS self-check, warn when DANE is not configured (through static host
keys), instead of showing "OK". (#185 by morki, 73373a1) - Systemd service file now syslogs as facility "mail". (by kiekerjan,
151bd1a) - Add favicon to web interfaces. Admins can use the webserver config to serve a
different file. (#186 by morki, c629ae2) - Attempts at improving interoperability with SMTP clients and the "login" SASL
authentication mechanism. (#51 by hmfaysal, #223 by gdunstone & wneessen,
aead738, 7ecc3f6) - Recognize more charsets than utf-8/iso-8859-1/us-ascii when parsing message
headers with addresses. (#204 by morki, 5678b03) - webapi: Implement adding "alternative files" to messages sent with the Send
method. (#188 by morki, 6c488ea) - webmail: Add setting to show html version of a message by default, instead of
text version. (#196 by GildedHonour, b77f44a) - When login sessions to admin/account/webmail interfaces expiry or are no
longer valid, explain the reason in the message above the login form. (#202
by ally9335, a977082) - webapi: Add "RcptTo" to webapi MessageGet result. (mattanja on matrix,
b0c4b09) - webadmin: At managing aliases, mention an alias member won't receive a
message if the member address is in the message From header. (#220 by
wneessen, bbc419c) - In ACME port config option, explain why using a HTTPS reverse proxy will not
work for ACME tls-alpn-01 verification. (#218 by mgkirs, 7d3f307) - Add more details to X-Mox-Reason message header added during delivery, for
understanding why a message is accepted/rejected. (#179 by Fell, #157 by
mattfbacon, 32b549b) - Many small improvements.
Bug fixes
- webadmin: Propagate error when quota size cannot be parsed, improve parsing
and hint in error message. (#115 by pmarini-nc, 72be3e8) - webadmin: Don't show js runtime typecheck errors for invalid values in DMARC
and TLS reports. (#161 by RobSlgm, a2c9cfc) - webmail: In list of From address to use in compose window, don't add the
catchall address. (1a0a396) - webmail: Only show "edit" button on drafts, and similar for "e" shortcut.
(8254e9c) - webadmin: Show correct host TLSRPT record in dns selfcheck, and make all
suggested dns records absolute. (#182 by mdavids, 9bab312) - Show the same SPF record for a domain in the dnsrecords and dnscheck
output/pages. (#176 by rdelaage & RobSlgm, 7e54280) - Fix parsing message headers with addresses that need double quotes. (#199 by
gene-hightower, 016fde8) - Reject attempts at STARTTLS for SMTP & IMAP when no TLS config is present.
Instead of dereferencing a nil pointer, which is caught by the go runtime,
with fallback error handling gracefully closing the SMTP connection.
(a7bdc41) - For certain errors during SCRAM authentication, handle errors more gracefully
instead of aborting the connection. (#222 by wneessen, c7315cb) - For messages retired from the delivery queue, set "success" field properly,
and include the SMTP code/enhanced code on success too (not only on failure).
(fdc0560) - webmail: Fix loading a "view" (messages in a mailbox) when the "initial"
message cannot be parsed. (#219 by wneessen, fb65ec0) - smtpclient: Handle server closing connection after writing its response to
RCPT TO in pipelined mode. (#198 by soheilpro, 17346d6) - imapserver: Prevent unbounded memory allocations when handling a command
(solves same problem as in CVE-2024-34055). (aef99a7) - For incoming SMTP deliveries with STARTTLS, use certificate of hostname if
SNI hostname is unknown. Instead of failing the connection because no
certificates are available. Fixes interoperability with SMTP clients that do
opportunistic SMTP without sending a hostname. (#206 by RobSlgm, 62bd2f4)
Update instructions
Before upgrading, do a dry-run first.
- Make a temporary backup with the old mox version:
mox-v0.0.11 backup data/tmp/testupgrade - Verify that all is well with the old version:
mox-v0.0.11 verifydata data/tmp/testupgrade - Verify the state with the new version:
mox-v0.0.12 verifydata data/tmp/testupgrade
With a successful dry-run, the upgrade should go smoothly. Make a new backup
with mox-v0.0.11 backup data/tmp/backup (the previous backup was modified by
the dry-run, so couldn't be used to restore!), replace the binary and restart.
For further details, see
https://www.xmox.nl/faq/#hdr-how-do-i-upgrade-my-mox-installation
If you run into any problems, please create a bug report.
After upgrading, you may want to run "mox reparse" to parse the message headers
of all messages in all accounts. Message headers for addresses with character
sets other than us-ascii/utf-8/iso-8859-1 will be fixed.
Thanks
Thanks for all contributions, bug reports, feedback and discussions. It improves
mox, keep it coming!
Development on mox is funded through the NLnet NGI0 Entrust Fund,
https://nlnet.nl/entrust/, with financial support from the European
Commission's Next Generation Internet programme.
Downloading & compiling
v0.0.11
New features
- Improve queue management (40ade99)
- Add option to put messages in the queue "on hold", preventing delivery
attempts until taken off hold again. - Add "hold rules", to automatically mark some/all submitted messages as "on
hold", e.g. from a specific account or to a specific domain. - Add operation to "fail" a message, causing a DSN to be delivered to the
sender. previously we could only drop a message from the queue. - Update admin page & add new cli tools for these operations, with new
filtering rules for selecting the messages to operate on. In the admin
interface, add filtering and checkboxes to select a set of messages to operate
on.
- Add option to put messages in the queue "on hold", preventing delivery
- Add a webapi and webhooks for a simple HTTP/JSON-based API, helps with
sending transactional email. (for issue #31 by cuu508, 09fcc49)- Webapi allows submitting messages without having to compose the message
yourself, and without having to know SMTP. - Webhooks makes it easy to process delivery failure/success updates, without
needing IMAP and process DSNs. - History about outgoing/sent messages can be kept for a configurable interval,
per account. Also for the new webhook queue. - Messages can be delivered with a "unique SMTP MAIL FROM" address, using a
unique id after the localpart catchall separator, e.g.
you+<unique>@example.org. - Automatic suppression list management, protecting server reputation.
- Extra metadata can be attached through the webapi, or through
X-Mox-Extra-: headers during SMTP submission. - Most settings are per-account, configurable through config file and
account web interface. The webapi must be enabled in mox.conf through field
WebAPIHTTP(s). - Gopherwatch.org was created to validate this functionality, and it can now
operate either with SMTP/IMAP or webapi/webhooks.
- Webapi allows submitting messages without having to compose the message
- Add aliases/lists: when sending to an alias, the message gets delivered to all
members. (for issue #57 by hmfaysal, issue #99 by naturalethic, feedback by
damir & marin, 960a512). - IMAP quota extension (RFC 9208), so mail clients can show disk usage (issue
#115 by pmarini, 4dea2de) - Webmail: when moving a single message out of/to the inbox, ask if user wants
to create/remove a rule to automatically do that server-side for future
deliveries, either based on list-id header if present, or message-from address.
(6c0439c) - Webmail: add server-side stored settings, initially for signature, top/bottom
reply and showing the security indicator bars below address input fields.
(for issue #102 by nixigaj, 70adf35) - Webmail: for replies/forwards, add button "send and archive thread" next to
the "send" button, and give it a control+shift+Enter shortcut. (for issue #135
by mattfbacon, 5229d01) - Webmail: store composed message as draft until send, ask about unsaved changes
when closing compose window. (9529ae0) - Webmail: remember server-side per from-address whether we should show the
text/html/html-with-external-resources version of a message. (0f735a1)
Improvements
- Add account config option to skip first-time sender delay for incoming
messages over SMTP. (8b2c978) - In quickstart, check if outgoing SMTP connection on port 25 can be made. New
cloud machines tend to have the port blocked, early warning is helpful.
(reported by arnt, 0262f46) - In quickstart, use "postmaster@" for the contact address with the ACME account
for Let's Encrypt if the initial address has a non-ASCII localpart, to prevent
account registration from failing. (reported by arnt, f4b6e14) - Add a "direct" transport, that allows influencing behaviour of the normal
delivery mechanism of dialing MX records: The IP address family can be limited
to IPv4 or IPv6 (either may not have proper reverse DNS set up). (for issue
#149, PR #153 by lmeunier, be570d1) - Also give delivery another try with 5xx response when it happens during MAIL
FROM/RCPT TO, not only EHLO as before. (related to #149, PR #152 by lmeunier,
feb8e6c) - Make error messages around syntax errors in config files related to
spurious spaces more helpful/understandable. (reported by arnt, 6516a27) - In SMTP server, reevaluate if SMTPUTF8 extension is needed for delivery, to
prevent potential delivery problems to servers that don't implement SMTPUTF8.
(issue #145, by lmeunier, 9c5d234) - When importing maildir, use file mtime as received timestamp if no timestamp
is available in filename. (based on message from abdul h, 6d38a1e) - If webauth login cookie is missing, and forwarding was configured, hint that
reverse proxy may be stripping path. (for issue #151 by naturalethic,
afc47c8) - Webmail: When adding submitted message to Sent mailbox, keep any Bcc address
in Bcc header. (c9451d4) - Make more of the dynamic config options (in domains.conf) configurable through
the web interfaces, instead of requiring editing the config file. (baf4df5,
a69887b, e702f45) - Webmail: Allow resizing of compose window, and remember width/height for
viewport dimension. (e8bbaa4) - Webmail: Show all images (inline and attachment) below the text part (for the
text view, not for html view). (3a58b2a) - Webmail: Add export functionality, similar to existing option in account web
interface, but not also possible per mailbox or hierarchy. (bf5cfca) - Webmail: ctrl+Backspace on empty address input field removes the field (b54e903)
- Localserve: delivery from queue now goes through the smtp server instead of
directly from queue to local accounts. To go through the full regular delivery
paths. (1cf7477) - Many small improvements.
Bug fixes
- Always properly escape values in Authentication-Results header added to
incoming messages. Some generated values could have characters that weren't
escaped. (2c9cb5b) - Fix logging in on account and webmail interface for account names (not email
addresses) with non-ASCII characters. (reported by arnt, 666f84e) - Update to latest bstore with a fix for ordering of certain database results.
Only a single query in mox would have triggered the issue, with no expected
impact. (d34dd8a) - For incoming TLS connections (HTTPS, but also SMTP and IMAP) for unrecognized
domain names (for which we don't have a TLS certificate), don't respond with an
"internal error" TLS alert, but with an "unrecognized name" alert. More helpful
to user figuring out what's going on. (reported by arnt, 89a9a8b).
Update instructions
Before upgrading, do a dry-run first.
- Make a temporary backup with the old mox version:
mox-v0.0.10 backup data/tmp/testupgrade - Verify that all is well with the old version:
mox-v0.0.10 verifydata data/tmp/testupgrade - Verify the state with the new version:
mox-v0.0.11 verifydata data/tmp/testupgrade
With a successful dry-run, the upgrade should go smoothly. Make a new backup
with mox-v0.0.10 backup data/tmp/backup (the previous backup was modified by
the dry-run, so couldn't be used to restore!), replace the binary and restart.
For further details, see
https://www.xmox.nl/faq/#hdr-how-do-i-upgrade-my-mox-installation
If you run into any problems, please create a bug report.
Thanks
Thanks for contributions and/or feedback from: pmarini, tabatinga0xffff,
lmeunier, alex, arnt, abdul h, cuu508, naturalethic, nixigaj, mattfbacon,
jsfan3, hmfaysal, damir & marin from sartura, RobSlgm, daftaupe, vipas84,
TragicLifeHu, manaus0xff, jdlawrie, Bloomers7577, kbrgmn (and all those I
missed).
Feedback, feature requests, bug reports, contributions (start small!) are all
welcome. An easy way to help mox is to use it and spread the word!
Development on mox is funded through the NLnet NGI0 Entrust Fund,
https://nlnet.nl/entrust/, with financial support from the European
Commission's Next Generation Internet programme.
v0.0.10
New features
- Implement SMTP "FUTURERELEASE" extension in SMTP server. For submitting a
message for delivery from the queue at a time in the future, e.g. tomorrow
morning 9:00. (93c52b0) - Delivery from the queue to multiple recipients in a single SMTP transaction,
transferring data only once. This is only done for recipients with the same
recipient domain. The maximum recipients limit from the RFC 9422 SMTP LIMITS is
honored and mox now announces its own limit. (47ebfa8) - Allow configuring DNS blocklists (DNSBLs) only for monitoring, without using
them for incoming email. Previously, mox would only monitor DNSBLs that are
used for incoming connections. But it is useful to know if your IPs are on a
blocklist, unrelated to whether you're using the blocklist. (15e450d)
Improvements
- Mox has a separate website now, https://www.xmox.nl. It should be more
friendly for first-time visitors than the github page. It also has an initial
video, with more to come. Content, except images/videos, is in the mox git
repository, so functionality and documentation can be changed together.
(0bc3072) - Fix interpreting a per-account negative total size quota as "no limit",
overriding the global/default setting. (issue #115 by pmarini-nc) - Webmail: When Q/B-word-decoding attachment filenames, recognize more
character set encodings. (issue #113 by jsfan3) - Webmail: show unicode for internationalized email addresses by default. Not
the xn-- names, which are not user-friendly. A hover still shows the xn--
names. After talking to arnt at FOSDEM. - Localparts of addresses are now normalized to Unicode NFC throughout mox,
including for incoming deliveries. Previously, incoming SMTPUTF8 deliveries
with non-NFC-normalized unicode localparts (e.g. with separate code points for
accents and such (NFD)) would not be accepted. (8e6fe74) - The PRECIS (RFC 8265) password profile is now applied when setting/using
passwords. It prevents confusing users who use unusual unicode whitespace
codepoints in their passwords. (c57aeac) - Webmail: Implement registering "mailto:" links. Click the new button in the
Help popup to register. From Hans-JÃķrg. (ee1db2d) - In DSNs, show the full (multiline) SMTP response, not just the first line. It
often has helpful details. (50c1396) - More DSN improvements: put the full SMTP reply in field Diagnostic-Code
(1c934f0), when delivering a local DSN add Delivered-To header
(79da4fa), when parsing an incoming DSN set the Action field (e.g. failed,
delayed) (f6497b1), match DSN to threads based on Referenced/In-Reply-To
only, not subject (13923e4). - In quickstart and self-check, improve the check whether resolver verifies
DSNSEC. We were looking up NS on ".", but some DNSSEC-verifying resolvers
respond to that with unauthentic data. (issue #139 by triatic) - More helpful instructions about setting up a DNSSEC-verifying resolver, and
how to test it. (issue #131 by romner-set) - Relevant for reusable components: the "slog" package from golang.org/x/exp is
now replaced with slog from the standard library. Function signatures have
changed. (d1b87cd)
Bug fixes
- smtpserver: Spurious \r were sometimes injected when fixing up crlf line
endings for incoming messages. The check could look at wrong a buffer,
seemingly randomly incorrectly concluding a \r was missing before a \n.
Messages with the extra \r added shouldn't cause any trouble.
You can find these messages withgrep -rn $'\r\r$' data/accounts/$youraccount/msg/,
remove one \r manually and runmox fixmsgsize $youraccountto
reparse the message. (issue #117, by haraldrudell) - Deliveries could seemingly randomly but consistencly fail with an incorrect
diagnostic about the message containing a bare newline. It would happy due to
crlf handling around buffer starts/ends. (issue #129 by x8x) - When adding a message to the queue for delivery, set the correct local
account, so DSNs about delivery failures go to the correct user, not the
postmaster account. (dc83ad1) - imapserver: In a sequence/uid pattern, the "*" would in some cases be interpreted
as the first message, but it should always be the last message in a mailbox.
(14aa854). - Fix displaying DMARC reports with empty values for some fields. The
TypeScript checks would reject them for being invalid enums, empty strings
are now part of the enum. (20812dc) - In outgoing TLS reports, always use DNS ASCII A-labels, not unicode U-labels.
(62be829) - For domains configured only for TLS/DMARC reporting, don't reject messages to
that domain during submission, but deliver them as normal. (1d9e80f) - smtpclient: Treat server's size limit of SIZE=0 as "no limit", instead of
failing to deliver. (39bfa43) - Accept TLS reports that reference multiple domains, and that mix reports
about hosts and recipient domains. (e0c36ed) - Admin: Prevent writing out an invalid domains.conf that cannot be parsed
again. Happened when the last address of an account was removed through the
admin web interface. (issue #133 by ally9335) - Webmail: sending to invalid addresses could result in (failing) attempts to an
empty address instead of returning an error message to the user. (63cef8e)
Update instructions
Before upgrading, do a dry-run first.
- Make a temporary backup with the old mox version:
mox-v0.0.9 backup data/tmp/testupgrade - Verify that all is well with the old version:
mox-v0.0.9 verifydata data/tmp/testupgrade - Verify the state with the new version:
mox-v0.0.10 verifydata data/tmp/testupgrade
With a successful dry-run, the upgrade should go smoothly. Make a new backup
with mox-v0.0.9 backup data/tmp/backup (the previous backup was modified by
the dry-run, so couldn't be used to restore!), replace the binary and restart.
For further details, see
https://www.xmox.nl/faq/#hdr-how-do-i-upgrade-my-mox-installation
If you run into any problems, please create a bug report.
Thanks
Thanks for contributions and/or feedback from: haraldrudell, x8x, romner-set,
triatic, mteege, Hans-JÃķrg, arnt, jsfan3, pmarini-nc, ArnoSen, andreasheil,
theduke, daluntw, lmeunier, ally9335, p-rintz, daftaupe (and everyone at the
FOSDEM email devroom, and all those I missed).
Feedback, feature requests, bug reports, contributions (start small!) are all
welcome. An easy way to help mox is to use it and spread the word!
Development on mox is funded through the NLnet NGI0 Entrust Fund,
https://nlnet.nl/entrust/, with financial support from the European
Commission's Next Generation Internet programme.
Download or compiling
v0.0.9
New features
- Per-account disk space quota. Mox now tracks the total size of messages in an
account (overhead from the message index database or file system is not
included). A maximum disk usage can be configured globally and/or per account.
If configured, the maximum allowed disk usage is enforced. By default, no
maximum is configured. Setting quota for accounts can prevent a single account
from filling up the disks. (d73bda7) - When suggesting CAA DNS records (specifying which Certificate Authorities are
allowed to sign certificates for a domain), suggest variants that bind to the
ACME account ID, and restricts the validation methods to those used by mox.
Should prevent MitM close to a machine from requesting TLS certificates through
ACME as seen on the internet recently. (db3fef4) - Add config file fields for ACME external account binding (EAB). Some ACME
providers require EAB to link an ACME account with a non-ACME account at the
provider. With EAB, more ACME providers can be used with mox. (ee1094e) - Implement the PLUS-variants of the SCRAM authentication mechanisms:
SCRAM-SHA-256-PLUS and SCRAM-SHA-1-PLUS. The PLUS variants add TLS channel
binding: Authentication only succeeds if the client and server are on the same
TLS connection. Authentication will fail if there is a MitM (that has a valid
TLS certificate). (e7478ed) - Use a
mail.<domain>CNAME for the SMTP (submission) and IMAP servers of a
domain, pointing to the mail server host name. Before, clients were instructed
to configure the mail server host name directly, but that makes it harder to
migrate the domain to another mail server in the future: All clients would need
to update their settings. A CNAME can be pointed to a new server without
requiring changes to client settings. (da3ed38)
Improvements
- The admin, account and mail web interfaces now use session cookie-based
authentication (with csrf) instead of HTTP authentication. These interfaces
now have a "logout" button (not possible with HTTP authentication). (#58,
0f8bf2f) - Webmail: Don't automatically mark unclassified messages in the Rejects mailbox
as non-junk when reading them. For all other mailboxes the behaviour is
unchanged. (416113a) - Webmail: Ask user to reload the application when the server version has
changed. (8e37fad) - Webmail: In the message view, show the DMARC status of the domain of the
message "From" address. (fb81eff) - Webmail: When composing, leave out our own address when replying. (7c1879d)
- Junk filtering: Make content-based filtering for first-time senders more
strict for messages delivered over non-TLS connections, or when the addressee
isn't in a To/Cc message header. Common for junk, uncommon for non-junk.
(2ff87a0) - SMTP server: after "MAIL FROM:" and "RCPT TO:" commands, allow a space (which
is invalid syntax) also for delivery. We only allowed it for submission,
assuming only (submitting) mail clients or spammers had sloppy SMTP
implementations. In practice, also legitimate delivering mail servers have
sloppy implementations. (#101, af5da17) - When generating a Authentication-Results message header (with results for
SPF/DKIM/DMARC/etc), put each result on a new line for better readability.
(2710a5b) - Make many non-server Go packages more easily reusable. Package imports were
changed so more packages can be imported without pulling in mox internals. See
https://github.com/mjl-/moxtools for a tool that reuses Go packages. It is
deployed publicly at https://tools.xmox.nl/. As part of this change, mox now
uses Go's slog package for logging. Changes in the API's between releases are
tracked at https://github.com/mjl-/mox/tree/main/apidiff. (5b20cba,
72ac1fd, f3a35a6) - SMTP server: for submission, if a message has a Return-Path header, only fail
in pedantic mode. (#103, 57fc37a) - Webmail: For messages in the Sent mailbox, show To/Cc/Bcc in italic, and show
all correspondents in collapsed threads. (#104, 802dcef) - The admin and account web interfaces were changed from JavaScript to
TypeScript, making it easier to maintain. (a9940f9). - Implement IMAP-UTF-7 more fully, and allow creating mailboxes with "special"
characters: "&" (the IMAP-UTF-7 escape character), "#" (the IMAP namespace
character), "*" and "%" (matching characters). These were not allowed out of
caution, but occur in real-world mailbox names. Mox now uses IMAP-UTF-7 when
sending mailbox names for clients that did not enable IMAP4rev2 or UTF8=ACCEPT.
Before, mox would always send UTF-8, but not all clients understand that, and it
can cause confusion with IMAP-UTF-7 and "&" escaping. (#110, d84c96e) - IMAP server: Add STATUS=SIZE as capability. It was already implemented as
part of IMAP4rev2, but older clients won't recognize that. (59bffa4) - And more smaller improvements.
Bug fixes
- SMTP server and SMTP smuggling: Mox was itself not vulnerable to SMTP
smuggling, treating only "\r\n.\r\n" as end of transaction. But two
improvements have been made: (1f9b640)- Bare carriage returns are no longer accepted during SMTP transactions. Bugs
in other mail servers can lead them to accept other sequences as
end-of-transaction, notably "\r.\r". Mox would accept submitted messages with
that sequence for delivery. Such messages could trigger bugs in other mail
servers causing them to materialize non-existent messages. By no longer
accepting bare carriage returns in submitted messages, mox can no longer be used
to trigger the "\r.\r"-bug in other mail servers. SMTP transactions with a bare
carriage return now result in an error mentioning SMTP smuggling. Mox can still
store messages with bare carriage returns, e.g. from imports. Mox already added
missing carriage returns to bare newlines. - A bug in mox caused sequences of "\nX\n" for any X (including "\n.\n") to
result in a temporary processing error. For "\n.\n" this accidentially was fine
behaviour, for other characters the bug has been fixed. Any sequence of
"\r\n.\r\n" where one or both carriage returns are missing now result in an
error mentioning SMTP smuggling.
- Bare carriage returns are no longer accepted during SMTP transactions. Bugs
- IMAP server: The on-disk message size was not correctly calculated for messages
added with the APPEND command (typically used for imported messages and when a
mail client sends a message) when bare newlines ("\n") got a missing carriage
return added ("\r\n"). This would cause errors when attempting to read the
message. If you are affected by this, run "mox fixmsgsize " to fix up
incorrect message sizes. Reported by daftaupe. (02eb7b5) - SMTP server: When writing "slow responses" (when a message is deemed junk),
ensure the total response time isn't too long (slightly less than 30 seconds).
Slow responses were writing 1 byte per second. With a long response (e.g. long
error message), a sending mail server may not consume a full response. If mox
was the sending server, it would report a timeout after 30 seconds. Report by
naturalethic. (fbc18d5) - IMAP server: Only send "OLDNAME" in a response to the LIST command when
IMAP4rev2 is enabled. IMAP4rev1 clients (most common) don't understand it. From
duesee with imap-flow. (41e3d1a)
Update instructions
Before upgrading, do a dry-run first.
- Make a temporary backup with the old mox version:
mox-v0.0.8 backup data/tmp/testupgrade - Verify that all is well with the old version:
mox-v0.0.8 verifydata data/tmp/testupgrade - Verify the state with the new version:
mox-v0.0.9 verifydata data/tmp/testupgrade
With a successful dry-run, the upgrade should go smoothly. Make a new backup
with mox-v0.0.8 backup data/tmp/backup (the previous backup was modified by
the dry-run, so couldn't be used to restore!), replace the binary and restart.
For further details, see
https://github.com/mjl-/mox#how-do-i-upgrade-my-mox-installation
If you run into any problems, please create a bug report.
After upgrading, you may want to:
- Run "mox fixmsg " if you've imported messages over IMAP that have
bare newlines ("\n" instead of "\r\n"). - Configure your email clients to use authentication mechanism
SCRAM-SHA-256-PLUS for SMTP (submission) and IMAP, if they support it. If mail
clients have trouble logging in after upgrading, they may be picking a SCRAM
PLUS variant without properly supporting it. Explicitly configuring the non-PLUS
authentication mechanism should fix the problem and ensures a MitM cannot
downgrade the chosen authentication mechanism by altering the list of supported
authentication mechanisms. - Change the CAA records for your domains to include the ACME account id and
allowed validation methods. See the suggested DNS records for each configured
domain. - Set disk usage quota, either globally for all accounts or per account. See
QuotaMessageSize in mox.conf, https://pkg.go.dev/github.com/mjl-/mox/config. - Add
ClientSettingsDomain: mail.<yourdomain>to each domain in domains.conf,
add the CNAME record as afterwards suggested in the DNS records page, and
update client account settings to use the new host name. - For mox setups configured behind an existing webserver, add "Forwarded: true"
to the (Admin|Account|Webmail)HTTP(S) sections in mox.conf. It causes them to
use X-Forwarded-* headers for determining if HTTPS was active (for secure
cookies), and for the IP used for rate limiting.
Thanks
Thanks for contributions and/or feedback from: Fell, duesee (and
https://github.com/duesee/imap-flow/), daftaupe, naturalethic, jsfan3, Halyul,
mattfbacon, jsaponara, pmarini (and those I missed).
Fee...
v0.0.8
New features:
- DNSSEC-awareness throughout the code base, based on
https://github.com/mjl-/adns, a fork of Go's DNS resolver. DNSSEC
is a requirement for DANE (see below). If you don't have a
DNSSEC-verifying stub resolver configured, DNS lookups are regarded
as unverified. Installing unbound and and is still the recommended
action. - DANE for incoming and outgoing delivery (RFCs 7672, 6698 and 7671).
DANE is a mechanism to require verified TLS (with STARTTLS) for delivery
over SMTP. Verification with DANE does not use the global WebPKI/PKIX
pool of Certificate Authorities. With DANE, verification is done based
on DNS records of type TLSA. These records specify (hashes of) public
keys to allow (DANE-EE), ignoring expiration/hostname-match/issuing
party, and/or they specify (hashes of) certificates of allowed
certificates authorities (DANE-TA), regardless of whether those
authorities are in the globally trusted WebPKI/PKIX CA pool.
DANE requires that DNS records are DNSSEC-protected, both to protect
the MX records and the TLSA records. MTA-STS (already implemented)
has similar goals, but does use the WebPKI/PKIX Certificate Authorities
pool, both to verify TLS certificates and to protect MX records.
DANE and MTA-STS can coexist: In the default configuration, mox
generates private keys, then retrieves certificates from Let's Encrypt
for these private keys (through https://github.com/mjl-/autocert, a
fork of golang.org/x/crypto/acme/autocert). These certificates are
valid for MTA-STS, and TLSA records are generated for the keys for
verification with DANE. For inbound delivery with DANE protection,
your DNS records must be DNSSEC-protected. For outbound delivery with
DANE protection, a trusted DNSSEC-verifying stub resolver is required. - Mox now compiles on Windows, so "mox localserve" and most other
commands to work, but "mox serve" (the actual mail server) does not
yet work. - "SMTP Require TLS Option" (RFC 8689), consisting of two mechanisms:
- A REQUIRETLS SMTP extension to require verified TLS along each hop
in message delivery, either through MTA-STS or DANE. - A message header "TLS-Required: No", that overrides any TLS
requirement along the way as specified by any MTA-STS or DANE
policy.
These mechanisms can be used to ensure secure delivery, or to work
around delivery issues due to TLS requirements. Mox remembers whether
an SMTP server offered the REQUIRETLS extension. Webmail automatically
selects it if all recipients support it. Webmail also lets the user
select the "TLS-Required: No" header.
- A REQUIRETLS SMTP extension to require verified TLS along each hop
- Outgoing DMARC reports (RFC 7489). Mox now stores the results of DMARC
evaluations for inbound messages. These results can be viewed in the
admin web pages. Reports are typically sent every 24 hours (covering a
24 UTC day), but will be sent for up to 1 hour intervals if requested
by a domain. Sending DMARC reports is enabled by default, but can
be disabled through new option NoOutgoingDMARCReports in mox.conf.
Reporting addresses can be added to a suppression list, to reduce
noise due to deliverability issues. Incoming DMARC reports were
already implemented. - Outgoing SMTP TLS reporting (RFC 8460). When delivering outbound
messages, the SMTP client will look up MTA-STS and/or DANE policies
for TLS requirements, with a fallback to opportunistic TLS.
The evaluated security policies, (TLS) connection success/failure
counts, and any failure details, are stored. Reports are sent once
per day to reporting addresses in the TLSRPT DNS record of a domain,
over a 24 hour UTC day period. By default, reports are only sent
if there was a failure. The pending results can be viewed in the
admin web pages. Sending reports can be disabled with new option
NoOutgoingTLSReports in mox.conf. Reports with only successes can be
enabled through OutgoingTLSReportsForAllSuccess. Reporting addresses
can be added to a suppression list to reduce noise due to delivery
failures.
Improvements:
- Webmail: Recognize encoded file names in message attachments. Either with
RFC2231-encoding (as specified) or Q/B-word encoding (as used in practice).
(#82) - Webmail: For portait images, don't let image extend beyond window height.
- Webmail: Wrap long header lines, instead of showing horizontal scrollbar.
- Webmail: Replying without having text selected now starts a top-post
with an "On ... wrote:"-line. Replying with text selected still starts
a bottom-post containing only the selected text, quoted. (#83) - Webmail: In the compose window, autoresize address input fields to
match the content. - Webmail: When composing a message, show security properties of recipient
addresses: Whether STARTTLS is known to be offered by the SMTP server
(historically), whether MTA-STS is implemented, whether MX records are
DNSSEC-signed, whether DANE is implemented, and whether REQUIRETLS is
offered by the SMTP server (historically). - Webmail: Add clear marker between message header and body, so an
HTML message cannot fake being part of the UI. - Webmail: If a "display name" of an address contains address-like
characters ("@" or "<" or ">"), only display the actual email address
in the message listing, not the display name. Should prevent confusion
attacks with messages specifying an unrelated email address in the
display name. - The suggested SRV DNS record for autodiscovery now points directly to
the host name, not to a CNAME (which is technically invalid, but seems
to work in practice). - When ACME-validation for a new TLS certificate fails, log error messages that
may explain the reason. E.g. "your CAA record forbids Let's Encrypt from
issuing certificates". - SMTP server: workaround for Windows Mail that has invalid additional space in
its "AUTH PLAIN" command. - Fix delivery to recipient domains with an MX host containing an underscore,
such as "_dc-mx.." as apparently used by cloudflare. From
richard g. - When generating a DSN message (for delivery failure), try harder to DKIM-sign
it: With a configured domain, also when sending from
postmaster@mailhost.. - For incoming messages, track whether TLS and REQUIRETLS was used during
delivery, and whether the message matched a forwarding or mailing list rule,
and show it in the webmail. - In logging, change "fatal io error" to just "io error". The "fatal" sounds
too serious, it's just the connection that will be closed. (#39) - Add rfc/xr.go to generate HTML pages with cross-referenced code and
RFC. These HTML pages are published at https://www.xmox.nl/xr/dev/ - Webmail: In case of long lists of addresses in To/Cc/Bcc headers, only show
the first 4 addresses along with a "More" button. (#98) - Clarify documentation on importing messages from the command-line,
which can be unintuitive due to systemd service file mount points. (#79) - Implement obsolete SASL LOGIN for submission, for interoperability with the
new cloud Outlook. - Fix IMAP ESEARCH response for clients before IMAP4rev2, notably cloud
Outlook. - Many small improvements.
Bug fixes:
- Security: When looking up MTA-STS policies, don't follow CNAME records
for the recipient domain. A single unauthenticated CNAME response
could redirect policy lookup to another domain. - Webmail: When replying to selected text consisting of characters in multiple
unicode blocks, don't loose some of the selected text in the reply. - Don't parse DKIM "selectors" as IDNA domains. They are just DNS
labels. Based on email from richard g. - Update to latest bstore (database library) to fix a bug with
deleting/updating records. Problem found during development of new
features, behaviour not seen in any committed version. - Webmail: Fix the date shown in the message headers. It was off by the timezone.
- Fix concurrency bug with accessing a math/rand PRNG with Read. Mostly
replaced with crypto/rand. Found during development and tests. - The queue page on the webadmin would fail with a JS error when a message was
in the queue and no transport was configured (which is the default). - For domains configured only to accept DMARC reports, don't request an
autoconfig TLS certificate through ACME at startup. - For incoming messages, convert bare newlines to carriage
return+newline. The import code already did this. Having bare newlines
could cause imapserver's fetch command to fail with a (connection)
panic in some cases.
Update instructions:
Before upgrading, you should do a dry-run first:
- Make a temporary backup with the old mox version:
mox-v0.0.7 backup data/tmp/testupgrade - Verify that all is well with the old version:
mox-v0.0.7 verifydata data/tmp/testupgrade - Verify the state with the new version:
mox-v0.0.8 verifydata data/tmp/testupgrade
With a successful dry-run, the upgrade should go smoothly. Make a new backup
with mox-v0.0.7 backup data/tmp/backup (the previous backup used for the
dry-run has been modified, so couldn't be used to restore!), replace the binary
and restart.
If you are upgrading from v0.0.6, see its upgrade instructions for commands to
execute. It's better to immediately upgrade to v0.0.8 (see issue #71).
If you run into any problems, please create an issue.
After upgrading, you may want to configure DANE:
To make use of DANE for outbound deliveries, make sure you have a
trusted DNSSEC-verifying stub resolver. Unbound is recommended. Don't
use systemd-resolved, its DNSSEC support is not ready for use.
To make use of DANE for inbound deliveries, first make sure your
DNS records are DNSSEC signed, and your DNS operator supports TLSA
records. The SMTP TLS private keys ("host keys) should be added to
the...
