v0.28.1

MillionSend v0.28.1 fixes false alarms in the content monitor (#217) and in the matching of new teams against teams suspended for phishing (#216). Create inbox now lists every domain your team has (#215). No database migrations.

Content monitor (#217)

These apply only to instances that run the content monitor's judge (ABUSE_JUDGE), which is off by default.

• A developer's local test no longer holds a New-tier team.
  • The case: a password-reset test built on a framework's default template signs with the framework's name, under the product's own sender, and links only to localhost. The judge reads that as impersonation.
  • The change: when every link in the message points to a loopback address, including any link read from its images, and the message has no Reply-To, the verdict parks the message for the review list instead of holding the team.
  • Any other link, a mailto: or tel: link, or a Reply-To keeps the hold.
• A store's notice may link a carrier too.
  • v0.27.0 spared a platform's notice for a client business only when it linked the client's site alone. Now it may also link other registered sites, such as a carrier's tracking page. None of them may be a brand the monitor knows, or a host where every user shares one name (file shares, forms, site builders, link pages, chat links).
  • The first such notice still parks for review. Once an operator releases mail to every site it links, later notices of that shape go out without waiting.
  • A notice that adds a new site keeps the client site's release. Any other released site in it is taken back as before.
• Released mail stops counting toward the repeat hold. Five phishing-type verdicts from 80 within seven days hold a New-tier team. A verdict that spared the team, and whose mail an operator released, no longer counts toward them while every site it rested on keeps that release. The verdict that takes such a release back counts it again at once.
• Links with an underscore in the host are screened. Such a link was left out of a message's destinations, so it was never screened before SES. It is now.

Phishing-team matching (#216)

This applies to every instance.

• The instance's own mail and domains no longer tie teams together.
  • The problem: a team suspended for phishing kept fingerprints from the onboarding email the instance had sent it. Every shared inbox address also sits under one of the instance's own domains. So a New team sending from its shared inbox address could match unrelated suspended teams on the domain name alone. That opened a linked flag and mailed the operator. One kind of evidence never holds a team, so no team was suspended.
  • The fix: the onboarding email is no longer read. Domains under the instance's own are neither kept nor compared: the shared inbox domain, the onboarding, account and notification senders' domains, and the app's.
  • Fingerprints kept before this release stop matching, with no migration.

Inboxes (#215)

• Create inbox lists every domain your team has.
  • A domain that doesn't receive mail yet says what it still needs: Receiving off, Pending or Failed.
  • A card under the address checks the domain's MX record first. If no other mail server gets the domain's mail, it turns receiving on right there and then shows the MX record to add. If mail already goes to another provider, it suggests a subdomain instead of taking that mail over.
  • Members get a link to send to an owner or admin.
• Domain page:
  • Members now see the Receiving and Catch-all switches disabled, with a reason, instead of failing after the confirm.
  • A warning shows while receiving is on but the MX record still points elsewhere.
  • Links can open a domain on its receiving switch (?focus=receiving).
• Fix: a null MX (0 ., RFC 7505) now counts as no MX in the receiving check, on the domain page and in the API. The receiving record reads missing, not mismatch.

Upgrading a self-hosted instance

No migrations and no configuration changes.

• Upgrade: docker compose pull, then docker compose up -d. On Kubernetes, upgrade with --version 0.28.1.
• MX on a separate host (deploy/mx/docker-compose.yml): nothing it does changes in this release. To keep it on the app's version, set MILLIONSEND_TAG=0.28.1 there once the app runs this release, then pull and restart it.

Coming from v0.27.x or earlier? Read the v0.28.0 notes first. That release adds migration 0066; run docker compose run --rm --no-deps millionsend migrate before up -d.