UwUMail Server 0.30.1

First published release of 0.30: the tag build of 0.30.0 stopped before it published anything,
because its amd64 binary still did not start on CPUs without AVX (a build cache from the
ubuntu-26.04 runner). 0.30.1 is 0.30.0 built afresh; the notes for 0.30.0 below apply.

UwUMail Server 0.29.1

Warning: the amd64 build does not start on CPUs without AVX (exit code 132, SIGILL, e.g. VMs with the CPU type qemu64/kvm64). Update to 0.30.0 instead.

First published release of 0.29: the 0.29.0 tag never produced a release, because the image scan stopped it before anything was pushed. Everything listed under 0.29.0 ships here.

Security

• The container image now uses a distroless base (Debian 13.7) with zlib 1.3.1-1+deb13u1, which fixes CVE-2026-76844 and CVE-2026-85091.

UwUMail Server 0.28.1

Added

• Refused mail can be marked Fixed (Server → Queue → Refused mail): it goes back into the
  queue, together with every other refusal with the same cause (for Microsoft the same block
  list code such as S3150 across hotmail.com, outlook.com and live.com, otherwise the same reply
  code to the same domain). For this, a refused mail from one of the server's own accounts keeps
  its message (up to 10 MB) for the 30 days it stays on the list; bounces and forwards keep
  nothing. Mail of a sender who is suspended, in the trash or deleted stays on the list. Entries
  from before this version have no copy and are only taken off the list. See
  docs/microsoft.md.

UwUMail Server 0.28.0

Added

• Outgoing spam scan: mail that one of the server's own people sends to other servers (SMTP
  submission and JMAP) is checked with the word lists, the Bayes filter, the link and URI lists
  and the virus scanner before it leaves. At or above the reject threshold (spam.reject_score,
  10 points by default) it is refused with "550 5.7.1 This message looks like spam and was not
  sent" (JMAP: forbiddenToSend). Mail within the server is not affected. See
  docs/outbound-abuse.md.
• Sending limits per account: at most 500 recipients an hour and 2000 a day, from every door
  together (smtp.max_recipients_per_hour / _per_day, 0 = no limit). Over the limit, SMTP
  answers 451 4.7.1 and JMAP rateLimit; a single message with more recipients than a whole
  hour or day allows is refused for good (550 5.5.3, JMAP tooManyRecipients).
• Send suspension: spam refusals, hitting the sending limit (once per window) and complaints
  count as strikes, and refusals for addresses that do not exist (5.1.x) are counted on their own. After 3 strikes or 25 hard bounces within 60 minutes,
  the account may not send to other servers for 60 minutes. Mail inside the server still works.
  All four values are settings (Settings → Receiving, 0 turns a limit off). The person gets a
  clear error with the minutes left, and admins get an alert. Server → Logs → Sending lists the
  suspensions with the time left and can lift one early. Suspensions survive a restart.
• Complaints: ARF feedback reports sent to abuse@ of any of the server's domains (for example
  from Microsoft's JMRP) are stored and listed on Server → Logs → Sending. They are tied to the
  sending account by the original Message-ID, never by the recipient. A complaint counts as a
  strike only when it passed DMARC and comes from the domain the mail went to (or from
  Microsoft's JMRP), at most once per reporter domain and window. The mail itself is still
  delivered normally.
• Login block exemptions accept host names (for example a dynamic DNS name). The server resolves
  them every 5 minutes (A and AAAA, at most 16 addresses each) and keeps the last addresses when a
  lookup fails. Only public addresses are used. The Blocks page shows each name with its
  addresses. Only the login block is affected.

Changed

• Portal: the "New" tag in the menu now only appears for features that came with an update of
  the server (not on fresh installs of that version) and disappears on all devices once you open
  the entry.
• When Microsoft blocks the server's address (S3150 and similar), mail is no longer bounced at
  once. It is held and tried again every 45 minutes for up to 48 hours, and only then bounced.
  The sender gets a delay notice on the first hold. The Microsoft page and the admin mail show the
  address, how many recipients are held, and the steps to get delisted (sender.office.com, the
  confirmation mail, SNDS). A block counts as over as soon as mail to Microsoft goes through
  again.

UwUMail Server 0.27.0

Fixed

• An alias added to an account later, by an admin or by the person themselves, now shows up as a
  sender identity right away. Until now only the addresses an account had when its identities
  were first read became identities. The server already let the account send as a later alias,
  but webmail and mail apps did not offer it as a sender. Removing an alias also removes its
  identity, unless the account may still send as it some other way (a send-as domain, a group or
  a shared mailbox). Aliases added before this release don't get an identity automatically: add
  it once in the identity settings, or remove the alias and add it again.

Added

• Admins can let a person send only within this server: a new switch "Only send within this
  server" on the person's page (off for everyone, logged in the audit log). Such an account can
  still write to every address on this server's domains, masked-only domains included. Recipients
  elsewhere are refused: in a mail app at the RCPT step with "550 5.7.1 This account may only
  send to addresses on this server", in the webmail and over JMAP they come back to the sender in
  a bounce while the people here still get the message. A message with nobody here at all is
  refused as a whole. Mail held back for later is checked again when it goes, and mail already in
  the outgoing queue bounces at its next attempt. Switched on for a shared mailbox, it also holds
  for its members when they send as it. Forwarding only goes to people on this server (existing
  targets elsewhere are skipped while the switch is on), forwarding addresses pass such mail on
  only to their targets here, away replies only answer senders on this server, and sending
  through a fetched mailbox's provider is switched off. Mail apps can see it in the JMAP session
  (uwuInternalOnly and uwuInternalDomains in the submission capability). See
  docs/jmap-sending.md.

Changed

• Webmail 0.25.0 (3695165): only sending within this server. For such an account the
  webmail says so under the sender, marks recipients elsewhere and won't send to them, and shows
  the server's refusal as such.

UwUMail Server 0.26.2

Fixed

• Verification codes in HTML-only mail are found again when the code stands in a table cell or a
  heading of its own: the text ran into the next sentence ("842526Dieser Einmalcode …"), and the
  space after a bold code went missing ("9063ist der Code"). The guess now reads such mail with
  each block on a line of its own.
• A validity written after the number ("5 Minuten gültig") or as a word ("verfällt nach zwei
  Minuten", "expires in ten minutes") is read; such codes counted as valid for 15 minutes.

Added

• The guess also finds sign-in and confirmation links (kind: "link"): exactly one https link
  to the From domain behind a button such as "Sign in" or "E-Mail bestätigen", in mail that says
  it was asked for or expires, not in list, bulk or reply mail and without a redirect in the
  link, and only with DMARC passed like every guess. See
  docs/verification-codes.md and
  docs/security-audit-0.26.2.md.

UwUMail Server 0.26.1

First published release with verification codes: the 0.26.0 tag never produced a release, because the image scan stopped it before anything was pushed. Everything listed under 0.26.0 ships here.

Security

• The container image now uses a distroless base with OpenSSL 3.5.7-1~deb13u3, which fixes CVE-2026-75804 and CVE-2026-84782. UwUMail itself uses rustls, and nothing in the image uses QUIC or DTLS. The accepted findings for these two are gone from .trivyignore.

UwUMail Server 0.25.0

Added

• Pairing with UwUAuth under Server → Settings → UwUAuth: paste the pairing code (or the text of
  its QR code), and the OpenID Connect login is set up without copying a client ID or secret.
  Unpairing switches it off again. See docs/uwuauth.md.
• SCIM 2.0 at /scim/v2 for UwUAuth: people become mailboxes that log in with UwUAuth, are locked
  and unlocked, made admins, and moved to the trash from there. Only addresses on domains of this
  server; groups are kept but change nothing about mail. Mailboxes that were here before only get
  UwUAuth's id noted: they are linked at the first UwUAuth login with a verified email, and SCIM
  does not lock, promote or remove them. Wrong SCIM tokens have a limit of their own, apart from
  wrong passwords. Pairing asks for the password on an older login.
• OpenID Connect: auth.oidc.sync_admin applies the admin claim at every login,
  auth.oidc.scopes sets the scopes asked for, and auth.oidc.private_network allows a login
  service in the local network (its host only, HTTPS with a trusted certificate still required).

Fixed

• The server builds on macOS again (the DANE resolver setup used a Linux-only error type).

UwUMail Server 0.24.2

Fixed

• Mail to domains below .me or .org (and other zones amid a DNSSEC key rollover) no longer
  stays in the queue with DNSSEC: the MX records of … do not validate. The DNSSEC lookups for
  DANE now go over TCP: the zone's key set no longer fits a UDP answer, came back truncated, and
  failed to decode, so every name below it looked bogus.

Security

• rustls-webpki 0.103.16, webpki-roots and webpki-root-certs 1.0.10: distrusted emSign
  intermediates are no longer accepted (RUSTSEC-2026-0381, -0382, -0383).

UwUMail Server 0.24.1

Fixed

• Mail to servers with a self-signed X.509 v1 certificate (e.g. Proxmox Mail Gateway) no longer
  stays in the queue with UnsupportedCertVersion. Such certificates are now accepted for
  opportunistic TLS, with the handshake signature still checked against the certificate's key.