v1.0.9

Highlights

• Plug-ins and themes as packages
  Install plug-ins and themes from pinned git commits. Web plug-ins run in
  sandboxed frames with permissioned access to layout slots, pages, settings,
  storage and the composer. Server plug-ins run as WebAssembly with mail hooks,
  API routes and scheduled jobs. Themes can now carry background images and
  per-part styles. See docs/plugins.md, docs/plugin-development.md and
  docs/theme-development.md, plus working examples in docs/examples/.

• 14 new interface languages
  Spanish, Portuguese, Italian, Dutch, Swedish, Hungarian, Romanian, Turkish,
  Russian, Ukrainian, Arabic, Chinese (Simplified), Japanese and Korean.
  Arabic uses a mirrored right-to-left layout. All of them are also available
  for AI translation and spell checking.

• Protocol extensions

  • Sieve: duplicate, notify, editheader, mime and more.
  • IMAP: UIDONLY, UTF8, MULTIAPPEND, SAVEDATE, UIDBATCHES, UNAUTHENTICATE,
    OBJECTID search and more.
  • POP3: AUTH and UTF8.
  • SMTP: FUTURERELEASE, DELIVERBY, MT-PRIORITY and NO-SOLICITING.
  • JMAP: blobs and principals.
  • WebDAV: quota, byte ranges and extended MKCOL.

• Phishing protection
  The built-in filter now scores traces that only a forged message leaves:

  • a "not spam" verdict the sender wrote itself, before any server could
    have scanned the message
  • a message claiming to come from Thunderbird that Thunderbird could not
    have made (a script's Message-ID, Outlook-only headers)
  • links through Google's notification redirect in mail not sent by Google
  • footer links (privacy, contact, unsubscribe) that lead nowhere around a
    single real link
    An optional AI check (off by default) asks one of your AI models about mail
    the filter already finds doubtful. The model can only add points, never
    clear a message, and is protected against messages that try to talk it
    round.

• DMARC feedback
  Complaint and failure reports (ARF) sent to hosted domains are stored and
  shown under DMARC insights. Optionally, unoMail sends DMARC/DKIM/SPF failure
  reports, with recipients redacted and at most one per domain per hour.

Web mail

• An address can now have several sender identities, each with its own
  signature. Every account has a fixed primary identity that can't be removed.
  The identity dialog offers the addresses the account can send from (own
  address, aliases, masked addresses) or another address with its own SMTP
  server.
• AI summary, translation and reply suggestions moved into compact buttons in
  the message header and beside the reply actions. Results appear only when
  you ask for them.
• The composer stands out from the page in dark themes.
• Server error messages are shown in the interface language.
• Phones: taps near the left edge (back button, list checkboxes) no longer open
  the sidebar instead of reaching the button or checkbox.
• Phones: the message list keeps its scroll position after you close a message.
• In a narrow expanded list, the star sits under the checkbox to leave more
  room for the text.
• Fixed folders and other entries being duplicated in the collapsed sidebar.
• A note is shown when JavaScript is disabled.

Administration

• AI model settings are tested when you save them. A failed test explains why
  and offers "Save anyway".
• DNS health texts are translated. SPF is now checked the way receiving servers
  check it (a, mx, include, redirect, for IPv4 and IPv6), and the server's
  public addresses are looked up over public DNS, so a container's /etc/hosts
  no longer hides them.
• The SMTP blacklist and whitelist tables load without waiting on reverse-DNS
  lookups, and show a spinner instead of an empty message while loading.
• The address column of the Remote IPs table on the dashboard is wider.
• New settings under Server settings -> Built-in spam filter for the AI
  phishing check: on/off, model, the score from which the model is asked,
  and the points for a phishing verdict.

Security

• Medium, SSO: a mailbox is now linked to the provider identity (sub) that
  first signed in to it, and a different identity with the same e-mail address
  is refused. If a user's provider account is replaced, reset the mailbox's
  2-step verification in its dialog; that also removes the link.
• Low, 2-step verification: a code try is counted before the code is checked,
  so parallel guesses no longer get extra tries.
• Low, CalDAV/CardDAV: remembered sign-ins end as soon as the domain or the
  mailbox's DAV access is switched off.