New System Limits for Address Creation

The most important change is that there are five new config parameters for system limits. If they are reached, users can't create new addresses on your relay anymore. The parameters are documented here. The defaults are:

• max_imap_connections = 10000
• max_smtp_connections = 1000
• max_load_1m = 5 (You can see your system's load average of the last 1 minute with the uptime command; the first number after load average)
• min_available_memory = 200M
• min_free_disk_space = 1G

Note: previously the IMAP connection limit was 50k, not 10k. Larger relays with more resources should adjust their settings, as they can likely take more than that.

Breaking Changes

• [breaking] Introduce configurable system limits to reject new address creation and limit imap/smtp connections.

Features

• Reduce maximal_queue_lifetime from 5d to 2d
• Disable negative cache in unbound (#992)
• (mtail) Add incoming_mailer_daemon_mail_count
• (postfix) Disable processing of MIME headers
• (dovecot) Advertise privacy_mail as admin contact, drop server comment

Bug Fixes

• Set relay restrictions per smtpd service with default reject
• Reduce maxproc for filtermail-transport LMTP client to 500
• Core 2.50.0 does not have delete_server_after config anymore.
• Check if all required ports are available for filtermail (#983)
• Always deploy unbound.conf.d/chatmail.conf (#993)
• Expire empty directories (#994)
• Crypt-r dependency was declared for wrong Python version
• Always overwrite /etc/resolv.conf, even if it is a symbolic link
• Pass kwargs to files.put()
• List Iroh proxy endpoints used by 0.35 and 1.0, drop stale /relay/probe from earlier versions
• Fix port discovery when ss -tulpn shows dovecot before stats

Documentation

• Add scripts/initenv.sh to upgrade instructions
• Update overview diagrams (#995)
• (overview) Remove mermaid styles from 'Accepting and delivering mail' (#1009)
• (README.md) Clarify security enforcement (#1011)

Miscellaneous Tasks

• (ci) Auto-trigger docker build on release tag push
• (acmetool) Update let's encrypt ToS link to 1.8
• (ci) Update doc staging upload path
• (ci) Fix docs upload path

Refactor

• (postfix) Remove unused "filter" lmtp service
• Install dns-root-data instead of using unbound-anchor
• (deps) Remove domain-validator dependency

Testing

• Set socket security for IMAP and SMTP to "TLS" in "dclogin"

New Contributors

• @punkero-org made their first contribution in #953
• @Hocuri made their first contribution in #1011
• @W0rmsy made their first contribution in #1018

Full Changelog: 1.11.0...1.12.0