v0.16.0

[0.16.0] - 2026-XX-XX

This version includes multiple breaking changes. If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• Web UI rewritten from the ground up using the JMAP management API, featuring a refreshed design and addressing 76 enhancement requests and bug fixes.
• CLI rewritten from the ground up to use the JMAP management API.
• Security enhancements:
  • Password strength enforcement using the zxcvbn algorithm
  • Password expiration, rotation policies and IP address restrictions for user accounts
  • App Passwords with limited access (stalwartlabs#1609), labels (stalwartlabs#2255), IP address restrictions and expiration dates
  • API keys with limited access, labels, IP address restrictions and expiration dates
  • Auto-ban comments and details about the triggering event (stalwartlabs#1321)
  • Auto-ban expiration after a configurable time period (stalwartlabs#964)
• DNS Management:
  • Automatic DNS management of MX, TXT, CNAME, SRV, CAA and TLSA records (stalwartlabs#463 stalwartlabs#1017 stalwartlabs#1419 stalwartlabs#2438 stalwartlabs#1370 stalwartlabs#1406 stalwartlabs#1371)
  • Automatic update of TLSA records when ACME certificates change (stalwartlabs#1664)
  • RFC2136 SIG(0) support (stalwartlabs#856)
  • Route53 provider support (contributed by @jimmystewpot)
  • Google Cloud DNS provider support (contributed by @jimmystewpot)
  • Bunny provider support (contributed by @angeloanan)
  • Porkbun provider support (contributed by @jeffesquivels)
  • DNSimple provider support (contributed by @NelsonVides)
  • Spaceship provider support (contributed by @matserix)
• DKIM:
  • Automatic DKIM key generation, rotation and DNS management (stalwartlabs#368 stalwartlabs#961)
  • Store DKIM keys in the database (stalwartlabs#1264)
  • Ignore insecure signatures when verifying DKIM (stalwartlabs#1068 stalwartlabs#467)
• ACME/TLS:
  • DNS-PERSIST-01 ACME challenge support (stalwartlabs#2837)
  • Renew certificates on demand, view certificate details (stalwartlabs#675 stalwartlabs#1162 stalwartlabs#2566)
  • CAA record support (stalwartlabs#468) with accounturi parameter (stalwartlabs#1933)
  • TLSA records publishing restricted to 3 1 1 and 2 1 1 (stalwartlabs#2193)
• OIDC and OAuth:
  • JWT token validation without requesting userinfo from the OIDC provider.
  • Audience (aud) claim (stalwartlabs#2603) and scope validation support.
  • Groups support (stalwartlabs#1448)
  • RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients
• LDAP:
  • Separate filter for groups (stalwartlabs#1841)
  • Improve support for OpenLDAP schemas (stalwartlabs#760)
  • Improve and simplify LDAP settings (stalwartlabs#2194 stalwartlabs#2174)
• Directory:
  • Masked email addresses for enhanced privacy (Enterprise)
  • Domain aliases (stalwartlabs#583)
  • E-mail alias descriptions and option to disable aliases (stalwartlabs#506)
  • Account archiving and un-deletion (stalwartlabs#2767) (Enterprise)
  • Per-domain directory backends (Enterprise)
• Account configuration and discovery:
  • Automatic Configuration of Email, Calendar, and Contact Server Settings (draft-mailmaint-uaautoconf-04) (stalwartlabs#2201)
  • MS Autodiscover V2 support (stalwartlabs#679)
• Sieve: Allow deactivating scripts without deleting them (stalwartlabs#1251).
• Tracing: Enable events only mode (stalwartlabs#2276)
• Clustering:
  • Automatic cluster node ID generation and management.
  • Unified cluster management (stalwartlabs#960)
  • Outbound MTA role (stalwartlabs#1692)

Changed

• Replaced REST API with JMAP API (stalwartlabs#2262 stalwartlabs#959 stalwartlabs#1480)
• Removed support for Authenticated Received Chain (ARC) sealing (learn more).
• Directory: Removed smtp, imap and memory directory backends.
• Use aws-lc for cryptographic operations instead of ring.
• Use rustls-platform-verifier for TLS certificate verification instead of webpki (stalwartlabs#247).

Fixed

• Directory:
  • Cannot remove built-in "admin" role from user once it was assigned (stalwartlabs#1467)
  • Delete associated records (stalwartlabs#963)
  • Updated Role permissions not applied (stalwartlabs#2038)
  • Recreated account cannot log in until server is restarted (stalwartlabs#1469)
  • Subaddressing does not work for groups (stalwartlabs#475)
  • New LDAP aliases are rejected (stalwartlabs#1318).
  • Validate account and group names (stalwartlabs#2209)
• MTA:
  • RCPT TO stage settings improvements (stalwartlabs#2217 stalwartlabs#394)
  • Relay to IP addresses (stalwartlabs#838)
  • Duplicate delivery inverted check
  • SASL challenge responses include invalid Go ahead text
• JMAP:
  • Fix inMailboxOtherThan query logic.
  • Fix hasAttachment search field (stalwartlabs#2778)
• IMAP:
  • Increment argument max length to 8000 bytes
  • ACL: Add RIGHTS capability (stalwartlabs#2762)
  • ACL: Fix ACL SET permission override.
• WebDAV:
  • Return 304 NOT_MODIFIED on If-None-Match
  • Use RFC 2616 instead of RFC 1123 for date formatting
  • Fix ACL container/item mismatch in reports.
  • CalDAV: Allow organized properties to be present in PUT requests if they are equal to the existing ones.
• Configuration: Prefix parsing issues (stalwartlabs#2495)
• OIDC: JWKS Exposes Symmetric Signing Key
• SQLite: Fix thread pool exhaustion.
• PostgreSQL: Use clean recycling method on connection pool
• Meilisearch: Make id sorteable.
• ACME: Fix wrong origin for subdomain updates (stalwartlabs#2360)
• Spam filter: Skip invalid messages during training.
• Calendar: Include minutes in localized invite templates (stalwartlabs#2828)
• HTTP: Fix 204 CORS preflight responses

---

Check binary attestation here