v0.16.0

[0.16.0] - 2026-XX-XX

This version includes multiple breaking changes. If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• Web UI rewritten from the ground up using the JMAP management API, featuring a refreshed design and addressing 76 enhancement requests and bug fixes.
• CLI rewritten from the ground up to use the JMAP management API.
• Security enhancements:
  • Password strength enforcement using the zxcvbn algorithm
  • Password expiration, rotation policies and IP address restrictions for user accounts
  • App Passwords with limited access (stalwartlabs#1609), labels (stalwartlabs#2255), IP address restrictions and expiration dates
  • API keys with limited access, labels, IP address restrictions and expiration dates
  • Auto-ban comments and details about the triggering event (stalwartlabs#1321)
  • Auto-ban expiration after a configurable time period (stalwartlabs#964)
• DNS Management:
  • Automatic DNS management of MX, TXT, CNAME, SRV, CAA and TLSA records (stalwartlabs#463 stalwartlabs#1017 stalwartlabs#1419 stalwartlabs#2438 stalwartlabs#1370 stalwartlabs#1406 stalwartlabs#1371)
  • Automatic update of TLSA records when ACME certificates change (stalwartlabs#1664)
  • RFC2136 SIG(0) support (stalwartlabs#856)
  • Route53 provider support (contributed by @jimmystewpot)
  • Google Cloud DNS provider support (contributed by @jimmystewpot)
  • Bunny provider support (contributed by @angeloanan)
  • Porkbun provider support (contributed by @jeffesquivels)
  • DNSimple provider support (contributed by @NelsonVides)
  • Spaceship provider support (contributed by @matserix)
• DKIM:
  • Automatic DKIM key generation, rotation and DNS management (stalwartlabs#368 stalwartlabs#961)
  • Store DKIM keys in the database (stalwartlabs#1264)
  • Ignore insecure signatures when verifying DKIM (stalwartlabs#1068 stalwartlabs#467)
• ACME/TLS:
  • DNS-PERSIST-01 ACME challenge support (stalwartlabs#2837)
  • Renew certificates on demand, view certificate details (stalwartlabs#675 stalwartlabs#1162 stalwartlabs#2566)
  • CAA record support (stalwartlabs#468) with accounturi parameter (stalwartlabs#1933)
  • TLSA records publishing restricted to 3 1 1 and 2 1 1 (stalwartlabs#2193)
• OIDC and OAuth:
  • JWT token validation without requesting userinfo from the OIDC provider.
  • Audience (aud) claim (stalwartlabs#2603) and scope validation support.
  • Groups support (stalwartlabs#1448)
  • RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients
• LDAP:
  • Separate filter for groups (stalwartlabs#1841)
  • Improve support for OpenLDAP schemas (stalwartlabs#760)
  • Improve and simplify LDAP settings (stalwartlabs#2194 stalwartlabs#2174)
• Directory:
  • Masked email addresses for enhanced privacy (Enterprise)
  • Domain aliases (stalwartlabs#583)
  • E-mail alias descriptions and option to disable aliases (stalwartlabs#506)
  • Account archiving and un-deletion (stalwartlabs#2767) (Enterprise)
  • Per-domain directory backends (Enterprise)
• Account configuration and discovery:
  • Automatic Configuration of Email, Calendar, and Contact Server Settings (draft-mailmaint-uaautoconf-04) (stalwartlabs#2201)
  • MS Autodiscover V2 support (stalwartlabs#679)
• Sieve: Allow deactivating scripts without deleting them (stalwartlabs#1251).
• Tracing: Enable events only mode (stalwartlabs#2276)
• Clustering:
  • Automatic cluster node ID generation and management.
  • Unified cluster management (stalwartlabs#960)
  • Outbound MTA role (stalwartlabs#1692)

Changed

• Replaced REST API with JMAP API (stalwartlabs#2262 stalwartlabs#959 stalwartlabs#1480)
• Removed support for Authenticated Received Chain (ARC) sealing (learn more).
• Directory: Removed smtp, imap and memory directory backends.
• Use aws-lc for cryptographic operations instead of ring.
• Use rustls-platform-verifier for TLS certificate verification instead of webpki (stalwartlabs#247).

Fixed

• Directory:
  • Cannot remove built-in "admin" role from user once it was assigned (stalwartlabs#1467)
  • Delete associated records (stalwartlabs#963)
  • Updated Role permissions not applied (stalwartlabs#2038)
  • Recreated account cannot log in until server is restarted (stalwartlabs#1469)
  • Subaddressing does not work for groups (stalwartlabs#475)
  • New LDAP aliases are rejected (stalwartlabs#1318).
  • Validate account and group names (stalwartlabs#2209)
• MTA:
  • RCPT TO stage settings improvements (stalwartlabs#2217 stalwartlabs#394)
  • Relay to IP addresses (stalwartlabs#838)
  • Duplicate delivery inverted check
  • SASL challenge responses include invalid Go ahead text
• JMAP:
  • Fix inMailboxOtherThan query logic.
  • Fix hasAttachment search field (stalwartlabs#2778)
• IMAP:
  • Increment argument max length to 8000 bytes
  • ACL: Add RIGHTS capability (stalwartlabs#2762)
  • ACL: Fix ACL SET permission override.
• WebDAV:
  • Return 304 NOT_MODIFIED on If-None-Match
  • Use RFC 2616 instead of RFC 1123 for date formatting
  • Fix ACL container/item mismatch in reports.
  • CalDAV: Allow organized properties to be present in PUT requests if they are equal to the existing ones.
• Configuration: Prefix parsing issues (stalwartlabs#2495)
• OIDC: JWKS Exposes Symmetric Signing Key
• SQLite: Fix thread pool exhaustion.
• PostgreSQL: Use clean recycling method on connection pool
• Meilisearch: Make id sorteable.
• ACME: Fix wrong origin for subdomain updates (stalwartlabs#2360)
• Spam filter: Skip invalid messages during training.
• Calendar: Include minutes in localized invite templates (stalwartlabs#2828)
• HTTP: Fix 204 CORS preflight responses

---

Check binary attestation here

v0.15.5

v0.15.5

---

Check binary attestation at here

v0.15.4

Create directories for FoundationDB installation

Add commands to create necessary directories for FoundationDB.

v0.15.3

v0.15.3

v0.15.2

Update macOS runner version in CI workflow

v0.15.1

v0.15.1

v0.15.0

Spam filter and index configuration updates

v0.14.1

v0.14.1

---

Check binary attestation at here

v0.14.0

v0.14.0

v0.13.4

v0.13.4

---

Check binary attestation at here