New features

• Implement TLS client certificate authentication using their public keys (not other certificate properties, so no name/expiration/constraint validation). Accounts can add multiple TLS public keys, e.g. one for each mail client. For use with SMTP/IMAP and the "external" SASL authentication mechanism. IMAP "preauth" is enabled with TLS certificate authentication, but can be disabled per key. (8804d6b60ec0)

Improvements

• quickstart: Write all output to a file "quickstart.log" for later reference (2255ebcf1186)
• smtpserver: Add an option for the smtp delivery listener to enable/disable tls session tickets. (issue [#237], e59f894a94c2)
• smtpserver: Add prometheus metric and alerting rule for failing starttls handshakes for incoming deliveries. (related to issue [#237], afb182cb14de)
• webmail: Split pasted address into multiple address, by commas. (PR [#252], 501f594a0af5)
• Clarify that "aliases" are more small-scale lists, not additional addresses for an account. And make "public posting" the default for new aliases. (issue [#244], 0e338b0530c3, cbe418ec5934)
• smtpserver: When doing slow writes due to spammy incoming delivery, try a bit harder to prevent a timeout for the other side (if it is mox/itself!) (5a14a5b067ac)
• quickstart: For -existing-webserver, also add tls key/cert placeholder for mail.$domain. (5320ec1c5bc8)
• Do not try to get a tls cert for autoconfig.<domain> at startup if there is no listener with autoconfig enabled. Reduces needless logging in setups that don't use autoconfig. (35af7e30a6ad)
• "mox retrain" command: Make the "account" parameter optional, retraining all accounts when absent. (94fb48c2dc02)
• webmail: Move config options for showing keyboard shortcuts and for showing additional headers from localstorage to the settings popup, storing their values on the server. (3f727cf38094)
• webmail: Don't bind to shortcuts ctrl-l, ctrl-u and ctrl-I since they are commonly used in browsers. (4d3c4115f823)
• webapi: Add Content-Disposition and Filename to the payload of incoming webhooks (issue [#258], 42793834f8b6)
• Add ability to include custom CSS & JS in web interfaces (webmail, webaccount, webadmin), and use css variables in webmail for easier customization. (96d86ad6f1e6, related to issue [#114])
• webmail: When marking message as unread, also clear its (non)junk flags (1f604c6a3db4)
• webaccount: Update text about opening apple mobileconfig profile files, it has gotten harder to use in iOS18. (636bb91df6d8)
• admin: Better handling of disabled MTA-STS during self-check. (7f5e1087d42d)
• admin: In self-check for SPF records against our IPs, don't try checking the unspecified addresses (0.0.0.0 and ::), and warn if there are no explicitly configured IPs. (726c0931f77d)
• autoconfig: More RFC compliant SRV service not available DNS records (issue [#240], 355488028db4)

Bug fixes

• Fix verifying DANE-TA connections for outgoing email deliveries where the DANE-TA record is not for the first certificate in the chain after the leaf certifiate. (f7666d1582fe)
• junk filter: Fix adjusting word counts after train/untrain. (17baf9a8830c)
• Log when mox root process cannot forward signals to unprivileged child and give the mox.service permissions to send such signals. (32d4e9a14c25)
• webadmin: When loading page with webserver routes, internal services would always be shown with "admin" as internal services, and saving the handler would overwrite the correct setting. (issue [#264], 965a2b426fae)
• When opening an account by email address, such as during login attempts, and the address is an alias, fail with proper error "no such credentials" instead of with error "no such account" and printing a stack trace. (for issue [#238], 3d4cd0043094)
• webmail: Fix using the compose window/popup after saving a draft message failed. (issue [#256], ee48cf0dfd46)
• webmail: Fix css to not show text on button (actually html "a" element for links) for downloaded (visited) attachments in blue. (f7193bd4c321)

Update procedure

After updating, run "mox retrain" to retrain the bayesian junk filter for all accounts. Retraining an account with many messages can require quite some working memory. Due to a bug (now fixed), reclassifying messages as (non)-junk updated the scores of words incorrectly, sometimes resulting in very high (non)-junk reputation of some words. The junk filter should perform better after retraining.

If you are using the mox.service systemd unit file on Linux, you should add "CAP_KILL" to CapabilityBoundingSet (and reload & restart the service) so graceful shut downs are faster.

Before upgrading, do a dry-run first.

• Make a temporary backup with the old mox version: mox-v0.0.13 backup data/tmp/testupgrade
• Verify that all is well with the old version: mox-v0.0.13 verifydata data/tmp/testupgrade
• Verify the state with the new version: mox-v0.0.14 verifydata data/tmp/testupgrade

With a successful dry-run, the upgrade should go smoothly. Make a new backup with mox-v0.0.13 backup data/tmp/backup (the previous backup was modified by the dry-run, so couldn't be used to restore!), replace the binary and restart. For further details, see https://www.xmox.nl/faq/#hdr-how-do-i-upgrade-my-mox-installation

If you run into any problems, please create a bug report.

Thanks

Thanks for all the contributions/bug reports/feedback/discussions, much appreciated! Special thanks to: exander77, bwbroersma, Robby-, wneessen, kiekerjan, robbo5000, morki, laura-lilly, ally9335, spectral369, mattfbacon, mwyvr, s0ph0s-dog, soheilpro and many more!

Downloading & compiling

See https://www.xmox.nl/install/#hdr-download.