Download

One signed package per release. The installer fetches it for you; the files are here for anyone who wants to verify them first.

Current release

Version0.25.41
Published2026-10-20
Packagemailtronx-0.25.41-linux-amd64.tar.gz (119.6 MB, Linux amd64: both binaries, schema updates, runtime scripts, VERSION, source commit)
SHA-256a70c560a0e66e975b2bbc88a661960cc9f72a39b279303ddea023f8bde3e09a7
Manifestfeed.json · signature feed.json.sig (ed25519 over the exact manifest bytes)
Release keymailtronx-release-key.pem · ed25519 public key EuviQN5Ku55X+N4WZMEDdxRU8WkcxKMrXrUHtjDtUbY= · SHA-256 of the DER form dc0bc32b299cff197086b179edb78224b1fe39b1bef0b4830c7cb323ed6e71bd
NotesSupport MariaDB-only appliances in authoritative role checks

Only the current release is downloadable here. An appliance keeps every release it has installed and can roll back to any of them from Configure Server → Patches.

Install

On a fresh Debian 13 server, as root:

curl -fsSL https://mailtronx.com/install.sh | sudo bash

The bootstrap downloads the manifest and its signature, verifies the signature against the release key built into it, downloads the package, checks its SHA-256, unpacks it under /root/mailtronx-install/<version>/ and runs the installer. The installer installs the mail stack from Debian's own packages, configures everything, obtains the certificate and prints the console address with a one-time administrator password. Re-running the installer is safe: it upgrades the software and never overwrites what you configured.

Requirements

Installer variables

Set in the environment to skip the prompts: MTX_HOSTNAME (the appliance's fully qualified name), MTX_DOMAIN (the first mail domain), MTX_ADMIN_PASSWORD, MTX_TIMEZONE (default America/Los_Angeles), MTX_ACME_EMAIL, MTX_ACME_ACCOUNT_KEY and MTX_ACME_ACCOUNT_URL (issue the first certificate under an existing Let's Encrypt account), MTX_TLS_CERT and MTX_TLS_KEY (your own certificate instead of Let's Encrypt), MTX_DNS, MTX_MAIL_DISK, MTX_SSH_PORT.

Verify a release yourself

The installer does this on every run. To check by hand on any Linux machine with curl and OpenSSL:

curl -fsSLO https://mailtronx.com/releases/feed.json
curl -fsSLO https://mailtronx.com/releases/feed.json.sig
curl -fsSLO https://mailtronx.com/mailtronx-release-key.pem
base64 -d feed.json.sig > feed.sig
openssl pkeyutl -verify -pubin -inkey mailtronx-release-key.pem -rawin -in feed.json -sigfile feed.sig
# prints "Signature Verified Successfully"
curl -fsSLO https://mailtronx.com/releases/mailtronx-0.25.41-linux-amd64.tar.gz
grep -o '"sha256":"[0-9a-f]*"' feed.json
sha256sum mailtronx-0.25.41-linux-amd64.tar.gz
# the two values must match

Release history

One line per release since the first published package. The manifest always points at the newest.

VersionDateChange
0.25.412026-10-20Support MariaDB-only appliances in authoritative role checks
0.25.402026-10-20Preserve legacy RBL and populated destination baselines
0.25.392026-10-20Read legacy empty backup destinations without rewriting configuration
0.25.382026-10-20Initialize native agent for configuration administration
0.25.342026-10-20Preserve deployed mail-flow navigation in synchronization candidate (0.25.34)
0.25.322026-10-20Restore page descriptions above mail-flow details (0.25.32)
0.25.312026-10-20Group mail controls by processing stage and explain native owners
0.25.292026-10-19Share cluster rejection history with durable collection and replay-safe synchronization
0.25.282026-10-19Remove unrelated relay exemption section from Greylisting page
0.25.272026-10-19Remove remaining redundant greylisting policy sentence
0.25.262026-10-19Remove redundant mandatory greylisting UI notices
0.25.252026-10-19Manage greylisting with fixed MailtronX defaults
0.25.242026-10-19Clarify default country greylisting on GeoIP scoring page
0.25.232026-10-19Require greylisting and reject application disable requests
0.25.222026-10-19Remove advanced sender grouping fields from Greylisting controls
0.25.212026-10-19Show country greylisting defaults and selected country coverage
0.25.202026-10-19Add default country-based greylisting with native retry handling
0.25.192026-10-19Preserve implicit greylisting defaults on unchanged Apply
0.25.182026-10-19Build operational greylisting policy controls and truthful rejection history
0.25.172026-10-19Support native MariaDB dump command for protected policy backups
0.25.162026-10-19Provide private cleanup service in SMTP handoff regression fixture
0.25.152026-10-19Avoid repeated SMTP reconnect and trusted-relay greylisting deferrals
0.25.132026-10-15Add cluster topology map with scoped health and verified flow evidence
0.25.122026-10-15Separate security event logging from policy and show native penalty progression
0.25.112026-10-15Keep client log identifiers on one line and expose security block timelines
0.25.102026-10-15Fix persistent abuse native schema test comment parsing
0.25.92026-10-15Add persistent client abuse history and seven/thirty-day firewall escalation
0.25.82026-10-15Protect mail clients from repeated protocol probes and failed chat logins
0.25.72026-10-15Preserve Full Mail upgrades and support imported certificate updates
0.25.62026-10-15Accept full mailbox addresses during cold DAV authentication
0.25.52026-10-15Match SOGo native MySQL session schema without an oversized index
0.25.42026-10-15Handle unused packaged chat host during native certificate validation
0.25.32026-10-15Preserve native firewall state when enabling groupware client ports
0.25.22026-10-15Migrate existing Full Mail DAV routing and domain authentication safely
0.25.12026-10-15Normalize vendored groupware schema formatting
0.25.02026-10-15Add Full Mail groupware provider configuration and administration
0.24.502026-10-14Add MX management authority and scoped external recipient feeds
0.24.492026-10-12Size Rspamd analysis from its content and keep each label on one line
0.24.482026-10-12Separate the Rspamd support text from complete lower cell borders
0.24.472026-10-12Align Rspamd groups in a centered table and open the incoming connector gap
0.24.462026-10-12Add vertical spacing to the mail flow stages and analysis text
0.24.452026-10-12Fit the outer Rspamd analysis box around its compact groups
0.24.442026-10-12Size the four Rspamd analysis boxes to their content without stretching
0.24.432026-10-12Remove the obsolete clickable-stage hint from the mail flow page
0.24.422026-10-12Remove navigation from all mail flow diagram stages
0.24.412026-10-12Remove the documentation shortcut from the mail flow footer
0.24.402026-10-12Let Rspamd analysis groups wrap in a flexible two-column layout
0.24.392026-10-12Center the compact mail flow panel and diagram within the application
0.24.382026-10-12Fit the mail processing diagram to the normal application page scale
0.24.372026-10-12Override the global mouse focus frame within the mail flow diagram
0.24.362026-10-12Place release-stage lifecycle documentation under application updates
0.24.352026-10-12Retire duplicate release stages after signed package recovery verification
0.24.342026-10-12Compact the mail processing diagram and remove server-role branches
0.24.332026-10-12Give the mail flow navigation item its required icon
0.24.322026-10-12Add mail security flow diagram first under Anti-Spam
0.24.312026-10-11Make validation fixtures track current pages and use portable scratch directories
0.24.302026-10-11Keep developer tests separate from Olefy-enabled production releases
0.24.292026-10-11Manage Olefy security runtime in signed appliance releases and upgrades
0.24.282026-10-11Keep scoped MX security rollout in the existing Ansible workflow
0.24.272026-10-11Correct Fail2ban journal time and MX submission settings; disable SSH compression
0.24.262026-10-11Supply appliance-local nameserver glue through generic DNS metadata
0.24.252026-10-11Prepare writable rbldnsd query log while preserving systemd state ownership
0.24.242026-10-11Protect Rspamd controller with appliance authentication and roles; support patched ClamAV rollout
0.24.232026-10-11Move Rspamd Console navigation into Anti-Spam
0.24.222026-10-11Move misplaced Mail Server and Anti-Spam navigation items
0.24.212026-10-06Treat local RBL positive DNS answers as hits
0.24.202026-10-06Keep local RBL rules available without remote monitoring
0.24.192026-10-06Match local RBL positive DNS response explicitly
0.24.182026-10-06Mark local RBL namespace insecure in Unbound
0.24.172026-10-06Allow loopback queries for local RBL resolver
0.24.162026-10-06Route local RBL lookups through rbldnsd
0.24.152026-10-06Explain RBL scoring and greylist retries
0.24.142026-10-06Score listed RBL senders at greylist threshold
0.24.132026-10-06Preserve saved configuration across application patches
0.24.122026-10-06Enable AbuseIPDB RBL by default
0.24.112026-10-06Add AbuseIPDB-only RBL sync action
0.24.102026-10-06Add AbuseIPDB as a local weighted RBL
0.24.92026-10-06RBL page: center public zone entry fields
0.24.82026-10-06RBL page: refine save and public zone layout
0.24.72026-10-06RBL page: save zone settings together
0.24.62026-10-05Protect ManageSieve alongside IMAP and submission from login abuse
0.24.52026-10-05Enforce SMTP framing safeguards across trusted and submission paths
0.24.42026-10-05Preserve diagnostic search links and distinguish message totals
0.24.32026-10-05Show SMTPS client connections and missing map warnings
0.24.22026-10-05Expose mail client activity with account and connection details
0.24.12026-10-05Show real messages with correlated fields and searchable log colors
0.24.02026-10-05Add MAILLOG2 mail and spam event viewer with keyword highlighting
0.23.152026-10-05Match Dovecot 2.4 authentication worker failures without duplicate bans
0.23.142026-10-05Add native Dovecot abuse protection with expiring mail-client bans
0.23.132026-10-05Route complete socketmap recipient addresses directly to backend
0.23.122026-10-05Show deployment mode in System Information and simplify Home description
0.23.112026-10-05Serialize installer and automatic configuration rendering
0.23.102026-10-05Preserve valid existing certificates during installer reruns
0.23.92026-10-05Add durable recipient directory and fresh MX gateway deployment
0.23.82026-10-05Display initial administrator credentials at successful interactive installation
0.23.72026-10-05Store the first certificate before configuring fresh appliance TLS
0.23.62026-10-05Keep installer credentials on private input streams and retain release staging
0.23.52026-10-05Show node mode only in the banner and retire its console page
0.23.42026-10-05Fix deployment types and show node mode in the console banner
0.23.32026-10-05Preserve concurrent v0.21.60 certificate and recovery changes in node roles
0.23.22026-10-05Prepare MX service isolation and guard privileged submission enable
0.23.12026-10-05Merge committed appliance policy transaction foundation into node roles
0.23.02026-10-05Add read-only appliance inventory for node-role migration planning
0.22.02026-10-05Add node-role policies and safe deployment previews
0.21.602026-10-05Align network save spacing and use provider-neutral certificate description
0.21.592026-10-05Apply matching appliance certificates automatically with verified recovery
0.21.582026-10-05Simplify certificate filters and center search
0.21.572026-10-05Move Quota Groups navigation to Mail Server
0.21.562026-10-05Add administrator policy validation and safe transaction foundation
0.21.552026-10-04Align proportional login logo and balance OS patch panels
0.21.542026-10-04Shorten matching NTP panels with compact server input
0.21.532026-10-04Use black background behind login header logo
0.21.522026-10-04Compact OS patch status and scheduler into adjacent panels
0.21.512026-10-03Align shared blue page descriptions with each content layout
0.21.502026-10-03Center dashboard introduction inside a blue bordered panel
0.21.492026-10-03Remove duplicate operating system metric panel from dashboard
0.21.482026-10-03Restore live operating system metric tiles in shared banner
0.21.472026-10-03Move RBL Management to its descriptive page route
0.21.462026-10-03Rename Manage Users route and retire DNS Configuration page
0.21.452026-10-03Replace legacy network navigation with Network Settings
0.21.442026-10-03Frame DNS routing description in an aligned blue panel
0.21.432026-10-03Show acknowledged RBL hub submission statistics
0.21.422026-10-03Support shared domain DKIM keys and validate effective signing configuration
0.21.412026-10-03fix: load shared network validation before page scripts
0.21.402026-10-03fix: validate network fields and support internal-only DNS
0.21.392026-10-03Use active release helper for root scheduling
0.21.382026-10-03Move MailtronX schedules to root cron and expose network recovery progress
0.21.372026-10-03Hide container networks and clarify DNS routing
0.21.362026-10-03Blend disabled Gateway background with appliance fields
0.21.352026-10-03Darken disabled Gateway fields
0.21.342026-10-03Show disabled gateways clearly on secondary interfaces
0.21.332026-10-03Preserve dnsmasq resolver comments without false DNS drift
0.21.322026-10-02Protect resolver files on new appliance deployments
0.21.312026-10-02Retain MailtronX ownership header in resolver configuration
0.21.302026-10-02Document DNS routing blocks and preserve section spacing
0.21.292026-10-02Set default network confirmation timeout to30seconds
0.21.272026-10-02Remove resolver configuration path from network DNS field help
0.21.262026-10-02Show managed internal DNS upstreams instead of the public loopback resolver
0.21.252026-10-02Guard main gateway recovery and initialize appliance backup encryption
0.21.242026-10-02Keep network interface fields compact and give Node more room
0.21.232026-10-02Explain missing backup encryption prerequisite when saving DNS
0.21.222026-10-02Label internal DNS servers clearly and widen network label column
0.21.212026-10-02Preserve dotted subnet mask notation when loading network addresses
0.21.202026-10-02Inherit parent link MTU for configured interface aliases
0.21.192026-10-02Accept configured interface aliases in network validation
0.21.182026-10-02Accept dotted network hostnames and clarify FQDN guidance
0.21.172026-10-02Structure all network section headers with left center right div areas
0.21.162026-10-02Make DNS provider encryption explicit in selector labels
0.21.152026-10-02Remove Custom from public DNS provider selector
0.21.142026-10-02Explain use of internal resolvers when public TLS is not configured
0.21.132026-10-02Clarify internal search domains in network settings hint
0.21.122026-10-02Clarify configurable and live network interface section headers
0.21.112026-10-02Explain recommended TLS use in public DNS selector hint
0.21.102026-10-02Align public DNS badge with TLS configuration state
0.21.92026-10-02Explain split DNS and show verified public TLS status in network header
0.21.82026-10-02Widen new network settings label column by 25 percent
0.21.72026-10-02Normalize saved provider settings for network form dirty tracking
0.21.62026-10-02Copy original network page with only public DNS TLS selector added
0.21.52026-10-02Keep DNS comments column at original network form width
0.21.42026-10-02Use one public DNS provider selector without add or remove controls
0.21.32026-10-02Match network DNS form spacing and compact provider controls
0.21.22026-10-02Simplify network DNS form and align public TLS provider row
0.21.12026-10-02fix: allow DNS TLS validation and recovery time before activation
0.21.02026-10-02feat: add isolated network DNS page with private routing and verified TLS providers
0.20.972026-10-02ui: theme Rspamd page selectors
0.20.962026-10-02ui: darken Rspamd form fields and clarify tabs
0.20.952026-10-02ui: version embedded Rspamd theme assets
0.20.942026-10-02ui: preserve Rspamd directory requests and navy palette
0.20.932026-10-02ui: embed and theme Rspamd console
0.20.922026-10-02ui: move Manage Users into Configure Server
0.20.912026-10-02ui: restore usable user hover menu and reorder navigation
0.20.902026-10-02ui: show plain username in shared banner
0.20.892026-10-02ui: unify Cancel styling and simplify GeoIP footer
0.20.882026-10-02ui(geo): add shared gray Cancel button style
0.20.872026-10-02ui: standardize blue and red action buttons on ADC styles
0.20.862026-10-02ui(geo): remove duplicate count and share green primary style
0.20.852026-10-02ui(geo): arrange country header and add button hover glows
0.20.842026-10-02ui(geo): clarify Democratic Republic of the Congo label
0.20.832026-10-02ui(geo): add blue control bars and open five-column layout
0.20.822026-10-02ui(geo): add flags and one persistent country scoring form
0.20.812026-10-02ui(geo): consolidate country restrictions into searchable grid
0.20.802026-10-02ui(nav): use colored emoji for submenu icons
0.20.792026-10-01ui(nav): tighten hover glow and brighten edge
0.20.782026-10-01Make submenu icons and navigation backgrounds consistent
0.20.772026-10-01DNS-01 panel: the RFC 2136 form is shown when the page opens again (the blank first entry and hidden fields are reverted); the DNS provider list is as in 0.20.74
0.20.762026-10-01DNS provider list: first entry blank
0.20.752026-10-01DNS provider list: RFC 2136 entry renamed "RFC 2136 (your own name server)" and moved to the end; the list opens on a choose-the-provider placeholder; a save without a provider is refused
0.20.742026-10-01Agent socket: acme-issue, acme-dns01-test and acme-renew-now get the 10-minute connection deadline (the 30 s default closed the socket before a DNS provider test could answer)
0.20.732026-10-01Long agent calls (DNS-01 test, issue, run-now): the handler extends its own response write deadline; the server-wide 30 s WriteTimeout dropped the response after a ClouDNS propagation wait (nginx 502)
0.20.722026-10-01DNS-01 via providers: web waits up to 5-6 min on the agent for DNS-01 test, issue and run-now (provider propagation waits run for minutes); nginx console location proxy_read_timeout 600s in the installer template; agent logs DNS-01 test results; page texts say DNS-01 can take minutes
0.20.712026-10-01DNS-01 through a DNS provider API: lego's provider catalog (221 providers, generated by scripts/gen-dnsproviders.py) with per-provider credential fields on the Certificates page; Other: RFC 2136 kept with its existing fields; existing dns01.json files migrate as rfc2136; HTTP-01 untouched. Test connection takes a domain for API providers. Last scan shown in the browser's local time.
0.20.702026-10-01Renew after: input validation, digits only and a whole number from 7 to 60, enforced in the field (digit filter, maxlength 2), on submit, and in the web handler (400); the agent keeps its own range check
0.20.692026-10-01Certificates page: Renew after field 4 characters wide and centred, hint reworded (Renew after this many days. Range: (7 to 60)); Registered at shown in the browser's local time; Contact email centred
0.20.682026-10-01Auto-Renewal panel: status display restored (status tag, Run Renewal Now, Running, Scan interval, Last scan, Due now, Renewed / failed); it had been removed without being asked in 0.20.67. The single Renew after N days control stays.
0.20.662026-10-01Certificates page: schedule table helpers scoped to the Let's Encrypt script block (rows were not rendered)
0.20.652026-10-01ACME auto-renewal made configurable: on/off, mode (within window | every N days), cadence days, window days, scan interval, per-certificate override (inherit/window/cadence/never), once-a-day retry after a failure, schedule table on the Certificates page; settings in /etc/ssl/mailtronx/acme/renewal.json
0.20.642026-10-01ACME: Let's Encrypt production is the default directory everywhere (register form, agent default); staging is never offered. Docs: default wording, the import/forget paragraph separated from the Issue sentence, account API list updated (import/forget)
0.20.632026-10-01ACME: Test directory button and its command removed (not required for anything; registration and issuance fetch the directory themselves)
0.20.622026-10-01ACME: account deactivation at the CA removed from the product; Forget account removes the account from this appliance only (key and record kept as .bak, nothing sent to the CA)
0.20.612026-10-01Certificates page: an Import account button opens the import section, which states whether an account was already imported (date and URL) or which account the appliance made itself
0.20.602026-10-01ACME: the account record carries its origin (installer, page, imported); the Certificates page tag reads IMPORTED ACCOUNT or APPLIANCE-CREATED with an Origin row; the import form is a visible block instead of a collapsed line
0.20.582026-10-01Domain SMTP Validation: a list answer counts as a listing only when it means blocked (Hostkarma codes from its wiki: only 127.0.0.2; white, yellow and NOBL answers and texts saying white listed or not listed are not listings)
0.20.572026-10-01Domain SMTP Validation: not listed is PASS even when a list did not answer; Blocklists header reads Checking N lists, listed on (L of N); no counts for a stored result without per-list data
0.20.562026-10-01Domain SMTP Validation: Blocklists panel shows totals in its header, the listings in full with Delist, and the clean lists folded into one collapsed row per address
0.20.542026-10-01Left menu: a group header opens and closes its group in place instead of jumping to its first page (clicking DIAGNOSTICS landed on Mail Log, which is filed under MAIL SERVER, so the group never opened); the duplicate Live Mail Log entry leaves Diagnostics (Mail Log stays under Mail Server)
0.20.532026-10-01Mail Tests: a tag fragment left at a section boundary is not shown as a detail line
0.20.522026-10-01Mail Tests: build fix (no firstNonEmpty in the web package); 0.20.50 and 0.20.51 did not compile and were never released
0.20.512026-10-01Domain SMTP Validation: the last domain and its finished result are kept per user (mt_domainsmtp_results) and shown again on the next visit until Validate is clicked; the Domains validate link runs at once (run=1); line break before the filtering-service clause of the SPF MX text
0.20.502026-10-01Mail Tests (Diagnostics): send a DKIM-signed test message from the appliance to mail-tester.com (fresh one-time address, result page read every 10 s, score and every section with removal links) or to any address; sender = a mailbox on the appliance (convention outbound-smtp-test@<domain>); history in mt_mailtests
0.20.492026-09-30Domain SMTP Validation: line break after the forward-confirmed reverse DNS sentence (a newline in a result text renders as a line break)
0.20.482026-09-30Domain SMTP Validation: no TLS session, no connection: and no route to host in red
0.20.472026-09-30Domain SMTP Validation: wording, This MX host is not listed
0.20.462026-09-30Domain SMTP Validation: its mail goes out unsigned in red; red result text bold
0.20.452026-09-30Domain SMTP Validation: sub-rows inherit their record's status and level and show a badge only where they deviate
0.20.442026-09-30Domain SMTP Validation: derived SPF and DMARC checks shown as indented sub-rows under their record; the record's Propagation cell spans the group
0.20.432026-09-30Domain SMTP Validation: the phrases zone not signed, not published and no signing key shown in red
0.20.422026-09-30Domain SMTP Validation: no fact rows in the tables (DNS source and the appliance role become notes under the panel titles; DMARC report addresses folded into the DMARC reports line; DKIM one REQUIRED line per case incl. domains not hosted here; SPF receive-only MX is a PASS; unchecked blocklists folded into the summary line); Propagation column only in the DNS panel
0.20.412026-09-30Domain SMTP Validation: Propagation reads N/A on lines that are not DNS records
0.20.402026-09-30Domain SMTP Validation: IPv6 matcher covers :: compression as one address
0.20.392026-09-30Domain SMTP Validation: IPv4 and IPv6 addresses shown in cyan on every line
0.20.382026-09-30Domain SMTP Validation: fact lines (status INFO) show a dash in the Level column instead of a second INFO
0.20.372026-09-30scripts/mailtester: every result section expanded and recorded (title, badge, details); --result <url> re-reads an existing result page without sending
0.20.362026-09-30scripts/mailtester: the send step can run through an external command (MTX_MT_SEND_CMD), so the message leaves from the appliance itself
0.20.352026-09-30Domain SMTP Validation: every MX address tested at the same time (a domain with seven MX addresses outlasted the web proxy when tested one after another); scripts/mailtester: deliverability test against mail-tester.com (Playwright driver, template message with List-Unsubscribe, sent through the appliance)
0.20.342026-09-30Domain SMTP Validation: the propagation step accepts the underscore labels of service records (_dmarc, _mta-sts, _smtp._tls, _25._tcp); the agent refused them on 0.20.33
0.20.332026-09-30Domain SMTP Validation: the four check groups run at the same time and each panel fills as its answer arrives; propagation is a second step (part prop, questions kept server-side under a token) so the record lines appear first with Working... in the Propagation column; blocklist lookups concurrent; RECOMMENDED badge yellow when NOT SET; blocklist counts as (n of m)
0.20.322026-09-30Domain SMTP Validation: Level badge neutral unless a REQUIRED line fails or warns, NOT SET as a yellow badge, Propagation column reduced to Yes / Partial / No (resolvers without an answer left out)
0.20.302026-09-30Domain SMTP Validation: progress text of the page script repaired (an apostrophe ended the string; the checks never started on 0.20.28 and 0.20.29)
0.20.292026-09-30Domain SMTP Validation: the MTA-STS policy host is resolved at the authoritative name servers like every other in-zone name and pinned for the fetch, never through the appliance's own resolver
0.20.282026-09-30Domain SMTP Validation: in-zone records read from the domain's authoritative name servers (no resolver cache: what is published now); public resolvers only for reverse DNS, other zones and DNSSEC validation; the panel names the servers asked
0.20.272026-09-30Domain SMTP Validation: reverse DNS judged as forward-confirmed (MX name required only for this appliance), SPF authorisation of the MX informational unless the MX is this appliance, a front-end filtering MX reported as such
0.20.262026-09-30Domain SMTP Validation: DMARC report addresses listed once
0.20.252026-09-30Domain SMTP Validation (Domains): one per-domain view of the public e-mail presence — MX hosts, reverse DNS, port 25 + STARTTLS certificates, blocklists, SPF, DKIM (own selector verified against the local key), DMARC, MTA-STS, TLS-RPT, DANE, DNSSEC, appliance-side checks; replaces MX Record Validation and Domain Diagnostics (redirected); public resolvers only, failed lookups never count as listings
0.20.242026-09-30Certificate assignment mirrored into the database (cfg_cert_assignment): recorded on every assignment, seeded from the store, re-applied by renderAll
0.20.232026-09-30Settings in the database: thresholds, greylisting, message size, logging, time, LDAP, patch/update/backup settings recorded on every change (cfg_*), seeded once from the live state, re-applied by renderAll
0.20.222026-09-30Schema: seed the postscreen zones the installer template configures, so the database holds the installed defaults and regeneration reproduces them
0.20.212026-09-30Regeneration from the database: renderAll at console start, as the installer last step (mailtronx-web render-all) and on POST /api/system/render
0.20.202026-09-30canary: the quota policy row carries the mail group name
0.20.192026-09-30canary: banned-phrases check matches the rendered regex
0.20.182026-09-30canary: quota group tied to the canary mail group; the mail group gets a member so the Postfix map answers
0.20.172026-09-30Configuration canary (deploy/canary.py): seed one test item per page, snapshot every configured value, verify after a patch or installer run
0.20.162026-09-30Certificates: the assignment record always names every service (filled from the live configuration)
0.20.152026-09-30Installer: swap block rewritten (was mangled at write time); Postfix started before Dovecot so the spool sockets exist
0.20.142026-09-30Installer: create /etc/aliases when the image has none (newaliases failed on a fresh DigitalOcean image)
0.20.132026-09-30Installer: wait for the agent socket after the restart; keep distro-started Dovecot/Postfix/nginx down until configured
0.20.122026-09-30Certificates: drop the last import left by the removed self-signed generator
0.20.112026-09-30Certificates: a real certificate at install (Let's Encrypt HTTP-01, or MTX_TLS_CERT/MTX_TLS_KEY), installer stops when neither is possible; the self-signed generator is removed from installer, console and agent
0.20.102026-09-30Installer: swapfile on every appliance without swap (RAM size, 2-4 GB) — golden standard
0.20.82026-09-30Certificates: record the live assignment at agent start and before the installer rewrites service files, so pre-existing assignments survive the first upgrade
0.20.72026-09-30Certificates: persist the service assignment and restore it after installer runs (cert-reapply); the installer no longer forces the appliance certificate
0.20.62026-09-30Installer: America/Los_Angeles default zone (MTX_TIMEZONE) and five NTS time sources on every appliance; schema re-run no longer collides on quota-group Default rows
0.20.52026-09-30Replay: re-render the settings rules when the set is outdated; /replay?run=<id> opens a report
0.20.42026-09-30Replay: placeholder source address for messages without one, host rules off for them; one settings rule per header combination; rules rendered at run start when missing
0.20.32026-09-30Replay: XCLIENT with an unavailable address for messages without Received headers; DATE_IN_PAST off for replays
0.20.22026-09-30Replay: detect the listener from the master.cf service list, not from a postconf warning
0.20.12026-09-30Replay: setup renders the rspamd settings rules and reloads rspamd (upgraded appliances)
0.20.02026-09-30Replay Corpus (Diagnostics): replay real spam archives locally with original client identity
0.19.22026-09-30Installer: handle systemd-resolved on cloud images (DigitalOcean)
0.19.12026-09-29Routing: error: and discard: text may contain spaces
0.19.02026-09-29Sender Relay, per-recipient routes and relay credentials
0.18.02026-09-29BCC by Sender, BCC by Recipient and the archive address
0.17.12026-09-29Domain alias map: match the @domain key as a whole
0.17.02026-09-29Catch-all and alias domains on the Domains page
0.16.12026-09-29Template test: the Users page replaces Admin Accounts
0.16.02026-09-29Users page: accounts, LDAP / Active Directory sign-in, group-to-role mappings and API tokens on one page
0.15.12026-09-29Routing page: the entry example uses the arrow form the page documents
0.15.02026-09-29Mail Routing, default relay host and Allow Relaying enforced in Postfix
0.14.32026-09-29Lists: whitelisted senders and addresses are exempt from the banned lists
0.14.22026-09-29Lists: the From-header rules read their own copies of the banned maps
0.14.12026-09-29Lists: envelope-sender rules use the default extraction; the From-header twins read their own map copies
0.14.02026-09-29Anti-Spam lists enforced by the scanner: banned domains, addresses, words, phrases, character sets, whitelist
0.13.12026-09-29API tokens: expiry stored and compared on the database clock
0.13.02026-09-29API tokens: bearer authentication for scripts and other systems
0.12.82026-09-29Installer: update feed on mailtronx.com by default; README: Get started with the one-line install
0.12.72026-09-29Installer: create the database users before loading the schema