2.1.27

Mail deliverability, per-account services, and the two editions the website has been publishing all along. Update — one of the fixes is a mailbox being able to send as anybody else on the server.

Fixed​

• A mailbox could send as any domain on the server. There was no sender-login check of any kind, so an authenticated mailbox could put any hosted domain in its envelope sender — and because the message genuinely came from this server over an authenticated session, SPF passed, DKIM signed it and DMARC passed. One customer could send mail that every check in the world agreed was really from another customer's company.
• The spam filter's blocklists were answering nothing, silently. rspamd asked Spamhaus and URIBL through a large public resolver, which they refuse — and a refusal reads as "this address is clean" rather than as an error. Queries now go to a resolver on this machine, and the switch is only made after the lists have been proved to answer.
• A site that worked on nginx was broken and slow on OpenLiteSpeed. Persistent FCGI connections to a PHP-FPM pool that closes them meant whichever request drew a dead connection hung for the full timeout: /wp-login.php took 30 seconds and failed while / on the same site answered in 0.2. It is 0.075s now. wp-admin's stylesheets were being blocked as mixed content on the same sites, for a second reason, also fixed.
• Autoresponders and filters wrote where Dovecot never reads. Both saved to a directory the mail server does not look in, and both reported success.
• wp-cli aimed at a PHP version the site had stopped running.
• Mail Log and Track Delivery opened on an empty box asking for an address instead of showing what is there.
• The IP address page could not assign an address: its CSRF field carried a name the server was not looking for.
• CSRF origin checks compared hosts and ignored schemes (GHSA-82ff-hg59-8x73), in both panels. Somebody on the network path could serve a form at the plaintext origin of the panel's own name and be read as same-origin.

Added​

• Mail clients configure themselves. autoconfig for Thunderbird, autodiscover for Outlook, and the SRV records both look for, generated with every zone. A client that finds none of these falls back to asking a customer for a hostname, a port and an encryption setting, which is the support ticket these records exist to prevent.
• ARC on forwarded mail, so a message this server relays keeps its authentication result instead of arriving looking forged.
• TLS reporting (TLS-RPT) and MTA-STS. The MTA-STS DNS record is deliberately withheld until the policy has been fetched over real HTTPS with a certificate that validates — publishing it before the policy is reachable is how mail stops arriving.
• DANE to pin the mail certificate, and BIMI for a verified logo.
• A mail trust page that says which signals it cannot measure, rather than filling the gaps with a number.
• Per-account Memcached and Varnish. Each account gets its own, on a socket only that account can open, in front of only its own sites.
• Hotlink protection, custom error pages, MIME handlers and HTTP/3, per site.
• Blank sites. Adding a domain gave a working vhost the panel could not see, because Site Manager is built from a table only installers wrote to. Somebody bringing their own code now gets a first-class entry — and it is the first card on the page, not the tenth.
• Published system requirements, measured on a real server rather than estimated, including where the memory actually goes. The mail scanners come to about 3.5 GB between them, more than everything else combined.
• An SSL/TLS section for administrators and resellers.
• A favicon option for the webmail, and a larger brand logo on its sign-in page.

Changed​

• Two editions, Community and Enterprise, which is what the website has published for a while against a panel that shipped one. Community is one administrator running their own accounts, websites, mail and DNS, without limit. Enterprise adds the multi-tenant half: resellers, and signing in as one.

Notes​

The edition is decided offline and never by asking the licensing server. An install that holds a licence key is Enterprise; a free download, which has no key, is Community. The remote check still counts activations and reports a licence's real state on the licence page, but it no longer decides what the panel will do — a vendor outage or a customer's firewall must not take a reseller's login away in the middle of an afternoon.

Nothing about a licence is ever fatal. Every way of failing lands on Community with a reason an administrator can act on, and an expired Enterprise licence falls back rather than locking: websites, mailboxes and zones are untouched, and what stops is reseller management. Every server running today keeps what it has, including installs predating the split.

Sender binding takes effect at the next mail-stack render. The map is generated first and the enforcement second, on purpose: a restriction that arrives before the map it consults is a mail outage. Two versions of this fix were wrong before it was right, both caught by testing against a genuinely remote client rather than from the server itself — the plain reject_sender_login_mismatch also refuses bounces and cron mail, and putting permit_mynetworks first short-circuits the check for everything originating on the machine, including every account's PHP.