Release Highlights

Vectis Mail ships on a fast, steady cadence. This page is a curated tour of the milestones rather than a per-commit changelog — for the full, version-by-version detail (every fix and internal change), see the GitHub Releases.

Current stable release: v0.1.62, released 2 November 2026.

Foundation — general availability

The first GA release established the full self-hosted, multi-tenant mail platform: Postfix and Dovecot for transport and storage, Rspamd and ClamAV for filtering, a modern admin console, per-domain DKIM signing, automatic TLS certificates via Let’s Encrypt, and a first-class REST API. One install, your domains, your server — standard protocols throughout.

Spam filtering & deliverability

Advanced per-domain spam filtering (Pro). Per-domain spam (Junk) and reject thresholds, greylisting toggles, and sender allow/block lists — tune one tenant without touching the rest, with changes taking effect in seconds.
DMARC enforcement. Inbound mail that forges a domain publishing a DMARC p=reject policy is rejected at SMTP, and p=quarantine forgeries are marked as spam. On by default (rspamd.enforce_dmarc).
DMARC rejections you can see, and exceptions for real senders. The Spam lists page shows the mail DMARC enforcement refused for each domain over the last 30 days, grouped by sender, on every plan. On Pro, a sender with broken SPF or DKIM can be let through with a DMARC exception tied to the network it sends from (an IP, a range, or a hostname that must resolve back to it), so the same domain from anywhere else is still refused. See when DMARC rejects a sender you want.
Blocklist lookups that work. Spamhaus, URIBL and DNSWL refuse queries that arrive through shared or public DNS resolvers, so on most servers those checks were silently scoring nothing. The spam filter now carries its own local resolver, so lookups come from your server’s own address and return real answers. On by default; opt out with rspamd.local_resolver: false. Spamhaus’s free public mirrors are meant for non-commercial, modest-volume use; see DNS blocklists for what that means for commercial installs.
Your own Spamhaus key. A business can add its own Spamhaus Data Query Service key to secrets.yaml, and spam filtering and the blocklist check then query Spamhaus through that account instead of the public mirrors. Until a key is set, the Deliverability page, vectis config validate and the startup log say so. See using your own Spamhaus DQS key.
Blocklist monitoring for your own IP. Every six hours, Vectis checks your server’s sending IP against six major blocklists (Spamhaus ZEN, SpamCop, Barracuda, PSBL, UCEPROTECT, s5h.net) through its own resolver. Each result is listed, not listed or could not be checked, with the reason, and a “could not be checked” is never shown as clean. A listing links straight to that list’s delisting page from the Deliverability dashboard.
IP warmup that actually limits. A new sending IP gets a 30-day ramp that starts at 50 recipients a day outside your server. Over the day’s limit, the send API answers 429 with a Retry-After, and mail clients get a temporary refusal: the message isn’t accepted, so it stays with the sender to retry rather than bouncing. Mail between your own domains doesn’t count. Progress is on the Deliverability dashboard; see the IP warmup guide.
Redis-backed filtering. Rspamd shares the stack’s Valkey store, so rate limiting and reply tracking run out of the box, and greylisting works when you turn it on (system-wide, or per domain on Pro).
A spam classifier that stays bounded. Learned Bayes tokens now expire: the significant ones are kept, common ones last 10 days, and the rest 100 days, so the classifier’s database no longer grows without limit.
DKIM that heals itself. Signing keys are generated, permissioned, and reconciled automatically across upgrades, closing the classic “unsigned mail after a config change” gap.
Deliverability self-check. A built-in vectis domain check verifies SPF, DKIM, DMARC, and DNS alignment so you can confirm a domain is set up to land in the inbox before you send.

Migration & provisioning

Native IMAP import. Move existing mailboxes into Vectis Mail directly over IMAP — no external tooling — with progress tracking and cancellation.
SCIM 2.0 provisioning (Enterprise). Automated user lifecycle management from your identity provider.

Single sign-on & Enterprise

OIDC SSO (Pro) and SAML 2.0 SSO (Enterprise) for federated login.
The Enterprise tier adds SAML SSO, SCIM provisioning, a business-hours support SLA, and GDPR DSAR export & erasure — flat per-tenant pricing, never per seat.

Backup & disaster recovery

Scheduled, encrypted backups with configurable schedule and retention, editable from the admin UI, plus off-host synchronisation so a single host failure is never a single point of data loss.
Hardened, atomic restore so a recovery can’t leave the system half-restored.
Mail keeps running through Docker upgrades. New installs turn on Docker’s live-restore, so upgrading the Docker packages no longer stops and restarts the mail containers. On an existing server, add "live-restore": true to /etc/docker/daemon.json and run systemctl reload docker; the containers keep running.

Security & supply chain

Sustained security hardening. A dedicated pre-launch hardening programme tightened authentication (per-account and per-IP login rate limiting, TOTP replay protection), added CSRF protection, enforced API-key domain scoping, bounded inbound-message resource use, and moved secret hashing to Argon2id.
Signed releases (Ed25519). Every release binary and release manifest is signed with an offline Ed25519 key whose public half is compiled into the product, and verified in-process before any self-update — defence against a compromised download origin. Releases also ship an SPDX SBOM and keyless cosign signatures for the binary and every container image.
vectis verify. Proves a server runs exactly what was published for its version: the signed manifest, every container image by digest, and the CLI binary by hash. Run it on demand, or install its timer to re-check on a schedule and email you if anything stops matching. Every release has its own signed manifest, and a published release can never be overwritten.
Release integrity on the dashboard. The admin dashboard shows the last vectis verify result to super admins: verified, failed, unverifiable, or stale if the scheduled check has stopped running. You see at a glance whether the server still matches what was published, without opening a terminal.
No internal addresses in forwarded mail. Delivered mail no longer carries an extra Received header naming the server’s internal container address, which a mailbox filter that forwards mail elsewhere used to pass on.
No logins on port 25. Port 25 is for server-to-server mail and no longer accepts SMTP authentication. Mail clients and webmail send on 587 (STARTTLS) or 465 (TLS), where sending limits and suspensions always apply. If a client is set to send through port 25 with a username and password, switch it to 587 or 465.
Pre-flight refuses public credentials. vectis preflight fails if an existing secrets.yaml still holds a development or example credential, and names the fields to replace. The installer generates random values (and leaves only its own marker for the first admin password), so this catches a server assembled by hand from sample files.

Licensing

Offline licence verification for Pro and Enterprise entitlements, so a licensed install keeps working through transient network or provider issues.

Looking for the earliest detailed notes? See v0.1.0 and v0.1.1. For everything in between and since, the GitHub Releases page carries the complete per-version changelog.