Skip to content
Vectis MailVectis Mail

Release Highlights

Vectis Mail ships on a fast, steady cadence. This page is a curated tour of the milestones rather than a per-commit changelog — for the full, version-by-version detail (every fix and internal change), see the GitHub Releases.

Current stable release: v0.1.52, released 11 October 2026.

Foundation — general availability

Section titled “Foundation — general availability”

The first GA release established the full self-hosted, multi-tenant mail platform: Postfix and Dovecot for transport and storage, Rspamd and ClamAV for filtering, a modern admin console, per-domain DKIM signing, automatic TLS certificates via Let’s Encrypt, and a first-class REST API. One install, your domains, your server — standard protocols throughout.

Spam filtering & deliverability

Section titled “Spam filtering & deliverability”
  • Advanced per-domain spam filtering (Pro). Per-domain spam (Junk) and reject thresholds, greylisting toggles, and sender allow/block lists — tune one tenant without touching the rest, with changes taking effect in seconds.
  • DMARC enforcement. Inbound mail that forges a domain publishing a DMARC p=reject policy is rejected at SMTP, and p=quarantine forgeries are marked as spam. On by default (rspamd.enforce_dmarc).
  • Redis-backed filtering. Rspamd shares the stack’s Valkey store, so rate limiting and reply tracking run out of the box, and greylisting works when you turn it on (system-wide, or per domain on Pro).
  • A spam classifier that stays bounded. Learned Bayes tokens now expire: the significant ones are kept, common ones last 10 days, and the rest 100 days, so the classifier’s database no longer grows without limit.
  • DKIM that heals itself. Signing keys are generated, permissioned, and reconciled automatically across upgrades, closing the classic “unsigned mail after a config change” gap.
  • Deliverability self-check. A built-in vectis domain check verifies SPF, DKIM, DMARC, and DNS alignment so you can confirm a domain is set up to land in the inbox before you send.

Migration & provisioning

Section titled “Migration & provisioning”
  • Native IMAP import. Move existing mailboxes into Vectis Mail directly over IMAP — no external tooling — with progress tracking and cancellation.
  • SCIM 2.0 provisioning (Enterprise). Automated user lifecycle management from your identity provider.

Single sign-on & Enterprise

Section titled “Single sign-on & Enterprise”
  • OIDC SSO (Pro) and SAML 2.0 SSO (Enterprise) for federated login.
  • The Enterprise tier adds SAML SSO, SCIM provisioning, a business-hours support SLA, and GDPR DSAR export & erasure — flat per-tenant pricing, never per seat.

Backup & disaster recovery

Section titled “Backup & disaster recovery”
  • Scheduled, encrypted backups with configurable schedule and retention, editable from the admin UI, plus off-host synchronisation so a single host failure is never a single point of data loss.
  • Hardened, atomic restore so a recovery can’t leave the system half-restored.

Security & supply chain

Section titled “Security & supply chain”
  • Sustained security hardening. A dedicated pre-launch hardening programme tightened authentication (per-account and per-IP login rate limiting, TOTP replay protection), added CSRF protection, enforced API-key domain scoping, bounded inbound-message resource use, and moved secret hashing to Argon2id.
  • Signed releases (Ed25519). Every release binary and release manifest is signed with an offline Ed25519 key whose public half is compiled into the product, and verified in-process before any self-update — defence against a compromised download origin. Releases also ship an SPDX SBOM and keyless cosign signatures for the binary and every container image.
  • vectis verify. Proves a server runs exactly what was published for its version: the signed manifest, every container image by digest, and the CLI binary by hash. Run it on demand, or install its timer to re-check on a schedule and email you if anything stops matching. Every release has its own signed manifest, and a published release can never be overwritten.
  • Release integrity on the dashboard. The admin dashboard shows the last vectis verify result to super admins: verified, failed, unverifiable, or stale if the scheduled check has stopped running. You see at a glance whether the server still matches what was published, without opening a terminal.
  • Pre-flight refuses public credentials. vectis preflight fails if an existing secrets.yaml still holds a development or example credential, and names the fields to replace. The installer generates random values (and leaves only its own marker for the first admin password), so this catches a server assembled by hand from sample files.

Licensing

Section titled “Licensing”
  • Offline licence verification for Pro and Enterprise entitlements, so a licensed install keeps working through transient network or provider issues.

Looking for the earliest detailed notes? See v0.1.0 and v0.1.1. For everything in between and since, the GitHub Releases page carries the complete per-version changelog.