Back to Community Threads

Build 9805 (Nov 5, 2026)

Question asked by kevind - Today at 7:44 PM

Unanswered

Wow, lots of adds, changes, fixes, and security patches! Share your experience with installation and operation.

Added: [HA] Language support for cluster administrators.
Added: A new anti-spam setting that uses a message's ARC chain to catch senders that failed DMARC at origin.
Added: A new system level Event when a user is detected as "failed to load".
Added: A protocol network traffic capture utility for system administrators.
Added: A warning banner on the Antivirus settings page when Microsoft Defender real-time protection is disabled.
Added: The option to use an external, standalone SpamFoo server.
Added: Zoom video conferencing integration.
Changed: [API] 'PreviewAttachment', 'InlineAttachmentView', 'AttachedFile', 'ContactImage', 'GalContactImage', and 'PreviewImage' requires a bearer token or an HttpOnly resource cookie.
Changed: [API] Licensing -> AboutInfo requires authentication.
Changed: Added more details to content filter logging.
Changed: Attachment and inline-image endpoints now fully verify access permissions.
Changed: Hardened MIME message parsing against messages with an excessive number of parts or overly nested parts.
Changed: Integration settings (chat provider, etc.) now appear on the user and domain Settings pages as the Marketplace was removed.
Changed: Licensing page now uses a grid layout instead of cards.
Changed: Logging in with a temporary password now enforces Two-Step Authentication.
Changed: Microsoft 365 and Outlook.com accounts can now use the Microsoft Graph API or IMAP for mailbox migration and retrieval, replacing Exchange Web Services (EWS).
Changed: Move to Junk / Move to Inbox buttons replaced with Spam / Not Spam dropdown to re-classify messages.
Changed: New installs now enable SpamFoo antispam and message classification by default.
Changed: OpenTelemetry now reports CPU, memory, IDS blocks, spam, virus, and message data totals, and identifies each server by name, version, edition, and HA role.
Changed: Outbound spam and IDS quarantine handling now applies to local recipients, not just remote ones, based on the Internal Spam Check Behavior setting.
Changed: Reorganized the settings tree for domains and users.
Changed: Reorganized the Spool view into separate Normal, High, and Low priority tabs.
Changed: Users with Two-Step Authentication enabled are now prompted for it after resetting their password.
Removed: The SmarterMail Marketplace - all associated features are now part of the Settings menu.
Fixed: [HA] [HUB] Modifying LearnSpam field concurrently modifies LearnHam field in Rspamd settings.
Fixed: [HA] [HUB] Unblocking an IDS IP can make the hubs out of sync.
Fixed: [HA] Allowed host restrictions are not enforced by hubs or on requests routed through them.
Fixed: [HA] Deleting a node doesn't release its system administrator usernames for other nodes to use.
Fixed: [HA] IMAP, POP and SMTP can misinterpret commands that are sent together or in multiple chunks.
Fixed: [HA] Login fails when the username has leading or trailing spaces.
Fixed: [HA] Managing a node can fail when the cluster is behind a load balancer without sticky sessions.
Fixed: [HA] Messages addressed to a domain’s postmaster can be rejected or misrouted instead of being relayed to the responsible node.
Fixed: [HA] Nodes can log a license update error when a license change is sent from the hub.
Fixed: [HA] Nodes do not go active on restart when failover is disabled at creation.
Fixed: [HA] Propagating domain or user defaults to cluster nodes could reset unrelated settings to their defaults.
Fixed: [HA] Restoring a node after a failover or restarting cluster hubs could leave the cluster in an inconsistent state.
Fixed: [HA] Setting up 2FA for a cluster admin isn't localized.
Fixed: [HA] Temporary DNS failures could cause a node to reject proxied connections from cluster hubs.
Fixed: [HA] When managing a single node, domain lists show every domain in the cluster instead of only that node’s.
Fixed: A failed SpamFoo client update can stop all local mail delivery until SpamFoo is manually reinstalled.
Fixed: Account synced with New Outlook (EWS) sends messages in raw HTML.
Fixed: An intermittent SmarterMail Chat error toast that appeared after the connection dropped and automatically reconnected.
Fixed: An invalid or malformed refresh token could return an HTTP 200 Success status instead of 401 Unauthorized.
Fixed: Browser notification pop-ups could display untranslated text.
Fixed: Calendar appointments could show an incorrect last-modified date, causing some changes to not sync reliably to connected devices.
Fixed: Calendar events with the same start and end time don’t trigger reminders and cause high disk activity on large calendars.
Fixed: Changing an existing appointment's busy status with Outlook (EWS) can cause a delivery error under certain conditions.
Fixed: Command-line antivirus scanners on Windows receive the message file path with forward slashes, which can make them fail to find the file.
Fixed: Disk Usage report shows “N/A” for Last Login when a user had only signed in through a sync protocol such as IMAP, POP, EAS, EWS, or MAPI.
Fixed: Dismissing or snoozing a meeting reminder in Outlook (MAPI) marks attendees who haven’t responded as "Tentative".
Fixed: Domain and system footers break PGP or S/MIME signatures.
Fixed: Domains sharing the same hostname for automatic (ACME) certificates could show a false "certificate generated but has binding errors" status.
Fixed: Duplicate delivery status notifications were sent when a message matched more than one alias.
Fixed: EAS, EWS, MAPI, Autodiscover and OAB requests fail with an error when the client sends a malformed authentication cookie.
Fixed: Editing one occurrence of a recurring meeting in Outlook (MAPI) could result in duplicate calendar entries.
Fixed: Failed refresh-token authentication attempts were logged without the client ID.
Fixed: Folder auto-clean can show an incorrect date in the logs for last clean time.
Fixed: Guests uploading files to an online meeting see a false “session expired” message.
Fixed: High-priority messages can be delayed in the spool behind a backlog of normal- or low-priority messages.
Fixed: Image attachments can show a broken thumbnail when composing a message.
Fixed: Internal Spam Check Behavior set to Check Other Domains could be bypassed or misapplied for spoofed senders, domain aliases, and messages from drop folders or routing rules.
Fixed: Mailing list messages retain a Disposition-Notification-To header from the original poster, resulting in unexpected read receipts.
Fixed: Messages sent from a mailbox named “_event” are treated as system-generated emails.
Fixed: On Windows, a volume mount set to the root of a drive can be disabled while domains are still stored on it.
Fixed: Outlook (MAPI) shows a false conflict when editing appointments in a shared calendar.
Fixed: Outlook connections over MAPI that use Basic authentication fail to sign in.
Fixed: Recipient can receive a duplicate messages after a service restart or when relayed between High Availability servers.
Fixed: Recipient fields incorrectly interpret some characters when using a non-US keyboard layout.
Fixed: Recurring calendar events don't sync to Outlook (MAPI) when an edited occurrence had a subject or location in Chinese or another multi-byte language.
Fixed: Refreshing webmail could briefly display the browser's language instead of the user's selected language.
Fixed: Spoofed messages can misdirect auto-replies.
Fixed: SSL/TLS certificates could serve an incomplete chain to some clients.
Fixed: Terminating a user session does not sign the user out.
Fixed: Text pasted from Microsoft Word into the webmail editor loses its formatting.
Fixed: The Scheduled folder count doesn’t update after scheduling an email.
Fixed: The webmail message list could get stuck and stop refreshing after a loading error.
Fixed: Unable to configure an external SMTP account for a Microsoft 365 account using smtp.office365.com.
Fixed: Webmail could unexpectedly log you out when multiple tabs or windows were open at the same time.
Security: .NET updated to patch critical CVEs.
Security: Hardened authorization and identity verification across system admins, mail, chat, and legacy APIs.
Security: Hardened HTML sanitization of event descriptions in recurring calendar occurrences.
Security: Hardened input validation and sender authentication across various areas.
Security: Improved sanitization of HTML email content.
Security: Password reset now uses a short-lived, single-use confirmation code instead of an emailed reset link.

Back to Community Threads

Reply to Thread

Enter the verification text