SecurityGateway for Email v12.5 Release Notes

SecurityGateway 12.5.0b

变更和新功能

[29574] Added a domain administrator permission for managing a domain's maximum user limit.
Global administrators can now allow selected domain administrators to edit the Max Users value for their domains. Domain administrators cannot lower the limit below the domain's current user count. An operator setting can require domain administrators to set a user limit when creating new domains and, when enabled, also prevents them from removing a domain's existing user limit. An optional confirmation, disabled by default, warns domain administrators that increasing the user limit may affect billing. These domain administrator billing options are available under Setup / Users > Accounts > Administrators > Options.
[29576] Added domain administrator warning emails when a domain approaches its maximum user limit.
SecurityGateway now notifies the affected domain's administrators when the domain reaches 75%, 90%, or 100% of its configured Max Users limit. Administrators can turn these notices on or off from Setup > Users > Accounts > Administrators > Options.
[29193] Modernized system-generated email messages and the quarantine action confirmation page.
Quarantine reports, administrator alerts, secure message notifications, 2FA verification emails, low disk space warnings, and other system-generated messages now use a consistent branded email layout with clearer action buttons and improved mobile readability.
[29156] Updated OpenSSL to version 3.6.3.

修复

[29628] Updated the UnRAR library used for RAR archive extraction to address security vulnerabilities in older UnRAR versions.
[29587] Fixed a SecurityGateway crash when a delivery failure notice attempted to attach an oversized original message. Delivery failure notices now include only the original message headers when the original message exceeds 50 MB, or a lower configured limit.
[25568] Fixed system-generated messages, such as secure message notifications, matching several SpamAssassin rules. These messages now include a plain text alternative to the HTML body, and the To header address is enclosed in angle brackets.
[28112] Fixed the SMTP Authentication Required and Authentication Mismatch filters running after the Invalid Sender check on upgraded installations, which could still reveal valid mailbox names through different SMTP responses.
(beta only) [29625] Fixed user allowlist and blocklist changes not taking effect immediately during SMTP processing.
(beta only) [29622] Fixed log files opened from the All Logs list showing the Current IKARUS AV Update Log breadcrumb and submenu highlight.
(beta only) [29611] Fixed quarantine reports not rendering correctly in Outlook desktop clients
(beta only) [29595] Attachment Disguise Protection may identify a GRP (MDaemon mailing list) file as a Powershell script

SecurityGateway 12.5.0a

特殊说明事项

[29217] The default Host Screening blocklist now includes domain.
Many spam bots send EHLO domain instead of a real hostname. This new default helps stop those connections earlier in the SMTP conversation. It is added automatically on new installations and during upgrades.

主要新功能

[29180] Refreshed and modernized web interface
The web interface has been updated with a cleaner layout, improved visual hierarchy, and a more polished overall look. The default light and dark themes have both been refreshed. Mobile browsers are better supported, particularly on the dashboard page. A new classic theme is available for users who prefer an experience closer to earlier versions.
[29042] New REST API for automation and integration
SecurityGateway now includes a standard, OpenAPI-described REST/JSON API that makes it easier to automate administration and connect the product to provisioning systems, identity platforms, and custom workflows.

Manage core objects: The API supports users, domains, domain aliases, administrators, API keys, server/domain/user settings, allowlists, blocklists, mail servers, verification sources, DKIM selectors, archive stores, Sieve content-filter scripts, IP Shield entries, Dynamic Screening entries, and webhook subscriptions, plus read-only performance counters.

Secure access with API keys: Administrators can create API keys from Settings > API Keys.

Built-in documentation: Machine-readable OpenAPI documentation is available via the web server at /api/v1/openapi and can be imported directly into tools such as Postman. Generated HTML documentation is available on disk at /docs/api/api_openapi.htm or via the web server at /api_openapi.html.

Compatibility note: The existing XML-RPC API remains available, but new automation should use the REST API. This is an initial release; more endpoints and capabilities will be added in future versions.
[28787] Feature permissions for domain administrators
Global administrators can now control which product areas each domain administrator may manage. Permissions are configured per administrator from the Edit Administrator dialog. A new Default Domain Administrator Permissions page under Setup/Users > Accounts > Default Administrator Permissions defines starting permissions for new domain admins and can apply those defaults to existing admins in bulk. Defaults can be overridden per domain.

Read-only access: Domain admins without permission to manage a feature area retain read-only access to it for their domains. Archiving and RMail™ are the exception. Rather than dropping to read-only, their pages are hidden entirely from domain administrators who lack permission to manage them. This preserves their behavior prior to 12.5 and lets providers who don't offer these features keep them out of view for their domain admins.

Delegation: The "Domain Admins (Delegation)" permission controls whether a domain administrator can create or manage other administrators for their domains. A domain admin cannot grant a permission they do not themselves hold.

Upgrade behavior: All feature areas available to domain administrators prior to this version remain enabled by default for existing domain admins after upgrading.
[29266] Dynamic Screening enhancements for authentication failure tracking
Dynamic Screening has been extended with additional controls for how failed authentication attempts are tracked and blocked. Configure under Security > Anti-Abuse > Dynamic Screening.

Flexible timing: Block durations and tracking windows can now be set in minutes, hours, or days.

Escalating block duration: A repeat-offense multiplier can extend block duration on subsequent violations without changing the base rule.

Subnet-level blocking: Optional CIDR aggregation blocks a wider network range when attacks originate from many nearby IP addresses.

Duplicate failure suppression: Failures that repeat the same password can be excluded from the failure count, reducing unnecessary blocking from cached credentials while still counting distinct failures.
[26290] Google Workspace API supported as user verification source
Domains using Google Workspace can now verify local users through the Google Workspace API instead of SMTP callbacks. The integration resolves aliases and uses a Google Cloud service account and OAuth 2.0. Configure under Setup > Verification Sources.
[1710] Attachment filtering by content type
Attachment Filtering rules can now match on detected file type in addition to, or instead of, file extension. Configure under Security > Filtering > Attachments.
[29394] Attachment Disguise Protection
SecurityGateway can now detect attachments whose actual file type does not match their file extension (for example, an executable renamed to .pdf). Mismatched attachments can be refused, quarantined, or accepted, with optional subject tagging and score adjustment. Configure under Security > Filtering > Attachment Disguise.

变更和新功能

[29228] Changed startup behavior so the service can start when the database version is newer than the executable version, allowing version downgrades and rolling cluster upgrades. Going forward, database schema changes will be additive and backward compatible.
[29406] Added optional DNS-based domain ownership verification. When the new Require domain ownership verification setting is enabled under Setup > Server > Domain Settings (off by default), newly created domains enter a pending state and do not accept mail until the owner publishes a TXT record at _sgverify.<domain> with the token shown on the domain edit page. Verification runs on demand from the domain edit page or POST /api/v1/domains/{id}/verify, and hourly in the background. A new domain.verified webhook event fires on success. Global administrators can skip verification per-domain when creating a domain.
[29208] New installations now enable SSL/TLS and HTTPS by default with an auto-generated self-signed certificate. Replace it with a trusted certificate for production use.
[29504] Domain administrators can now self-serve Domain Mail Servers and User Verification Sources for the domains they manage. New permissions Can Manage Domain Mail Servers and Can Manage Verification Sources let global admins delegate these areas without granting full control. Delegated admins can create, edit, delete, and assign mail servers or verification sources to their own domains; resources shared with a domain they don't administer are visible as read-only and Test still works. A new Created By column shows resource origin. Test runs asynchronously and shows the SMTP transcript in the dialog.
[29380] 为锁定恢复新增 SGDBTool 命令：sethttpport（更改 HTTP 端口）、disablehttpsredirect（禁用 HTTPS 重定向）、disabletfa（为用户禁用双重验证）、disablerequiretfa（在全局或域级别禁用强制双因素认证重验证）
[29292] SGDBTool createadmin and resetadmin no longer hard-code the administrator name and password. The email address and password may now be specified on the command line, or entered interactively when omitted.
[29245] Added PROXY protocol support (v1 and v2) so SecurityGateway can run behind HAProxy and similar load balancers while still receiving the original client IP address and SNI hostname. Configure under Setup > System > PROXY Protocol.
[27530] Added SNI-based domain identification for SMTP connections so the correct domain can be identified earlier in the session and its SMTP hostname can be used immediately after STARTTLS. See also [27489].
[27489] Domain SMTP hostnames can now be configured without requiring IP binding. Hostname fields are now grouped under a Hostnames section on the domain properties tab.
[23581] Added DNSSEC support for outbound SMTP delivery. When DNS validation is available, DNSSEC-signed domains can satisfy REQUIRETLS without needing MTA-STS.
[28327] SMTP now rejects MAIL FROM and RCPT TO addresses longer than 254 characters instead of silently truncating them.
[29171] Added an option to limit the size of messages attached to delivery failure notifications. If the original message is too large, only headers are attached.
[23803] Archived messages can now still be viewed from Message Log after routine maintenance purges the message body from the primary database. This applies to messages archived from this version forward.
[26248] 现在可以为每个域名自定义管理员隔离报告设置。新增的“管理员隔离配置”页面支持针对各个域名进行独立的覆盖配置。
[29202] Quarantine report links now take users to the correct page after login. "View All Quarantined Messages" opens quarantine, and "Manage Preferences" opens quarantine options.
[29547] Improved bad archive queue notifications by showing the web interface path Archiving > Failed Messages, and linking directly to that view after login.
[4576] User allowlist and blocklist pages now show when each entry was added, support column sorting, and can automatically purge entries created by outbound auto-exempt after a configurable retention period. New installations enable a 90-day default. The combined Blocklist/Allowlist Configuration page has been split into separate pages; allowlist auto-purge settings now live under Security > Allowlists > Configuration, with per-domain overrides correctly honored.
[15630] Content Filter and DLP transcripts now show which address or envelope condition matched, making rule troubleshooting easier.
[17768] Upgraded the content-filter regex engine from PCRE 8 to PCRE2 with JIT compilation and a compiled-pattern cache, reducing CPU use for regex-heavy Content Filter and DLP rules.
[4664] Added audit logging for bulk domain and account imports, including summary results in the system log and individual change-log entries for imported users and domains.
[16159] Added a Notes field to domain properties for documenting domain-specific information in the web UI, REST API, and XML-RPC API.
[29373] Added a global default theme with per-domain override so administrators can choose the default UI theme for users. The login page also follows this setting unless a user has already chosen a personal theme.
[29544] Improved the non-admin My Account navigation by hiding the redundant single-item Main top-level menu and renaming the account landing tab to Overview.
[29338] LetsEncrypt: Updated the script to support multiple nodes in a cluster. This requires Windows Remote Management.
[29345] LetsEncrypt: The script now ignores certificate errors by default.
[29461] Updated the bundled Firebird database engine to version 5.0.4.
[28933] 已将 SpamAssassin 更新到 4.0.2 版本
[29343] 已修复 LetsEncrypt 在指纹中插入多余空格导致比较失败的问题

修复

[28528] Fixed relayed messages (non-local sender and non-local recipient) being shown as Inbound in the message log. They are now classified as Outbound, while inbound mail rejected before RCPT keeps its Inbound classification.
[17477] Fixed the Stop Delivery action for queued messages taking effect immediately with no confirmation prompt. Users are now asked to confirm before delivery is stopped.
[29468] Improved performance when stopping delivery for a large remote queue. SecurityGateway now marks and removes affected queued messages in bulk, reducing cleanup time and database load.
[29451] Fixed messages for invalid local recipients being accepted and queued for outbound relay when an external Firebird database became temporarily unreachable during an SMTP session.
[29430] 已修复 SMTP EmergencyCutoff 在 DATA 传输被中止时，会在如站队列中残留部分邮件文件和锁文件的问题；这些文件可能会在服务重启时被移动到 Crashdumps\InboundQueue。
[26771] Fixed SMTP/HTTP binding problems with compressed IPv6 notation and with mixed IPv4 and link-local IPv6 bindings.
[29229] Fixed RCPT TO incorrectly accepting multiple comma-separated addresses instead of returning a syntax error.
[28854] Fixed MAIL lookup checking only the domain's A record instead of also checking MX host IP addresses.
[28536] Fixed BATV tags not being removed from the sender address in Message Log when a message was rejected for an invalid recipient.
[28582] 已修复由于记录拒绝时未设置 FROMUSERID，导致被拒收的外发邮件未显示在发件人邮件列表中的问题
[29207] Fixed NDR messages showing only the last line of multi-line SMTP error responses.
[26034] Fixed long UTF-8 headers being encoded as one oversized RFC 2047 encoded word instead of being folded correctly.
[27245] Fixed quarantine reports, password resets, secure message notifications, and 2FA emails using the wrong hostname in links. A new per-domain Host Name setting now controls the hostname used for login links.
[29529] 已修复 SMTP 呼叫转发验证记录未显示在入站会话日志中的问题。现在，在进行收件人验证期间，SecurityGateway 与远程邮件服务器之间的 SMTP 会话内容将会包含在日志记录中。
[29458] 已修复当 SecurityGateway 暂时无法与外部 Firebird 数据库通信时，长期存在的数据库连接池连接无法自动恢复的问题。
[29261] Fixed failed authentication attempts not causing IP to be blocked when connecting from IPv6 address.
[29399] Fixed failed authentication logs showing ACCOUNT: @domain.com instead of ACCOUNT:none when the account does not exist.
[29508] Fixed administrators being able to accidentally downgrade or disable their own account via the web UI.
[29591] Fixed domain administrators assigned to multiple domains seeing the wrong domain's address allowlist on the initial allowlist page load.
[28455] Fixed external administrators receiving "Access Denied" when setting up two-factor authentication for the first time with the 2FA requirement enabled.
[29050] 已修复即使启用“记住我”，会话过期也注销用户的问题。拥有有效“记住我”Cookie 的用户在会话过期时，自动重新认证。
[25947] Fixed an external administrator being created with the same email address as an existing secure recipient, preventing the administrator from signing in with admin privileges.
[21821] Fixed Location Screening not blocking connections when MaxMind geolocation returns only a continent (e.g., "Europe") with no specific country code.
[21926] Fixed duplicate IP entries in Dynamic Screening when block occurs due to concurrent SMTP sessions.
[27721] Fixed IP Shielding DATA event rejection error displaying the SMTP envelope sender instead of the From header domain.
[29518] Fixed Passwordless Sign-In and Device Authentication credential registration failing with "Something went wrong while trying to register your credentials".
[28637] Fixed URIBL spam score being incorrectly added to recipients who have spam filtering disabled in multi-recipient SMTP transactions.
[28727] Fixed URIBL score being inflated when a message contains multiple subdomains of the same base domain.
[29260] 已修复在禁用 URIBL 调试日志时，URIBL 错误地将单标签名称查询到 URI 黑名单的问题
[29226] Fixed SpamAssassin scores being incorrectly applied to recipients who have spam filtering disabled in multi-recipient SMTP transactions.
[29414] Fixed Bayesian classification being enabled in the UI but disabled in SpamAssassin's local.cf on clean installs, which caused sa-learn to fail.
[17011] Fixed SPF recursive lookup errors not being logged when SPF evaluation exceeds RFC 7208 limits.
[8610] Fixed SPF evaluation returning a result based on the first v=spf1 TXT record found when a domain publishes multiple SPF records. Per RFC 7208, multiple SPF records now correctly return PermError.
[24488] Fixed DMARC aggregate reports having duplicate rows when there are multiple envelope from addresses with the same domain.
[28566] Fixed DMARC verification ignoring exclusion settings such as domain mail servers and authenticated senders because the wrong configuration section was being read.
[26072] Fixed DMARC tests running unnecessarily on messages collected through Remote POP when the sender IP address was not known.
[27237] Fixed PTR lookup test only logging the first time it is executed in an SMTP session.
[29471] Fixed HELO lookup test only logging the first time it is executed in an SMTP session.
[29413] Fixed sgdbtool importselector reporting success but the imported DKIM selector not appearing in the web interface.
[14008] Fixed multi-recipient messages having attachments stripped when one recipient matched a Content Filter discard rule.
[26150] Fixed user-created Sieve scripts not respecting script order configured in the web interface.
[26690] Fixed Sieve body :content matching to follow RFC 5173. It now matches the decoded body of selected MIME parts without text extraction or HTML-to-plaintext conversion. Rules that depended on the old plaintext behavior should use :text instead; :content can now match raw HTML content such as <script> redirects in attachments.
[29365] Fixed Sieve greylist actions set during pre-RCPT phases (AUTH, IP, HELO, MAIL) not being carried into the RCPT phase.
[29437] Fixed Content Filter and DLP "contains the word(s)" conditions not appearing when a saved rule was reopened in the rule editor, even though the words were still saved in the rule.
[29442] Fixed Sieve :proximity allof() constraints being silently dropped when the first test was a regex or wildcard term, which could cause some content-filter rules to fire outside the configured character window. Logging now also distinguishes proximity anchor matches from matches that satisfy the proximity window.
[29488] Fixed Sieve body :text :contains not matching messages that have no Content-Type header (bare RFC 2822 plaintext).
[29410] Fixed Display Name Protection flagging a protected user as not authorized when sending from their own local account or one of its aliases. The verified MAIL FROM identity is now used to suppress the false positive; messages whose only match is in the From header continue to be flagged.
[26659] Fixed domain-specific greylisting not excluding messages sent from domain mail servers.
[28849] Fixed greylisting being incorrectly triggered when sending mail from a local domain with greylisting enabled to a local domain with greylisting disabled.
[27811] Fixed Ikarus returning a "could not be scanned" status for documents containing macros, which caused messages to be quarantined instead of applying the configured virus action.
[11048] Fixed allowlist and blocklist not matching senders whose email address contains a Backscatter Protection (BATV) code.
[28825] Fixed IP blocklist/allowlist search not finding entries with CIDR notation.
[29133] Fixed duplicate entries in block/allow lists not showing a warning message.
[29335] 已修复允许列表和阻止列表导出仅包含列标题而无数据的问题
[29390] 已修复在反病毒更新日志查看器中点击刷新后返回按钮失效的问题——每次刷新都会重复添加浏览器历史记录条目
[28364] Fixed page title bar not displaying domain name and navigation context at desktop screen widths.
[29264] Fixed landing page links not highlighting the correct navigation menu item due to typos and missing submenu values.
[29368] Fixed the tertiary navigation menu disappearing from Secure Messaging after clicking Save.
[28605] 已修复在邮件记录中点击超链接跳转到列表视图后返回时，未重新选中原邮件的问题
[3331] Fixed domain changes (add/edit/delete) made outside of the current session not being reflected in the web interface.
[29297] Fixed the Search Settings close icon (red X) wrapping to a new line instead of staying inline with the search field.
[1310] Fixed Message Log "Result" and "Reason" columns not sorting correctly when clicking the column header.
[27313] Fixed folded RFC 2047 encoded subjects being truncated in Message Log. Message Log subjects are still limited to 256 UTF-8 chars.
[29298] Fixed Message Log not showing the admin email address when an administrator released a message from the user quarantine queue.
[28719] Fixed quarantined messages being redeliverable from the All Messages log, and the redeliver action not displaying a success/failure summary. Quarantined messages are now skipped with a message indicating they must be released from quarantine first.
[24702] Fixed users being able to open, download, or redeliver quarantined messages from their message log when they were not allowed to access quarantine.
[28123] Fixed clicking slightly off a checkbox in list views (quarantine, message log, etc.) deselecting all previously selected items.
[28082] Fixed "Search My Message Archive" menu item being visible to users when archiving is not enabled for their domain.
[29064] Fixed slow personal message archive search when filtering by date range.
[29450] Fixed the Domains and Users list not sorting when clicking the Name or Users column header; the list was reversed instead of sorted.
[1296] Fixed import button being enabled before a file is selected in import dialogs (whitelist, domain, user, terms, selector).
[24656] Fixed quarantine configuration schedule day names not being translated for non-English languages.
[27722] Fixed "Save and Close" button not being enabled when pasting text into IP Shield, Sieve script, content filter, disclaimer, and outbound footer editor fields.
[28684] 已修复当邮件服务器描述包含双引号字符时，全局管理员在新增用户时无法查看域下拉列表或邮件服务器列表的问题
[29342] Fixed the My Account change-password dialog not sending the user ID to the server, causing silent failure.
[29310] Fixed the DKIM signing DNS configuration dialog not explaining the %DOMAIN% placeholder when viewing a shared selector. Also added a Copy DNS Record button and clearer guidance.
[29346] 已修复俄语翻译不准确的问题：允许列表下拉框显示为“阻止列表”文本、允许列表发件人的域存在拼写错误，以及显示/隐藏搜索按钮标签互换
[29369] Fixed the AI Classification prompt editor showing {categorization_labels} instead of {classification_labels} in the variable list and example prompt.
[29364] Fixed the QR Code Detection page missing the descriptive text shown on other Anti-Abuse pages.
[29396] Fixed Settings Search not returning ARC verification settings from the DMARC verification page.
[29167] Fixed local AI models (e.g., Ollama) incorrectly requiring API key to fetch model list.
[29553] Fixed clicking "New" on the Admins tab of the Domain Properties dialog throwing an "Illegal qualified name character" XML parse error.
[29579] Fixed clicking "Save and Close" on the Trusted ARC Sealers dialog throwing a JavaScript error and silently losing changes.
[29316] 已修复在外部数据库不可达时处理隔离报告导致崩溃的问题
[28670] 已修复“设置 / 用户 | 系统 | 目录”中无法指定不能在本地创建的数据库备份目录的问题。在使用外部 Firebird 数据库时，可能需要此功能。
[29485] Fixed configuration database backup failing with an IBPP::WrongType "BOOLEAN and int16_t" error on systems with AI Classification prompts configured.
[29185] Fixed inaccurate system CPU usage reporting on dashboard.
[29545] Fixed message archiving failing with "this IndexWriter is closed" errors until the service was restarted.
[29549] Fixed the archive retry queue repeatedly retrying messages whose control files could not be read.
[29347] Fixed LetsEncrypt not correctly detecting the redirect to HTTPS.