Skip to content
TrustMyStack, home

mailcow-dockerized

2026-11
mailcow/mailcow-dockerized

mailcow: dockerized - 🐮 + 🐋 = 💕

Version of mailcow/mailcow-dockerized you run

CompareView on GitHub
Maintenance
ActiveBased on the last push: commit history is not collected yet
License
GPL-3.0Copyleft · OSI-approved
Security
30 advisories3 critical, 14 high, 9 medium, 4 low · Scorecard 5.7/10
Supported versions
No scheduleendoflife.date does not track this project

13.8k stars · 1.9k forks · 506 open issues · last release 10 days ago · data checked 5 hours ago

OverviewTourReleasesDocker imagesSecurityLogos

Breaking changes

What to check before upgrading, taken from the notes of the last 30 releases.

  • 2026-11Nov 5, 2026

    ⚠️ Breaking Changes

    • Sync job API: add/syncjob needs a source_id, and the server fields (host1, port1, enc1, authmech1) are no longer accepted or returned. Existing jobs are migrated automatically.

    Action: If you create or read sync jobs through the API, update your client. Create a source with add/syncjob_source (or look it up with get/syncjob_source/all) and pass its source_id.

    • Request body limit: 64 MB for UI/API, NGINX_MAX_BODY_SIZE (default 128m) for SOGo/EAS/DAV. If it is below your Postfix message_size_limit, large mails can't be sent via SOGo webmail or ActiveSync.

    Action: If you raised the Postfix message size limit, set NGINX_MAX_BODY_SIZE in mailcow.conf above it and run docker compose up -d.

    • Custom nginx locations (data/conf/nginx/site.*.custom): they are now limited to 64 MB as well, before there was no limit. Apps you run under the mailcow host this way (e.g. Nextcloud or Gitea under a path) reject larger uploads with 413. Own server blocks in data/conf/nginx/*.conf (e.g. Nextcloud on its own subdomain) are not affected.

    Action: Add client_max_body_size to your location (e.g. client_max_body_size 0; for no limit) and run docker compose restart nginx-mailcow.

  • 2025-07Jul 15, 2025
    • ⚠️ Vulnerability fixed⚠️
  • 2025-03Mar 25, 2025

    Breaking Changes

    Logins for Administrator, Domain Administrator, and Users have been separated:

    • Administrator Login: /admin
    • Domain Administrator Login: /domainadmin
    • Users: /

    Direct SOGo login is now disabled. All unauthenticated requests to /SOGo will be redirected to /.

    Users must use the mailcow login.

    Administrators can define whether a user should be redirected to the mailcow UI or SOGo after login.

Release history

All releases on GitHub
Atom feed/feed/mailcow/mailcow-dockerized
BadgeLatest version of mailcow/mailcow-dockerized[![version](/badge/mailcow/mailcow-dockerized)](/p/mailcow/mailcow-dockerized)

🍂🐮 Moovember 2026 | Feature & Security Update: Mailbox Groups, imapsync Rework & SOGo 5.12.13

> [!CAUTION]

> Please create a backup before updating.

> [!IMPORTANT]

> Important security update. We strongly recommend updating as soon as possible.

> Among other issues, this release fixes a remote code execution (RCE) vulnerability that can be exploited by authenticated admins and domain admins.

> Details on the fixed issues will be published early next week. Please read the breaking changes before updating.

> Workaround until you can update: limit access to admin and domain admin accounts.

⚠️ Breaking Changes

  • Sync job API: add/syncjob needs a source_id, and the server fields (host1, port1, enc1, authmech1) are no longer accepted or returned. Existing jobs are migrated automatically.

Action: If you create or read sync jobs through the API, update your client. Create a source with add/syncjob_source (or look it up with get/syncjob_source/all) and pass its source_id.

  • Request body limit: 64 MB for UI/API, NGINX_MAX_BODY_SIZE (default 128m) for SOGo/EAS/DAV. If it is below your Postfix message_size_limit, large mails can't be sent via SOGo webmail or ActiveSync.

Action: If you raised the Postfix message size limit, set NGINX_MAX_BODY_SIZE in mailcow.conf above it and run docker compose up -d.

  • Custom nginx locations (data/conf/nginx/site.*.custom): they are now limited to 64 MB as well, before there was no limit. Apps you run under the mailcow host this way (e.g. Nextcloud or Gitea under a path) reject larger uploads with 413. Own server blocks in data/conf/nginx/*.conf (e.g. Nextcloud on its own subdomain) are not affected.

Action: Add client_max_body_size to your location (e.g. client_max_body_size 0; for no limit) and run docker compose restart nginx-mailcow.

🔐 Security

  • SOGo 5.12.13, an upstream security release (notes)
  • Several security fixes in mailcow (details next week)
  • Fail2ban counts failed logins of all protocols (IMAP, POP3, SMTP, Sieve, EAS, DAV), 2FA rate limit

🚀 New Features

All new features are documented at https://docs.mailcow.email/.

Mailbox groups & shared mailboxes

  • Groups with their own address work as distribution lists. Members can come from all domains you manage.
  • Members can send as the group address and as other addresses of the group.
  • Share mailboxes with a group (IMAP, shown as Shared/), as well as SOGo calendars and address books. Members can be subscribed automatically.
  • Shared mailboxes have no login of their own and are accessed through groups.
  • Mailbox templates can be assigned per group, with a priority.
  • Domain admins manage the groups of their domains (new ACL "Mailbox groups").

Identity provider sync (Keycloak, LDAP/AD)

  • Groups from the IdP are synced to mailcow groups, including their members.
  • Optional offboarding: if a user is disabled or deleted in the IdP, the mailbox login is disabled, but mail is still delivered. Off by default.
  • The admin UI shows the sync status, conflicts and a preview.

imapsync rework

  • Sync sources: the server settings (host, port, encryption, authentication) are defined once and used by any number of jobs. A source can be available to everyone, to specific domains or to single users. Presets cover common providers.
  • OAuth2 (XOAUTH2) for Microsoft 365 and Google. Tokens are refreshed automatically, even while a job is running.
  • Parallel jobs: several jobs run at the same time. The maximum and a bandwidth limit can be set in the admin UI.
  • The certificate of the source server is verified (SSL and STARTTLS). The check can be turned off per source.
  • Updated to imapsync 2.314.

API keys

  • Any number of API keys, each with a description, read-only or read-write access and its own IP allowlist.
  • Keys from mailcow.conf are shown as locked service keys.

What's Changed

Features

Fixes & Security

Updates

Translations

Full release notesCompare with previous