LoginSign Up
← Back to all sparks
M

Maddy

COMMS
Velocity2.5

All-in-one composable mail server

maddy.email ↗

maddy's back-to-back security releases close DMARC bypasses and IMAP storage bugs.

mail-serverself-hostedgolangsecuritydmarc
◆Current state
maddy is an all-in-one Go mail server for SMTP and IMAP. Its last two releases are security fixes: 0.9.6 in October required explicit trust for PROXY headers and closed an auth misconfiguration, and 0.9.7 fixes two DMARC verification bypasses that let attackers spoof domains with p=reject, plus long-standing IMAP storage bugs. Malformed MIME messages are now stored as a single part instead of being lost.
◆Where it's heading
Feature work stopped after the 0.9 line in spring; recent releases are driven by reported vulnerabilities. The project is fixing correctness in mail authentication and storage rather than adding capabilities.
◆Prediction
Further security point releases look more likely than a 0.10.0 feature release, though 0.9.1 flagged libdns provider removals for 0.10.0.

◆Recent moves

  1. 8d ago

    maddy 0.9.7 fixes two DMARC bypasses and IMAP storage bugs

    Fixes two DMARC bypasses, one from mixed-case From domains and one from malformed From headers, along with long-standing IMAP storage bugs. It is the second security release in five weeks and stays compatible with 0.9.6.

    View source ↗
  2. 1mo ago

    maddy 0.9.6 fixes PROXY trust and auth bypass misconfig

    A security release requiring explicit trust for PROXY protocol headers and closing an auth misconfiguration that could skip password checks. Operators of maddy mail servers should upgrade.

    View source ↗
  3. 5mo ago

    maddy 0.9.5 fixes nested pipeline logging and systemd reload reporting

    Cleanup after the logger tree refactor in 0.9.4: the message pipeline now always initialises its logger for nested pipelines, and a nil check was added on logger close. A dangling destination limiter on first RCPT error was fixed, arm64 Docker builds re-enabled, and systemd now reports READY=1 after reload — the last of these tying off the no-downtime reload work from 0.9.0.

    View source ↗
  4. 6mo ago

    maddy 0.9.4 removes the maddyctl symlink and implicit run command

    Two long-deprecated conveniences are gone: the binary no longer changes behaviour when invoked as maddyctl, and running maddy with no command no longer defaults to run — a warning that had been in place since 0.6, four years earlier. The stated reason is that the CLI hacks made --log handling inconsistent, which fits the wider pattern of trading convenience for predictable behaviour. A LOGIN SASL auth directive was added and the logger tree properly restructured.

    View source ↗
  5. 7mo ago

    maddy 0.9.3 patches an LDAP injection flaw in auth.ldap

    A security release fixing an LDAP injection vulnerability in the auth.ldap module, tracked as CVE-2026-40193, which could be used to extract directory information including password hashes and authorization data. Anyone authenticating against LDAP needs this one; the release also fixes dependency cycles when loading config.

    View source ↗
  6. 7mo ago

    maddy 0.9.2 fixes an rspamd panic on unspecified tls_client

    A single-fix release issued two minutes after 0.9.1 to repair the rspamd integration that release broke. It changes nothing else, and exists only because the tls_client directive definition landed wrong.

    View source ↗