MDaemon Server v23.5 Release Notes

MDaemon 23.5.2 - January 30, 2024

SPECIAL CONSIDERATIONS

[16456] Hosted email options with MDaemon Private Cloud are now available. To learn more, please visit: https://mdaemon.com/pages/mdaemon-email-msp.

CHANGES AND NEW FEATURES

WEBMAIL

• [5759] Changed the server to no longer load unsubscribed folders when HideUnsubscribedFolders=Yes for the user. The unsubscribed folders will be loaded for the Settings | Folders page.
• [27164] Pro theme - users can now click on the current folder, and it will reload the list view. All contacts, and all documents views will be turned off.
• [27429] Pro theme - Added the "Advanced Compose" setting at Settings | Compose. When enabled, the CC and BCC fields will always be visible in the Compose view.
• [27454] Added client side logging for device authentication failures.

OTHER

• [22209] IMAP Server - Added support for the ID extension (RFC 2971). It is enabled by default. To disable it, edit \MDaemon\App\MDaemon.ini and set [Special] EnableIMAPID=No. If the option to hide software version information is enabled, the MDaemon version is only disclosed after authentication.
• [27500] SMTP Server - To prevent inbound SMTP smuggling, MDaemon now requires message data to end with <CRLF>.<CRLF>. Previously, it would allow <LF>.<LF>. To disable this, edit \MDaemon\App\MDaemon.ini and set [Special] SMTPRequireCRLFdotCRLF=No.
• [27507] SMTP Server - To prevent outbound SMTP smuggling, MDaemon by default removes bare <CR> characters from messages. To disable this, edit \MDaemon\App\MDaemon.ini and set [Special] SMTPAllowBareCR=Yes.

FIXES

• [27473] fix to ActiveSync - When sending a mail fails due to an improperly formatted recipient address, the message is left in the temp queue
• [27350] fix to Pro theme - reminders from an instance of a recurring event that differ from the series are never delivered
• [27358] fix to Pro theme - "Shared Folders" and "Public Folders" show up and order of folders is incorrect
• [23625] fix to Pro theme - Inline images sent from Pro theme may not show up when using IIS
• [27420] fix to Pro theme - The correct signature value given for the default email address is not displayed on load
• [27427] fix to Webmail - Published appointment scheduler treats events marked Free as Busy
• [27410] fix to SpamAssassin - envelope_sender_header set to wrong value in local.cf
• [27060] fix to ActiveSync - Issue with message flags in multi-account Outlook profiles when Reading Pane is enabled
• [27477] fix to possible crash in WebAdmin.dll and WorldClient.dll
• [26730] fix to Let's Encrypt - The list of alternate hostnames is truncated when performing a certificate request
• [27474] fix to SpamAssassin - blocklist rules scored twice
• [27488] fix to Webmail - Schedule sometimes shows incorrect availability
• [27461] fix to MDRA - In multiple queues, clicking Learn Spam or Learn Non-Spam generates this error: URL variable [File] not found
• [27356] fix to Pro theme - Delete All Attachments button is available when the user does not have delete permissions
• [27486] fix to possible crash in MdMbSrch.dll
• [27475] fix to possible crash in MDAirSync.dll
• [27514] fix to messages being scanned by AV even when the IP is excluded
• [27497] fix to Spam Filter files not fully updated to say "Welcomelist" instead of "Whitelist"
• [27509] fix to Cluster Service - Failure to add Secondary Cluster nodes due to error retrieving Join Timestamp
• [27523] fix to SPF records that use "include:domain.com." are not evaluated properly
• [27545] fix to ActiveSync - PIM item changes not being sent to clients until cached data times out
• [27552] fix to MDRA - unable to assign a moderator to a mailing list

MDaemon 23.5.1 - November 29, 2023

CHANGES AND NEW FEATURES

WEBMAIL

• [27139] Pro theme - Publish Schedule - Added optional location and comment fields that will be included in any event created through the schedule page.
• [27248] Pro theme - Improved the organization of the Folder Actions page.
• [27169] The WebAuthn feature on the 2FA page now automatically starts the authentication process when WebAuthn is the only option.

ANTIVIRUS

• [26323] AV log will log attachment file names.
• [27283] IMAP server excludes trusted IPs from virus scanning when option is enabled.
• [27414] Turned off HTTPS for Outbreak Protection due to possible crashes.

FIXES

• [26956] fix to ActiveSync - Performance issues when servicing 4000+ clients
• [27240] fix to AntiVirus - AV Updater screen shows 0 for IKARUS signature version
• [27241] fix to ActiveSync and Autodiscover servers and MDPGP do not hide software version information by default
• [27247] fix to possible crash in DynScrn.dll related to Location Screening
• [27228] fix to WorldClient theme - When you right-click a contact and click Send vCard, the VCF file is not attached to the new message
• [27251] fix to Webmail - Verification email has lines longer than some email servers will allow.
• [27250] fix to MDRA - Enabling/Disabling Greylisting leaves the Save button greyed out
• [27254] fix to Webmail - When publicly publishing your calendar, the hyperlink does not work
• [27261] fix to Pro theme - Drafts are not auto saved if the user's most recent keystroke is a space
• [27200] fix to Webmail - When viewing an MS Teams invitation, there are broken links found at the bottom of the message
• [27264] fix to Pro theme - Category colors missing from the category selection page
• [27267] fix to mailing list subscription reminder emails are missing a Message-ID header and are not DKIM signed
• [27287] fix to incorrect text in message logged to Windows event log after AV or Spam Filter timeout
• [27294] fix to MDRA - landing page links for Spam Filter | Blocked senders, Allowed senders are incorrect, and blocklist_from is being prepended with blacklist_from
• [27276] fix to MDSpamD leaving temp folder after shutting down
• [27140] fix to possible ClamAV/CFengine hang
• [23754] fix to Content Filter copy user action places message in wrong queue
• [27334] fix to Webmail - Two Factor Auth Setup on sign-in - Options are not displayed correctly
• [27347] fix to Pro theme - Reminders are not saved correctly until the user changes the default reminder
• [27141] fix to Pro theme - When replying to emails with large bodies the reply window is very slow
• [27359] fix to Webmail - Setting up 2FA using an authenticator app is not working
• [27355] fix to MDaemon may generate extra meeting invitations when it processes an invitation to the meeting organizer
• [27372] fix to ActiveSync - Unable to re-schedule meeting when using WindowsOutlook15
• [27284] fix to MDRA - Accounts created using deleted mailing lists addresses are still treated as mailing lists
• [27242] fix to Pro theme - A blank window is displayed when clicking a mailto link
• [27223] fix to Webmail - Filters - The OK button is barely visible when selecting a custom header
• [27352] fix to MDRA - Learn Spam button in Spam Trap Queue menu does not work
• [27286] fix to performance counter for ActiveSync server state is 0 until the MD GUI is opened
• [27335] fix to accepting a meeting invitation in eM Client results in a duplicate event being added to the user's calendar
• [27311] fix to Header Translation - When translating forwarded messages, the X-Return-Path and X-MDRedirect_From headers are unchanged
• [27033] fix to Dynamic Screening - Unable to disable "Attempted AUTH on port with AUTH disabled" notifications
• [27008] fix to MDaemon allows creation of mailing lists with accented characters
• [26938] fix to Installer - possible "There was a problem encountered. This program will exit." popup when updating
• [27384] fix to CalDAV - Tasks do not support attachments
• [27014] fix to DSN messages disclose the MDaemon version when "Hide software version identification" is enabled
• [27383] fix to ActiveSync - unable to open shared calendar folder until the folder owner has used ActiveSync
• [27387] fix to possible crash in MDaemon.exe
• [27389] fix to CardDAV - The contact "office" field is not synchronized
• [23785] fix to CalDAV - Attendee properties in VTODO data uploaded via CalDAV are not persisted
• [23786] fix to CalDAV - Location property in VTODO data uploaded via CalDAV is not persisted
• [27390] fix to CardDAV - IM Address type is lost and IM addresses are duplicated when synchronized with eM Client
• [27399] fix to CardDAV - Business/Home Website contact fields are not synchronized with eM Client
• [27406] fix to CardDAV - Children contact field is not synchronized with eM Client
• [27402] fix to ClamAV reporting "Heuristics.Limits.Exceeded.MaxFileSize" as infected instead of non-scan
• [27401] fix to MDaemon GUI - Webmail Enable Password Recovery setting is not honored. Enable Password Recovery is now a domain level setting and enabled by default.
• [27419] fix to duplicate reminders are created for a recurring event with multiple reminders

MDaemon 23.5.0 - September 26, 2023

CHANGES AND NEW FEATURES

WEBMAIL

• [26455] Added a Public Schedule option, so that users can allow others to schedule a meeting.
• [20285] Added support for WebAuthn (formerly FIDO U2F) as a passwordless authentication method or as a Two Factor Auth method.
• [26890] Pro theme - Added AI based functionality to summarize a message, suggest a reply, and improve an email being composed by the user. This feature submits message data to openai.com, so please be cautious about the information you submit.
  Webmail's AI message features are disabled by default for all domains. They can be enabled by checking "Enable AI message features" in the MD GUI at Setup | Webmail & IM Services | Webmail | Settings and the Domain Manager's Webmail screen, or in MDRA at Main | Webmail Settings | Settings and Main | Domain Manager | Webmail Settings.
  Webmail's AI message features are disabled per user by default. You can enable them as part of a Group controlled by an Account Template or per user. The Domain setting takes precedence over the user setting. If it is disabled on the Domain level, then enabling it on the Group or user level does nothing. If the feature is disabled, the WCAPI will return a 404 Not Found error.
• [26604] Made some visual updates to Pro theme.
• [26612] Added a warning message on the login screen when the caps lock is turned on.
• [26603] Updated CKEditor to v4.20.1.
• [15742] Added an option in webmail to hide the "Help" link on the login page. Add HideLoginHelp=Yes to the MDaemon/WorldClient/Domains.ini [Default:Settings] or [%DOMAIN%:Settings] section to hide the link.
• [26283] Separated Two Factor Auth email verification from authenticator app verification.
• [26822] Password Recovery feature now sends an email without revealing to the user where the email was sent. Two Factor Auth occurs after clicking the recovery link in the email.
• [6358] Pro theme - Added a dialog on the Compose view contact picker for adding a contact with three fields (Name, Email, Mobile Phone).
• [26896] Changed how Webmail authenticates to MDaemon's SMTP server so the user's password is not needed.
• [26196] Added an option to delete all attachments from a given message in the WorldClient and Pro themes.
• [26755] Pro theme - Updated the Tiny Editor to not include the path information.
• [26756] Pro theme - Reduced the size of the first letter/checkbox in the mail list for desktop sizes.
• [26757] Pro theme - Added new Style options at Settings | Personalize.
• [22045] Pro theme - Added a total new messages count, and current folder unread count badge for less than 992px browser widths.
• [25239] Webmail will now by default use STARTTLS when sending mail to MDaemon via SMTP. It can also be configured to use port 465 and implicit TLS. To change this, edit \MDaemon\WorldClient\Domains.ini and set [Default:Settings] SmtpPort, SmtpUseImplicitTLS, SmtpUseStartTLS, and SmtpRequireTLS.
• [13171] Webmail - Added an option to "Mark deleted messages as read" at Settings | Personalize.
• [9698] Pro and WorldClient themes - Added a Description column to the Documents view.
• [9694] Added an All Documents toggle button in the Documents view.
• [27039] Changed the compose <P> replacement from <DIV> to <BR> + <DIV>.
• [21515] Pro theme - Added support for multiple event reminders.

REMOTE ADMINISTRATION (MDRA)

• [26416] Added editor GUIs for all direct edit files.
• [9854] Added a button to hide any given chart in the Traffic and Mailboxes summary pages. Once hidden, charts can be displayed in the current user settings (top right) or by click the related button.
• [26152] Added a warning message below the password field when the caps lock is turned on.
• [26622] Made some modernizing updates to the list views.
• [26603] Updated CKEditor to v4.20.1.
• [16189] Added a "Delete All" button to the Mailing List Members page.
• [26840] Added support for WebAuthn (formerly FIDO U2F) as a passwordless authentication method or as a Two Factor Auth method.
• [16112] Added the ability to choose a folder to nest under in the public folder and shared folder editors.
• [20672] Added a note that a user might show as a member of a mailing list due to membership in a Group.
• [24788] Added the ability to view the email message as a user would see it in addition to being able to view the source in the Message Search and Queues. RAW messages are still only in text/plain.
• [26868] Added links to the Queues on the Status page.
• [12637] Added the ability to include multiple addresses on the public folder access control page, but only for New rights.
• [27032] Added a Health Check page at Security | Health Check, which allows global admins to see all the important security settings values and compare them with the default values. Admins can also select multiple settings to change to the default value or click a link to go to the page where the setting is located. In addition, admins can undo the most recent change made on the page, or view previous changes made during the current browser session and undo specific changes.

SECURITY

• [27183] Updated ClamAV to 1.0.3.
• [26599] Added HTTPS support for Outbreak Protection.
• [26898] Updated SpamAssassin to 4.0.0.

XMLAPI

• [26893] Added MDaemon Connector management.
• [25484] Added administrative user interface for the XMLAPI service.
• [21264] Added SPF management.
• [26688] Added Bandwidth Throttling management.
• [26668] Added IPShield management.
• [26660] Added Site Policy management.
• [26655] Added DNSBL management.
• [26640] Added Spam Honeypot management.
• [26558] Added Hijack Detection management.
• [26557] Added Recipient Block management.
• [26556] Added Spambot Detection management.
• [26555] Added SMTP Screen management.
• [26554] Added Location Screen management.
• [21266] Added IPScreen management.
• [21265] Added HostScreen management.
• [19297] Added Sender Block management.
• [26808] Added 'Mark all as read' feature to 'FolderOperation'.
• [26580] The FolderOperation 'list' action returns IMAP flags for mail folders.
• [27101] Added API functions/methods to update an existing Dynamic Screening Allow/Block/Gateway list entry.
• [27076] Added more detailed warnings and error messages to API clients.

OTHER

• [26930] Added option at Accounts | Account Settings | Other | Passwords for whether to delete an account's app passwords when the account's password is changed. It's enabled by default.
• [14327] Added Restrictions to the Account Templates. When an account is removed from a group with an account template that controls restrictions, the account's restrictions revert to their previous values, or possibly to another group's account template if the account is a member of multiple groups.
• [19656] The Location Screening option "SMTP connections are accepted but authentication is blocked" is now per country instead of global. Blocking SMTP connections prevents your server from receiving mail from a country. Allowing SMTP connections with authentication disabled lets your server receive mail from a country while blocking brute force / dictionary attacks from them. Configure this at Security | Security Manager | Screening | Location Screening. Protocols other than SMTP are not affected.
• [26791] MDaemon ignores CRYPT_E_NO_REVOCATION_CHECK errors when validating remote servers' SSL certificates.
• [25888] Removed obsolete "Compose in new browser window" Webmail option from the UI.
• [26996] Dynamic Screening - Added single record Get API functions for DS Block and Allow records: HrDSGetBlackItem and HrDSGetWhiteItem. See DynScrn.h for additional information.
• [27100] Dynamic Screening - Added API functions/methods to update an existing Allow/Block/Gateway list entry. (ie. Change Expiration, Comment, etc.)
• [27099] Dynamic Screening - Spam Honeypot trigger address is included in the comment when blocking an IP address.
• [27102] ActiveSync - Logging for Dynamic Screening Access Denied now includes the reason (blocklist, location screening, policy violation).
• [26336] LetsEncrypt - Added support for TLS 1.3.

FIXES

• [26567] fix to Webmail - SendCode link does not work on the Two Factor Auth verification page
• [26569] fix to Webmail - Compose attach view reloads the folders
• [26618] fix to Pro theme - "List refresh time" setting not being honored
• [26664] fix to Pro theme - With Voice Recorder disabled, you can still access it using the Pro theme via HTTPS
• [26683] fix to Pro theme - Use APOP displays as true in Mailboxes where it is false
• [26706] fix to WorldClient theme - "Do not ask me again" option is missing the checkbox in confirmation popups
• [26693] fix to Pro theme - Dropbox reconnect account statement appearing for all OAuth connections
• [26758] fix to Pro theme - Unsubscribe by email opens a blank page
• [26766] fix to MDRA - Unable to add IPv6 address with CIDR notation to Dynamic Screening Allow or Block lists
• [26776] fix to MDRA - Unable to delete an account via Domain Manager
• [26784] fix to Pro theme - Some non-ASCII characters are HTML encoded in Notes, Tasks, Contacts, and Event bodies
• [26787] fix to Pro theme - Error when changing the text of the default signature when using a non-English language
• [25049] fix to MDRA - Security | Content Filter | Compression, Unchecking used fixed archive name should disable the input field for the archive name
• [26819] fix to MDRA - "Current password" not being translated
• [26828] fix to Pro theme - Google Drive folders do not show up immediately after setup is completed
• [26829] fix to Webmail vulnerability
• [26841] fix to MDRA - Both Add Email Address and Replace Mismatched Email can be enabled when only one should be able to be selected
• [26883] fix to Pro theme - Shared documents not allowing files to be downloaded
• [26589] fix to Pro theme - Cannot edit an occurrence of a recurring event on small screen sizes
• [26831] fix to Pro theme - Folders containing non-ASCII characters are not displayed correctly
• [26891] fix to MDRA - Unable to see secondary drive when editing an account's mailbox path - it only displays the C: drive
• [26919] fix to Pro theme - Weekly recurring event does not default to the day of the week for the date of the event
• [26762] fix to MDaemon - Message is not sent to custom queue host name when a global smart host is set
• [26739] fix to MDaemon - SPF verification exemption domain name not applied in SPF records with redirects
• [26714] fix to MDRA - Unable to open file error after clicking "Edit Mailing List Admins" button
• [26711] fix to MDRA - Enable mailing list subscriptions manager option re-enables after restart
• [26701] fix to MDaemon - Failure to send outbound messages when sending restriction exception is used and To header exceeds 255 characters
• [26504] fix to MDaemon - Minger lookup fails when address doesn't exist and is set as a public folder submission address
• [25932] fix to MDaemon - Bandwidth throttling is not applied to LAN domains and IPs
• [26984] fix to MDaemon - Requeing a message releases the message instead
• [25706] fix to MDaemon - Domain and account signatures may be added to messages collected via DomainPOP and MultiPOP
• [26993] fix to MDaemon - Messages released from quarantine are not processed by account IMAP filters
• [27005] fix to MDRA - fusion charts are not showing up as dark when dark mode is enabled
• [25399] fix to MDaemon Server - Success DSN not sent for messages that use a route slip
• [27011] fix to MDRA - show password toggle and notification edit icons have poor contrast in Dark Mode
• [25366] fix to MDaemon - wrong characters in messages such as autoresponders for Latvian and other languages, by changing the charset for auto generated messages from iso-8859-1 to utf-8
• [27040] fix to Webmail - App Passwords list does not show up when 2FA is required, 2FA is enabled and the user uses 2FA Remember Me to sign-in
• [27046] fix to Webmail - Cannot delete Notes from the note list in some themes
• [27018] fix to process holding queue after each AV signature update not working with Ikarus AV
• [27047] fix to WorldClient theme - recurring month interval input field is missing in the calendar editor
• [27045] fix to MDRA - Wrong dialog shows up in Message Search view if user has been to the Account Manager recently
• [27058] fix to MDRA - Clicking the type of search on the Messages and Queues landing page checks that type of search on the page
• [27050] fix to LetsEncrypt not correctly processing requests with no alternate hosts
• [27062] fix to SPF - Failure to match DNS record that contains macros when using IPv6
• [26994] fix to ASLogView.exe - command line parameters not functioning as expected
• [26986] fix to Cluster Service - Slow Primary shutdown
• [26990] fix to Cluster Service - Slow Secondary shutdown
• [26594] fix to XMLAPI - List Management operations do not enforce security
• [26578] fix to XMLAPI - UpdateUser AutoResponder only updates if DaysActive is specified
• [27054] fix to ActiveSync - Global/Domain Virtually Merge public contacts option does not work
• [27079] fix to IKARUS AV sometimes fails to scan the first message when scanserver service starts
• [27089] fix to message body search not finding Chinese text
• [27090] fix to Pro theme - "Unable to evaluate: SESSIONID" error in Webmail logs
• [27067] fix to WorldClient theme - When creating a task in a new Tasks folder and then changing the Complete value, duplicate entries are displayed in the list
• [26995] fix to Webmail - With public contacts set as the default view, adding a contact from within a message stores the contact in the public contacts folder
• [27091] fix to Webmail - When the UserOverrides:Theme is set to Pro then trying to access any other theme causes the page to reload over and over instead of sending the user to the Pro theme
• [22855] fix to Webmail - Using the All Unread saved search, certain messages do not stay marked as read
• [24096] fix to Pro theme - Adding event to second calendar in side-by-side view does not select the right calendar
• [25428] fix to LookOut theme - Incorrect behavior occurs when checking/unchecking the "Complete" checkbox
• [24421] fix to Webmail - Unable to create a new shared or public folder under a hidden folder
• [27029] fix to MDRA - "Today Only" button does not work with a date format other than MM/DD/YYYY
• [27113] fix to account settings not returning to New Accounts template settings when removed from a group using an account template
• [27131] fix to Pro theme - Current calendar not selected when creating a new event
• [27159] fix to Pro theme - Link in Signature or message body changed to relative path
• [27163] fix to Pro theme - Selected signature not being used when composing
• [27186] fix to possible crash in WorldClient.dll
• [27194] fix to issues when logging in to Webmail without full email address when using Two Factor Auth
• [27198] fix to Pro theme - clicking the expand button results in a duplicate of the top level message