Service Provider Edition features are available with SecurityGateway for MSPs licensing (https://mdaemon.com/pages/security-gateway-msp). Release note entries for these features are prefixed with "(Service Provider Edition)".
SG-On-Behalf-Of request header to the API. A global
administrator API key can run a request as another user, identified by email address
or user ID, so an integration acting for a customer is subject to that customer's
permissions and provisioning limits instead of the key's full administrative access.
FirebirdEventAlertIntervalHours, sets the
minimum hours between these emails (default 24); 0 disables the email while
leaving the dashboard warning in place.
My Account > Settings page, where
quarantine report preferences are managed.
My Account > Settings page
having no effect.
Templates\StyleSheets\themes is added to the theme list without restarting
SecurityGateway.
Setup / Users > Accounts > Administrators. A protected domain
administrator can only be managed, or removed from a domain, by a global administrator.
Can Create Domains permission inherit the protected administrators
and customer ID (API only) from the creator's home domain.
domain.
Many spam bots send EHLO domain instead of a real hostname. This new
default helps stop those connections earlier in the SMTP conversation. It is added
automatically on new installations and during upgrades.
The web interface has been updated with a cleaner layout, improved visual hierarchy, and a more polished overall look. The default light and dark themes have both been refreshed. Mobile browsers are better supported, particularly on the dashboard page. A new classic theme is available for users who prefer an experience closer to earlier versions.
SecurityGateway now includes a standard, OpenAPI-described REST/JSON API that makes it easier to automate administration and connect the product to provisioning systems, identity platforms, and custom workflows.
Manage core objects: The API supports users, domains, domain aliases, administrators, API keys, server/domain/user settings, allowlists, blocklists, mail servers, verification sources, DKIM selectors, archive stores, Sieve content-filter scripts, IP Shield entries, Dynamic Screening entries, and webhook subscriptions, plus read-only performance counters.
Secure access with API keys: Administrators can create API keys
from Setup / Users > API Keys.
Built-in documentation: Machine-readable OpenAPI documentation is
available via the web server at /api/v1/openapi and can be imported
directly into tools such as Postman. Generated HTML documentation is available
on disk at /docs/api/api_openapi.htm or via the web server at
/api_openapi.html.
Compatibility note: The existing XML-RPC API remains available, but new automation should use the REST API. This is an initial release; more endpoints and capabilities will be added in future versions.
Global administrators can now control which product areas each domain administrator
may manage. Permissions are configured per administrator from the Edit Administrator
dialog. A new Default Domain Administrator Permissions page under
Setup/Users > Accounts > Default Administrator Permissions
defines starting permissions for new domain admins and can apply those defaults to
existing admins in bulk. Defaults can be overridden per domain.
Read-only access: Domain admins without permission to manage a feature area retain read-only access to it for their domains. Archiving and RMail™ are the exception. Rather than dropping to read-only, their pages are hidden entirely from domain administrators who lack permission to manage them. This preserves their behavior prior to 12.5 and lets providers who don't offer these features keep them out of view for their domain admins.
Delegation: The "Domain Admins (Delegation)" permission controls whether a domain administrator can create or manage other administrators for their domains. A domain admin cannot grant a permission they do not themselves hold.
Upgrade behavior: All feature areas available to domain administrators prior to this version remain enabled by default for existing domain admins after upgrading.
Dynamic Screening has been extended with additional controls for how failed
authentication attempts are tracked and blocked.
Configure under Security > Anti-Abuse > Dynamic Screening.
Flexible timing: Block durations and tracking windows can now be set in minutes, hours, or days.
Escalating block duration: A repeat-offense multiplier can extend block duration on subsequent violations without changing the base rule.
Subnet-level blocking: Optional CIDR aggregation blocks a wider network range when attacks originate from many nearby IP addresses.
Duplicate failure suppression: Failures that repeat the same password can be excluded from the failure count, reducing unnecessary blocking from cached credentials while still counting distinct failures.
Domains using Google Workspace can now verify local users through the Google Workspace API
instead of SMTP callbacks. The integration resolves aliases and uses a Google Cloud service
account and OAuth 2.0. Configure under Setup / Users > Accounts > User Verification Sources.
Attachment Filtering rules can now match on detected file type in addition to, or
instead of, file extension. Configure under
Security > Filtering > Attachments.
SecurityGateway can now detect attachments whose actual file type does not match
their file extension (for example, an executable renamed to .pdf).
Mismatched attachments can be refused, quarantined, or accepted, with optional
subject tagging and score adjustment. Configure under
Security > Filtering > Attachment Disguise.
Global administrators can now allow selected domain administrators to edit the
Max Users value for their domains. Domain administrators cannot lower the limit
below the domain's current user count. An operator setting can require domain
administrators to set a user limit when creating new domains and, when enabled,
also prevents them from removing a domain's existing user limit. An optional
confirmation, disabled by default, warns domain administrators that increasing the
user limit may affect billing. These domain administrator billing options are available under
Setup / Users > Accounts > Administrators > Options.
SecurityGateway now notifies the affected domain's administrators when the domain
reaches 75%, 90%, or 100% of its configured Max Users limit. Administrators can turn
these notices on or off from
Setup / Users > Accounts > Administrators > Options.
Quarantine reports, administrator alerts, secure message notifications, 2FA verification emails, low disk space warnings, and other system-generated messages now use a consistent branded email layout with clearer action buttons and improved mobile readability.
Setup / Users > Accounts > Domain Creation (off by default), newly created
domains enter a pending state and do not accept mail until the owner publishes a TXT record
at _sgverify.<domain> with the token shown on the domain edit page.
Verification runs on demand from the domain edit page or POST /api/v1/domains/{id}/verify,
and hourly in the background. A new domain.verified webhook event fires on success. Global
administrators can skip verification per-domain when creating a domain.
sethttpport,
disablehttpsredirect, disabletfa, disablerequiretfa,
and disablelocationscreening.
Setup / Users > System > PROXY Protocol.
Archiving > Failed Messages, and linking directly to that view after
login.
Security > Allowlists > Configuration, with per-domain overrides
correctly honored.