Global administrators can now allow selected domain administrators to edit the Max Users value for their domains. Domain administrators cannot lower the limit below the domain's current user count. An operator setting can require domain administrators to set a user limit when creating new domains and, when enabled, also prevents them from removing a domain's existing user limit. An optional confirmation, disabled by default, warns domain administrators that increasing the user limit may affect billing. These domain administrator billing options are available under Setup / Users > Accounts > Administrators > Options.
SecurityGateway now notifies the affected domain's administrators when the domain
reaches 75%, 90%, or 100% of its configured Max Users limit. Administrators can turn
these notices on or off from
Setup > Users > Accounts > Administrators > Options.
Quarantine reports, administrator alerts, secure message notifications, 2FA verification emails, low disk space warnings, and other system-generated messages now use a consistent branded email layout with clearer action buttons and improved mobile readability.
domain.
Many spam bots send EHLO domain instead of a real hostname. This new
default helps stop those connections earlier in the SMTP conversation. It is added
automatically on new installations and during upgrades.
The web interface has been updated with a cleaner layout, improved visual hierarchy, and a more polished overall look. The default light and dark themes have both been refreshed. Mobile browsers are better supported, particularly on the dashboard page. A new classic theme is available for users who prefer an experience closer to earlier versions.
SecurityGateway now includes a standard, OpenAPI-described REST/JSON API that makes it easier to automate administration and connect the product to provisioning systems, identity platforms, and custom workflows.
Manage core objects: The API supports users, domains, domain aliases, administrators, API keys, server/domain/user settings, allowlists, blocklists, mail servers, verification sources, DKIM selectors, archive stores, Sieve content-filter scripts, IP Shield entries, Dynamic Screening entries, and webhook subscriptions, plus read-only performance counters.
Secure access with API keys: Administrators can create API keys
from Settings > API Keys.
Built-in documentation: Machine-readable OpenAPI documentation is
available via the web server at /api/v1/openapi and can be imported
directly into tools such as Postman. Generated HTML documentation is available
on disk at /docs/api/api_openapi.htm or via the web server at
/api_openapi.html.
Compatibility note: The existing XML-RPC API remains available, but new automation should use the REST API. This is an initial release; more endpoints and capabilities will be added in future versions.
Global administrators can now control which product areas each domain administrator
may manage. Permissions are configured per administrator from the Edit Administrator
dialog. A new Default Domain Administrator Permissions page under
Setup/Users > Accounts > Default Administrator Permissions
defines starting permissions for new domain admins and can apply those defaults to
existing admins in bulk. Defaults can be overridden per domain.
Read-only access: Domain admins without permission to manage a feature area retain read-only access to it for their domains. Archiving and RMail™ are the exception. Rather than dropping to read-only, their pages are hidden entirely from domain administrators who lack permission to manage them. This preserves their behavior prior to 12.5 and lets providers who don't offer these features keep them out of view for their domain admins.
Delegation: The "Domain Admins (Delegation)" permission controls whether a domain administrator can create or manage other administrators for their domains. A domain admin cannot grant a permission they do not themselves hold.
Upgrade behavior: All feature areas available to domain administrators prior to this version remain enabled by default for existing domain admins after upgrading.
Dynamic Screening has been extended with additional controls for how failed
authentication attempts are tracked and blocked.
Configure under Security > Anti-Abuse > Dynamic Screening.
Flexible timing: Block durations and tracking windows can now be set in minutes, hours, or days.
Escalating block duration: A repeat-offense multiplier can extend block duration on subsequent violations without changing the base rule.
Subnet-level blocking: Optional CIDR aggregation blocks a wider network range when attacks originate from many nearby IP addresses.
Duplicate failure suppression: Failures that repeat the same password can be excluded from the failure count, reducing unnecessary blocking from cached credentials while still counting distinct failures.
Domains using Google Workspace can now verify local users through the Google Workspace API
instead of SMTP callbacks. The integration resolves aliases and uses a Google Cloud service
account and OAuth 2.0. Configure under Setup > Verification Sources.
Attachment Filtering rules can now match on detected file type in addition to, or
instead of, file extension. Configure under
Security > Filtering > Attachments.
SecurityGateway can now detect attachments whose actual file type does not match
their file extension (for example, an executable renamed to .pdf).
Mismatched attachments can be refused, quarantined, or accepted, with optional
subject tagging and score adjustment. Configure under
Security > Filtering > Attachment Disguise.
Setup > Server > Domain Settings (off by default), newly created
domains enter a pending state and do not accept mail until the owner publishes a TXT record
at _sgverify.<domain> with the token shown on the domain edit page.
Verification runs on demand from the domain edit page or POST /api/v1/domains/{id}/verify,
and hourly in the background. A new domain.verified webhook event fires on success. Global
administrators can skip verification per-domain when creating a domain.
Setup > System > PROXY Protocol.
Archiving > Failed Messages, and linking directly to that view after
login.
Security > Allowlists > Configuration, with per-domain overrides
correctly honored.