Merge branch 'staging' into feat/new-imapsync

2026-08-19 13:33:19 +00:00 · 2026-08-19 09:01:47 +02:00
parent 17d20599a7 d80b15b06c
commit 161f763b6c
56 changed files with 555 additions and 221 deletions
@@ -14,7 +14,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Mark/Close Stale Issues and Pull Requests 🗑️
-        uses: actions/stale@v10.3.0
+        uses: actions/stale@v11.0.0
        with:
          repo-token: ${{ secrets.STALE_ACTION_PAT }}
          days-before-stale: 60
@@ -27,7 +27,7 @@ jobs:
          - "watchdog-mailcow"
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
      - name: Setup Docker
        run: |
          curl -sSL https://get.docker.com/ | CHANNEL=stable sudo sh
@@ -8,11 +8,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Run the Action
-        uses: devops-infra/action-pull-request@v1.2.1
+        uses: devops-infra/action-pull-request@v1.4.0
        with:
          github_token: ${{ secrets.PRTONIGHTLY_ACTION_PAT }}
          title: Automatic PR to nightly from ${{ github.event.repository.updated_at}}
@@ -13,7 +13,7 @@ jobs:
      packages: write
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
@@ -15,7 +15,7 @@ jobs:
   runs-on: ubuntu-latest
   steps:
    - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7

    - name: Generate postscreen_access.cidr
      run: |
@@ -23,10 +23,15 @@ A big thank you to everyone supporting us on GitHub Sponsors—your contribution
  <a href="https://www.maehdros.com/" target=_blank><img
    src="https://avatars.githubusercontent.com/u/173894712" height="58"
  /></a>
+  <a href="https://garske-systems.de/" target=_blank><img
+    src="https://garske-systems.de/img/logo_min.png" height="58"
+  /></a>

 ### 50$/Month Sponsors
  <a href="https://github.com/vnukhr" target=_blank><img
    src="https://avatars.githubusercontent.com/u/7805987?s=52&v=4" height="58"
+  /></a><a href="https://github.com/humiico" target=_blank><img
+    src="https://avatars.githubusercontent.com/u/110134705?s=52&v=4" height="58"
  /></a>

 ## Info, documentation and support
@@ -249,12 +249,33 @@ while true; do
  done <<< "${SQL_DOMAINS}"

  if [[ ${ONLY_MAILCOW_HOSTNAME} != "y" ]]; then
+  # Fetch all domains with an active MTA-STS policy once.
+  unset MTA_STS_ACTIVE_DOMAINS
+  declare -A MTA_STS_ACTIVE_DOMAINS
+  if [[ ${AUTODISCOVER_SAN} == "y" ]]; then
+    SQL_MTA_STS_DOMAINS=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT domain FROM mta_sts WHERE active = 1" -Bs)
+    if [[ $? -eq 0 ]]; then
+      while read mta_sts_domain; do
+        if [[ -z "${mta_sts_domain}" ]]; then
+          # ignore empty lines
+          continue
+        fi
+        MTA_STS_ACTIVE_DOMAINS["${mta_sts_domain}"]=1
+      done <<< "${SQL_MTA_STS_DOMAINS}"
+    fi
+  fi
  for SQL_DOMAIN in "${SQL_DOMAIN_ARR[@]}"; do
    unset VALIDATED_CONFIG_DOMAINS_SUBDOMAINS
    declare -a VALIDATED_CONFIG_DOMAINS_SUBDOMAINS
    for SUBDOMAIN in "${ADDITIONAL_WC_ARR[@]}"; do
      FULL_SUBDOMAIN="${SUBDOMAIN}.${SQL_DOMAIN}"

+      # Skip mta-sts subdomain unless MTA-STS is enabled (active) for this domain
+      if [[ "${SUBDOMAIN}" == "mta-sts" && -z "${MTA_STS_ACTIVE_DOMAINS[${SQL_DOMAIN}]}" ]]; then
+        log_f "MTA-STS is not enabled for ${SQL_DOMAIN} - skipping mta-sts subdomain certificate"
+        continue
+      fi
+
      # Skip if subdomain matches MAILCOW_HOSTNAME
      if [[ "${FULL_SUBDOMAIN}" == "${MAILCOW_HOSTNAME}" ]]; then
        continue
@@ -1,7 +1,7 @@
-FROM alpine:3.21 AS builder
+FROM alpine:3.24 AS builder

 WORKDIR /src
-ENV CLAMD_VERSION=1.4.2
+ENV CLAMD_VERSION=1.4.6

 RUN apk upgrade --no-cache \
  && apk add --update --no-cache \
@@ -68,7 +68,7 @@ RUN wget -P /src https://www.clamav.net/downloads/production/clamav-${CLAMD_VERS
  "/clamav/etc/clamav/clamav-milter.conf.sample" > "/clamav/etc/clamav/clamav-milter.conf" || exit 1


-FROM alpine:3.21
+FROM alpine:3.24

 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"

@@ -1,4 +1,4 @@
-FROM nginx:1.30.2-alpine
+FROM nginx:1.30.4-alpine
 LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>"

 ENV PIP_BREAK_SYSTEM_PACKAGES=1
@@ -7,13 +7,13 @@ ARG APCU_PECL_VERSION=5.1.28
 # renovate: datasource=github-tags depName=Imagick/imagick versioning=semver-coerced extractVersion=(?<version>.*)$
 ARG IMAGICK_PECL_VERSION=3.8.1
 # renovate: datasource=github-tags depName=php/pecl-mail-mailparse versioning=semver-coerced extractVersion=^v(?<version>.*)$
-ARG MAILPARSE_PECL_VERSION=3.1.9
+ARG MAILPARSE_PECL_VERSION=3.2.0
 # renovate: datasource=github-tags depName=php-memcached-dev/php-memcached versioning=semver-coerced extractVersion=^v(?<version>.*)$
 ARG MEMCACHED_PECL_VERSION=3.4.0
 # renovate: datasource=github-tags depName=phpredis/phpredis versioning=semver-coerced extractVersion=(?<version>.*)$
 ARG REDIS_PECL_VERSION=6.3.0
 # renovate: datasource=github-tags depName=composer/composer versioning=semver-coerced extractVersion=(?<version>.*)$
-ARG COMPOSER_VERSION=2.9.5
+ARG COMPOSER_VERSION=2.10.2

 RUN apk add -U --no-cache autoconf \
  aspell-dev \
@@ -1,17 +1,17 @@
-FROM golang:1.25-bookworm AS builder
+FROM golang:1.26-trixie AS builder
 WORKDIR /src

 ENV CGO_ENABLED=0 \
    GO111MODULE=on \
 		NOOPT=1 \
-    VERSION=1.8.22
+    VERSION=1.11.0

 RUN git clone --branch v${VERSION} https://github.com/Zuplu/postfix-tlspol && \
    cd /src/postfix-tlspol && \
    scripts/build.sh build-only


-FROM debian:bookworm-slim
+FROM debian:trixie-slim
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"

 ARG DEBIAN_FRONTEND=noninteractive
@@ -1,4 +1,4 @@
-@version: 3.38
+@version: 4.8
@include "scl.conf"
 options {
  chain_hostnames(off);
@@ -7,7 +7,7 @@ options {
  dns_cache(no);
  use_fqdn(no);
  owner("root"); group("adm"); perm(0640);
-  stats_freq(0);
+  stats(freq(0));
  bad_hostname("^gconfd$");
 };
 source s_src {
@@ -1,4 +1,4 @@
-@version: 3.38
+@version: 4.8
@include "scl.conf"
 options {
  chain_hostnames(off);
@@ -7,7 +7,7 @@ options {
  dns_cache(no);
  use_fqdn(no);
  owner("root"); group("adm"); perm(0640);
-  stats_freq(0);
+  stats(freq(0));
  bad_hostname("^gconfd$");
 };
 source s_src {
@@ -1,4 +1,4 @@
-FROM debian:bookworm-slim
+FROM debian:trixie-slim

 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"

@@ -1,4 +1,4 @@
-@version: 3.38
+@version: 4.8
@include "scl.conf"
 options {
  chain_hostnames(off);
@@ -7,7 +7,7 @@ options {
  dns_cache(no);
  use_fqdn(no);
  owner("root"); group("adm"); perm(0640);
-  stats_freq(0);
+  stats(freq(0));
  bad_hostname("^gconfd$");
 };
 source s_src {
@@ -1,4 +1,4 @@
-@version: 3.38
+@version: 4.8
@include "scl.conf"
 options {
  chain_hostnames(off);
@@ -7,7 +7,7 @@ options {
  dns_cache(no);
  use_fqdn(no);
  owner("root"); group("adm"); perm(0640);
-  stats_freq(0);
+  stats(freq(0));
  bad_hostname("^gconfd$");
 };
 source s_src {
@@ -2,7 +2,7 @@ FROM debian:trixie-slim
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"

 ARG DEBIAN_FRONTEND=noninteractive
-ARG RSPAMD_VER=rspamd_3.14.3-1~236eb65
+ARG RSPAMD_VER=rspamd_4.1.4-1~beb659b
 ARG CODENAME=trixie
 ENV LC_ALL=C

@@ -1,6 +1,6 @@
 # SOGo built from source to enable security patch application
 # Repository: https://github.com/Alinto/sogo
-# Version: SOGo-5.12.8
+# Version: SOGo-5.12.9
 #
 # Applied security patches:
 # -
@@ -12,8 +12,8 @@ FROM debian:bookworm
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"

 ARG DEBIAN_FRONTEND=noninteractive
-ARG SOGO_VERSION=SOGo-5.12.8
-ARG SOPE_VERSION=SOPE-5.12.8
+ARG SOGO_VERSION=SOGo-5.12.10
+ARG SOPE_VERSION=SOPE-5.12.10
 # Security patches to apply (space-separated commit hashes)
 ARG SOGO_SECURITY_PATCHES=""
 # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?<version>.*)$
@@ -32,8 +32,17 @@ function auth_password_verify(request, password)
  -- Returning PASSDB_RESULT_PASSWORD_MISMATCH will reset the user's auth cache entry.
  -- Returning PASSDB_RESULT_INTERNAL_FAILURE keeps the existing cache entry,
  -- even if the TTL has expired. Useful to avoid cache eviction during backend issues.
+
+  -- On a network-level failure (nginx unreachable, DNS failure, timeout) https.request
+  -- returns nil plus an error string, so c is not a numeric HTTP status code. Treat this
+  -- as a backend outage and keep the cache entry, rather than wiping it as a mismatch.
+  if type(c) ~= "number" then
+    dovecot.i_info("HTTP request to auth backend failed with " .. tostring(c) .. " for user " .. request.user)
+    return dovecot.auth.PASSDB_RESULT_INTERNAL_FAILURE, "Upstream unreachable"
+  end
+
  if c ~= 200 and c ~= 401 then
-    dovecot.i_info("HTTP request failed with " .. c .. " for user " .. request.user)
+    dovecot.i_info("HTTP request failed with " .. tostring(c) .. " for user " .. request.user)
    return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Upstream error"
  end

@@ -1,13 +1,3 @@
 # global_sieve_before script
 # global_sieve_before -> user sieve_before (mailcow UI) -> user sieve_after (mailcow UI) -> global_sieve_after

-require ["mailbox", "fileinto"];
-
-if header :contains ["Chat-Version"] [""] {
-  if mailboxexists "DeltaChat" {
-    fileinto "DeltaChat";
-  } else {
-    fileinto :create "DeltaChat";
-  }
-  stop;
-}
@@ -42,12 +42,19 @@ http {
        https https;
    }

+    map $server_port $sogo_auth_internal {
+        65510   "1";
+        default "";
+    }
+
    {% if HTTP_REDIRECT %}
    # HTTP to HTTPS redirect
    server {
        root /web;
        listen {{ HTTP_PORT }} default_server;
+        {% if ENABLE_IPV6 %}
        listen [::]:{{ HTTP_PORT }} default_server;
+        {%endif%}

        server_name {{ MAILCOW_HOSTNAME }} autodiscover.* autoconfig.* mta-sts.* {{ ADDITIONAL_SERVER_NAMES | join(' ') }};

@@ -116,6 +116,9 @@ location ~ \.php$ {
    include /etc/nginx/fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_param PATH_INFO $fastcgi_path_info;
+    fastcgi_param HTTP_X_REAL_IP $remote_addr;
+    # trusted internal-auth marker; empty for external clients (see nginx.conf map)
+    fastcgi_param SOGO_AUTH_INTERNAL $sogo_auth_internal;
    fastcgi_read_timeout 3600;
    fastcgi_send_timeout 3600;
 }
@@ -37,7 +37,7 @@ postscreen_access_list = permit_mynetworks,
  cidr:/opt/postfix/conf/postscreen_access.cidr,
  tcp:127.0.0.1:10027
 postscreen_bare_newline_enable = no
-postscreen_blacklist_action = drop
+postscreen_denylist_action = drop
 postscreen_cache_cleanup_interval = 24h
 postscreen_cache_map = proxy:btree:$data_directory/postscreen_cache
 postscreen_dnsbl_action = enforce
@@ -107,8 +107,6 @@ smtpd_sender_restrictions = reject_authenticated_sender_login_mismatch,
  reject_unknown_sender_domain
 smtpd_soft_error_limit = 3
 smtpd_tls_auth_only = yes
-smtpd_tls_dh1024_param_file = /etc/ssl/mail/dhparams.pem
-smtpd_tls_eecdh_grade = auto
 smtpd_tls_exclude_ciphers = ECDHE-RSA-RC4-SHA, RC4, aNULL, DES-CBC3-SHA, ECDHE-RSA-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA
 smtpd_tls_loglevel = 1

@@ -152,7 +150,7 @@ smtp_sasl_auth_enable = yes
 smtp_sasl_password_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_sasl_passwd_maps_sender_dependent.cf
 smtp_sasl_security_options =
 smtp_sasl_mechanism_filter = plain, login
-smtp_tls_policy_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_tls_policy_override_maps.cf socketmap:inet:postfix-tlspol:8642:QUERY
+smtp_tls_policy_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_tls_policy_override_maps.cf socketmap:inet:postfix-tlspol:8642:QUERYwithTLSRPT
 smtp_header_checks = pcre:/opt/postfix/conf/anonymize_headers.pcre
 mail_name = Postcow
 # local_transport map catches local destinations and prevents routing local dests when the next map would route "*"
@@ -29,7 +29,6 @@ smtps    inet  n       -       n       -       -       smtpd
 # TLS protocol can be modified by setting submission_smtpd_tls_mandatory_protocols in extra.cf
 submission inet n       -       n       -       -       smtpd
  -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
-  -o smtpd_enforce_tls=yes
  -o smtpd_tls_security_level=encrypt
  -o smtpd_tls_mandatory_protocols=$submission_smtpd_tls_mandatory_protocols
  -o tls_preempt_cipherlist=yes
@@ -38,7 +37,6 @@ submission inet n       -       n       -       -       smtpd
 10587      inet n       -       n       -       -       smtpd
  -o smtpd_upstream_proxy_protocol=haproxy
  -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
-  -o smtpd_enforce_tls=yes
  -o smtpd_tls_security_level=encrypt
  -o smtpd_tls_mandatory_protocols=$submission_smtpd_tls_mandatory_protocols
  -o tls_preempt_cipherlist=yes
@@ -1,6 +1,6 @@
-# Whitelist generated by Postwhite v3.4 on Fri May  1 00:43:37 UTC 2026
+# Whitelist generated by Postwhite v3.4 on Sat Aug  1 00:35:20 UTC 2026
 # https://github.com/stevejenkins/postwhite/
-# 2249 total rules
+# 2256 total rules
 2a00:1450:4000::/36	permit
 2a00:1450:4864::/56	permit
 2a01:111:f400::/48	permit
@@ -29,6 +29,7 @@
 2a01:b747:3004:200::/56	permit
 2a01:b747:3005:200::/56	permit
 2a01:b747:3006:200::/56	permit
+2a01:b747:3007::/56	permit
 2a02:a60:0:5::/64	permit
 2a0f:f640::/56	permit
 2c0f:fb50:4000::/36	permit
@@ -57,13 +58,14 @@
 8.25.196.0/23	permit
 8.36.116.0/24	permit
 8.39.54.0/23	permit
+8.39.54.240/29	permit
 8.39.54.250/31	permit
 8.39.144.0/24	permit
 8.40.222.0/23	permit
+8.40.222.240/29	permit
 8.40.222.250/31	permit
+8.47.10.9	permit
 12.130.86.238	permit
-13.107.213.40	permit
-13.107.246.40	permit
 13.108.16.0/20	permit
 13.110.208.0/21	permit
 13.110.209.0/24	permit
@@ -1385,6 +1387,7 @@
 117.120.16.0/21	permit
 119.42.242.52/31	permit
 119.42.242.156	permit
+121.244.91.31	permit
 121.244.91.48	permit
 121.244.91.52	permit
 122.15.156.182	permit
@@ -1554,12 +1557,14 @@
 147.243.128.26	permit
 148.105.0.0/16	permit
 148.105.8.0/21	permit
+148.116.32.128/25	permit
 149.72.0.0/16	permit
 149.72.234.184	permit
 149.72.248.236	permit
 149.97.173.180	permit
 149.118.160.128/25	permit
 150.136.21.199	permit
+150.171.109.72	permit
 150.230.98.160	permit
 151.145.38.14	permit
 152.67.105.195	permit
@@ -1637,8 +1642,9 @@
 164.177.132.168/30	permit
 165.1.100.0/25	permit
 165.173.128.0/24	permit
-165.173.180.1	permit
+165.173.180.0/24	permit
 165.173.180.250/31	permit
+165.173.182.0/24	permit
 165.173.182.250/31	permit
 165.173.189.205	permit
 166.78.68.0/22	permit
@@ -1700,6 +1706,7 @@
 173.203.81.39	permit
 173.224.161.128/25	permit
 173.224.165.0/26	permit
+173.224.166.48/28	permit
 174.36.84.8/29	permit
 174.36.84.16/29	permit
 174.36.84.32/29	permit
@@ -2231,7 +2238,7 @@
 2001:748:400:3301::4	permit
 2404:6800:4000::/36	permit
 2404:6800:4864::/56	permit
-2603:1061:14:72::1	permit
+2603:1061:14:75::1	permit
 2607:13c0:0001:0000:0000:0000:0000:7000/116	permit
 2607:13c0:0002:0000:0000:0000:0000:1000/116	permit
 2607:13c0:0004:0000:0000:0000:0000:0000/116	permit
@@ -3,8 +3,7 @@ rules {
    backend = "http";
    url = "http://nginx:9081/pipe.php";
    selector = "reject_no_global_bl";
-    formatter = "default";
-    meta_headers = true;
+    formatter = "multipart";
  }
 	RLINFO {
 		backend = "http";
@@ -16,8 +15,7 @@ rules {
    backend = "http";
    url = "http://nginx:9081/pushover.php";
    selector = "mailcow_rcpt";
-    formatter = "json";
-    meta_headers = true;
+    formatter = "multipart";
  }
 }

@@ -32,47 +32,42 @@ function parse_email($email) {
  $a = strrpos($email, '@');
  return array('local' => substr($email, 0, $a), 'domain' => substr(substr($email, $a), 1));
 }
-if (!function_exists('getallheaders'))  {
-  function getallheaders() {
-    if (!is_array($_SERVER)) {
-      return array();
-    }
-    $headers = array();
-    foreach ($_SERVER as $name => $value) {
-      if (substr($name, 0, 5) == 'HTTP_') {
-        $headers[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value;
-      }
-    }
-    return $headers;
-  }
+// rspamd metadata_exporter (multipart formatter):
+//   - $_POST['metadata']        JSON with the rspamd metadata
+//   - $_FILES['message']        raw RFC822 message
+if (empty($_POST['metadata']) || !isset($_FILES['message']) || $_FILES['message']['error'] !== UPLOAD_ERR_OK) {
+  error_log("QUARANTINE: missing multipart parts from rspamd" . PHP_EOL);
+  http_response_code(400);
+  exit;
 }

-$raw_data_content = file_get_contents('php://input');
+$meta = json_decode($_POST['metadata'], true);
+if (!is_array($meta)) {
+  error_log("QUARANTINE: cannot decode metadata JSON" . PHP_EOL);
+  http_response_code(400);
+  exit;
+}
+
+$raw_data_content = file_get_contents($_FILES['message']['tmp_name']);
 $raw_data = mb_convert_encoding($raw_data_content, 'HTML-ENTITIES', "UTF-8");
-$headers = getallheaders();
+$raw_size = (int)$_FILES['message']['size'];

-$qid      = $headers['X-Rspamd-Qid'];
-$fuzzy    = $headers['X-Rspamd-Fuzzy'];
-$subject  = iconv_mime_decode($headers['X-Rspamd-Subject']);
-$score    = $headers['X-Rspamd-Score'];
-$rcpts    = $headers['X-Rspamd-Rcpt'];
-$user     = $headers['X-Rspamd-User'];
-$ip       = $headers['X-Rspamd-Ip'];
-$action   = $headers['X-Rspamd-Action'];
-$sender   = $headers['X-Rspamd-From'];
-$symbols  = $headers['X-Rspamd-Symbols'];
-
-$raw_size = (int)$_SERVER['CONTENT_LENGTH'];
+$qid      = $meta['qid']     ?? 'unknown';
+$subject  = $meta['subject'] ?? '';
+$score    = $meta['score']   ?? 0;
+$rcpts    = $meta['rcpt']    ?? array();
+$user     = $meta['user']    ?? 'unknown';
+$ip       = $meta['ip']      ?? 'unknown';
+$action   = $meta['action']  ?? 'no action';
+$sender   = $meta['from']    ?? '';
+$symbols  = json_encode($meta['symbols'] ?? array());
+$fuzzy    = json_encode(is_array($meta['fuzzy'] ?? null) ? $meta['fuzzy'] : array());

 if (empty($sender)) {
  error_log("QUARANTINE: Unknown sender, assuming empty-env-from@localhost" . PHP_EOL);
  $sender = 'empty-env-from@localhost';
 }

-if ($fuzzy == 'unknown') {
-  $fuzzy = '[]';
-}
-
 try {
  $max_size = (int)$redis->Get('Q_MAX_SIZE');
  if (($max_size * 1048576) < $raw_size) {
@@ -94,7 +89,7 @@ catch (RedisException $e) {
 $rcpt_final_mailboxes = array();

 // Loop through all rcpts
-foreach (json_decode($rcpts, true) as $rcpt) {
+foreach ($rcpts as $rcpt) {
  // Remove tag
  $rcpt = preg_replace('/^(.*?)\+.*(@.*)$/', '$1$2', $rcpt);

@@ -32,50 +32,46 @@ function parse_email($email) {
  $a = strrpos($email, '@');
  return array('local' => substr($email, 0, $a), 'domain' => substr(substr($email, $a), 1));
 }
-if (!function_exists('getallheaders'))  {
-  function getallheaders() {
-    if (!is_array($_SERVER)) {
-      return array();
-    }
-    $headers = array();
-    foreach ($_SERVER as $name => $value) {
-      if (substr($name, 0, 5) == 'HTTP_') {
-        $headers[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value;
-      }
-    }
-    return $headers;
-  }
+// rspamd metadata_exporter (multipart formatter): metadata JSON arrives as $_POST['metadata'].
+if (empty($_POST['metadata'])) {
+  error_log("NOTIFY: missing metadata part from rspamd" . PHP_EOL);
+  http_response_code(400);
+  exit;
 }

-$headers = getallheaders();
-$json_body = json_decode(file_get_contents('php://input'));
+$meta = json_decode($_POST['metadata'], true);
+if (!is_array($meta)) {
+  error_log("NOTIFY: cannot decode metadata JSON" . PHP_EOL);
+  http_response_code(400);
+  exit;
+}

-$qid      = $headers['X-Rspamd-Qid'];
-$rcpts    = $headers['X-Rspamd-Rcpt'];
-$sender   = $headers['X-Rspamd-From'];
-$ip       = $headers['X-Rspamd-Ip'];
-$subject  = iconv_mime_decode($headers['X-Rspamd-Subject']);
-$messageid= $json_body->message_id;
+$qid      = $meta['qid']    ?? 'unknown';
+$rcpts    = $meta['rcpt']   ?? array();
+$sender   = $meta['from']   ?? '';
+$ip       = $meta['ip']     ?? 'unknown';
+$subject  = $meta['subject'] ?? '';
+$messageid= $meta['message_id'] ?? '';
 $priority = 0;

-$symbols_array = json_decode($headers['X-Rspamd-Symbols'], true);
+$symbols_array = $meta['symbols'] ?? array();
 if (is_array($symbols_array)) {
  foreach ($symbols_array as $symbol) {
-    if ($symbol['name'] == 'HAS_X_PRIO_ONE') {
+    if (($symbol['name'] ?? null) == 'HAS_X_PRIO_ONE') {
      $priority = 1;
      break;
    }
  }
 }

-$sender_address = $json_body->header_from[0];
+$sender_address = $meta['header_from'][0] ?? '';
 $sender_name = '-';
 if (preg_match('/(?<name>.*?)<(?<address>.*?)>/i', $sender_address, $matches)) {
 	$sender_address = $matches['address'];
  $sender_name =  trim($matches['name'], '"\' ');
 }

-$to_address = $json_body->header_to[0];
+$to_address = $meta['header_to'][0] ?? '';
 $to_name = '-';
 if (preg_match('/(?<name>.*?)<(?<address>.*?)>/i', $to_address, $matches)) {
 	$to_address = $matches['address'];
@@ -85,7 +81,7 @@ if (preg_match('/(?<name>.*?)<(?<address>.*?)>/i', $to_address, $matches)) {
 $rcpt_final_mailboxes = array();

 // Loop through all rcpts
-foreach (json_decode($rcpts, true) as $rcpt) {
+foreach ($rcpts as $rcpt) {
  // Remove tag
  $rcpt = preg_replace('/^(.*?)\+.*(@.*)$/', '$1$2', $rcpt);

@@ -185,6 +185,9 @@ paths:
              example:
                username: info@domain.tld
                domain: domain.tld
+                description: my time limited alias
+                validity: 8760
+                permanent: false
              properties:
                username:
                  description: 'the mailbox an alias should be created for'
@@ -192,6 +195,15 @@ paths:
                domain:
                  description: "the domain"
                  type: string
+                description:
+                  description: "a description for the alias, defaults to an empty string"
+                  type: string
+                validity:
+                  description: "how many hours the alias stays valid, 1 to 87600, defaults to 8760 (one year)"
+                  type: integer
+                permanent:
+                  description: "keep the alias after it expired, defaults to false"
+                  type: boolean
              type: object
      summary: Create time limited alias
  /api/v1/add/app-passwd:
@@ -1072,6 +1084,7 @@ paths:
                          password2: "*"
                          quota: "3072"
                          force_pw_update: "1"
+                          force_tfa: "1"
                          tls_enforce_in: "1"
                          tls_enforce_out: "1"
                          tags: ["tag1", "tag2"]
@@ -1118,6 +1131,7 @@ paths:
                password2: atedismonsin
                quota: "3072"
                force_pw_update: "1"
+                force_tfa: "1"
                tls_enforce_in: "1"
                tls_enforce_out: "1"
                tags: ["tag1", "tag2"]
@@ -1151,6 +1165,9 @@ paths:
                force_pw_update:
                  description: forces the user to update its password on first login
                  type: boolean
+                force_tfa:
+                  description: force 2FA enrollment at login
+                  type: boolean
                tls_enforce_in:
                  description: force inbound email tls encryption
                  type: boolean
@@ -3628,6 +3645,7 @@ paths:
                        - mailbox
                        - active: "1"
                          force_pw_update: "0"
+                          force_tfa: "0"
                          name: Full name
                          password: "*"
                          password2: "*"
@@ -3678,6 +3696,7 @@ paths:
                attr:
                  active: "1"
                  force_pw_update: "0"
+                  force_tfa: "0"
                  name: Full name
                  authsource: mailcow
                  password: ""
@@ -3701,6 +3720,9 @@ paths:
                    force_pw_update:
                      description: force user to change password on next login
                      type: boolean
+                    force_tfa:
+                      description: force 2FA enrollment at login
+                      type: boolean
                    name:
                      description: Full name of the mailbox user
                      type: string
@@ -5375,6 +5397,7 @@ paths:
                    - active: "1"
                      attributes:
                        force_pw_update: "0"
+                        force_tfa: "0"
                        mailbox_format: "maildir:"
                        quarantine_notification: never
                        sogo_access: "1"
@@ -5391,6 +5414,7 @@ paths:
                      quota: 3221225472
                      quota_used: 0
                      rl: false
+                      sender_acl: ["otherbox@doman3.tld", "@aliasdomain.tld"]
                      spam_aliases: 0
                      username: info@doman3.tld
                      tags: ["tag1", "tag2"]
@@ -6388,6 +6412,7 @@ paths:
                    - active: "1"
                      attributes:
                        force_pw_update: "0"
+                        force_tfa: "0"
                        mailbox_format: "maildir:"
                        quarantine_notification: never
                        sogo_access: "1"
@@ -6405,6 +6430,7 @@ paths:
                      quota: 3221225472
                      quota_used: 0
                      rl: false
+                      sender_acl: ["otherbox@domain3.tld", "@aliasdomain.tld"]
                      spam_aliases: 0
                      username: info@domain3.tld
                      tags: ["tag1", "tag2"]
@@ -6427,7 +6453,7 @@ paths:
                response:
                  value:
                    - type: "success"
-                      log: ["cors", "edit", {"allowed_origins": ["*", "mail.mailcow.tld"], "allowed_methods": ["POST", "GET", "DELETE", "PUT"]}]
+                      log: ["cors", "edit", {"allowed_origins": ["*", "https://mail.mailcow.tld"], "allowed_methods": ["POST", "GET", "DELETE", "PUT"]}]
                      msg: "cors_headers_edited"
          description: OK
          headers: { }
@@ -6444,7 +6470,7 @@ paths:
            schema:
              example:
                attr:
-                  allowed_origins: ["*", "mail.mailcow.tld"]
+                  allowed_origins: ["*", "https://mail.mailcow.tld"]
                  allowed_methods: ["POST", "GET", "DELETE", "PUT"]
              properties:
                attr:
@@ -380,13 +380,13 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
            else {
              $state = state_nomatch;
            }
-            $state .= '<br />' . $current[$data_field[$current['type']]];
+            $state .= '<br />' . htmlspecialchars($current[$data_field[$current['type']]]);
          }
          if ($current['type'] == 'TXT' &&
              stripos($current['txt'], 'v=dmarc') === 0 &&
              $record[2] == $dmarc_link) {
            $current['txt'] = str_replace(' ', '', $current['txt']);
-            $state = $current[$data_field[$current['type']]] . state_optional;
+            $state = htmlspecialchars($current[$data_field[$current['type']]]) . state_optional;
          }
          elseif ($current['type'] == 'TXT' &&
                  stripos($current['txt'], 'v=spf') === 0 &&
@@ -396,7 +396,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
            if (in_array($ip, $rslt) && in_array(expand_ipv6($ip6), $rslt)) {
              $state = state_good;
            }
-            $state .= '<br />' . $current[$data_field[$current['type']]] . state_optional;
+            $state .= '<br />' . htmlspecialchars($current[$data_field[$current['type']]]) . state_optional;
          }
          elseif ($current['type'] == 'TXT' &&
                  stripos($current['txt'], 'v=dkim') === 0 &&
@@ -426,7 +426,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
        if ($state == state_nomatch) {
          $state = array();
          foreach ($currents as $current) {
-            $state[] = $current[$data_field[$current['type']]];
+            $state[] = htmlspecialchars($current[$data_field[$current['type']]]);
          }
          $state = implode('<br />', $state);
        }
@@ -436,12 +436,22 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
          <td>%s</td>
          <td class="dns-found">%s</td>
          <td class="dns-recommended">%s</td>
-        </tr>', $record[0], $record[1], $record[2], $state);
+        </tr>', htmlspecialchars($record[0]), htmlspecialchars($record[1]), $record[2], $state);
        $record[3] = explode('<br />', $state);
      }

      unset($record);

+      // Make a hostname RHS absolute so it is not read relative to $ORIGIN.
+      // Already-absolute names, the SRV root target "." and IP addresses are left alone.
+      $absolutize = function($host) {
+        $host = trim($host);
+        if ($host === '' || $host === '.' || substr($host, -1) === '.' || filter_var($host, FILTER_VALIDATE_IP)) {
+          return $host;
+        }
+        return $host . '.';
+      };
+
      $dns_data = sprintf("\$ORIGIN %s.\n", $domain);
      foreach ($records as $record) {
        if ($domain == substr($record[0], -strlen($domain))) {
@@ -462,22 +472,32 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
              $val = str_replace(state_optional, '', $val);
              $val = str_replace(state_good, '', $val);
              if (strlen($val) > 0) {
+                // these are all TXT values, their RHS is a character string, not a name
                $vals[] = sprintf("%s\tIN\t%s\t%s\n", $label, $record[1], $val);
              }
            }
          }
          else {
+            if ($record[1] == 'MX' || $record[1] == 'CNAME') {
+              $val = $absolutize($val);
+            }
+            elseif ($record[1] == 'SRV') {
+              // format here is "target port"; only the target is a name
+              $parts = explode(' ', $val, 2);
+              $parts[0] = $absolutize($parts[0]);
+              $val = implode(' ', $parts);
+            }
            $vals[] = sprintf("%s\tIN\t%s\t%s\n", $label, $record[1], $val);
          }

          foreach ($vals as $val) {
-            $dns_data .= str_replace($domain, $domain . '.', $val);
+            $dns_data .= $val;
          }
        }
      }
      ?>
    </table>
-    <a id='download-zonefile' class="btn btn-sm btn-secondary visible-xs-block visible-sm-inline visible-md-inline visible-lg-inline mb-4" style="margin-top:10px" data-zonefile="<?=base64_encode($dns_data);?>" download='<?=$_GET['domain'];?>.txt' type='text/csv'>Download</a>
+    <a id='download-zonefile' class="btn btn-sm btn-secondary visible-xs-block visible-sm-inline visible-md-inline visible-lg-inline mb-4" style="margin-top:10px" data-zonefile="<?=base64_encode($dns_data);?>" download='<?=htmlspecialchars($_GET['domain']);?>.txt' type='text/csv'>Download</a>
    <script>
      var zonefile_dl_link = document.getElementById('download-zonefile');
      var zonefile = atob(zonefile_dl_link.getAttribute('data-zonefile'));
@@ -0,0 +1,67 @@
+<?php
+require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
+
+header('Content-Type: application/json');
+
+// Admins only
+if (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] !== 'admin') {
+  http_response_code(403);
+  echo json_encode(array('status' => 'error', 'message' => 'access denied'));
+  exit;
+}
+
+$owner   = $GLOBALS['MAILCOW_GIT_OWNER'];
+$repo    = $GLOBALS['MAILCOW_GIT_REPO'];
+$current = $GLOBALS['MAILCOW_GIT_VERSION'];
+
+// Cache key is bound to the running version, so an update invalidates it naturally
+$cache_key = 'MAILCOW_UPDATE_CHECK/' . $current;
+
+// Serve cached result if present (one GitHub call per TTL, not one per page load)
+$cached = $redis->get($cache_key);
+if ($cached !== false) {
+  echo $cached;
+  exit;
+}
+
+// GitHub requires a User-Agent and rate-limits unauthenticated requests to 60/h per IP
+function github_get($url) {
+  $ch = curl_init($url);
+  curl_setopt_array($ch, array(
+    CURLOPT_RETURNTRANSFER => true,
+    CURLOPT_USERAGENT      => 'mailcow-update-check',
+    CURLOPT_TIMEOUT        => 10,
+    CURLOPT_HTTPHEADER     => array('Accept: application/vnd.github+json'),
+  ));
+  $body = curl_exec($ch);
+  $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+  curl_close($ch);
+  if ($body === false || $code !== 200) return false;
+  $json = json_decode($body, true);
+  return is_array($json) ? $json : false;
+}
+
+$latest  = github_get("https://api.github.com/repos/{$owner}/{$repo}/releases/latest");
+$release = github_get("https://api.github.com/repos/{$owner}/{$repo}/releases/tags/{$current}");
+
+// Any failure (rate limit, offline, unexpected payload) -> honest error, cached briefly
+if ($latest === false || $release === false ||
+    empty($latest['tag_name']) || empty($latest['created_at']) || empty($release['created_at'])) {
+  $result = json_encode(array('status' => 'error', 'message' => 'could not reach GitHub API'));
+  $redis->setex($cache_key, 300, $result);
+  echo $result;
+  exit;
+}
+
+$date_latest  = strtotime($latest['created_at']);
+$date_current = strtotime($release['created_at']);
+
+if ($date_latest <= $date_current) {
+  $result = json_encode(array('status' => 'no_update'));
+} else {
+  $result = json_encode(array('status' => 'update_available', 'latest_tag' => $latest['tag_name']));
+}
+
+// Cache the positive result for an hour
+$redis->setex($cache_key, 3600, $result);
+echo $result;
@@ -429,14 +429,25 @@ function domain_admin_sso($_action, $_data) {

  switch ($_action) {
    case 'check':
-      $token = $_data;
+      $token = preg_replace('/[^a-zA-Z0-9-]/', '', $_data);

      $stmt = $pdo->prepare("SELECT `t1`.`username` FROM `da_sso` AS `t1` JOIN `admin` AS `t2` ON `t1`.`username` = `t2`.`username` WHERE `t1`.`token` = :token AND `t1`.`created` > DATE_SUB(NOW(), INTERVAL '30' SECOND) AND `t2`.`active` = 1 AND `t2`.`superadmin` = 0;");
      $stmt->execute(array(
-        ':token' => preg_replace('/[^a-zA-Z0-9-]/', '', $token)
+        ':token' => $token
      ));
      $return = $stmt->fetch(PDO::FETCH_ASSOC);
-      return empty($return['username']) ? false : $return['username'];
+      if (empty($return['username'])) {
+        return false;
+      }
+      // single-use: consume the token; if a concurrent request already used it, deny
+      $del = $pdo->prepare("DELETE FROM `da_sso` WHERE `token` = :token");
+      $del->execute(array(
+        ':token' => $token
+      ));
+      if ($del->rowCount() < 1) {
+        return false;
+      }
+      return $return['username'];
    case 'issue':
      if ($_SESSION['mailcow_cc_role'] != "admin") {
        $_SESSION['return'][] = array(
@@ -53,6 +53,39 @@ function valid_network($network) {
 function valid_hostname($hostname) {
  return filter_var($hostname, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME);
 }
+// Validates a browser-style Origin: scheme://host[:port], no path/query/fragment/credentials
+function valid_origin($origin) {
+  $parts = parse_url($origin);
+  if ($parts === false || !isset($parts['scheme']) || !isset($parts['host'])) {
+    return false;
+  }
+  if (!in_array(strtolower($parts['scheme']), array('http', 'https'), true)) {
+    return false;
+  }
+  if (isset($parts['user']) || isset($parts['pass']) || isset($parts['path']) || isset($parts['query']) || isset($parts['fragment'])) {
+    return false;
+  }
+  $host = $parts['host'];
+  $host_without_brackets = trim($host, '[]');
+  if (!valid_hostname($host_without_brackets) && !filter_var($host_without_brackets, FILTER_VALIDATE_IP)) {
+    return false;
+  }
+  // Reject anything that doesn't round-trip to the exact same origin (e.g. stray trailing slash)
+  $port = isset($parts['port']) ? ':' . $parts['port'] : '';
+  $rebuilt = strtolower($parts['scheme']) . '://' . strtolower($host) . $port;
+  return strtolower($origin) === $rebuilt;
+}
+// Bring an origin into the exact form a browser sends it (scheme://host[:port], lowercase).
+function normalize_cors_origin($origin) {
+  $origin = trim($origin);
+  if ($origin === '*') {
+    return '*';
+  }
+  if ($origin !== '' && !preg_match('~^[a-z][a-z0-9+.-]*://~i', $origin)) {
+    $origin = 'https://' . $origin;
+  }
+  return valid_origin($origin) ? strtolower($origin) : false;
+}
 // Thanks to https://stackoverflow.com/a/49373789
 // Validates exact ip matches and ip-in-cidr, ipv4 and ipv6
 function ip_acl($ip, $networks) {
@@ -558,7 +591,7 @@ function logger($_data = false) {
      $type = $return['type'];
      $msg = null;
      if (isset($return['msg'])) {
-        $msg = json_encode($return['msg'], JSON_UNESCAPED_UNICODE);
+        $msg = json_encode($return['msg'], JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
      }
      $call = null;
      if (isset($return['log'])) {
@@ -600,6 +633,18 @@ function logger($_data = false) {
    return true;
  }
 }
+function is_local_mailcow_domain($domain) {
+  // True if domain is a locally managed, active primary or alias domain
+  global $pdo;
+  $domain = idn_to_ascii($domain, 0, INTL_IDNA_VARIANT_UTS46);
+  if (empty($domain)) {
+    return false;
+  }
+  $stmt = $pdo->prepare("SELECT 1 FROM `domain` WHERE `domain` = :d AND `active` = 1
+    UNION SELECT 1 FROM `alias_domain` WHERE `alias_domain` = :d2 AND `active` = 1 LIMIT 1");
+  $stmt->execute(array(':d' => $domain, ':d2' => $domain));
+  return (bool)$stmt->fetchColumn();
+}
 function hasDomainAccess($username, $role, $domain) {
  global $pdo;
  if (empty($domain) || !is_valid_domain_name($domain)) {
@@ -2283,10 +2328,13 @@ function cors($action, $data = null) {
        return false;
      }

-      $allowed_origins = isset($data['allowed_origins']) ? $data['allowed_origins'] : array($_SERVER['SERVER_NAME']);
+      $allowed_origins = isset($data['allowed_origins']) ? $data['allowed_origins'] : array(getBaseURL());
      $allowed_origins = !is_array($allowed_origins) ? array_filter(array_map('trim', explode("\n", $allowed_origins))) : $allowed_origins;
-      foreach ($allowed_origins as $origin) {
-        if (!filter_var($origin, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) && $origin != '*') {
+      foreach ($allowed_origins as &$origin) {
+        if ($origin === '*') {
+          continue;
+        }
+        if (!valid_origin($origin)) {
          $_SESSION['return'][] = array(
            'type' => 'danger',
            'log' => array(__FUNCTION__, $action, $data),
@@ -2294,7 +2342,10 @@ function cors($action, $data = null) {
          );
          return false;
        }
+        // browsers always send a lowercase scheme/host in the Origin header, so normalize to match
+        $origin = strtolower($origin);
      }
+      unset($origin);

      $allowed_methods = isset($data['allowed_methods']) ? $data['allowed_methods'] : array('GET', 'POST', 'PUT', 'DELETE');
      $allowed_methods  = !is_array($allowed_methods) ? array_map('trim', preg_split( "/( |,|;|\n)/", $allowed_methods)) : $allowed_methods;
@@ -2342,26 +2393,35 @@ function cors($action, $data = null) {
        );
      }

-      $cors_settings                    = !$cors_settings ? array('allowed_origins' => $_SERVER['SERVER_NAME'], 'allowed_methods' => 'GET, POST, PUT, DELETE') : $cors_settings;
-      $cors_settings['allowed_origins'] = empty($cors_settings['allowed_origins']) ? $_SERVER['SERVER_NAME'] : $cors_settings['allowed_origins'];
+      $cors_settings                    = !$cors_settings ? array('allowed_origins' => getBaseURL(), 'allowed_methods' => 'GET, POST, PUT, DELETE') : $cors_settings;
+      $cors_settings['allowed_origins'] = empty($cors_settings['allowed_origins']) ? getBaseURL() : $cors_settings['allowed_origins'];
      $cors_settings['allowed_methods'] = empty($cors_settings['allowed_methods']) ? 'GET, POST, PUT, DELETE, OPTION' : $cors_settings['allowed_methods'];

      return $cors_settings;
    break;
    case "set_headers":
      $cors_settings = cors('get');
+      // normalize the stored list; it may still hold bare hostnames written before origins were validated as origins
+      $allowed_origins = array_filter(array_map('normalize_cors_origin', explode(',', $cors_settings['allowed_origins'])));
+      $origin = isset($_SERVER['HTTP_ORIGIN']) ? normalize_cors_origin($_SERVER['HTTP_ORIGIN']) : false;
      // check if requested origin is in allowed origins
-      $allowed_origins = explode(', ', $cors_settings['allowed_origins']);
-      $cors_settings['allowed_origins'] = $allowed_origins[0];
-      if (in_array('*', $allowed_origins)){
-        $cors_settings['allowed_origins'] = '*';
-      } else if (array_key_exists('HTTP_ORIGIN', $_SERVER) && in_array($_SERVER['HTTP_ORIGIN'], $allowed_origins)) {
-        $cors_settings['allowed_origins'] = $_SERVER['HTTP_ORIGIN'];
+      $allow_origin = null;
+      if (in_array('*', $allowed_origins, true)) {
+        $allow_origin = '*';
+      } else if ($origin !== false && in_array($origin, $allowed_origins, true)) {
+        $allow_origin = $origin;
      }
      // always allow OPTIONS for preflight request
      $cors_settings["allowed_methods"] = empty($cors_settings["allowed_methods"]) ? 'OPTIONS' : $cors_settings["allowed_methods"] . ', ' . 'OPTIONS';

-      header('Access-Control-Allow-Origin: ' . $cors_settings['allowed_origins']);
+      // a disallowed origin gets no Access-Control-Allow-Origin at all; echoing a different origin than the requesting one tells a browser nothing
+      if ($allow_origin !== null) {
+        header('Access-Control-Allow-Origin: ' . $allow_origin);
+      }
+      if ($allow_origin !== '*') {
+        // the response depends on the request origin, keep caches from mixing them up
+        header('Vary: Origin', false);
+      }
      header('Access-Control-Allow-Methods: '. $cors_settings['allowed_methods']);
      header('Access-Control-Allow-Headers: Accept, Content-Type, X-Api-Key, Origin');

@@ -3503,7 +3563,16 @@ function protect_route($allowed_roles = ['admin', 'domainadmin', 'user'], $redir
    if (isset($redirects['unauthenticated'])) {
      header('Location: ' . $redirects['unauthenticated']);
    } else {
-      header('Location: /');
+      // Send a deep link to the login page for its area instead of the user login at /,
+      // e.g. /admin/dashboard -> /admin rather than /
+      $request_uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '/';
+      if (strpos($request_uri, '/admin/') === 0) {
+        header('Location: /admin');
+      } elseif (strpos($request_uri, '/domainadmin/') === 0) {
+        header('Location: /domainadmin');
+      } else {
+        header('Location: /');
+      }
    }
    exit();
  }
@@ -41,13 +41,15 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          else {
            $username = $_SESSION['mailcow_cc_username'];
          }
-          if (isset($_data["validity"]) && !filter_var($_data["validity"], FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 87600)))) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => 'validity_missing'
-            );
-            return false;
+          if (isset($_data["validity"])) {
+            if (!filter_var($_data["validity"], FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 87600)))) {
+              $_SESSION['return'][] = array(
+                'type' => 'danger',
+                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                'msg' => 'validity_missing'
+              );
+              return false;
+            }
          }
          else {
            // Default to 1 yr
@@ -60,7 +62,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            $permanent = 0;
          }
          $domain = $_data['domain'];
-          $description = $_data['description'];
+          // spamalias.description is NOT NULL, an absent description must not become a null insert
+          $description = $_data['description'] ?? '';
          $valid_domains[] = mailbox('get', 'mailbox_details', $username)['domain'];
          $valid_alias_domains = user_get_alias_details($username)['alias_domains'];
          if (!empty($valid_alias_domains)) {
@@ -561,6 +564,18 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              $goto_domain = idn_to_ascii(substr(strstr($goto, '@'), 1), 0, INTL_IDNA_VARIANT_UTS46);
              $goto_local_part = strstr($goto, '@', true);
              $goto = $goto_local_part.'@'.$goto_domain;
+              // Deny external goto domains: global switch (all roles) overrides the per-DA ACL
+              if (($GLOBALS['ALIAS_DISABLE_EXTERNAL_DOMAINS'] === true ||
+                  (isset($_SESSION['acl']['alias_external_goto']) && $_SESSION['acl']['alias_external_goto'] != "1")) &&
+                  !is_local_mailcow_domain($goto_domain)) {
+                $_SESSION['return'][] = array(
+                  'type' => 'danger',
+                  'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                  'msg' => array('external_goto_denied', htmlspecialchars($goto))
+                );
+                unset($gotos[$i]);
+                continue;
+              }
              $stmt = $pdo->prepare("SELECT `username` FROM `mailbox`
                WHERE `kind` REGEXP 'location|thing|group'
                  AND `username`= :goto");
@@ -2330,6 +2345,19 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                  unset($gotos[$i]);
                  continue;
                }
+                // Deny external goto domains: global switch (all roles) overrides the per-DA ACL
+                $goto_domain = idn_to_ascii(substr(strstr($goto, '@'), 1), 0, INTL_IDNA_VARIANT_UTS46);
+                if (($GLOBALS['ALIAS_DISABLE_EXTERNAL_DOMAINS'] === true ||
+                    (isset($_SESSION['acl']['alias_external_goto']) && $_SESSION['acl']['alias_external_goto'] != "1")) &&
+                    !is_local_mailcow_domain($goto_domain)) {
+                  $_SESSION['return'][] = array(
+                    'type' => 'danger',
+                    'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                    'msg' => array('external_goto_denied', htmlspecialchars($goto))
+                  );
+                  unset($gotos[$i]);
+                  continue;
+                }
                if ($goto == $address) {
                  $_SESSION['return'][] = array(
                    'type' => 'danger',
@@ -3123,7 +3151,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            // Track affected mailboxes for SOGo update
            $update_sogo_mailboxes[] = $username;
          }
-          return true;
        break;
        case 'mailbox_rename':
          $domain = $_data['domain'];
@@ -3446,6 +3473,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            $attr["rl_frame"]                    = (!empty($_data['rl_frame'])) ? $_data['rl_frame'] : $is_now['rl_frame'];
            $attr["rl_value"]                    = (!empty($_data['rl_value'])) ? $_data['rl_value'] : $is_now['rl_value'];
            $attr["force_pw_update"]             = isset($_data['force_pw_update']) ? intval($_data['force_pw_update']) : $is_now['force_pw_update'];
+            $attr["force_tfa"]                   = isset($_data['force_tfa']) ? intval($_data['force_tfa']) : $is_now['force_tfa'];
            $attr["sogo_access"]                 = isset($_data['sogo_access']) ? intval($_data['sogo_access']) : $is_now['sogo_access'];
            $attr["active"]                      = isset($_data['active']) ? intval($_data['active']) : $is_now['active'];
            $attr["tls_enforce_in"]              = isset($_data['tls_enforce_in']) ? intval($_data['tls_enforce_in']) : $is_now['tls_enforce_in'];
@@ -4876,6 +4904,14 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              $mailboxdata['rl_scope'] = 'domain';
            }
            $mailboxdata['is_relayed'] = $row['backupmx'];
+            // Internal send-as ACL for this mailbox, mirrors the sender_acl field accepted by edit/mailbox
+            $mailboxdata['sender_acl'] = array();
+            $stmt = $pdo->prepare("SELECT `send_as` FROM `sender_acl` WHERE `logged_in_as` = :username AND `external` = '0'");
+            $stmt->execute(array(':username' => $_data));
+            $sender_acl_rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
+            foreach ($sender_acl_rows as $sender_acl_row) {
+              $mailboxdata['sender_acl'][] = $sender_acl_row['send_as'];
+            }
          }
          $stmt = $pdo->prepare("SELECT `tag_name`
            FROM `tags_mailbox` WHERE `username`= :username");
@@ -5163,8 +5199,11 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            $stmt->execute(array(
              ':username' => $username
            ));
-            $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE '%/" . $username . "/%' OR `c_uid` = :username");
+            // bind LIKE pattern + escape LIKE wildcards so the value matches literally (no SQLi, no over-match)
+            $c_object_like = '%/' . addcslashes($username, '\\%_') . '/%';
+            $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE :c_object_like OR `c_uid` = :username");
            $stmt->execute(array(
+              ':c_object_like' => $c_object_like,
              ':username' => $username
            ));
            $stmt = $pdo->prepare("DELETE FROM `sogo_store` WHERE `c_folder_id` IN (SELECT `c_folder_id` FROM `sogo_folder_info` WHERE `c_path2` = :username)");
@@ -5560,8 +5599,11 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            $stmt->execute(array(
              ':username' => $username
            ));
-            $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE '%/" . str_replace('%', '\%', $username) . "/%' OR `c_uid` = :username");
+            // bind LIKE pattern + escape LIKE wildcards so the value matches literally (no SQLi, no over-match)
+            $c_object_like = '%/' . addcslashes($username, '\\%_') . '/%';
+            $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE :c_object_like OR `c_uid` = :username");
            $stmt->execute(array(
+              ':c_object_like' => $c_object_like,
              ':username' => $username
            ));
            $stmt = $pdo->prepare("DELETE FROM `sogo_store` WHERE `c_folder_id` IN (SELECT `c_folder_id` FROM `sogo_folder_info` WHERE `c_path2` = :username)");
@@ -5643,7 +5685,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            // Track affected mailboxes for SOGo update
            $update_sogo_mailboxes[] = $username;
          }
-          return true;
        break;
        case 'mailbox_templates':
          if ($_SESSION['mailcow_cc_role'] != "admin") {
@@ -5718,8 +5759,11 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            $stmt->execute(array(
              ':username' => $name
            ));
-            $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE '%/" . $name . "/%' OR `c_uid` = :username");
+            // bind LIKE pattern + escape LIKE wildcards so the value matches literally (no SQLi, no over-match)
+            $c_object_like = '%/' . addcslashes($name, '\\%_') . '/%';
+            $stmt = $pdo->prepare("DELETE FROM `sogo_acl` WHERE `c_object` LIKE :c_object_like OR `c_uid` = :username");
            $stmt->execute(array(
+              ':c_object_like' => $c_object_like,
              ':username' => $name
            ));
            $stmt = $pdo->prepare("DELETE FROM `sogo_store` WHERE `c_folder_id` IN (SELECT `c_folder_id` FROM `sogo_folder_info` WHERE `c_path2` = :username)");
@@ -22,7 +22,7 @@ function quarantine($_action, $_data = null) {
        return false;
      }
      $stmt = $pdo->prepare('SELECT `id` FROM `quarantine` LEFT OUTER JOIN `user_acl` ON `user_acl`.`username` = `rcpt`
-        WHERE `qhash` = :hash
+        WHERE `qhash` = :hash
          AND user_acl.quarantine = 1
          AND rcpt IN (SELECT username FROM mailbox)');
      $stmt->execute(array(':hash' => $hash));
@@ -65,7 +65,7 @@ function quarantine($_action, $_data = null) {
        return false;
      }
      $stmt = $pdo->prepare('SELECT `id` FROM `quarantine` LEFT OUTER JOIN `user_acl` ON `user_acl`.`username` = `rcpt`
-        WHERE `qhash` = :hash
+        WHERE `qhash` = :hash
          AND `user_acl`.`quarantine` = 1
          AND `username` IN (SELECT `username` FROM `mailbox`)');
      $stmt->execute(array(':hash' => $hash));
@@ -170,6 +170,8 @@ function quarantine($_action, $_data = null) {
        }
        elseif ($release_format == 'raw') {
          $detail_row['msg'] = preg_replace('/^X-Spam-Flag: (.*)/m', 'X-Pre-Release-Spam-Flag: $1', $detail_row['msg']);
+          // dot-stuffing per RFC5321 4.5.2: escape leading dots
+          $detail_row['msg'] = preg_replace('~^\.~m', '..', $detail_row['msg']);
          $postfix_talk = array(
            array('220', 'HELO quarantine' . chr(10)),
            array('250', 'MAIL FROM: ' . $sender . chr(10)),
@@ -180,7 +182,7 @@ function quarantine($_action, $_data = null) {
            array('221', '')
          );
          // Thanks to https://stackoverflow.com/questions/6632399/given-an-email-as-raw-text-how-can-i-send-it-using-php
-          $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1); 
+          $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1);
          if (!$smtp_connection) {
            logger(array('return' => array(
              array(
@@ -192,7 +194,7 @@ function quarantine($_action, $_data = null) {
            return false;
          }
          for ($i=0; $i < count($postfix_talk); $i++) {
-            $smtp_resource = fgets($smtp_connection, 256); 
+            $smtp_resource = fgets($smtp_connection, 256);
            if (substr($smtp_resource, 0, 3) !== $postfix_talk[$i][0]) {
              $ret = substr($smtp_resource, 0, 3);
              $ret = (empty($ret)) ? '-' : $ret;
@@ -465,17 +467,19 @@ function quarantine($_action, $_data = null) {
          }
          elseif ($release_format == 'raw') {
            $row['msg'] = preg_replace('/^X-Spam-Flag: (.*)/m', 'X-Pre-Release-Spam-Flag: $1', $row['msg']);
+            // dot-stuffing per RFC5321 4.5.2: escape leading dots
+            $row['msg'] = preg_replace('~^\.~m', '..', $row['msg']);
            $postfix_talk = array(
              array('220', 'HELO quarantine' . chr(10)),
              array('250', 'MAIL FROM: ' . $sender . chr(10)),
              array('250', 'RCPT TO: ' . $row['rcpt'] . chr(10)),
              array('250', 'DATA' . chr(10)),
-              array('354', str_replace("\n.", '', $row['msg']) . chr(10) . '.' . chr(10)),
+              array('354', $row['msg'] . chr(10) . '.' . chr(10)),
              array('250', 'QUIT' . chr(10)),
              array('221', '')
            );
            // Thanks to https://stackoverflow.com/questions/6632399/given-an-email-as-raw-text-how-can-i-send-it-using-php
-            $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1); 
+            $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1);
            if (!$smtp_connection) {
              $_SESSION['return'][] = array(
                'type' => 'warning',
@@ -485,7 +489,7 @@ function quarantine($_action, $_data = null) {
              return false;
            }
            for ($i=0; $i < count($postfix_talk); $i++) {
-              $smtp_resource = fgets($smtp_connection, 256); 
+              $smtp_resource = fgets($smtp_connection, 256);
              if (substr($smtp_resource, 0, 3) !== $postfix_talk[$i][0]) {
                $ret = substr($smtp_resource, 0, 3);
                $ret = (empty($ret)) ? '-' : $ret;
@@ -833,7 +837,7 @@ function quarantine($_action, $_data = null) {
        )));
        return false;
      }
-      $stmt = $pdo->prepare('SELECT * FROM `quarantine` WHERE `qhash` = :hash');
+      $stmt = $pdo->prepare('SELECT * FROM `quarantine` WHERE `qhash` = :hash');
      $stmt->execute(array(':hash' => $hash));
      return $stmt->fetch(PDO::FETCH_ASSOC);
    break;
@@ -719,7 +719,8 @@ function init_db_schema()
          "alias_domains" => "TINYINT(1) NOT NULL DEFAULT '0'",
          "mailbox_relayhost" => "TINYINT(1) NOT NULL DEFAULT '1'",
          "domain_relayhost" => "TINYINT(1) NOT NULL DEFAULT '1'",
-          "domain_desc" => "TINYINT(1) NOT NULL DEFAULT '0'"
+          "domain_desc" => "TINYINT(1) NOT NULL DEFAULT '0'",
+          "alias_external_goto" => "TINYINT(1) NOT NULL DEFAULT '1'"
        ),
        "keys" => array(
          "primary" => array(
@@ -1641,6 +1642,8 @@ function init_db_schema()
        "pop3_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['pop3_access']),
        "smtp_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['smtp_access']),
        "sieve_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['sieve_access']),
+        "eas_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['eas_access']),
+        "dav_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['dav_access']),
        "acl_spam_alias" => 1,
        "acl_tls_policy" => 1,
        "acl_spam_score" => 1,
@@ -246,6 +246,10 @@ $PW_RESET_TOKEN_LIMIT = 3;
 // Maximum time in minutes a password reset token is valid
 $PW_RESET_TOKEN_LIFETIME = 15;

+// Globally forbid aliases with external (non-local) goto domains for ALL roles (incl. admins),
+// overriding the per-domain-admin da_acl. false = defer to da_acl.
+$ALIAS_DISABLE_EXTERNAL_DOMAINS = false;
+
 // UV flag handling in FIDO2/WebAuthn - defaults to false to allow iOS logins
 // true = required
 // false = preferred
@@ -30,7 +30,7 @@ $(document).ready(function() {
  // create host cpu and mem charts
  createHostCpuAndMemChart();
  // check for new version
-  if (mailcow_info.branch === "master"){
+  if (mailcow_info.branch === "master" && mailcow_cc_role === "admin"){
    check_update(mailcow_info.version_tag, mailcow_info.project_url);
  }
  $("#mailcow_version").click(function(){
@@ -1089,6 +1089,8 @@ jQuery(function($){
        return str;
      }).join('<br>\n');
      item.subject = escapeHtml(item.subject);
+      if (item.sender_mime != null) item.sender_mime = escapeHtml(item.sender_mime);
+      if (item['message-id'] != null) item['message-id'] = escapeHtml(item['message-id']);
      var scan_time = item.time_real.toFixed(3);
      if (item.time_virtual) {
        scan_time += ' / ' + item.time_virtual.toFixed(3);
@@ -1167,6 +1169,7 @@ jQuery(function($){
        if (item === null) { return true; }
        item.user = escapeHtml(item.user);
        item.call = escapeHtml(item.call);
+        if (item.msg) item.msg = escapeHtml(item.msg);
        item.task = '<code>' + item.task + '</code>';
        item.type = '<span class="badge fs-6 bg-' + item.type + '">' + item.type + '</span>';
      });
@@ -1174,6 +1177,7 @@ jQuery(function($){
      $.each(data, function (i, item) {
        if (item === null) { return true; }
        item.username = escapeHtml(item.username);
+        item.real_rip = escapeHtml(item.real_rip);
        item.service = '<div class="badge fs-6 bg-secondary">' + item.service.toUpperCase() + '</div>';
      });
    } else if (table == 'general_syslog') {
@@ -1212,6 +1216,11 @@ jQuery(function($){
      });
    } else if (table == 'rllog') {
      $.each(data, function (i, item) {
+        if (item.header_from != null) item.header_from = escapeHtml(item.header_from);
+        if (item.header_subject != null) item.header_subject = escapeHtml(item.header_subject);
+        if (item.from != null) item.from = escapeHtml(item.from);
+        if (item.rcpt != null) item.rcpt = escapeHtml(item.rcpt);
+        if (item.message_id != null) item.message_id = escapeHtml(item.message_id);
        if (item.user == null) {
          item.user = "none";
        }
@@ -1669,41 +1678,26 @@ function createHostCpuAndMemChart(){
 function check_update(current_version, github_repo_url){
  if (!current_version || !github_repo_url) return false;

-  var github_account = github_repo_url.split("/")[3];
-  var github_repo_name = github_repo_url.split("/")[4];

-  // get details about latest release
-  window.fetch("https://api.github.com/repos/"+github_account+"/"+github_repo_name+"/releases/latest", {method:'GET',cache:'no-cache'}).then(function(response) {
+  window.fetch("/inc/ajax/update_check.php", {method:'GET',cache:'no-cache'}).then(function(response) {
+    if (!response.ok) throw new Error("update check returned " + response.status);
    return response.json();
-  }).then(function(latest_data) {
-    // get details about current release
-    window.fetch("https://api.github.com/repos/"+github_account+"/"+github_repo_name+"/releases/tags/"+current_version, {method:'GET',cache:'no-cache'}).then(function(response) {
-      return response.json();
-    }).then(function(current_data) {
-      // compare releases
-      var date_current = new Date(current_data.created_at);
-      var date_latest = new Date(latest_data.created_at);
-      if (date_latest.getTime() <= date_current.getTime()){
-        // no update available
-        $("#mailcow_update").removeClass("text-warning text-danger").addClass("text-success");
-        $("#mailcow_update").html("<b>" + lang_debug.no_update_available + "</b>");
-      } else {
-        // update available
-        $("#mailcow_update").removeClass("text-danger text-success").addClass("text-warning");
-        $("#mailcow_update").html(lang_debug.update_available + ` <a href="#" id="mailcow_update_changelog">`+latest_data.tag_name+`</a>`);
-        $("#mailcow_update_changelog").click(function(){
-          if (mailcow_cc_role !== "admin" && mailcow_cc_role !== "domainadmin")
-            return;
+  }).then(function(data) {
+    if (data.status === "no_update") {
+      $("#mailcow_update").removeClass("text-warning text-danger").addClass("text-success");
+      $("#mailcow_update").html("<b>" + lang_debug.no_update_available + "</b>");
+    } else if (data.status === "update_available") {
+      $("#mailcow_update").removeClass("text-danger text-success").addClass("text-warning");
+      $("#mailcow_update").html(lang_debug.update_available + ` <a href="#" id="mailcow_update_changelog">`+data.latest_tag+`</a>`);
+      $("#mailcow_update_changelog").click(function(){
+        if (mailcow_cc_role !== "admin" && mailcow_cc_role !== "domainadmin")
+          return;

-          showVersionModal("New Release " + latest_data.tag_name, latest_data.tag_name);
-        })
-      }
-    }).catch(err => {
-      // err
-      console.log(err);
-      $("#mailcow_update").removeClass("text-success text-warning").addClass("text-danger");
-      $("#mailcow_update").html("<b>"+ lang_debug.update_failed +"</b>");
-    });
+        showVersionModal("New Release " + data.latest_tag, data.latest_tag);
+      })
+    } else {
+      throw new Error(data.message || "update check failed");
+    }
  }).catch(err => {
    // err
    console.log(err);
@@ -424,6 +424,11 @@ $(document).ready(function() {
    } else {
      $('#force_pw_update').prop('checked', false);
    }
+    if (template.force_tfa == 1){
+      $('#force_tfa').prop('checked', true);
+    } else {
+      $('#force_tfa').prop('checked', false);
+    }
    if (template.sogo_access == 1){
      $('#sogo_access').prop('checked', true);
    } else {
@@ -991,6 +996,7 @@ jQuery(function($){
              'style="min-width:2em;width:' + item.percent_in_use + '%">' + item.percent_in_use + '%' + '</div></div>'
            };
            item.username = escapeHtml(item.username);
+            item.name = escapeHtml(item.name);

            if (Array.isArray(item.tags)){
              var tags = '';
@@ -1242,6 +1248,7 @@ jQuery(function($){
            item.attributes.eas_access = '<i class="text-' + (item.attributes.eas_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.eas_access == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.eas_access == 1 ? '1' : '0') + '</span></i>';
            item.attributes.dav_access = '<i class="text-' + (item.attributes.dav_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.dav_access == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.dav_access == 1 ? '1' : '0') + '</span></i>';
            item.attributes.sogo_access = '<i class="text-' + (item.attributes.sogo_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.sogo_access == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.sogo_access == 1 ? '1' : '0') + '</span></i>';
+            item.attributes.force_tfa = '<i class="text-' + (item.attributes.force_tfa == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.force_tfa == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.force_tfa == 1 ? '1' : '0') + '</span></i>';
            if (item.attributes.quarantine_notification === 'never') {
              item.attributes.quarantine_notification = lang.never;
            } else if (item.attributes.quarantine_notification === 'hourly') {
@@ -1385,6 +1392,11 @@ jQuery(function($){
            return 1==data?'<i class="bi bi-check-lg"></i>':'<i class="bi bi-x-lg"></i>';
          }
        },
+        {
+          title: lang.force_tfa,
+          data: 'attributes.force_tfa',
+          defaultContent: ''
+        },
        {
          title: lang_edit.ratelimit,
          data: 'attributes.ratelimit',
@@ -1,6 +1,7 @@
 {
    "acl": {
        "alias_domains": "Alias-Domains hinzufügen",
+        "alias_external_goto": "Aliase mit externen Ziel-Domains erlauben",
        "app_passwds": "App-Passwörter verwalten",
        "bcc_maps": "BCC-Maps",
        "delimiter_action": "Delimiter-Aktionen (tags)",
@@ -433,6 +434,7 @@
        "domain_not_found": "Domain %s nicht gefunden",
        "domain_quota_m_in_use": "Domain-Speicherplatzlimit muss größer oder gleich %d MiB sein",
        "extended_sender_acl_denied": "Keine Rechte zum Setzen von externen Absenderadressen",
+        "external_goto_denied": "Externe Ziel-Adresse %s ist nicht erlaubt",
        "extra_acl_invalid": "Externe Absenderadresse \"%s\" ist ungültig",
        "extra_acl_invalid_domain": "Externe Absenderadresse \"%s\" verwendet eine ungültige Domain",
        "fido2_verification_failed": "FIDO2-Verifizierung fehlgeschlagen: %s",
@@ -727,6 +729,7 @@
        "mta_sts_mx": "MX-Server",
        "mta_sts_mx_info": "Erlaubt das Senden nur an explizit aufgeführte Mailserver-Hostnamen; der sendende MTA überprüft, ob der DNS-MX-Hostname mit der Richtlinienliste übereinstimmt, und erlaubt die Zustellung nur mit einem gültigen TLS-Zertifikat (schützt vor MITM).",
        "mta_sts_mx_notice": "Es können mehrere MX-Server angegeben werden (durch Kommas getrennt).",
+        "mta_sts_active_info": "Wenn nicht angehakt, wird die MTA-STS-Richtlinie nicht veröffentlicht und für die mta-sts-Subdomain kein Zertifikat über ACME angefordert.",
        "multiple_bookings": "Mehrfaches Buchen",
        "nexthop": "Next Hop",
        "none_inherit": "Keine Auswahl / Erben",
@@ -1070,7 +1073,7 @@
        "rspamd_result": "Rspamd-Ergebnis",
        "sender": "Sender (SMTP)",
        "sender_header": "Sender (\"From\"-Header)",
-        "settings_info": "Maximale Anzahl der zurückgehaltenen E-Mails: %s<br>Maximale Größe einer zu speichernden E-Mail: %s MiB",
+        "settings_info": "Maximale Anzahl der zurückgehaltenen E-Mails (pro Mailbox): %s<br>Maximale Größe einer zu speichernden E-Mail: %s MiB",
        "show_item": "Details",
        "spam": "Spam",
        "spam_score": "Bewertung",
@@ -1,6 +1,7 @@
 {
    "acl": {
        "alias_domains": "Add alias domains",
+        "alias_external_goto": "Allow aliases with external goto domains",
        "app_passwds": "Manage app passwords",
        "bcc_maps": "BCC maps",
        "delimiter_action": "Delimiter action",
@@ -434,6 +435,7 @@
        "domain_not_found": "Domain %s not found",
        "domain_quota_m_in_use": "Domain quota must be greater or equal to %s MiB",
        "extended_sender_acl_denied": "missing ACL to set external sender addresses",
+        "external_goto_denied": "External goto address %s is not allowed",
        "extra_acl_invalid": "External sender address \"%s\" is invalid",
        "extra_acl_invalid_domain": "External sender \"%s\" uses an invalid domain",
        "fido2_verification_failed": "FIDO2 verification failed: %s",
@@ -727,6 +729,7 @@
        "mta_sts_mx": "MX server",
        "mta_sts_mx_info": "Allows sending only to explicitly listed mail server hostnames; the sending MTA checks if the DNS MX hostname matches the policy list, and only allows delivery with a valid TLS certificate (guards against MITM).",
        "mta_sts_mx_notice": "Multiple MX servers can be specified (separated by commas).",
+        "mta_sts_active_info": "If unchecked, the MTA-STS policy will not be published and no certificate will be requested for the mta-sts subdomain via ACME.",
        "multiple_bookings": "Multiple bookings",
        "none_inherit": "None / Inherit",
        "nexthop": "Next hop",
@@ -923,6 +926,7 @@
        "filters": "Filters",
        "fname": "Full name",
        "force_pw_update": "Force password update at next login",
+        "force_tfa": "TFA",
        "gal": "Global Address List",
        "goto_ham": "Learn as <b>ham</b>",
        "goto_spam": "Learn as <b>spam</b>",
@@ -1070,7 +1074,7 @@
        "rspamd_result": "Rspamd result",
        "sender": "Sender (SMTP)",
        "sender_header": "Sender (\"From\" header)",
-        "settings_info": "Maximum amount of elements to be quarantined: %s<br>Maximum email size: %s MiB",
+        "settings_info": "Maximum amount of elements to be quarantined (per mailbox): %s<br>Maximum email size: %s MiB",
        "show_item": "Show item",
        "spam": "Spam",
        "spam_score": "Score",
@@ -111,7 +111,8 @@
        "app_passwd_protocols": "Protocoles autorisés pour le mot de passe de l'application",
        "dry": "Simuler la synchronisation",
        "internal": "Interne",
-        "internal_info": "Les alias internes sont accessibles uniquement depuis le domaine ou les alias du domaine."
+        "internal_info": "Les alias internes sont accessibles uniquement depuis le domaine ou les alias du domaine.",
+        "sender_allowed": "Autoriser l'envoi sous cet alias"
    },
    "admin": {
        "access": "Accès",
@@ -556,7 +557,9 @@
        "max_age_invalid": "L'âge maximum %s est invalide",
        "mode_invalid": "Le mode %s est invalide",
        "mx_invalid": "L'enregistrement MX %s est invalide",
-        "version_invalid": "La version %s est invalide"
+        "version_invalid": "La version %s est invalide",
+        "tfa_removal_blocked": "L’authentification à deux facteurs ne peut pas être supprimée, car elle est requise pour votre compte.",
+        "quarantine_category_invalid": "La catégorie de quarantaine doit être l’une des suivantes : add_header, reject, all\""
    },
    "debug": {
        "chart_this_server": "Graphique (ce serveur)",
@@ -755,7 +758,9 @@
        "mta_sts_info": "<a href='https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#SMTP_MTA_Strict_Transport_Security' target='_blank'>MTA-STS</a> est un standard qui oblige la délivrance des courriels entre les serveurs de courriels à utiliser TLS avec des certificats valides. <br>Il est utilisé quand <a target='_blank' href='https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities'>DANE</a> n'est pas possible à cause d'un manque ou d'un non support de DNSSEC.<br><b>Note</b> : Si le domaine du destinataire supporte DANE avec DNSSEC, DANE est <b>toujours</b> préféré – MTA-STS sert seulement en secours.",
        "mta_sts_mode_info": "Il y a trois modes parmi lesquels choisir :<ul><li><em>testing</em> – la politique est seulement surveillée, les violations n'ont pas d'impact.</li><li><em>enforce</em> – la politique est appliquée strictement, les connexions sans TLS valide sont rejetées.</li><li><em>none</em> – la politique est publiée mais non appliquée.</li></ul>",
        "mta_sts_max_age_info": "Durée en secondes pendant laquelle les serveurs de courriel peuvent mettre en cache cette politique avant de revérifier.",
-        "mta_sts_mx_info": "Autoriser l'envoi uniquement aux noms d'hôtes des serveurs de courriels indiqués explicitement ; le MTA émetteur vérifie si le nom d'hôte DNS du MX correspond à la liste de la politique, et autorise la délivrance seulement avec un certificat TLS valide (protège contre le MITM)."
+        "mta_sts_mx_info": "Autoriser l'envoi uniquement aux noms d'hôtes des serveurs de courriels indiqués explicitement ; le MTA émetteur vérifie si le nom d'hôte DNS du MX correspond à la liste de la politique, et autorise la délivrance seulement avec un certificat TLS valide (protège contre le MITM).",
+        "sender_allowed": "Autoriser l'envoi sous cet alias",
+        "sender_allowed_info": "Si cette option est désactivée, cet alias peut uniquement recevoir des courriels. Utilisez les ACL d’expéditeur pour autoriser certaines boîtes aux lettres à envoyer des messages via cet alias."
    },
    "footer": {
        "cancel": "Annuler",
@@ -988,7 +993,8 @@
        "recipient": "Destinataire",
        "open_logs": "Afficher les journaux",
        "iam": "Fournisseur d'identité",
-        "internal": "Interne"
+        "internal": "Interne",
+        "force_tfa": "TFA"
    },
    "oauth2": {
        "access_denied": "Veuillez vous connecter en tant que propriétaire de la boîte de réception pour accorder l’accès via Oauth2.",
@@ -1189,7 +1195,11 @@
        "yubi_otp": "Authentification OTP Yubico",
        "authenticators": "Authentificateurs",
        "u2f_deprecated_important": "Veuillez enregistrer votre clé dans le panneau d'administration avec la nouvelle méthode WebAuthn.",
-        "u2f_deprecated": "Il semble que votre clé ait été enregistrée à l'aide de la méthode U2F obsolète. Nous allons désactiver l'authentification à deux facteurs pour vous et supprimer votre clé."
+        "u2f_deprecated": "Il semble que votre clé ait été enregistrée à l'aide de la méthode U2F obsolète. Nous allons désactiver l'authentification à deux facteurs pour vous et supprimer votre clé.",
+        "force_tfa": "Imposer l'authentification à deux facteurs lors de la connexion",
+        "force_tfa_info": "L’utilisateur doit configurer l’authentification à deux facteurs avant de pouvoir accéder à l’interface.",
+        "setup_title": "Authentification à deux facteurs requise",
+        "setup_required": "Votre compte nécessite l’authentification à deux facteurs. Veuillez configurer une méthode 2FA pour continuer."
    },
    "fido2": {
        "set_fn": "Définir un nom",
@@ -1378,7 +1388,8 @@
        "forever": "Pour toujours",
        "spam_aliases_info": "Un alias de spam est une adresse de courriel temporaire qui peut être utilisée pour protéger les véritables adresses de courriel. <br> De manière optionnelle, une durée d'expiration peut être définie afin que l'alias soit automatiquement désactivé après la période définie, éliminant ainsi les adresses étant abusées ou ayant fuité.",
        "authentication": "Authentification",
-        "protocols": "Protocoles"
+        "protocols": "Protocoles",
+        "pw_update_required": "Votre compte nécessite un changement de mot de passe. Veuillez définir un nouveau mot de passe pour continuer."
    },
    "warning": {
        "cannot_delete_self": "Impossible de supprimer l’utilisateur connecté",
@@ -786,7 +786,8 @@
        "mta_sts_mx_info": "Permite envio apenas para nomes de host de servidor de email explicitamente listados; o MTA de envio verifica se o nome do host DNS MX corresponde à lista de políticas e permite entrega apenas com certificado TLS válido (protege contra MITM).",
        "mta_sts_mx_notice": "Múltiplos servidores MX podem ser especificados (separados por vírgulas).",
        "sender_allowed": "Permitir enviar como este alias",
-        "sender_allowed_info": "Se desativado, este alias poderá apenas receber e-mails. Use a ACL de remetente para substituir essa configuração e conceder a caixas de correio específicas permissão para enviar."
+        "sender_allowed_info": "Se desativado, este alias poderá apenas receber e-mails. Use a ACL de remetente para substituir essa configuração e conceder a caixas de correio específicas permissão para enviar.",
+        "mta_sts_active_info": "Se esta opção estiver desmarcada, a política MTA-STS não será publicada e nenhum certificado será solicitado via ACME para o subdomínio mta-sts."
    },
    "fido2": {
        "confirm": "Confirme",
@@ -1034,7 +1035,8 @@
        "weekly": "Semanalmente",
        "yes": "✓",
        "iam": "Provedor de Identidade",
-        "internal": "Interno"
+        "internal": "Interno",
+        "force_tfa": "A2F"
    },
    "oauth2": {
        "access_denied": "Faça login como proprietário da mailbox para conceder acesso via OAuth2.",
@@ -1086,7 +1088,7 @@
        "rspamd_result": "Resultado do Rspamd",
        "sender": "Remetente (SMTP)",
        "sender_header": "Remetente (cabeçalho “De”)",
-        "settings_info": "Quantidade máxima de elementos a serem colocados em quarentena: %s <br>Tamanho máximo do e-mail: %s MiB",
+        "settings_info": "Número máximo de elementos em quarentena (por caixa de correio): %s <br>Tamanho máximo do e-mail: %s MiB",
        "show_item": "Mostrar item",
        "spam": "Spam",
        "spam_score": "Ponto",
@@ -1001,7 +1001,8 @@
        "weekly": "Tedensko",
        "sieve_info": "Na uporabnika lahko shranite več filtrov, vendar je lahko hkrati aktiven le en predfilter in en postfilter.<br>\nVsak filter bo obdelan v opisanem vrstnem redu. Niti neuspešen skript niti izdan ukaz »keep;« ne bosta ustavila obdelave nadaljnjih skript. Spremembe globalnih skriptov sita bodo sprožile ponovni zagon Dovecota.<br><br>Globalni predfilter sita &#8226; Predfilter &#8226; Uporabniški skripti &#8226; Postfilter &#8226; Globalni postfilter sita",
        "tls_policy_maps_info": "Ta preslikava pravilnikov preglasi pravila odhodnega prenosa TLS neodvisno od uporabnikovih nastavitev pravilnikov TLS.<br>\n  Za več informacij preverite <a href=\"http://www.postfix.org/postconf.5.html#smtp_tls_policy_maps\" target=\"_blank\">dokumentacijo »smtp_tls_policy_maps«</a>.",
-        "internal": "Notranje"
+        "internal": "Notranje",
+        "force_tfa": "TFA"
    },
    "fido2": {
        "known_ids": "Znani ID-ji",
@@ -1077,7 +1078,7 @@
        "rspamd_result": "Rezultat Rspamd",
        "sender": "Pošiljatelj (SMTP)",
        "sender_header": "Pošiljatelj (glava »Od«)",
-        "settings_info": "Največje število elementov za karanteno: %s<br>Največja velikost e-pošte: %s MiB",
+        "settings_info": "Največje število elementov za karanteno (na poštni predal): %s<br>Največja velikost e-pošte: %s MiB",
        "show_item": "Prikaži element",
        "spam": "Neželena pošta",
        "subj": "Zadeva",
@@ -65,6 +65,7 @@ if (isset($_GET['app_password'])) {
      $attr['protocols'][] = 'dav_access';
  }
  app_passwd("add", $attr);
+  $password = htmlspecialchars($password, ENT_NOQUOTES);
 } else {
  $app_password = false;
 }
@@ -4,6 +4,7 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
 if (!isset($_SESSION['mailcow_cc_role'])) {
  $_SESSION['oauth2_request'] = $_SERVER['REQUEST_URI'];
  header('Location: /?oauth');
+  exit;
 }

 $request = OAuth2\Request::createFromGlobals();
@@ -24,6 +25,11 @@ if (!isset($_POST['authorized'])) {
  exit;
 }

+if (empty($_SESSION['mailcow_cc_username'])) {
+  header('Location: /?oauth');
+  exit;
+}
+
 // print the authorization code if the user has authorized your client
 $is_authorized = ($_POST['authorized'] == '1');
 $oauth2_server->handleAuthorizeRequest($request, $response, $is_authorized, $_SESSION['mailcow_cc_username']);
@@ -8,8 +8,12 @@ $ALLOW_ADMIN_EMAIL_LOGIN = (preg_match(
 $session_var_user_allowed = 'sogo-sso-user-allowed';
 $session_var_pass = 'sogo-sso-pass';

+// only the internal nginx auth_request loopback (127.0.0.1:65510) sets this;
+// external clients can never supply it (bare fastcgi param, not an HTTP header)
+$is_internal_auth = (($_SERVER['SOGO_AUTH_INTERNAL'] ?? '') === '1');
+
 // validate credentials for basic auth requests
-if (isset($_SERVER['PHP_AUTH_USER'])) {
+if ($is_internal_auth && isset($_SERVER['PHP_AUTH_USER'])) {
  // load prerequisites only when required
  require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';

@@ -50,6 +54,11 @@ elseif (isset($_GET['login'])) {
    (($_SESSION['acl']['login_as'] == "1" && $ALLOW_ADMIN_EMAIL_LOGIN !== 0) || ($is_dual === false && $login == $_SESSION['mailcow_cc_username']))) {
    if (filter_var($login, FILTER_VALIDATE_EMAIL)) {
      if (user_get_alias_details($login) !== false) {
+        // enforce tenant boundary
+        if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $login)) {
+          header("Location: /");
+          exit;
+        }
        // Block SOGo access if pending actions (2FA setup, password update)
        if (!empty($_SESSION['pending_tfa_setup']) || !empty($_SESSION['pending_pw_update'])) {
          header("Location: /");
@@ -80,7 +89,7 @@ elseif (isset($_GET['login'])) {
  exit;
 }
 // only check for admin-login on sogo GUI requests
-elseif (isset($_SERVER['HTTP_X_ORIGINAL_URI']) && strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 9), "/SOGo/so/") === 0) {
+elseif ($is_internal_auth && isset($_SERVER['HTTP_X_ORIGINAL_URI']) && strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 9), "/SOGo/so/") === 0) {
  // this is an nginx auth_request call, we check for existing sogo-sso session variables
  require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/vars.inc.php';
  if (file_exists($_SERVER['DOCUMENT_ROOT'] . '/inc/vars.local.inc.php')) {
@@ -49,6 +49,7 @@
            <div class="input-group">
              <div class="input-group-text"><i class="bi bi-lock-fill"></i></div>
              <input name="pass_user" type="password" id="pass_user" class="form-control" placeholder="{{ lang.login.password }}" required="" autocomplete="current-password">
+              <button type="button" class="input-group-text" style="cursor:pointer;" onclick="var i=document.getElementById('pass_user'),ic=this.querySelector('i');if(i.type==='password'){i.type='text';ic.className='bi bi-eye-slash';}else{i.type='password';ic.className='bi bi-eye';}" tabindex="-1" aria-label="Toggle password visibility"><i class="bi bi-eye"></i></button>
            </div>
          </div>
          <div class="d-flex justify-content-between mt-4" style="position: relative">
@@ -473,6 +473,10 @@ function recursiveBase64StrToArrayBuffer(obj) {
            window.location.reload();
          } else {
            var msg = (data && data[0] && data[0].msg) ? data[0].msg : 'Password change failed.';
+            // the API returns raw language keys, resolve them like the alert box does
+            if (Object.prototype.hasOwnProperty.call(lang_danger, msg)) {
+              msg = lang_danger[msg];
+            }
            $('#changePWAlert').show().text(msg);
          }
        },
@@ -49,6 +49,7 @@
            <div class="input-group">
              <div class="input-group-text"><i class="bi bi-lock-fill"></i></div>
              <input name="pass_user" type="password" id="pass_user" class="form-control" placeholder="{{ lang.login.password }}" required="" autocomplete="current-password">
+              <button type="button" class="input-group-text" style="cursor:pointer;" onclick="var i=document.getElementById('pass_user'),ic=this.querySelector('i');if(i.type==='password'){i.type='text';ic.className='bi bi-eye-slash';}else{i.type='password';ic.className='bi bi-eye';}" tabindex="-1" aria-label="Toggle password visibility"><i class="bi bi-eye"></i></button>
            </div>
          </div>
          <div class="d-flex justify-content-between mt-4" style="position: relative">
@@ -340,7 +340,7 @@
                  <div class="row mb-4">
                    <div class="offset-sm-2 col-sm-10">
                      <div class="form-check">
-                        <label><input type="checkbox" class="form-check-input" value="1" name="active"{% if mta_sts.active == '1' %} checked{% endif %}> {{ lang.edit.active }}</label>
+                        <label><i style="font-size: 16px; cursor: pointer;" class="bi bi-patch-question-fill m-2 ms-0" data-bs-toggle="tooltip" data-bs-html="true" data-bs-placement="bottom" title="{{ lang.edit.mta_sts_active_info|raw }}"></i><input type="checkbox" class="form-check-input" value="1" name="active"{% if mta_sts.active == '1' %} checked{% endif %}> {{ lang.edit.active }}</label>
                      </div>
                    </div>
                  </div>
@@ -8,6 +8,7 @@

    <input type="hidden" value="default" name="sender_acl">
    <input type="hidden" value="0" name="force_pw_update">
+    <input type="hidden" value="0" name="force_tfa">
    <input type="hidden" value="0" name="sogo_access">
    <input type="hidden" value="0" name="protocol_access">

@@ -165,6 +166,14 @@
        </div>
      </div>
    </div>
+    <div class="row">
+      <div class="offset-sm-2 col-sm-10">
+        <div class="form-check">
+          <label><input type="checkbox" class="form-check-input" value="1" name="force_tfa" id="force_tfa"{% if template.attributes.force_tfa == '1' %} checked{% endif %}> {{ lang.tfa.force_tfa }}</label>
+          <small class="text-muted">{{ lang.tfa.force_tfa_info }}</small>
+        </div>
+      </div>
+    </div>
    {% if not skip_sogo %}
    <div class="row">
      <div class="offset-sm-2 col-sm-10">
@@ -267,6 +267,7 @@
                      <small class="text-muted">{{ lang.admin.password_reset_info }}</small>
                    </div>
                  </div>
+                  {% endif %}
                  <div data-acl="{{ acl.extend_sender_acl }}" class="row mb-4">
                    <label class="control-label col-sm-2" for="extended_sender_acl">{{ lang.edit.extended_sender_acl }}</label>
                    <div class="col-sm-10">
@@ -279,7 +280,6 @@
                      {% endif %}
                    </div>
                  </div>
-                  {% endif %}
                  <div class="row">
                    <label class="control-label col-sm-2" for="protocol_access">{{ lang.edit.allowed_protocols }}</label>
                    <div class="col-sm-10">
@@ -56,6 +56,7 @@
            <div class="input-group">
              <div class="input-group-text"><i class="bi bi-lock-fill"></i></div>
              <input name="pass_user" type="password" id="pass_user" class="form-control" placeholder="{{ lang.login.password }}" required="" autocomplete="current-password">
+              <button type="button" class="input-group-text" style="cursor:pointer;" onclick="var i=document.getElementById('pass_user'),ic=this.querySelector('i');if(i.type==='password'){i.type='text';ic.className='bi bi-eye-slash';}else{i.type='password';ic.className='bi bi-eye';}" tabindex="-1" aria-label="Toggle password visibility"><i class="bi bi-eye"></i></button>
            </div>
          </div>
          <div class="mt-2 text-muted" style="font-size: 0.9rem;">
@@ -42,7 +42,7 @@ services:
            - mysql

    redis-mailcow:
-      image: redis:7.4.6-alpine
+      image: redis:7.4.10-alpine
      entrypoint: ["/bin/sh","/redis-conf.sh"]
      volumes:
        - redis-vol-1:/data/
@@ -65,7 +65,7 @@ services:
            - redis

    clamd-mailcow:
-      image: ghcr.io/mailcow/clamd:1.71
+      image: ghcr.io/mailcow/clamd:1.4.6-1
      restart: always
      depends_on:
        unbound-mailcow:
@@ -84,7 +84,7 @@ services:
            - clamd

    rspamd-mailcow:
-      image: ghcr.io/mailcow/rspamd:3.14.3-1
+      image: ghcr.io/mailcow/rspamd:4.1.4-1
      stop_grace_period: 30s
      depends_on:
        - dovecot-mailcow
@@ -117,7 +117,7 @@ services:
            - rspamd

    php-fpm-mailcow:
-      image: ghcr.io/mailcow/phpfpm:8.2.29-2
+      image: ghcr.io/mailcow/phpfpm:8.2.29-3
      command: "php-fpm -d date.timezone=${TZ} -d expose_php=0"
      depends_on:
        - redis-mailcow
@@ -203,7 +203,7 @@ services:
            - phpfpm

    sogo-mailcow:
-      image: ghcr.io/mailcow/sogo:5.12.8-1
+      image: ghcr.io/mailcow/sogo:5.12.10-1
      environment:
        - DBNAME=${DBNAME}
        - DBUSER=${DBUSER}
@@ -342,7 +342,7 @@ services:
            - dovecot

    postfix-mailcow:
-      image: ghcr.io/mailcow/postfix:3.7.11-2
+      image: ghcr.io/mailcow/postfix:3.10.12-1
      depends_on:
        mysql-mailcow:
          condition: service_started
@@ -385,7 +385,7 @@ services:
            - postfix

    postfix-tlspol-mailcow:
-      image: ghcr.io/mailcow/postfix-tlspol:1.8.23
+      image: ghcr.io/mailcow/postfix-tlspol:1.11.0
      depends_on:
        unbound-mailcow:
          condition: service_healthy
@@ -422,7 +422,7 @@ services:
        - php-fpm-mailcow
        - sogo-mailcow
        - rspamd-mailcow
-      image: ghcr.io/mailcow/nginx:1.30.2-1
+      image: ghcr.io/mailcow/nginx:1.30.4-1
      dns:
        - ${IPV4_NETWORK:-172.22.1}.254
      environment:
@@ -468,7 +468,7 @@ services:
          condition: service_started
        unbound-mailcow:
          condition: service_healthy
-      image: ghcr.io/mailcow/acme:1.97
+      image: ghcr.io/mailcow/acme:1.98
      dns:
        - ${IPV4_NETWORK:-172.22.1}.254
      environment:
@@ -25,6 +25,6 @@ services:
        - /var/run/mysqld/mysqld.sock:/var/run/mysqld/mysqld.sock

    mysql-mailcow:
-      image: alpine:3.23
+      image: alpine:3.24
      command: /bin/true
      restart: "no"