What's new¶
The main changes in recent releases and the current version of each module.
28 October 2026¶
- Single sign-on (SAML) 1.1.8: the IdP host is written to the CSRF allow list when the connection is saved and when a test starts, so the test page no longer returns 403. No manual
zmprovcommand. Without patch 122 the list is read only after mailboxd restarts. Details - Single sign-on (SAML) 1.1.7: per-connection Emergency password sign-in (Step 5); when off, error pages hide the password link and
?ignoreLoginURL=1is ignored on the sign-in page (saml-login-guard-install.sh/login-guard.js). Details
23 October 2026¶
- Certificates 1.2.2: Proxy CA now writes the attribute: the CA is saved to
zimbraReverseProxyClientCertCAat global, proxy server or domain scope and the client certificate mode (off/optional/on) is chosen in the same dialog; enabling a mode without a CA and removing the CA while a mode is on are blocked. Earlier versions saved nothing with the stock upload. Details - Certificates 1.2.1: redesigned screen. The header holds Let's Encrypt, Upload certificate and Domain certificate; the other tools (Import wildcard SSL, Install / CSR, View CSR, Proxy CA, Refresh) are in the More menu. Counter cards are colour coded; Let's Encrypt targets are cards with a status pill, relative times and a node list that shows only the roles using the certificate. Details
- Always On: with patch 603 and
zimbra_mysql_external=true,zmstatctlno longer startszmstat-mysql; the stats line ofzmcontrol statusshows Running. On Zimbra 9 (build 1038) the change is applied by hand. Details - Certificates 1.2.0: server and domain certificates are obtained and renewed automatically from Let's Encrypt (HTTP-01, manual DNS TXT or RFC2136/TSIG; wildcards via DNS). The current certificate is not touched until the new one is verified; restarts are manual or at an automatic time, nodes one after another. Upload ready certificate tests a certificate obtained elsewhere and installs it on all nodes. The installation package adds the jetty redirect for HTTP-01;
install.sh --verifychecks the redirect, the proxy port 80 mode and thezmrcchannel between servers. Details
22 October 2026¶
- Dumpster Recovery 1.0: search mail that users deleted even from their trash per account, view it read-only, download .eml or recover it to a folder you choose; every access is audited with a reason and case number. Delegated Admin gains a Dumpster Recovery capability and User Audit gains Dumpster verbs and a case-number filter. Details
- Mail Trace 1.0.0: in the admin console, follow whom a user sent what to from the MTA logs (Log trace), and whom a message reached and whether recipients forwarded it, even with a renamed attachment, from the mailboxes (Content trace). Attachment SHA-256 matching, MTA envelope for Bcc, background jobs, table and tree views, CSV report, SIEM note for MTA log gaps; global administrators and authorized delegated administrators. Details
- Dumpster Recovery and Mail Trace added to the installation package: both modules are in the
install.shmodule list; the admin zimlet and server extension are installed and verification checks both. The COS setting for Dumpster and the MTA helper for Mail Trace are done by hand; the installer prints the commands at the end. Details - User audit 1.2.5: Mail Trace actions (starting a job, cancelling, viewing results, downloading the report, changing the authorized list) appear on the Admin & sessions tab as readable text. Details
21 October 2026¶
- Certificates 1.1.6: the domain certificate window takes a Virtual IP address for several domains on one IP, switches on SNI when it is off, and Check served certificate shows which certificate the proxy really serves for the name. Details
- Patch package (zmpatch), Zimbra PFE 10: the proxy configuration no longer fails with
unknown directive "${web.strict.servername}"when a domain has a virtual IP. - Sensitivity labels 1.0.15: on a received labelled message, restricted actions (reply to all, forward, redirect, print, show original) are greyed out; the label is kept in drafts and replies inherit it. Details
17 October 2026¶
- Always On full HA: on a cluster with a witness, losing any single machine keeps reads and writes going. Directory multi-master (LDAP MMR), Galera + MaxScale, a 3-member ZooKeeper and an OpenSearch cluster; the message store is Ceph or Garage S3 (or an enterprise S3). Guided installation (
install.sh), lab-to-full-HA upgrade (--alwayson-upgrade-fullha), the S3 store extension and online migration of existing messages (blob-migrate). Setup · Operations - Profelis S3 / full-HA message store requires PFE 10: the S3 store extension and the
ceph,garage,s3stores are built and offered only for Zimbra PFE 10; on Zimbra 9 usenfs. - Security fix: log-injection remote code execution hardening for swatch, applied by the installer before and after
zmsetup(runinstall.sh --pre-zmsetupbetween the Zimbra packages andzmsetup; the install fails if the system is still unpatched) and by zmpatch 015 for PFE 9 and 10. The firewall phase now also restricts Zimbra's internal ports to the cluster addresses. - Proxy failover fix: short upstream timeouts on the proxy (
zimbraReverseProxyUpstreamConnectTimeout3 s and related): when the first server is lost, sign-ins now go through the other server (216/216 in the lab test instead of about 1 %). - Always On: the installer sets up ZooKeeper, the shared message store (NFS), OpenSearch, the firewall and database access together with the Always On module; one command (
--alwayson-nodes). Zimbra PFE 10 needs patch 604. Zero-downtime rolling restart (rolling-restart). Setup · Operations - Always On 1.0.7: per-node LDAP, MaxScale and Storage sync columns and a Sync line; the header is never clipped and the columns are aligned; the LDAP CSN comparison tolerates 60 seconds by server ID. Operations
- Single sign-on (SAML) 1.1.5: a published connection takes effect on the sign-in page within about a minute; no restart needed. Details
- Patch package (zmpatch): cumulative package with every patch from the base install to today; identical files are skipped, mailboxd is not restarted when nothing changed, an older package cannot replace a newer one without
--force. Upgrade - Certificates 1.1.4: the toolbar and the domain certificate button are visible; the screen makes a single request when it opens.
- Safer actions: Storage Activate/Deactivate, Backup Purge and LDAP Dump now ask for confirmation; in LDAP sync "Close accounts disabled in AD" is off by default.
- Webmail: the out-of-office alert appears; 2FA opens from the panel; the sign-in page and the recall report follow the user's language; the Nextcloud file list was fixed.
- Interface texts: Turkish letters and English screens fixed in all modules.
October 2026¶
- Certificates 1.1.0: each domain can serve its own SSL certificate on its own address; the key, chain, name and expiry are checked before saving. Details
- Quota 1.1.0: COS mode changes the COS's own quota and keeps individual quotas; domain selector and domain summary. Details
- Share inventory 1.4.0: search above the table header, share time and IP address. Details
- User audit 1.2.0: administrator actions, sign-in and sign-out records; JSON Lines export and a daily archive. Details
- Delegated administrators 1.3.0: an administrator limited to the members of a group (distribution list). Details
Current versions¶
| Module | Version |
|---|---|
| 2FA (user) | 1.0.8 |
| 2FA and passkey policy | 1.1.4 |
| Passkey administration | 1.0.10 |
| Admin UX | 1.0.1 |
| Colour palette | 1.0.3 |
| Always On | 1.0.7 |
| Profelis S3 (message store) | 1.0 |
| Archive | 1.0.13 |
| Backup | 1.4.9 |
| Certificates | 1.2.1 |
| Delegated administrators | 1.3.4 |
| Domain disclaimer | 1.0.11 |
| DLP | 1.0.14 |
| Storage tiers | 1.5.3 |
| GAL | 1.1.9 |
| Account security check | 1.1.6 |
| HA | 1.0.10 |
| Sensitivity labels | 1.0.15 |
| Label policy | 1.1.6 |
| AD sync | 1.0.10 |
| Distribution list permissions | 1.0.5 |
| Mail filters | 1.1.10 |
| Mail Trace | 1.0.1 |
| Mobile device management | 1.2.9 |
| Mailbox move | 1.0.8 |
| Nextcloud | 1.0.5 |
| Nextcloud administration | 1.0.2 |
| Out-of-office alert | 1.0.3 |
| Passkey | 1.0.8 |
| PGP | 1.0.10 |
| Quota | 1.1.3 |
| Recall (administration) | 1.1.4 |
| Recall (webmail) | 1.0.7 |
| Single sign-on (SAML) | 1.1.8 |
| My shares | 1.0.6 |
| Share inventory | 1.4.3 |
| Theme | 1.3.1 |
| User audit | 1.2.5 |
| WAF | 1.0.4 |