SecurityGateway 12.5.2 has been released! | MDaemon Technologies Community Forum
  1. Forum
  2. Security Gateway
  3. SecurityGateway 12.5.2 has been released!

SecurityGateway 12.5.2 has been released!

  • A

    SecurityGateway 12.5.2 is now available! It can be downloaded from https://mdaemon.com/pages/downloads-security-gateway-free-trial.

    SecurityGateway 12.5.2 - 2026-10-13

    CHANGES AND NEW FEATURES

    • [30405] Added support for OpenAI GPT-6 models, such as GPT-6 Luna and GPT-6.1 Sol, in AI Classification. AI prompts that used these models previously failed with an error from OpenAI, even though the model's connection test succeeded.

    FIXES

    • [30811] Fixed custom Sieve scripts sometimes running before built-in filters such as SpamAssassin, DKIM and DMARC instead of in the order shown on Security > Sieve Scripts. The order could also change after any script or filter setting was saved.
    • [30080] Fixed Dynamic Screening adding unnecessary database load to every inbound connection by reloading the domain list each time.
    • [30409] Fixed content filter "Send Note (Alert)" actions with an HTML message being sent as plain text, so recipients saw the HTML markup instead of the formatted message.
    • [30139] Fixed the Japanese administrative quarantine report leaving out the number of days after which quarantined messages are automatically deleted.
    • [30772] Fixed MDaemon XML API user verification sources ignoring the "Verify SSL certificate" and "Check certificate hostname" options, so neither the source nor its Test button could connect to an MDaemon server with a self-signed certificate.
    • [30161] Fixed vulnerabilities that could let a user crash the SecurityGateway service. Upgrading is strongly recommended.
    • [30168] Fixed a security issue in several domain settings pages that could let a domain administrator inject arbitrary sieve script code into system generated sieve scripts.
    • [30286] Fixed a security issue in the XML-RPC API that could let any signed-in user find out whether domains, email addresses or aliases belonging to other domains exist.
    • [30287] Fixed a security issue in the XML-RPC API that could let a domain administrator view mail servers and user verification sources belonging to other domains.
    • [30169] Fixed a security issue that could let spoofed messages forwarded through a trusted ARC sealer pass DMARC verification.
    • [30163] Fixed a security issue in WebAuthn sign-in that could reveal whether an account exists.
    • [30361] Fixed a security issue where a malicious destination mail server could respond to outbound delivery or recipient verification in an unexpected sequence, potentially causing the SecurityGateway service to stop.
    • [30376] Fixed a security issue where a specially crafted message collected from a Remote POP account could be processed for a recipient other than the one it was collected for.
    • [30242] Fixed quotes and angle brackets being saved incorrectly when editing content filter search string.
    • [30241] Fixed double-clicking a Trusted ARC Sealers entry not opening it for editing.
    • [29834] Fixed Retry All not working on the Bad Messages queue. The action now asks for confirmation before retrying the messages currently in the queue.
    • [30072] Fixed Japanese quarantine report emails failing to generate.
    • [30130] Fixed domain administrators being able to change archive store locations. Stores they create now use the automatic creation location, managed by global administrators. Store names cannot contain \ / or : characters.
    • [30189] Fixed content filter "starts with" conditions whose value ends in * acting as an exact match.
    • [30237] Fixed archive export download links not working and old exports not being removed by daily maintenance.
    • [30232] Fixed web interface resources appearing empty to monitoring tools and proxies that do not request compressed responses.
    • [30230] Fixed browsers repeatedly downloading unchanged web interface files instead of using cached copies.
    • [30219] Fixed pop-up editors truncating values containing double quotes or interpreting HTML markup instead of displaying it as text.
    • [30210] Fixed the HELO lookup exclusion for matching PTR records being ignored when it was the only exclusion selected. Re-save the Reverse Lookups page to apply the fix.
    • [30229] Fixed Merge Users addresses being difficult to read in the Dark theme.
    • [16940] Fixed outbound delivery continuing without encryption after a STARTTLS "421 service not available" response. Delivery now tries another mail server or retries later.
    • [20660] Fixed incorrect alias assignments during Active Directory user verification when the primary address uses a domain not hosted by SecurityGateway.
    • [21524] Fixed SecurityGateway stopping another application's ClamAV scanner when starting or restarting its own scanner.
    • [23497] Fixed Show All Headers hiding message content in quarantine report and secure message portal views. Headers now scroll separately.
    • [25141] Fixed DKIM and SPF failure reports being malformed.
    • [29289] Fixed database errors after startup when external Firebird database notifications could not be initialized. Notification failures are now logged without affecting other database operations.
    • [28885] Fixed domain-specific Location Screening settings being unable to allow a country blocked by the global settings.
    • [28653] Fixed the STARTTLS Allowlist being ignored for domains publishing MTA-STS records. Delivery is refused when the allowlist prevents TLS but MTA-STS requires encryption. REQUIRETLS and the STARTTLS Required List still override the allowlist.
    • [28580] Fixed IP blocklist and allowlist entries sorting alphabetically instead of numerically.
    • [28535] Fixed ARC signing failures when ARC verification had not been performed. Signing is now skipped and the reason is recorded in the message transcript.
    • [27726] Fixed Ikarus stopping virus scans and leaving mail in quarantine after its license store was damaged or changed. SecurityGateway now restores the license at startup when needed.
    • [25249] Fixed copied DKIM settings not enabling signing for destination domains. Domains must use their own selector or a shared selector; signing remains disabled until a suitable selector is selected.
    • [30271] Fixed custom reports by recipient or sender domain showing no messages for non-local domains listed after the first domain in the report.
    • [30206] Fixed REST API webhooks subscribed to * along with specific event types only receiving the specific events. Existing webhooks set up this way now receive all events.
    • [30307] Fixed REST API webhook notifications, including test pings, being sent up to 10 seconds (sometimes longer) after the event that triggered them. They are now sent immediately.

    --
    Arron Caruth
Please login to reply to this topic!

Participants