Changes for version 4.20261111 - 2026-11-11
- Core: Unfold folded header values and escape control characters when logging, so each entry stays on a single line.
- Core: Harden permissions of the dequeue and generated /tmp directories, and only read queue files owned by the milter user.
- Core: Refuse objects in dequeue items. NOTE: Custom handlers which pass objects to add_dequeue must convert them to plain data.
- DMARC: Queue aggregate reports as plain data. Reports queued by an earlier version will not be sent.
- DMARC: Fix a security issue where a domain could escape DMARC evaluation when a From header did not fully parse, for example due to an empty list member. Empty list members are now accepted, domains are evaluated from every mailbox which has one, and a From header which can not be fully parsed is reported as dmarc=permerror and the mail quarantined. Mail with no parseable From domain is also quarantined.
- DMARC: strict_multifrom now also applies to multiple From headers, not only multiple From domains.
- IPRev: Results now follow RFC 8601 section 2.7.3. Previously every unverified connection was reported as iprev=fail.
- Transient DNS errors (SERVFAIL, timeout etc) on the PTR lookup, or on the forward lookup for the connecting IP address family, now give iprev=temperror.
- No PTR data for the IP (NXDOMAIN or no records) now gives iprev=permerror.
- Reaching the lookup limit now gives iprev=permerror.
- iprev=fail is now only used when the forward and reverse lookups completed but did not match. Policy keyed on iprev=fail may need to consider these results.
- IPRev: Fix forward lookup errors being double prefixed in the comment, and report the errors for each host which did not verify. Forward lookups stop once the lookup limit is reached.
- Sanitize: Ignore trailing dots when matching the authserv-id of received Authentication-Results headers, so a header claiming to be from a local host in fully qualified form (host.example.com.) is removed.
- DKIM: Limit the DNS lookups started early while headers are received to early_lookup_limit (default 10) per message, and skip duplicates. Only look up ADSP early when check_adsp is enabled.
- XGoogleDKIM: Limit early DNS lookups as for DKIM.
- ARC: Accept a bare domain in smtp.mailfrom of trusted SPF results, as used by Microsoft and AOL. Skip results whose smtp.mailfrom does not yield a domain, rather than passing them to DMARC with an empty domain.
- ARC: Fix trusted DKIM results with header.i but no header.d being ignored.
Documentation
A Perl Mail Authentication Milter
Manage the Authentication Milter Block List
A Perl Mail Authentication Milter client
Work with Authentication Milter logs
Modules
A Perl Mail Authentication Milter
App::Cmd base class
Command to add a block to a given file
Command to delete a block for a given file
Command to list current blocks for a given file
App::Cmd base class
Command to convert an authentication milter arex log back into an A-R header
Client for connecting back to the authmilter server
Load config files for Authentication Milter
Define and export useful constants
Class representing an exception
Load and serve static files via the in-built http server.
Handler superclass
Handler class for ARC
Handler class for sending data to Abusix
Example handler class
Handler class for Address alignment
Handler class for SMTP Auth
Handler class for BIMI
Block mail based on simple rules
Handler class for DKIM
Handler class for DMARC
Handler class for IPRev
Handler class for Local IP Connections
Handler class for logging of headerss
Handler class for PTR checking
Handler class for RBLDNS checks
Handler class for Checking Return address validity
Handler class for SPF
Handler class for Removing headers
Handler class for SenderID
Handler class for message size metrics
Handler class for TLS
Timeout Tester
Handler class for Trusted IP addresses
Handler class for Google specific DKIM
Class for metrics generation
Class for Grafana dashboards
Local modified copy of Net::Milter
Patches to Net::Server::PreFork
Setup system wide pragmas
Milter protocol handling
SMTP protocol handling
DNS Recolver methods
Class used for testing
Class for testing handlers