Tip: All changes are tracked in the Gateway documentation, see the information in the last row of the documentation agreement.
For the latest 15.0 releases, see https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html
For the latest 14.1 releases, see https://downloads.seppmail.com/extrelnotes/141/ERN14.1.html
For the latest 14.0 releases, see https://downloads.seppmail.com/extrelnotes/140/ERN14.0.html
For the latest 13.1 releases, see https://downloads.seppmail.com/extrelnotes/131/ERN13.1.html
SEPPMAIL Gateway news via Statuspal As of July 2025, SEPPMAIL Secure E-Mail Gateway customers and partners can register for Statuspal messages under the link https://seppmail.statuspal.eu/#subscribe. Information about the Gateway is now also published here.
Release Date: November 3rd, 2026
SEPPMAIL version: 15.1.1
Author: Birgit Grossmann
After creating a managed domain, the page for editing the domain opens automatically. Due to an error, the page did not load correctly, meaning it was not possible to customise the domain. This has been fixed now.
The HTML preview function for templates and disclaimers in the admin GUI had stopped working. This has been fixed now.
Fixed an issue where disclaimer and template configuration JSON files were not written in UTF-8 encoding, which could corrupt special characters. Everything is now in UTF-8.
Added a system configuration option in system.conf to disable the collection of customer summary data, which can take a long time on large installations.
Until now, it was not possible to import a standard backup of a multi-customer system as a new customer onto another system. This is now possible.
Up to now, we have only had the maintenance node in a cluster create and send a database backup. This carries the risk that, if that backup is corrupted, another cluster node would still have a backup available. Now, each node creates a backup again, but only the maintenance node sends it via email.
In version 15.1.0, we introduced a feature to send warning emails if the backup could not be sent. As some customers download the backup via SCP and have therefore not set up any backup operators, they were receiving these warning emails due to the absence of backup operators. We are now able to recognise this situation and will refrain from sending warning emails if SCP backup is configured and no backup operators have been set up.
We have reduced the maximum size of the code dumps to be written to 5 MB. This prevents the /tmp partition from being flooded with core files when a relevant error occurs, while still allowing us to detect it.
The Content-ID headers of disclaimer inline images and attachments are now RFC 2045 compliant.
Added error handling so the database logging page loads correctly even if a log entry contains empty data.
Fixed an issue where rotated mail log files could not be viewed and rebuilding the mail log archive index caused errors.
A bug in the code meant that temporary files were not deleted during mail log indexing, which resulted in the /tmp partition becoming full for customers with a very large number of mail logs whenever everything had to be re-indexed. This has been fixed now.
Adapted the D-Trust MPKI connector to the new connector specification 2.28.
Fixed an issue where the SwissSignREST MPKI connector settings were not loaded in the Admin GUI.
Updated the GlobalSign root CA certificate chain so that GlobalSign certificates can be issued correctly.
Certificate orders via the SwissSignREST connector that are not issued in time are now kept as pending requests and completed later, preventing duplicate certificates.
Fixed a regression where external DNS names could no longer be resolved after a local DNS zone was configured with the built-in DNS resolver. Specifically, the root anchor key for DNSSEC had been updated/replaced. We are now ensuring that it is reloaded.
Fixed an issue in the OpenBSD kernel that prevented hard disks from being detected on Azure systems.
Fixed the error handling of PUT /v1/ssl, which returned an internal server error instead of the actual error message.
Fixed PUT /webmail/domain/{domainName} failing with an internal server error when "Initial password via SMS" is enabled.
If signing or encryption is requested and no key material exists, a key or certificate is now generated automatically (and a local user created if necessary) instead of bouncing the message, provided automatic key generation and user creation are enabled.
In the RuleSet function make_lft, there was an issue when the email to be processed contained recipients for whom LFT was permitted and others for whom it was not. This has now been fixed.
If "Delete expired certificates automatically" and "Automatically check revocation status every day" are enabled, revoked certificates are now deleted automatically as well.
Fixed an issue where the result of a CRL check did not override the OCSP check result, so revoked certificates were not marked as revoked.
From version 15.1.1 onwards, we will only support self-signed PGP keys, and the use of third-party-signed keys will be disabled.
PGP messages that are not actually encrypted (NULL encryption) are now detected and no longer marked as encrypted.
We have implemented support for the QEMU Guest Agent (qemu-ga). This requires only a serial interface.
Fixed an issue where GINA read receipts were only sent for the first recipient of a message sent to multiple recipients.
With this release, the GINAv2 beta phase ends, and the GINAv2 options have been removed from the GINA domain settings. The final version of GINAv2 is nearly complete and will be released soon.
Release Date: September 29th, 2026
SEPPMAIL version: 15.1.0.1
Author: Birgit Grossmann
Fixed internal server error in edit GINA domain page.
Release Date: September 28th, 2026
SEPPMAIL version: 15.1
Author: Birgit Grossmann
It is now possible to test one or all key server connections in the Mail Processing settings.
Test connection(s)
In the past we saw sometimes that the LDAP size increased very fast without any reason. To prevent a complete loss of the DB, we now implemented a bloating detection to warn the admin that something might be broken with the LDAP.
It is now possible to restrict the sections/menus accessible for customer admins. The feature is configured in the Customer Management "Edit settings for customer '<customername>' ".
Edit settings for customer '<customername>'
Example for a restricted menu view
The appliance now also checks the LFM partition regarding the used space. The admin will get a watchdog warning if the LFM partition is over 85% full.
This feature makes it possible to actively send notification mails to external users if their public S/MIME certificate is going to expire, with the request to send us a mail signed with their new S/MIME cert so we can collect it. For the notification mail there are a number of new templates. The admin can create new templates but has to follow the naming convention "cert_expiry_notify_<2 char country code>".
Advanced Settings
New default mail templates in Mail System
Example notification mail
If the creation and/or sending of a backup during the nightly backup fails, we will now add a notification to the admin GUI and add this warning to the daily digest.
In the past we used an openssl shell call for the revocation test against a CRL. Now we use direct Perl code which makes the calls faster and less resource-intensive.
The appliance now also does an audit for all RestAPI calls modifying any data. This gives us the possibility to analyze who added, changed or deleted any data via RestAPI.
A value was missing from the smimeKeyType enumeration in the REST API OpenAPI schema. This resulted in a schema validation error when retrieving a list of certificates if any of them had this missing smimeKeyType. This has been fixed now.
It is now possible to access Postgres from the Rule Engine. For this, a configuration file has to be uploaded in the Mail Processing. See the linked Rule Engine documentation for more details.
Setting without uploaded PostgreSQL configuration
Setting with uploaded PostgreSQL configuration
Starting with 15.1.0 we will add the X-SM-Actions header to every mail processed by SEPPMAIL. We will use this header later in the Outlook AddIn to do a categorization for incoming mail.
This header is also part of the DKIM and ARC signature so a manipulation will be detected. The header will also be deleted before the RuleEngine processes the mail.
To make the code more secure against command injections, we now always use argument escaping whenever we hand over an argument to a shell call.
In one of the Emposo findings it was possible to inject JavaScript code in the Admin GUI via a manipulated Message-ID. We fixed it and added some more mechanisms to prevent this kind of attack.
This is one of the Emposo findings. It was possible for a RestAPI token without MSP privileges to add, change or delete RootCA certificates. Now only MSP token are allowed to do so.
There was a bug in the CSS parsing software when handling the attributes of a CSS class that were already specified. This lead to a situation where both attribute values were written to the secure-email.html. This has been fixed now.
In the GINA Domain settings in the "Write GINA Email" section it is now possible to restrict the file types of uploaded attachments. These follow the same rules as the type parameter of the partoftype() RuleSet function.
Restrict mail attachments to configured MIME types
--- end of document ---