Learn Mailserver - Modern Features & Roadmap

#Introduction

Throughout this series you've been using the latest component versions without ever stopping to ask: what's new? Episode 21 answers that. We dissect Postfix 3.11, Dovecot 2.4, and Roundcube 1.7 — releases that each brought significant changes in 2026 — then close with the industry trends that will shape how you manage a mail server in the years ahead.

We'll also learn how to verify the running versions and read release notes, so your upgrade decisions are always fact-based.

#Verifying the Running Versions

Before discussing the releases, make sure you know what's running on the server:

postconf mail_version
dovecot --version
php /var/www/webmail/bin/console version

• postconf mail_version — the Postfix version (target 3.11.5).
• dovecot --version — the Dovecot CE version (target 2.4.4).
• bin/console version — the Roundcube version (target 1.7.2).

Also check the feature support that affects security:

postconf smtpd_forbid_bare_newline

The habit of recording versions in your server documentation (episode 22) makes upgrades an accountable process: you know what's running, when it was last updated, and what to check afterward.

#Postfix 3.11

Postfix 3.11 was released March 2026, with maintenance point release 3.11.5 in July 2026. Three things stand out:

• Berkeley DB migration — support for the hash: and btree: lookup tables based on Berkeley DB is being dropped on a number of distributions. That means configurations using hash:/etc/postfix/virtual need to migrate to the new format recommended by the distro, or use another backend like lmdb:. This directly affects episode 10, which uses hash:.
• CVE fixes — Postfix 3.11.5 closes CVE-2026-43964, a DoS vulnerability. The 3.10, 3.9, and 3.8 release classes are also still actively maintained (3.10.12, 3.9.13, and 3.8.19 respectively), while 3.7 is officially EOL since March 2026.
• Modern TLS support — continues to align with the latest ciphers and protocols; episodes 6 and 18 take advantage of it.

#Lookup Table Migration

Migrating from hash: to lmdb: is as simple as changing the format and rebuilding the database from the source file:

sudo postconf -e 'virtual_alias_maps = lmdb:/etc/postfix/virtual'
sudo postmap lmdb:/etc/postfix/virtual
sudo postfix check
sudo postfix reload

postmap lmdb:/etc/postfix/virtual reads the text file and produces the virtual.lmdb database. Do the same for every map that uses hash: — and test with postmap -q afterward.

A word of practice for you: don't stick with 3.7; plan the upgrade to 3.11 and test the lookup table migration before switching over fully.

#Dovecot 2.4

Dovecot CE 2.4.0 (2025) is the first major release in over a decade — its changes touch the foundations, not just features. The key points for you:

• Config rewrite — the variable system was overhauled: the %u syntax from the 2.3 era is replaced by the %{user} syntax. Old tutorials (including some in this series when referenced from older sources) need adjustment when reading 2.4 documentation.
• Rootless Docker image — the official image can run without root, making modern container deployments easier.
• Experimental IMAP4rev2 & SMTPUTF8 — preparation toward the next-generation IMAP standard and international email addresses.
• SCRAM-SHA-PLUS & TLS channel binding — stronger authentication that binds credentials to a specific TLS session.
• Ongoing CVE fixes — 2.4.4 (May 2026) closes a number of flaws in lib-var-expand, the Sieve CPU limit, base64 TLS binding, IMAP ACL, and a memory DoS. That's why dovecot --version should always target 2.4.4.

#Preparing the 2.3 to 2.4 Migration

Before moving to 2.4, find every use of the old syntax in your configuration:

grep -R "%u" /etc/dovecot/ || echo "no old-style variables found"

grep -R "%u" /etc/dovecot/ will find remnants of 2.3 syntax. Replace %u with %{user}, %d with %{domain}, and %n with %{user:user} per the official guide. Do the migration on a test server first, then verify a clean doveconf -n before cutting over production.

Your dovecot --version should show 2.4.4 — if it's still 2.3.x, schedule the migration by reading the official 2.3 → 2.4 guide.

#Roundcube 1.7

Roundcube 1.7.0 (May 2026) is a major release that demands attention:

• Mandatory public_html/ entry point — since 1.7, public files must live in public_html/, not the directory root. Episode 8 already applied this — good.
• Enhanced OAuth2/OIDC — identity mapping and SSO flows are more mature, supported by episode 20.
• Markdown mail rendering — Markdown-formatted email displays nicely.
• Quick actions menu — fast access to common actions directly from the email list.
• Ongoing security — 1.7.1 and 1.7.2 (July 2026) close CVE-2026-54432/54433 and improve the TNEF parser. Still-maintained LTS releases: 1.6.17 and 1.5.15.

#Upgrade Path

Roundcube provides bin/installto.sh to update an existing installation:

sudo php /var/www/webmail/bin/installto.sh /var/www/webmail-1.7.2/

This script copies files, migrates the config, and updates the database schema. Back up the database and the webmail directory before running it — episode 12 is your best friend at this point.

Always verify available releases from the official source roundcube.net/download, and follow the latest releases at github.com/roundcube/roundcubemail/releases.

#2026 Industry Trends

Beyond the three components, the industry directions that affect your decisions:

• AI-based spam filtering — heuristic filters are now joined by machine learning models; some providers integrate them on top of SpamAssassin.
• DMARC enforcement increasingly mandatory — big mailbox providers are starting to require DMARC reject; email without strong authentication is getting harder to survive (episode 17).
• IPv6-native MX — MX with IPv6 addresses is going mainstream; make sure your DNS and firewall are ready for AAAA.
• Managed email from distro repos — distributions are starting to offer integrated mail server packages as an alternative to manual install.
• Increasing MTA-STS adoption — more domains adopt MTA-STS (episode 18), reducing TLS downgrade attacks.

#Conclusion

Episode 21 is done. Key takeaways:

• Postfix 3.11: Berkeley DB migration, CVE-2026-43964 closed, 3.7 is now EOL.
• Dovecot 2.4: config rewrite %{var}, rootless Docker, SCRAM-SHA-PLUS, and many CVE fixes in 2.4.4.
• Roundcube 1.7: mandatory public_html/, mature OAuth2/OIDC, Markdown rendering, CVEs closed in 1.7.2.
• 2026 trends: AI anti-spam, mandatory DMARC, IPv6-native MX, growing MTA-STS.
• Always verify versions and read release notes before upgrading.

The release map is clear. In episode 22 — the final episode — we bring everything together: Ecosystem, Alternatives & Final Reflections — comparing solutions, deciding when to self-host, and closing with a complete production checklist. See you in episode 22!