mailcow 2025-03 release notes

This release includes features that have been tested in the nightly branch over the past year. If you’ve been following our nightly progress update, you may already be familiar with some of the changes listed below.

[!CAUTION] Before updating, please ensure you have a current backup of your installation.

This update heavily changes the authentication process. If you don’t want to apply the 2025-03 update, you can switch to the legacy branch with ./update.sh --legacy.
The legacy branch will only receive security updates until February 2026.
Read more about the legacy branch

Breaking Changes

Logins for Administrator, Domain Administrator, and Users have been separated:

Administrator Login: /admin
Domain Administrator Login: /domainadmin
Users: /

Direct SOGo login is now disabled. All unauthenticated requests to /SOGo will be redirected to /.
Users must use the mailcow login.
Administrators can define whether a user should be redirected to the mailcow UI or SOGo after login.

Other Notable Changes

All Alpine-based images have been updated to Alpine 3.21.
2FA protected mailboxes will need an app password for authentication with mail protocols.

New Feature

mailcow now supports external Identity Providers for authentication.
This is optional — administrators can configure an external identity provider, which can be used alongside the SQL database for authentication.
You can even configure which authentication source a specific user should use.

Currently supported Identity Providers:

Keycloak – Documentation
LDAP/AD – Documentation
Generic OIDC – Documentation

Improvements

mailcow now uses Dovecot’s password caching to reduce authentication-related load.

Changelog

Full Changelog: https://github.com/mailcow/mailcow-dockerized/compare/2025-02…2025-03

New Contributors

@marvinruder made their first contribution in https://github.com/mailcow/mailcow-dockerized/pull/6365