Mailman 3 SaaS

Custom Mailman fork by New IT

We maintain enhanced custom forks of Mailman, which include features and fixes that are not part of the official codebase.

Gitlab.com/TheNewIT

Features

New dont_break_dkim setting for lists

This setting helps preserve DKIM signatures when DMARC mitigation mode is disabled.

Migration to email.message.EmailMessage

This improves compliance with modern email standards for encoding and security, eliminating errors like "Non-ascii sender address" or "InvalidMultipartContentTransferEncodingDefect".

Align defaults with latest features and best practices

Links to Postorius management pages are added to the admin-action-* and admin-notice-* templates. We set new lists as DMARC-mitigated by default and notify owners whenever a member's bounce score increases.

Fixes

Fix crash on user/address deletion with preferred-address memberships

Deleting or unlinking a user's preferred address left behind membership records that crashed Mailman during message delivery and API calls. All code paths that remove a preferred address now properly clean up dependent memberships.

Fix archives full-text indexer error

The annoying "Term Too Long" error in Xapian has been fixed.

Improve multi-site deployment behaviour

Postorius now respects virtual domains in the "From:" header of service emails.

Improve date rendering in HyperKitty archives

Removed relative dates from the HyperKitty search results page and fixed several date-rendering issues across the HyperKitty web pages.

Fix HyperKitty API and search archive exposure

If a mailing list with private archives is switched to the "never" policy without archive deletion, the archive becomes publicly exposed in the /api and /search paths.

Fix account takeover vulnerability

An attacker can attach a victim's email to their own web account - even though they cannot confirm it - and have the next login silently merge the victim's entire Mailman identity into the attacker's. This is most damaging against list owners who only exist in Mailman and never created a web account.

Fix broken DKIM signatures for Apple Mail

In rare cases involving Apple Mail sender devices, Mailman caused the DKIM signature to break on the receiver's end.