'postscreen_blacklist_action' to 'postscreen_denylist_action'
'postscreen_dnsbl_whitelist_threshold' to 'postscreen_dnsbl_allowlist_threshold'

And a 'postconf compatibility_level=3.11'.. then restart Postfix.

So just did a fresh install of iRedMail in a FreeBSD jail using the master repo as the source. Before running the install script, here's a few things I did to make the install go smoothly:

## Pre Install
1. upgrade `pkg` to the latest 2.6.2
2. In the master repo, edit the script 'functions/packages_freebsd.sh' and change
export MYSQL_VER='80' to export MYSQL_VER='84'.

The reason is `pkg` will install 'mysql80-client' and then half way through the install, it will try to install 'mysql84-client' and fail due to conflict. If you select 'Y' to continue, pkg will start uninstalling other packages.

## Post Install
1. Install the following 2 packages:
- py311-passlib
- py311-cheroot

Without this, doing 'python3 iredadmin.py' will throw errors.

2. Edit /usr/local/www/iredadmin/rc_scripts/uwsgi/freebsd.ini and change:
'wsgi-file = iredadmin.py' to 'uwsgi-file = iredadmin.py'

Without this change, going to '/iredadmin/' throws an Internal server error.

So other than those changes, everything works :>

Not sure whether it's modified by amavisd, but Postfix might handle this by default since it has "disable_mime_input_processing = no" and "disable_mime_output_conversion = no" (both are set to "no" by default which means Postfix will do mime processing / conversion), it modifies MIME if it's not RFC-compliant, it's good in your case since you don't have correct "Date:", but it might break DKIM signature too if it happens after signing. Anyway, you already found the solution and it's easy: generate RFC-compliant mime at the very beginning.

No, that actually fixes the symptom, which is failing DKIM signatures.  Fixing the problem would be changing the configuration slightly so that it does the DKIM-signing last and subsequently doesn't wind up changing fields that are protected by the DKIM signature.

I mean, what good is it if the thing DKIM failing was indicating was that the mail was tampered with by an overly-pedantic anti-virus program?

This is just super fun.  I do b'leev I've found a bug in the Amavis configuration.  We've been using iRedMail for a few years now, have SPF and DKIM and all that good stuff working, but are walking away from the previous distribution because reasons.  A brand new box was built with Trixie as the base, DKIM keys were just copied over into Amavis, and everything seemed good.  All the legacy devices  we've got sending mail were sending mail, and then while testing sending authenticated mail from a new internal host that I was spinning up, I started seeing signature failures.  WTF.

Mind you this program worked just fine from the old host and nine or ten others (going through the server running a much older version of iRedMail), and it's literally just a shell script so it's not like I could really have screwed up scp-ing it over, and it just hands the mail to sendmail (which I've been doing for like 20+ years) so... not fancy.  As I started digging into the issue I noticed something in the headers that caught my eye.  The "Date:" header showed -0000 as the timezone which won the stink-eye because the test program just calls $(date) which produces something not quite RFC-compliant ("Wed Apr  8 02:51:27 PM CDT 2026") but it's close enough for testing...or so I thought.  I thought there really should have been a CDT there or something to indicate the time zone wasn't UTC (because I hate converting those in my head).

It turns out that if Amavis doesn't like your date string, it will apparently replace it with a form that is RFC-compliant.  It didn't seem to care at all about my message ID that I forgot to wrap in angle-brackets and just passed that on through but whatevs...

Relevant information: h=message-id:subject:date:from:to;

The kicker is that this configuration apparently "corrects" the date string after it has generated the DKIM signature (which kinda breaks it).  Changing my date generator to using $(date +'%a, %d %b %Y %H:%M:%S %z') made the mails start passing DKIM checks.  That one change.  <<sigh>>

The other "clues" (blatantly fishing for Google with this on behalf of future admins) would be seeing Tests: [ALL_TRUSTED=-1,INVALID_DATE=0.432,INVALID_MSGID=1.167] showing up in the logs.  Again, it won't bother changing the message ID (most MTAs will just generate their own if you didn't specify one) to include <>'s, but it does replace your Date: string.  Heck, until today I didn't even know postfix or Amavis would bother altering the date string.

It was the last line in the file '/usr/local/www/iredadmin/rc_scripts/uwsgi/freebsd.ini'

wsgi-file = iredadmin.py

It should have been 'uwsgi-file = iredadmin.py' instead :<

After changing that, I restarted the jail and try to access /iredadmin/ and it works now..

Edit: I checked with another friend who is testing iRedMail on FreeBSD 15.0-RELEASE and that last line is also 'wsgi-file = iredadmin.py'.. maybe a typo :>

I'm running iRedMail (Ubuntu 22.04, iRedMail 1.6.x) with Fail2ban enabled by default. I noticed that after multiple failed IMAP login attempts (tested via Thunderbird), my IP is not getting banned as expected.

I checked jail.local and confirmed that the dovecot jail is enabled, and the logs do show repeated login failures. It seems like Fail2ban is detecting the events but not actually banning the IP.

Is there any additional configuration needed for Dovecot with iRedMail (e.g., custom filter, log backend, or different log path)?

Thanks!

It's been merged into master branch.

Wow thanks and great work

I have found the problem with the display of the users quotas with dovecot 2.4 service on debian trixie.

In the dovecot.conf file you have those lines:

which defines the name of the users quotas.

But when you query the IMAP server for the quotas, it adds this labelling which makes SOGo not understanding the naming of the quotas.

I commented those two lines and the IMAP server does not display anymore this labelling and permits SOGo interface to display the users quotas.

Hi Zhang, what happened to 'https://github.com/iredmail/iRedMail/ar … ds/pkg.zip' ?

This zip file contains the iRedMail.sh installer that installs binary packages instead of compiling via ports tree.

Thank you for your help anyway.

Regards