Issues

• [Low] Greylisting delays first-contact mail (2FA codes, password resets) with no way to tune it

  byjpr/mailserver#24 · Filter by author byjpr opened on Oct 9, 2026
  1

• [Low] Installer image is fetched from GitHub at install time

  byjpr/mailserver#23 · Filter by author byjpr opened on Oct 9, 2026

• [Low] Mail is stored unencrypted at rest

  byjpr/mailserver#22 · Filter by author byjpr opened on Oct 9, 2026

• [Low] GitHub Actions are pinned by tag, not commit

  byjpr/mailserver#21 · Filter by author byjpr opened on Oct 9, 2026

• [Low] No virus scanning, and no way to turn it on from settings.nix

  byjpr/mailserver#20 · Filter by author byjpr opened on Oct 9, 2026

• [Low] Any local process can control Rspamd (world-writable controller socket)

  byjpr/mailserver#19 · Filter by author byjpr opened on Oct 9, 2026

• [Low] Repository contents: mailbox list exposure and git-history ciphertexts

  byjpr/mailserver#18 · Filter by author byjpr opened on Oct 9, 2026

• [Medium] Untested code paths: relay credentials file permissions, OVH reinstall, first boot on each provider

  byjpr/mailserver#17 · Filter by author byjpr opened on Oct 9, 2026

• [Medium] Legitimate mail is rejected: mailing lists under DMARC enforcement, and apps sending as our domain

  byjpr/mailserver#16 · Filter by author byjpr opened on Oct 9, 2026

• [Medium] Nothing verifies that outbound port 25 actually works

  byjpr/mailserver#15 · Filter by author byjpr opened on Oct 9, 2026

• [Medium] Existing DNS records collide with generated ones (duplicate SPF, extra MX)

  byjpr/mailserver#13 · Filter by author byjpr opened on Oct 9, 2026

• [Medium] First install trusts the stock image's SSH host key blindly, then uploads the server's private host key

  byjpr/mailserver#12 · Filter by author byjpr opened on Oct 9, 2026

• [Medium] fail2ban can lock legitimate users out for up to a week

  byjpr/mailserver#11 · Filter by author byjpr opened on Oct 9, 2026

• [Medium] Disk exhaustion: no default mailbox quota

  byjpr/mailserver#9 · Filter by author byjpr opened on Oct 9, 2026

• [High] Account and credential hygiene: the real perimeter is undocumented, and the netcup token is printed to the terminal

  byjpr/mailserver#8 · Filter by author byjpr opened on Oct 9, 2026

• [High] No backups on OVHcloud, netcup or Serverspace

  byjpr/mailserver#6 · Filter by author byjpr opened on Oct 9, 2026

• [High] Patching is manual: kernel updates never take effect and update PRs are merged without CI

  byjpr/mailserver#4 · Filter by author byjpr opened on Oct 9, 2026