Kontrol7

The web server is now chosen per server - nginx, OpenLiteSpeed, LiteSpeed Enterprise or Apache - with nginx in front available as a switch. Every site on a server is served by that server's choice.

Added

• nginx in front is a switch you can turn on for any server. Tick nginx in front and nginx answers on ports 80 and 443 and passes requests to the server's web server. In this release Apache and LiteSpeed Enterprise run with nginx in front; OpenLiteSpeed runs either way.

Changed

• Each web server has one web server, chosen by you. Giving a server the web role now asks which web server it runs: nginx, OpenLiteSpeed, LiteSpeed Enterprise or Apache. Nothing is chosen for you. Change it any time on the server's page, on its Web server card. Every site on that server is served by it, and sites' files and data stay exactly where they are whichever web server reads them.

Removed

• No more web server choice per website. The website form and the site's Advanced tab no longer choose a web server; the site's page shows which web server its server runs.

Upgrading

Updating changes no server. A server set up before this release shows Not chosen yet on its Web server card and keeps serving exactly as before until you choose.

A web server can now answer your sites itself: OpenLiteSpeed can serve every site on a server directly, chosen on the server's page. HTTP/3 also starts working.

Added

• OpenLiteSpeed can serve a web server's sites directly. A web server's page has a Front door card. Choose OpenLiteSpeed and it answers every site on that server itself: HTTPS with each site's own certificate, HTTP/3, redirects, maintenance and suspended pages, security headers, password-protected folders, address allow and deny lists, and LSCache for WordPress, Joomla and Flarum. PHP still runs in each site's own container. The server takes over only once it has accepted its configuration, and the previous arrangement is put back automatically if it does not answer. nginx in front of each site's own server remains available as a choice.
• The switch says plainly what would stop it. It is refused, naming the sites concerned, while a server has no per-site containers, serves webmail, or hosts sites that use country rules, hotlink protection, the web application firewall, custom nginx rules, routes, a dedicated IP address or the white-label control panel address.

Fixed

• HTTP/3 now works where it is switched on. The firewall kept the port HTTP/3 uses closed, so browsers quietly fell back to HTTP/2. It is opened together with the setting now.

Upgrading

Updating changes no server: each keeps the arrangement it has until somebody chooses another on its page.

Why

LiteSpeed's strengths - its own HTTPS and HTTP/3, its cache, .htaccess handled natively - are at the front door. Behind nginx most of that was out of reach.

Ask now opens from the top bar, beside whatever you are looking at, instead of the old readings panel.

Changed

• Ask opens in a side panel from the top bar. The button at the top of every page now opens Ask on the right, without leaving the page. On a website, database, mailbox, DNS zone or server page it starts from that one thing; anywhere else it asks about your whole account. The conversation is the same one the Ask page holds, so Open as a page carries on where you left off. You can pin the panel open beside your work on wider screens.

Fixed

• Closing a pinned side panel no longer leaves an empty strip on the right. On phones a pinned panel also no longer reopens over the page each time it loads, and it closes with Escape or a tap outside.

Removed

• The readings panel is gone. It showed a few current numbers on website and server pages only, and those pages already show them.

Preview addresses are published as soon as the platform updates, rather than at the next daily check.

Fixed

• Preview addresses start working right after an update. The preview wildcard is now published every time the platform starts, so a change in where it belongs reaches DNS with the update itself rather than up to a day later.

A calmer, consistent panel: every list acts through one menu per row, results open in a proper dialog, and the panel never offers an action that makes no sense on your own record. Preview addresses now work when the preview zone sits under a domain you host, and inviting someone is one step.

Added

• Invite someone in one step. Enter their email, name and account: the sign-in is made and an invitation sent, and they set their own password from the link. Your own row offers only Change your password.

Changed

• Every list acts through one menu per row. Lists across the panel (servers, addresses, databases, DNS records, mail, websites, accounts, users and more) put their row actions in a single menu, with destructive actions last, marked in red and confirmed in a dialog. Tables fit their cards; passwords, links and answers open in a dialog with a copy button instead of inside a row.
• Create actions are at the top of each list. Add a node, New database, New domain, Enable mail on a domain, New account, New project, New private network and Invite someone sit in the page header and open their form at the top.

Fixed

• Actions that delete or suspend now ask first. Suspending an account and deleting a queued mail message were one click; they now ask in a dialog. Platform-owned sites cannot be suspended or deleted from the list.
• Preview addresses work under a domain you host. When the preview zone is a name under a zone this platform hosts (preview.example.net with example.net hosted), its wildcard is published there.
• The Platform page reports the panel address and server names correctly. The panel address you gave the installer is recorded automatically, and the page no longer claims server names exist nowhere when they resolve from a zone above them.

Visitors to a site on OpenLiteSpeed, Apache or LiteSpeed Enterprise now see this platform's own pages when the site is empty or its server is down, and the Users page is tidied up.

Changed

• The Users page keeps each person's actions in one menu. Send an invitation, Reset password and Delete sign-in are in a single menu on each row, and the table fits its card. An invitation link or new password opens in a dialog with a copy button rather than inside the row.

Fixed

• An empty site shows the platform's own page on every web server. A site with nothing published yet shows "Nothing is published here yet" whether it runs on nginx, OpenLiteSpeed, Apache or LiteSpeed Enterprise. Before, a site on OpenLiteSpeed answered that server's own 404 page, and the website list marked it as a site error.
• When the web server behind a site is down, visitors see the platform's page. A 502, 503 or 504 from OpenLiteSpeed, Apache or LiteSpeed Enterprise is replaced by the platform's own page for that error. A site's own 404 and 500 pages, such as WordPress's, are left as they are.

Domains whose DNS is at Cloudflare are now managed for you as soon as your Cloudflare token is saved, and the panel tells you what the internet actually sees, not only what kstack holds.

Added

• A domain at Cloudflare is linked and published by itself. When a domain's nameservers are Cloudflare's and a saved Cloudflare token can see that zone, kstack links it and sends its own records (mail, website, DKIM) to Cloudflare. It changes only the records it keeps and leaves everything else in the zone untouched. It runs when the domain is added, when a token is saved, and daily. Tokens can now be saved under Settings, DNS.
• Every server address says why its reverse name is not set. On the Addresses page, an address whose reverse name could not be set shows the reason, and a server with no usable public address is listed with what to fix.

Changed

• DNS and mail health reflect what the internet sees. A domain delegated elsewhere and not linked no longer shows as Published; it says where it is delegated and how to fix it. A mail domain whose public MX points somewhere other than its mail server shows MX elsewhere and names the address mail is going to.
• The Domains page lists domains. One row per domain, with its other names (www, ftp, aliases) inside the row. Searching for a subdomain finds the domain that holds it.

Why

A domain added while its DNS stayed at Cloudflare was served only from this platform's own nameservers, which nobody asks, while the panel said "Published" and "Delivering". Mail kept going to an old server until someone linked the zone by hand.

Each website's PHP now runs in its own container by default, not only its web server.

Changed

• New web servers serve each site's PHP from the site's own container. The default under Settings, New nodes, is now on. You can still switch a server back to its shared PHP on the server's Services tab.

Fixed

• Servers given containers by the last update now serve PHP from them too. A web server that the platform gave containers automatically in the previous update is switched over to serving PHP from them once. A server whose containers you configured yourself is left exactly as you set it.

Upgrading

After the update, each PHP site on an affected server is moved into its own container on the server's next cycle. Expect a short pause on each site while its container's PHP starts.

Why

A container per site is only half of isolation: until its PHP runs inside it, every site still shares one PHP process, one set of modules and one PHP version. Servers that were given containers in the previous update kept their PHP on the shared process.

Choose the web server for each website: nginx, OpenLiteSpeed, Apache, or LiteSpeed Enterprise on a server where you have a licence. Web servers now run each site in its own container by default.

Added

• Apache as a web server for any PHP site. On the site's Advanced tab, choose Apache (.htaccess) in the site's container. Apache runs inside that site's own container in front of its PHP and reads .htaccess on every request, the way customers coming from other hosts expect. WordPress and Joomla rules are rewritten for it when you switch.
• LiteSpeed Enterprise, licensed per server. On a web server's page, under Services, enter your LiteSpeed Enterprise serial (or request a 15-day trial). kstack installs it, registers the licence, and shows its state, the address it is locked to, and whether it answers. Sites on that server can then be switched to LiteSpeed Enterprise, and you can make it the default for new sites there. A lapsed licence or a changed server address is named as the cause on every affected site.

Changed

• New web servers run each site in its own container by default. A web server you add gets per-site containers unless you turn them off on its page. Existing web servers that never had them get them once after this update; a server you deliberately switched to a full web server without containers is left as it is.

Fixed

• OpenLiteSpeed sites no longer hang on a server without per-site containers. Such a site waited on a name lookup that could never answer. OpenLiteSpeed is now offered only where it can run, and a site already set to it on such a server is served by PHP-FPM until containers are on.
• A nameserver run elsewhere from your zones is left alone. If one of your nameserver names points at a secondary nameserver that takes your zones by transfer, kstack no longer points it at one of its own DNS servers.
• Server names and reverse DNS are brought up to date after an update. Server names and their reverse names are now refreshed every time the platform starts, so an update reaches them without waiting for the daily check.
• Removing a mail server's relay no longer fails. Taking a smarthost relay off a mail server answered with an error; it now removes the relay and its stored password.

Upgrading

Web servers without per-site containers are given them once after this update, unless you turned them off yourself. Sites keep serving while the containers are built. LiteSpeed Enterprise needs your own LiteSpeed licence.

Why

Customers moving from other hosts expect Apache's .htaccess behaviour or LiteSpeed's speed, and a host should be able to offer both. Per-site containers keep one customer's website apart from another's; they used to be off by default on a new web server, which left OpenLiteSpeed sites with nowhere to run.

Reverse DNS for your servers now sets itself. Save your Hetzner Cloud token or Robot web-service login once, and every server address gets a reverse name that matches its forward name.

Added

• Every server address gets its reverse name at Hetzner automatically. kstack asks Hetzner Robot and Hetzner Cloud which of them holds each of your servers' addresses, records it, and sets the reverse name once the server's own name resolves back to that address. It runs when you save the credentials, when a server's addresses change, and once a day. The Addresses page shows the state of each address: set, sent, waiting for its name to resolve, not found at Hetzner, or no credentials.
• Server names resolve in the zone above them. If your servers are named under ks.example.net and you host example.net, their names are published there. You no longer need a separate zone for the server names. Only public addresses are published; a server's private container network never appears in public DNS.

Changed

• Your nameservers are named as you publish them in notices. Notices about a DNS server call it by its nameserver name, such as ns1.example.net, rather than its machine name.

Fixed

• Reverse DNS on Hetzner dedicated servers is updated, not refused. Setting a reverse name through Robot used a call that only creates a new entry, which Hetzner refuses for every dedicated address that already has its default name. It now creates or updates.

Upgrading

Nothing to do if your Hetzner credentials are already saved under Settings, Reverse DNS: the first sync runs after the update. Check the Addresses page about ten minutes later.

Why

Mail servers and many blocklists check that a sending address has a reverse name pointing back to a name that resolves to it. Until now, saving the Hetzner credentials only stored them: nothing asked Hetzner which addresses you hold, server names did not resolve in a zone above them, and Robot's create-only call would have been refused for every dedicated address, because each one already has Hetzner's default name.

Your platform's own DNS zone now looks after itself. Save your nameserver names and kstack creates the zone they live in, points them at your DNS nodes, and keeps them there.

Added

• Saving your nameserver names creates the zone they live in. Save ns1/ns2 under Settings → DNS → Nameservers and kstack creates the parent zone (for example example.net) on your DNS nodes. If you save them before any node holds the DNS role, the zone is created as soon as one does.
• ns1 and ns2 always point at your DNS nodes. Each nameserver name gets the A and AAAA records of one DNS node and keeps them. When a node's address changes, its name follows on the node's next report. A record you typed by hand at a nameserver name is replaced by the correct one, and every change is in the activity log.
• The panel's own address is added to the zone. If the zone has no address for your panel's hostname, kstack adds the one the panel answers on. A record you already set there is left alone.

Upgrading

Nothing to do. If your nameserver names were already saved, the zone and its records appear after the update, the next time a DNS node reports or when you press Check and repair.

Why

Before this, saving nameservers like ns1/ns2.example.net did not create the zone those names live in, and nothing put records for them in it, so a freshly installed platform's DNS could not answer even with the glue records set at the registrar.

Setting up a new platform now leads you through it step by step, starting with DNS, and the installer works cleanly on a fresh Debian 13 server.

Changed

• The setup list on the dashboard starts with DNS, in order.
  1. Add two DNS machines. 2. Choose your nameserver names (any names you like, for example ns1.yourdomain.com). 3. Point those names at the machines: the list shows the exact records to add at your registrar and ticks itself once they work. Then add a machine for websites, backups and the rest. Each step is numbered.
• Choose what a server is for when you add it. Nodes → Add node now asks "What is this machine for?": websites, DNS, databases, mail, backups, or everything except mail. The role is set straight away, with no second visit to the node's page. The name is optional.
• Your nameserver names come first on Settings → DNS. They used to sit below every other DNS setting. Node naming is now marked optional, and a DNS server's page shows your own nameserver names instead of offering a name based on the machine.

Fixed

• The installer works through the two-line install on a fresh Debian 13 server. Files it created were readable only by root, which stopped the package manager from reading a signing key. It now uses normal permissions; secrets are still created readable by root only.
• A new DNS record is no longer reported as missing during install. When the server still holds an older answer, the installer checks public DNS, says what it found, and carries on.

Security

• The panel build no longer sends usage data from your server. The web framework's anonymous telemetry is switched off during installs and updates.

Upgrading

Nothing to do. Update from Panel → Updates. The dashboard's setup list then shows where your platform stands.

Why

Setting up DNS meant visiting four different places in the right order with nothing saying what that order was, and the page offered nameserver names you would never use. The dashboard now lists the steps in order, shows the exact records to add at your registrar, and ticks each step only when it is really done.

Staging copies of any website can be named for you on your own staging domain, and webmail now shows the time zone you choose.

Added

• Settings → Domains → Staging domain zone. Set a domain your platform serves, for example lbreeze.dev. A staging copy made without a name is then named on it automatically, as -<6 characters>., with its address published and its own certificate. This works for every kind of website: PHP, Node, Python, static and WordPress. A name you type yourself still works.

Changed

• The staging copy's name is optional on the website page. Leave it empty to have it named for you. Customers cannot type a name inside the platform's staging domain; only the platform hands those out.

Fixed

• Webmail's time zone now takes effect on kmail mail servers. The webmail program could not look up named time zones, so it showed every time in UTC whatever was set. Each mail server now repairs this on its next check and restarts webmail once.

Upgrading

To use a staging domain, the domain must be served by your platform's DNS servers. Then set it under Settings → Domains → Staging domain zone. Update your mail servers' agents with the control plane so webmail picks up its time zone.

Why

A staging copy used to need a name typed in, and the platform's own domains could not be used for one. You can now set a staging domain once, and every copy is named, addressed and certified on it automatically. The time-zone setting from 1.228.0 also takes effect on kmail mail servers in this release.

Domains served by Cloudflare show their real state, retired blocklists no longer report addresses as clean, webmail can show your time zone, and the digest subject reads properly.

Added

• Settings → Mail → Webmail time zone. Webmail shows message times and calendar entries in this zone for everyone who has not picked their own, instead of UTC. On kmail mail nodes it takes effect from version 1.228.1.

Fixed

• A domain served by Cloudflare no longer shows "Applying" forever. Once Cloudflare has accepted every record, the domain shows as up to date. If Cloudflare refuses a record, the domains list says "Publish failed" with Cloudflare's own reason.
• A blocklist that is not working is no longer counted as "clean". Before each check, every blocklist is asked about its own test address. One that does not answer is reported as not answering, never as a clean result. The retired SORBS lists are removed from the choices and from saved settings.
• Mail settings checkboxes sit beside their own labels.
• The activity digest says "1 thing happened", not "1 things happened".

Upgrading

Set Settings → Mail → Webmail time zone to your own zone, for example Europe/London. Domains served by Cloudflare correct themselves within five minutes of the update.

Why

Each fix here started from something on the live panel that looked wrong: a domain stuck at "Applying" with every record already published, two retired blocklists ticked in Mail settings that could only ever say "clean", and webmail times an hour out all summer.

Security release. Update promptly.

Updates can only ever come from our update server, and release signatures are checked only against the key built into kstack.

Security

• The update server's address is built into kstack and can no longer be changed in a configuration file. Installer and updater settings files are read as plain values and are never run as scripts. The licence key is sent only to the update server itself, never to a download address elsewhere.
• Release signatures are checked only against the signing key built into kstack. A release signed by any other key is refused, with a message naming both keys. A new signing key arrives inside a kstack release, signed by the key it replaces; it is never learned from the network.
• Zephyr downloads send your Zephyr licence only to the update server. A download or signature address on any other host is refused before the licence is sent.

Upgrading

Nothing to do. The first update onto this release still runs your box's previous updater, so an old update-address line may stay in the service file until the next update. The new program ignores it either way.

Why

Until now the address kstack fetched its updates from could be changed in a configuration file, and the update server could introduce a new signing key. Someone able to edit that file, or to answer in the update server's place, could have offered a box an update it would trust. Both are now fixed in the program itself.

Security release. Update promptly.

Mail now always travels encrypted when it is moved: from another provider into kstack, and between your own mail servers.

Added

• Mailboxes can be imported from Gmail, Microsoft 365 and other providers that only accept encrypted connections.

Changed

• The old provider's password is deleted once an import has finished. After a complete import with no failures, the stored password for the old mailbox is removed. An import that did not finish keeps it so it can be retried.

Fixed

• A mail move that fails while starting no longer blocks later moves. Before, such a move could hold every later move back for twelve hours. It is now recorded as failed straight away.

Security

• Moving a mail domain to another server is encrypted end to end. The copy between your two mail servers now runs over an encrypted connection, checked against a certificate made for that one move. There is no unencrypted fallback: if either side cannot do this, the move stops and rolls back.
• Importing mail from another provider uses an encrypted connection. The old provider's certificate is checked before the password is sent. The import uses the encrypted port (993) by default, or upgrades the connection on other ports. Only the platform operator can allow an unencrypted import, and it is named as insecure.

Upgrading

Update the control plane AND every mail server before moving a mail domain. When the versions are mixed, a move fails safely and rolls back; it never falls back to an unencrypted copy. Mailbox imports from other providers now default to port 993. An import that used an unencrypted port before needs an encrypted port, or the operator's explicit insecure override.

Why

Two paths sent mail and passwords over the network unencrypted. Importing a mailbox from another provider signed in to that provider in the clear. Moving a mail domain between two of your servers copied every message in the clear. Both are encrypted now, and providers that only accept encrypted connections (Gmail, Microsoft 365) can be imported.

Security release. Update promptly.

A security update for the archive library used when a zip is unpacked in the file manager, plus a stricter release check.

Fixed

• Releases are refused while a dependency has an advisory with a fix. The pre-release check misread the advisory report, so a fixable advisory never stopped a release. It now does.

Security

• The zip library is updated past three published advisories. The advisories (RUSTSEC-2026-0367, -0368, -0369) concern unpacking archives that contain symbolic links or set-user-ID files. kstack unpacks each file itself into the site's own folder, so a link inside an uploaded zip always became an ordinary file and no permissions were taken from the archive. A test now guards that behaviour.

Why

Three advisories were published against the zip library kstack uses, one of them rated critical. kstack's own unpacking never used the affected functions, so no installation was exposed, but the library is now on the fixed version. Our release check now refuses any advisory that has a fix available.

Website disk allowances can now be enforced on ext4 as well as XFS, and a spare partition can become a quota volume as well as an empty disk.

Added

• Disk allowances are enforced on ext4 volumes as well as XFS. A website on an ext4 volume with project quotas can no longer write past its allowance. Its neighbours are unaffected, and its existing files count from the first check.
• Prepare an empty disk or a spare partition as XFS or ext4 from the node's Storage tab. The Storage tab now lists empty disks and spare partitions, each with a filesystem picker. You type the device name to confirm, and the server checks again that the device is empty before formatting it. Then move the web data onto the new volume and allowances are enforced.

Changed

• A site at its allowance is explained with the error it actually shows. The site's health check now quotes "Disk quota exceeded" on ext4 and "No space left on device" on XFS, and says it is the site's own limit, not a full server.

Fixed

• Formatting a volume for site quotas no longer fails on a fresh server. Web servers now install the filesystem tools that formatting and quotas need. Before this release, a freshly installed node did not have them.

Upgrading

Nothing changes on a node until you prepare a volume. A node keeps measuring site disk use until its web data sits on a volume with project quotas: on a node's Storage tab, prepare an empty disk or spare partition as XFS or ext4, then move the web data onto it. Update the control plane and the node agents together. An older agent formats XFS even when ext4 was chosen, and the panel says so when that happens.

Why

Until now a website's disk allowance was only enforced on XFS volumes; everywhere else it was measured and flagged. Most servers run ext4, so on most nodes one site could still fill the disk for every other site. Now both filesystems hold each site to its allowance, and you choose which one when you prepare a volume.

Sign-in code emails no longer carry the code in their subject.

Changed

• No email template can put a code, link or password in its subject. The template editor refuses it, and a template saved earlier with one uses the standard subject instead; its body is kept.

Security

• Sign-in code emails no longer put the code in the subject. The subject now reads ": your sign-in code", and the code is only in the body. A code in a subject looks like phishing to spam filters and shows on a locked phone's screen.

Upgrading

Nothing to do. A customised email template that put a code or link in its subject uses the standard subject from now on; its body stays as you wrote it.

Why

A one-time code in a subject line looks like phishing to spam filters and shows on a locked phone's screen. The code is now only in the body of the email.

Fixes from a live audit of a running platform: alert emails that were being held back, mail that could not reach some new mailboxes, mailbox storage that was never reported, nameserver records that could be deleted by mistake, and restore drills reported as failures when they never ran.

Changed

• The platform's own nameserver records can no longer be deleted by mistake. The address records for your nameservers and your control panel show Edit but no Delete. A nameserver can only be pointed at an address one of your DNS servers actually has.

Fixed

• Alert emails and the daily digest are delivered again on platforms paired with Standby. The measurement push to Standby counted against the hourly limit on messages to a person, and it alone used the whole allowance, so every alert email was held back. The limit now counts only messages that reach a person (email and webhooks), and anything held back is listed, with the reason, under Profile → Notifications → Email.
• Mail for a new mailbox is no longer refused. After a mailbox import, a domain's mail folder could be left owned by the system instead of the mail server, so a mailbox that had never received mail could not receive any ("451 Internal error"). The mail server now repairs that folder by itself, and held mail is delivered on its next retry.
• Mailbox storage is reported. Each mailbox's usage now appears against its size, where it used to read "not reported by the mail server yet".
• A restore drill that could not reach its server is no longer reported as a failed backup. It shows as "drill not run", is tried again within the hour, and no longer turns the compliance report red. Earlier drills recorded this way are corrected.
• Notifications about a server name the server. They used to say "the platform".
• Delete dialogs for databases and DNS zones say they can be brought back from Recently deleted.
• The mail list's health filter separates a domain with no mailboxes from one still being set up.

Upgrading

Nothing to do. After the update, send yourself a test alert from Profile → Notifications to confirm email reaches you. Mail nodes repair their mail folders on their first cycle after the agent updates.

Why

Two of these stopped mail and alerts from reaching people while every status check looked healthy. After updating, held mail is delivered on its next retry, and alert emails resume.

A small correction to the VPS page.

Fixed

• Times on the VPS page no longer read "UTC UTC". The rebuild, email and restore rows showed the time zone twice.

A VPS can now be rebuilt from a fresh system image, keeping its address, name and backups, and its owner gets an email when a new or rebuilt server is ready.

Added

• Rebuild a VPS from a fresh image. On the server's page, choose a system, check the SSH keys and type the server's name to confirm. The disk is erased and the new system installed; the address, the name, the backups and the keys you chose stay. There is no password - the keys are the only way in. Snapshots are erased with the disk, so take a backup first if anything on it matters.
• "Your server is ready" and "Your server was rebuilt" emails. Sent once to the account's people when the server is running with its address. They give the address, the exact ssh root@... line, and the keys that open it by fingerprint. The wording can be changed under Settings -> System email.

Changed

• The server page says whether its email was sent. If a message could not be delivered, the server's page shows the mail server's reason, so a missing email can be explained.

Fixed

• A new VPS's page no longer fails before the server has reported in.

Upgrading

The emails need an outgoing mail server under Settings -> System email (see v1.222.0). Rebuilding needs the agents to update, which happens on their own after this release.

Why

A server's system image could only be chosen when it was created, and nobody was told when a server was ready or how to sign in to it.

The platform's own email - password resets, sign-in codes, invitations, alerts and summaries - now reaches a real mail server.

Changed

• Your profile shows every email attempt and why one failed. Profile -> Notifications lists the emails sent to your address on their own, with the mail server's own reason for any that failed. Before, other deliveries pushed them off the list.

Fixed

• Email is sent through your outgoing mail server, encrypted. A server entered without a port now uses 587, the standard submission port. Port 465 is encrypted from the first byte; any other port switches to encryption before logging in. With a username set, the password is never sent unencrypted: a server that cannot encrypt is refused, with that reason, and nothing is sent.
• The outgoing mail server is checked when you save it. Settings -> System email accepts host or host:port, and leaving it empty still switches email off.
• Password reset, sign-in code and welcome emails read normally. These three messages had runs of spaces in the middle of their sentences. If you saved one of them from Settings while it looked like that, press "Reset to default" on it.

Upgrading

After updating, open Profile -> Notifications and press "Send a test". If it fails, the reason is shown under "Email to ".

Why

Until this release the outgoing mail server setting could not work with a normal mail provider: a server entered without a port was never contacted, and the sender could not switch to an encrypted connection, which every mail provider requires before it accepts a login. No password reset, sign-in code or alert was being delivered.

Security release. Update promptly.

Updates, licence checks and webmail bundles now come only from the public update service, abandoned webmail sign-ins are cleaned up, and two TLS libraries get security fixes.

Added

• Webmail sessions nobody has used for 30 days are removed every day. "Keep me signed in" now lasts 30 days, so mail servers remove sign-ins that have gone unused for longer than that, such as one left on a lost phone. Anyone still using webmail is not affected.

Changed

• Your control panel gets updates, licence checks and webmail bundles only from the public update service. Installs now use https://updates.lbreeze.com for everything they download or check. Existing installs are moved there automatically on update; if you set a different update address yourself, it is kept. The Updates page no longer compares the update service with our internal build system.

Security

• Updated the TLS libraries the control panel and its servers use for secure connections. Fixes for issues published on 14 October 2026, including one that could weaken the key exchange of later connections and one that could make a connection use a large amount of memory.

Upgrading

Nothing to do. After updating, Settings → Mail → kmail bundle shows the edge as https://updates.lbreeze.com.

kmail is now the default webmail, and "Open control panel" from your billing account signs the customer straight in. DKIM key rotation no longer interrupts signing on domains whose DNS lives elsewhere.

Added

• "Open control panel" signs your customer in with one click. The billing client area's button now opens the control panel already signed in, through a one-time link that works for two minutes. A customer who has never had a panel login gets one on the spot, and can set a password later with Forgot password. Staff "log in as" links are single-use in the same way.

Changed

• kmail is the default webmail. New platforms, and platforms that never chose a webmail engine, now serve kmail at mail.: mail, calendar and contacts on the kstack design. It is fetched with your kstack licence, with no separate key. A mail server that cannot run kmail yet serves the next best webmail instead, and its page says why: Alpine and older systems such as Rocky 9 serve Roundcube, and a server still waiting for its kmail download serves SOGo or Roundcube. It switches to kmail on its own when it can.

Fixed

• Rotating a DKIM key keeps mail signed when your DNS is hosted elsewhere. The new key is staged and its record shown for you to publish. Signing moves to it on its own once the world can see that record. Rotation also keeps the domain's own mail setup: an SPF include for another provider stays, and MTA-STS is no longer added back for mail delivered elsewhere.
• Email can be turned on for a website whose DNS is hosted elsewhere. The website's Emails card now allows it and lists the records to add at your DNS provider, as the Mail section already did.
• Forwarders accept up to 64 destinations when created, as they already did when edited.
• Clearer wording on the DNS, zone history, Files and Studio pages.

Upgrading

If you set a separate kmail licence key under Settings → Mail, you can clear it: the kstack licence covers kmail. If your platform never chose a webmail engine, its mail servers move to kmail on their next cycle after the update. To keep another engine, choose it under Settings → Mail → Webmail.