KStack

Ask now opens from the top bar, beside whatever you are looking at, instead of the old readings panel.

Changed

• Ask opens in a side panel from the top bar. The button at the top of every page now opens Ask on the right, without leaving the page. On a website, database, mailbox, DNS zone or server page it starts from that one thing; anywhere else it asks about your whole account. The conversation is the same one the Ask page holds, so Open as a page carries on where you left off. You can pin the panel open beside your work on wider screens.

Fixed

• Closing a pinned side panel no longer leaves an empty strip on the right. On phones a pinned panel also no longer reopens over the page each time it loads, and it closes with Escape or a tap outside.

Removed

• The readings panel is gone. It showed a few current numbers on website and server pages only, and those pages already show them.

Preview addresses are published as soon as the platform updates, rather than at the next daily check.

Fixed

• Preview addresses start working right after an update. The preview wildcard is now published every time the platform starts, so a change in where it belongs reaches DNS with the update itself rather than up to a day later.

A calmer, consistent panel: every list acts through one menu per row, results open in a proper dialog, and the panel never offers an action that makes no sense on your own record. Preview addresses now work when the preview zone sits under a domain you host, and inviting someone is one step.

Added

• Invite someone in one step. Enter their email, name and account: the sign-in is made and an invitation sent, and they set their own password from the link. Your own row offers only Change your password.

Changed

• Every list acts through one menu per row. Lists across the panel (servers, addresses, databases, DNS records, mail, websites, accounts, users and more) put their row actions in a single menu, with destructive actions last, marked in red and confirmed in a dialog. Tables fit their cards; passwords, links and answers open in a dialog with a copy button instead of inside a row.
• Create actions are at the top of each list. Add a node, New database, New domain, Enable mail on a domain, New account, New project, New private network and Invite someone sit in the page header and open their form at the top.

Fixed

• Actions that delete or suspend now ask first. Suspending an account and deleting a queued mail message were one click; they now ask in a dialog. Platform-owned sites cannot be suspended or deleted from the list.
• Preview addresses work under a domain you host. When the preview zone is a name under a zone this platform hosts (preview.example.net with example.net hosted), its wildcard is published there.
• The Platform page reports the panel address and server names correctly. The panel address you gave the installer is recorded automatically, and the page no longer claims server names exist nowhere when they resolve from a zone above them.

Visitors to a site on OpenLiteSpeed, Apache or LiteSpeed Enterprise now see this platform's own pages when the site is empty or its server is down, and the Users page is tidied up.

Changed

• The Users page keeps each person's actions in one menu. Send an invitation, Reset password and Delete sign-in are in a single menu on each row, and the table fits its card. An invitation link or new password opens in a dialog with a copy button rather than inside the row.

Fixed

• An empty site shows the platform's own page on every web server. A site with nothing published yet shows "Nothing is published here yet" whether it runs on nginx, OpenLiteSpeed, Apache or LiteSpeed Enterprise. Before, a site on OpenLiteSpeed answered that server's own 404 page, and the website list marked it as a site error.
• When the web server behind a site is down, visitors see the platform's page. A 502, 503 or 504 from OpenLiteSpeed, Apache or LiteSpeed Enterprise is replaced by the platform's own page for that error. A site's own 404 and 500 pages, such as WordPress's, are left as they are.

Domains whose DNS is at Cloudflare are now managed for you as soon as your Cloudflare token is saved, and the panel tells you what the internet actually sees, not only what kstack holds.

Added

• A domain at Cloudflare is linked and published by itself. When a domain's nameservers are Cloudflare's and a saved Cloudflare token can see that zone, kstack links it and sends its own records (mail, website, DKIM) to Cloudflare. It changes only the records it keeps and leaves everything else in the zone untouched. It runs when the domain is added, when a token is saved, and daily. Tokens can now be saved under Settings, DNS.
• Every server address says why its reverse name is not set. On the Addresses page, an address whose reverse name could not be set shows the reason, and a server with no usable public address is listed with what to fix.

Changed

• DNS and mail health reflect what the internet sees. A domain delegated elsewhere and not linked no longer shows as Published; it says where it is delegated and how to fix it. A mail domain whose public MX points somewhere other than its mail server shows MX elsewhere and names the address mail is going to.
• The Domains page lists domains. One row per domain, with its other names (www, ftp, aliases) inside the row. Searching for a subdomain finds the domain that holds it.

Why

A domain added while its DNS stayed at Cloudflare was served only from this platform's own nameservers, which nobody asks, while the panel said "Published" and "Delivering". Mail kept going to an old server until someone linked the zone by hand.

Each website's PHP now runs in its own container by default, not only its web server.

Changed

• New web servers serve each site's PHP from the site's own container. The default under Settings, New nodes, is now on. You can still switch a server back to its shared PHP on the server's Services tab.

Fixed

• Servers given containers by the last update now serve PHP from them too. A web server that the platform gave containers automatically in the previous update is switched over to serving PHP from them once. A server whose containers you configured yourself is left exactly as you set it.

Upgrading

After the update, each PHP site on an affected server is moved into its own container on the server's next cycle. Expect a short pause on each site while its container's PHP starts.

Why

A container per site is only half of isolation: until its PHP runs inside it, every site still shares one PHP process, one set of modules and one PHP version. Servers that were given containers in the previous update kept their PHP on the shared process.

Choose the web server for each website: nginx, OpenLiteSpeed, Apache, or LiteSpeed Enterprise on a server where you have a licence. Web servers now run each site in its own container by default.

Added

• Apache as a web server for any PHP site. On the site's Advanced tab, choose Apache (.htaccess) in the site's container. Apache runs inside that site's own container in front of its PHP and reads .htaccess on every request, the way customers coming from other hosts expect. WordPress and Joomla rules are rewritten for it when you switch.
• LiteSpeed Enterprise, licensed per server. On a web server's page, under Services, enter your LiteSpeed Enterprise serial (or request a 15-day trial). kstack installs it, registers the licence, and shows its state, the address it is locked to, and whether it answers. Sites on that server can then be switched to LiteSpeed Enterprise, and you can make it the default for new sites there. A lapsed licence or a changed server address is named as the cause on every affected site.

Changed

• New web servers run each site in its own container by default. A web server you add gets per-site containers unless you turn them off on its page. Existing web servers that never had them get them once after this update; a server you deliberately switched to a full web server without containers is left as it is.

Fixed

• OpenLiteSpeed sites no longer hang on a server without per-site containers. Such a site waited on a name lookup that could never answer. OpenLiteSpeed is now offered only where it can run, and a site already set to it on such a server is served by PHP-FPM until containers are on.
• A nameserver run elsewhere from your zones is left alone. If one of your nameserver names points at a secondary nameserver that takes your zones by transfer, kstack no longer points it at one of its own DNS servers.
• Server names and reverse DNS are brought up to date after an update. Server names and their reverse names are now refreshed every time the platform starts, so an update reaches them without waiting for the daily check.
• Removing a mail server's relay no longer fails. Taking a smarthost relay off a mail server answered with an error; it now removes the relay and its stored password.

Upgrading

Web servers without per-site containers are given them once after this update, unless you turned them off yourself. Sites keep serving while the containers are built. LiteSpeed Enterprise needs your own LiteSpeed licence.

Why

Customers moving from other hosts expect Apache's .htaccess behaviour or LiteSpeed's speed, and a host should be able to offer both. Per-site containers keep one customer's website apart from another's; they used to be off by default on a new web server, which left OpenLiteSpeed sites with nowhere to run.

Reverse DNS for your servers now sets itself. Save your Hetzner Cloud token or Robot web-service login once, and every server address gets a reverse name that matches its forward name.

Added

• Every server address gets its reverse name at Hetzner automatically. kstack asks Hetzner Robot and Hetzner Cloud which of them holds each of your servers' addresses, records it, and sets the reverse name once the server's own name resolves back to that address. It runs when you save the credentials, when a server's addresses change, and once a day. The Addresses page shows the state of each address: set, sent, waiting for its name to resolve, not found at Hetzner, or no credentials.
• Server names resolve in the zone above them. If your servers are named under ks.example.net and you host example.net, their names are published there. You no longer need a separate zone for the server names. Only public addresses are published; a server's private container network never appears in public DNS.

Changed

• Your nameservers are named as you publish them in notices. Notices about a DNS server call it by its nameserver name, such as ns1.example.net, rather than its machine name.

Fixed

• Reverse DNS on Hetzner dedicated servers is updated, not refused. Setting a reverse name through Robot used a call that only creates a new entry, which Hetzner refuses for every dedicated address that already has its default name. It now creates or updates.

Upgrading

Nothing to do if your Hetzner credentials are already saved under Settings, Reverse DNS: the first sync runs after the update. Check the Addresses page about ten minutes later.

Why

Mail servers and many blocklists check that a sending address has a reverse name pointing back to a name that resolves to it. Until now, saving the Hetzner credentials only stored them: nothing asked Hetzner which addresses you hold, server names did not resolve in a zone above them, and Robot's create-only call would have been refused for every dedicated address, because each one already has Hetzner's default name.

Your platform's own DNS zone now looks after itself. Save your nameserver names and kstack creates the zone they live in, points them at your DNS nodes, and keeps them there.

Added

• Saving your nameserver names creates the zone they live in. Save ns1/ns2 under Settings → DNS → Nameservers and kstack creates the parent zone (for example example.net) on your DNS nodes. If you save them before any node holds the DNS role, the zone is created as soon as one does.
• ns1 and ns2 always point at your DNS nodes. Each nameserver name gets the A and AAAA records of one DNS node and keeps them. When a node's address changes, its name follows on the node's next report. A record you typed by hand at a nameserver name is replaced by the correct one, and every change is in the activity log.
• The panel's own address is added to the zone. If the zone has no address for your panel's hostname, kstack adds the one the panel answers on. A record you already set there is left alone.

Upgrading

Nothing to do. If your nameserver names were already saved, the zone and its records appear after the update, the next time a DNS node reports or when you press Check and repair.

Why

Before this, saving nameservers like ns1/ns2.example.net did not create the zone those names live in, and nothing put records for them in it, so a freshly installed platform's DNS could not answer even with the glue records set at the registrar.

Setting up a new platform now leads you through it step by step, starting with DNS, and the installer works cleanly on a fresh Debian 13 server.

Changed

• The setup list on the dashboard starts with DNS, in order.
  1. Add two DNS machines. 2. Choose your nameserver names (any names you like, for example ns1.yourdomain.com). 3. Point those names at the machines: the list shows the exact records to add at your registrar and ticks itself once they work. Then add a machine for websites, backups and the rest. Each step is numbered.
• Choose what a server is for when you add it. Nodes → Add node now asks "What is this machine for?": websites, DNS, databases, mail, backups, or everything except mail. The role is set straight away, with no second visit to the node's page. The name is optional.
• Your nameserver names come first on Settings → DNS. They used to sit below every other DNS setting. Node naming is now marked optional, and a DNS server's page shows your own nameserver names instead of offering a name based on the machine.

Fixed

• The installer works through the two-line install on a fresh Debian 13 server. Files it created were readable only by root, which stopped the package manager from reading a signing key. It now uses normal permissions; secrets are still created readable by root only.
• A new DNS record is no longer reported as missing during install. When the server still holds an older answer, the installer checks public DNS, says what it found, and carries on.

Security

• The panel build no longer sends usage data from your server. The web framework's anonymous telemetry is switched off during installs and updates.

Upgrading

Nothing to do. Update from Panel → Updates. The dashboard's setup list then shows where your platform stands.

Why

Setting up DNS meant visiting four different places in the right order with nothing saying what that order was, and the page offered nameserver names you would never use. The dashboard now lists the steps in order, shows the exact records to add at your registrar, and ticks each step only when it is really done.

Staging copies of any website can be named for you on your own staging domain, and webmail now shows the time zone you choose.

Added

• Settings → Domains → Staging domain zone. Set a domain your platform serves, for example lbreeze.dev. A staging copy made without a name is then named on it automatically, as -<6 characters>., with its address published and its own certificate. This works for every kind of website: PHP, Node, Python, static and WordPress. A name you type yourself still works.

Changed

• The staging copy's name is optional on the website page. Leave it empty to have it named for you. Customers cannot type a name inside the platform's staging domain; only the platform hands those out.

Fixed

• Webmail's time zone now takes effect on kmail mail servers. The webmail program could not look up named time zones, so it showed every time in UTC whatever was set. Each mail server now repairs this on its next check and restarts webmail once.

Upgrading

To use a staging domain, the domain must be served by your platform's DNS servers. Then set it under Settings → Domains → Staging domain zone. Update your mail servers' agents with the control plane so webmail picks up its time zone.

Why

A staging copy used to need a name typed in, and the platform's own domains could not be used for one. You can now set a staging domain once, and every copy is named, addressed and certified on it automatically. The time-zone setting from 1.228.0 also takes effect on kmail mail servers in this release.

Domains served by Cloudflare show their real state, retired blocklists no longer report addresses as clean, webmail can show your time zone, and the digest subject reads properly.

Added

• Settings → Mail → Webmail time zone. Webmail shows message times and calendar entries in this zone for everyone who has not picked their own, instead of UTC. On kmail mail nodes it takes effect from version 1.228.1.

Fixed

• A domain served by Cloudflare no longer shows "Applying" forever. Once Cloudflare has accepted every record, the domain shows as up to date. If Cloudflare refuses a record, the domains list says "Publish failed" with Cloudflare's own reason.
• A blocklist that is not working is no longer counted as "clean". Before each check, every blocklist is asked about its own test address. One that does not answer is reported as not answering, never as a clean result. The retired SORBS lists are removed from the choices and from saved settings.
• Mail settings checkboxes sit beside their own labels.
• The activity digest says "1 thing happened", not "1 things happened".

Upgrading

Set Settings → Mail → Webmail time zone to your own zone, for example Europe/London. Domains served by Cloudflare correct themselves within five minutes of the update.

Why

Each fix here started from something on the live panel that looked wrong: a domain stuck at "Applying" with every record already published, two retired blocklists ticked in Mail settings that could only ever say "clean", and webmail times an hour out all summer.

Security release. Update promptly.

Updates can only ever come from our update server, and release signatures are checked only against the key built into kstack.

Security

• The update server's address is built into kstack and can no longer be changed in a configuration file. Installer and updater settings files are read as plain values and are never run as scripts. The licence key is sent only to the update server itself, never to a download address elsewhere.
• Release signatures are checked only against the signing key built into kstack. A release signed by any other key is refused, with a message naming both keys. A new signing key arrives inside a kstack release, signed by the key it replaces; it is never learned from the network.
• Zephyr downloads send your Zephyr licence only to the update server. A download or signature address on any other host is refused before the licence is sent.

Upgrading

Nothing to do. The first update onto this release still runs your box's previous updater, so an old update-address line may stay in the service file until the next update. The new program ignores it either way.

Why

Until now the address kstack fetched its updates from could be changed in a configuration file, and the update server could introduce a new signing key. Someone able to edit that file, or to answer in the update server's place, could have offered a box an update it would trust. Both are now fixed in the program itself.

Security release. Update promptly.

Mail now always travels encrypted when it is moved: from another provider into kstack, and between your own mail servers.

Added

• Mailboxes can be imported from Gmail, Microsoft 365 and other providers that only accept encrypted connections.

Changed

• The old provider's password is deleted once an import has finished. After a complete import with no failures, the stored password for the old mailbox is removed. An import that did not finish keeps it so it can be retried.

Fixed

• A mail move that fails while starting no longer blocks later moves. Before, such a move could hold every later move back for twelve hours. It is now recorded as failed straight away.

Security

• Moving a mail domain to another server is encrypted end to end. The copy between your two mail servers now runs over an encrypted connection, checked against a certificate made for that one move. There is no unencrypted fallback: if either side cannot do this, the move stops and rolls back.
• Importing mail from another provider uses an encrypted connection. The old provider's certificate is checked before the password is sent. The import uses the encrypted port (993) by default, or upgrades the connection on other ports. Only the platform operator can allow an unencrypted import, and it is named as insecure.

Upgrading

Update the control plane AND every mail server before moving a mail domain. When the versions are mixed, a move fails safely and rolls back; it never falls back to an unencrypted copy. Mailbox imports from other providers now default to port 993. An import that used an unencrypted port before needs an encrypted port, or the operator's explicit insecure override.

Why

Two paths sent mail and passwords over the network unencrypted. Importing a mailbox from another provider signed in to that provider in the clear. Moving a mail domain between two of your servers copied every message in the clear. Both are encrypted now, and providers that only accept encrypted connections (Gmail, Microsoft 365) can be imported.

Security release. Update promptly.

A security update for the archive library used when a zip is unpacked in the file manager, plus a stricter release check.

Fixed

• Releases are refused while a dependency has an advisory with a fix. The pre-release check misread the advisory report, so a fixable advisory never stopped a release. It now does.

Security

• The zip library is updated past three published advisories. The advisories (RUSTSEC-2026-0367, -0368, -0369) concern unpacking archives that contain symbolic links or set-user-ID files. kstack unpacks each file itself into the site's own folder, so a link inside an uploaded zip always became an ordinary file and no permissions were taken from the archive. A test now guards that behaviour.

Why

Three advisories were published against the zip library kstack uses, one of them rated critical. kstack's own unpacking never used the affected functions, so no installation was exposed, but the library is now on the fixed version. Our release check now refuses any advisory that has a fix available.

Website disk allowances can now be enforced on ext4 as well as XFS, and a spare partition can become a quota volume as well as an empty disk.

Added

• Disk allowances are enforced on ext4 volumes as well as XFS. A website on an ext4 volume with project quotas can no longer write past its allowance. Its neighbours are unaffected, and its existing files count from the first check.
• Prepare an empty disk or a spare partition as XFS or ext4 from the node's Storage tab. The Storage tab now lists empty disks and spare partitions, each with a filesystem picker. You type the device name to confirm, and the server checks again that the device is empty before formatting it. Then move the web data onto the new volume and allowances are enforced.

Changed

• A site at its allowance is explained with the error it actually shows. The site's health check now quotes "Disk quota exceeded" on ext4 and "No space left on device" on XFS, and says it is the site's own limit, not a full server.

Fixed

• Formatting a volume for site quotas no longer fails on a fresh server. Web servers now install the filesystem tools that formatting and quotas need. Before this release, a freshly installed node did not have them.

Upgrading

Nothing changes on a node until you prepare a volume. A node keeps measuring site disk use until its web data sits on a volume with project quotas: on a node's Storage tab, prepare an empty disk or spare partition as XFS or ext4, then move the web data onto it. Update the control plane and the node agents together. An older agent formats XFS even when ext4 was chosen, and the panel says so when that happens.

Why

Until now a website's disk allowance was only enforced on XFS volumes; everywhere else it was measured and flagged. Most servers run ext4, so on most nodes one site could still fill the disk for every other site. Now both filesystems hold each site to its allowance, and you choose which one when you prepare a volume.

Sign-in code emails no longer carry the code in their subject.

Changed

• No email template can put a code, link or password in its subject. The template editor refuses it, and a template saved earlier with one uses the standard subject instead; its body is kept.

Security

• Sign-in code emails no longer put the code in the subject. The subject now reads ": your sign-in code", and the code is only in the body. A code in a subject looks like phishing to spam filters and shows on a locked phone's screen.

Upgrading

Nothing to do. A customised email template that put a code or link in its subject uses the standard subject from now on; its body stays as you wrote it.

Why

A one-time code in a subject line looks like phishing to spam filters and shows on a locked phone's screen. The code is now only in the body of the email.

Fixes from a live audit of a running platform: alert emails that were being held back, mail that could not reach some new mailboxes, mailbox storage that was never reported, nameserver records that could be deleted by mistake, and restore drills reported as failures when they never ran.

Changed

• The platform's own nameserver records can no longer be deleted by mistake. The address records for your nameservers and your control panel show Edit but no Delete. A nameserver can only be pointed at an address one of your DNS servers actually has.

Fixed

• Alert emails and the daily digest are delivered again on platforms paired with Standby. The measurement push to Standby counted against the hourly limit on messages to a person, and it alone used the whole allowance, so every alert email was held back. The limit now counts only messages that reach a person (email and webhooks), and anything held back is listed, with the reason, under Profile → Notifications → Email.
• Mail for a new mailbox is no longer refused. After a mailbox import, a domain's mail folder could be left owned by the system instead of the mail server, so a mailbox that had never received mail could not receive any ("451 Internal error"). The mail server now repairs that folder by itself, and held mail is delivered on its next retry.
• Mailbox storage is reported. Each mailbox's usage now appears against its size, where it used to read "not reported by the mail server yet".
• A restore drill that could not reach its server is no longer reported as a failed backup. It shows as "drill not run", is tried again within the hour, and no longer turns the compliance report red. Earlier drills recorded this way are corrected.
• Notifications about a server name the server. They used to say "the platform".
• Delete dialogs for databases and DNS zones say they can be brought back from Recently deleted.
• The mail list's health filter separates a domain with no mailboxes from one still being set up.

Upgrading

Nothing to do. After the update, send yourself a test alert from Profile → Notifications to confirm email reaches you. Mail nodes repair their mail folders on their first cycle after the agent updates.

Why

Two of these stopped mail and alerts from reaching people while every status check looked healthy. After updating, held mail is delivered on its next retry, and alert emails resume.

A small correction to the VPS page.

Fixed

• Times on the VPS page no longer read "UTC UTC". The rebuild, email and restore rows showed the time zone twice.

A VPS can now be rebuilt from a fresh system image, keeping its address, name and backups, and its owner gets an email when a new or rebuilt server is ready.

Added

• Rebuild a VPS from a fresh image. On the server's page, choose a system, check the SSH keys and type the server's name to confirm. The disk is erased and the new system installed; the address, the name, the backups and the keys you chose stay. There is no password - the keys are the only way in. Snapshots are erased with the disk, so take a backup first if anything on it matters.
• "Your server is ready" and "Your server was rebuilt" emails. Sent once to the account's people when the server is running with its address. They give the address, the exact ssh root@... line, and the keys that open it by fingerprint. The wording can be changed under Settings -> System email.

Changed

• The server page says whether its email was sent. If a message could not be delivered, the server's page shows the mail server's reason, so a missing email can be explained.

Fixed

• A new VPS's page no longer fails before the server has reported in.

Upgrading

The emails need an outgoing mail server under Settings -> System email (see v1.222.0). Rebuilding needs the agents to update, which happens on their own after this release.

Why

A server's system image could only be chosen when it was created, and nobody was told when a server was ready or how to sign in to it.

The platform's own email - password resets, sign-in codes, invitations, alerts and summaries - now reaches a real mail server.

Changed

• Your profile shows every email attempt and why one failed. Profile -> Notifications lists the emails sent to your address on their own, with the mail server's own reason for any that failed. Before, other deliveries pushed them off the list.

Fixed

• Email is sent through your outgoing mail server, encrypted. A server entered without a port now uses 587, the standard submission port. Port 465 is encrypted from the first byte; any other port switches to encryption before logging in. With a username set, the password is never sent unencrypted: a server that cannot encrypt is refused, with that reason, and nothing is sent.
• The outgoing mail server is checked when you save it. Settings -> System email accepts host or host:port, and leaving it empty still switches email off.
• Password reset, sign-in code and welcome emails read normally. These three messages had runs of spaces in the middle of their sentences. If you saved one of them from Settings while it looked like that, press "Reset to default" on it.

Upgrading

After updating, open Profile -> Notifications and press "Send a test". If it fails, the reason is shown under "Email to ".

Why

Until this release the outgoing mail server setting could not work with a normal mail provider: a server entered without a port was never contacted, and the sender could not switch to an encrypted connection, which every mail provider requires before it accepts a login. No password reset, sign-in code or alert was being delivered.

Security release. Update promptly.

Updates, licence checks and webmail bundles now come only from the public update service, abandoned webmail sign-ins are cleaned up, and two TLS libraries get security fixes.

Added

• Webmail sessions nobody has used for 30 days are removed every day. "Keep me signed in" now lasts 30 days, so mail servers remove sign-ins that have gone unused for longer than that, such as one left on a lost phone. Anyone still using webmail is not affected.

Changed

• Your control panel gets updates, licence checks and webmail bundles only from the public update service. Installs now use https://updates.lbreeze.com for everything they download or check. Existing installs are moved there automatically on update; if you set a different update address yourself, it is kept. The Updates page no longer compares the update service with our internal build system.

Security

• Updated the TLS libraries the control panel and its servers use for secure connections. Fixes for issues published on 14 October 2026, including one that could weaken the key exchange of later connections and one that could make a connection use a large amount of memory.

Upgrading

Nothing to do. After updating, Settings → Mail → kmail bundle shows the edge as https://updates.lbreeze.com.

kmail is now the default webmail, and "Open control panel" from your billing account signs the customer straight in. DKIM key rotation no longer interrupts signing on domains whose DNS lives elsewhere.

Added

• "Open control panel" signs your customer in with one click. The billing client area's button now opens the control panel already signed in, through a one-time link that works for two minutes. A customer who has never had a panel login gets one on the spot, and can set a password later with Forgot password. Staff "log in as" links are single-use in the same way.

Changed

• kmail is the default webmail. New platforms, and platforms that never chose a webmail engine, now serve kmail at mail.: mail, calendar and contacts on the kstack design. It is fetched with your kstack licence, with no separate key. A mail server that cannot run kmail yet serves the next best webmail instead, and its page says why: Alpine and older systems such as Rocky 9 serve Roundcube, and a server still waiting for its kmail download serves SOGo or Roundcube. It switches to kmail on its own when it can.

Fixed

• Rotating a DKIM key keeps mail signed when your DNS is hosted elsewhere. The new key is staged and its record shown for you to publish. Signing moves to it on its own once the world can see that record. Rotation also keeps the domain's own mail setup: an SPF include for another provider stays, and MTA-STS is no longer added back for mail delivered elsewhere.
• Email can be turned on for a website whose DNS is hosted elsewhere. The website's Emails card now allows it and lists the records to add at your DNS provider, as the Mail section already did.
• Forwarders accept up to 64 destinations when created, as they already did when edited.
• Clearer wording on the DNS, zone history, Files and Studio pages.

Upgrading

If you set a separate kmail licence key under Settings → Mail, you can clear it: the kstack licence covers kmail. If your platform never chose a webmail engine, its mail servers move to kmail on their next cycle after the update. To keep another engine, choose it under Settings → Mail → Webmail.

Restoring a virtual machine from a backup is now safe from start to finish, and you can see it happening.

Added

• You can follow a VM restore on the machine's page. Pressing restore now answers straight away that the restore has started, and it appears in Activity as "Restore started". The machine's page shows "being restored" while it runs, the reason if it fails, and "last restored" with the time and snapshot once it is done.

Changed

• Restoring a large VM no longer times out halfway. Restores of large disks are given hours to finish instead of fifteen minutes per step, so a big machine is restored completely rather than cut short.

Fixed

• A virtual machine being restored can no longer be replaced by an empty one. While a restore swaps the old machine for the backup, the server now holds the machine's name and builds nothing in its place. If a restore fails part-way, the name stays held and the page tells you to run the restore again - your backup is never thrown away in favour of a blank machine.

Why

A VM restore replaces the whole machine and, for a large disk, takes a long time. Until now nothing could tell you a restore was running or whether it had worked, and a narrow window during the restore could have left you with an empty machine instead of yours.

Security release. Update promptly.

Webmail no longer shows one customer's colleagues to another, website containers are locked down further, certificates renew without spending your Let's Encrypt allowance, outgoing mail can be routed through your own relay at four levels, and object storage is served over HTTPS.

Added

• Outgoing mail can go through your own relay, per server, per website or per mail domain. A relay can now be set for the whole platform, one mail server, one website or one mail domain; the most specific setting wins. Passwords are stored encrypted and never shown again. Mail sent through a domain's own relay keeps all sending limits.
• Object storage is served over HTTPS. Each object storage server gets a certificate for its name and serves HTTPS on the same port. Renewals take effect without interrupting uploads. Download links and connection details switch to HTTPS automatically once the certificate is in place.

Changed

• Certificate renewals no longer use up Let's Encrypt's rate limits. Renewals now tell Let's Encrypt which certificate they replace, which makes them exempt from its limits. New certificates are paced just inside every published limit instead of failing, renewals are spread more evenly, and the platform re-checks Let's Encrypt's suggested renewal window regularly so a certificate that must be replaced early is renewed early. Operators can see certificate capacity on the Jobs page.

Fixed

• Relays that require a login now work on Debian, Ubuntu and Rocky mail servers. Mail servers were missing a system package needed to log in to a relay, so every authenticated relay, including the platform-wide one, left mail waiting in the queue. Mail servers now install it.
• Access keys left behind by deleted buckets are switched off. Object storage servers now disable access keys that no longer belong to a bucket. Nothing is deleted: the data stays where it was.

Security

• Webmail's people search only shows people from your own domain. On a mail server shared by several customers, searching for a colleague in webmail could also return other customers' mailboxes. Searches, contact lookups and sharing pickers are now limited to the signed-in person's own domain.
• Webmail's cache can only be read by webmail itself. The webmail cache used to listen on a network port that other processes on the mail server could read. It now uses a private socket that only the webmail service can open.
• Website containers block more kernel features and the cloud metadata service. Each website's container now refuses a set of rarely-needed kernel features that are common in exploits, and can no longer reach the hosting provider's metadata address. New outbound connections from a site are limited per second (25 by default, adjustable per server), so a compromised site cannot flood the network. Existing sites pick up the new kernel rules at their next restart; the website's Health card says when one is waiting.

Upgrading

Nothing to do for most installs; each server applies its part on the first cycle after its agent updates. Website containers apply the tightened kernel rules at their next restart. Object storage switches to HTTPS once its certificate has been issued, which needs the server's published name to resolve. If you set a mail relay per domain, add that relay to the domain's SPF record (the relay card points to the field).

Why

Two of these close real gaps between customers on a shared server: who can find whom in webmail, and what a compromised website can reach. The others remove limits you would have hit as the platform grows: certificate rate limits, a mail relay that could never log in on Debian mail servers, and an object storage endpoint that only spoke plain HTTP.