Platform Updates

Posted on September 14, 2026 by Purelymail Team

Over the past few months, we’ve deployed several updates across client autoconfiguration, deliverability, webmail, the account administration portal, and our backend infrastructure. Here is a breakdown of the changes.

Automatic Email Setup (AutoConfig & AutoDiscover)

We have added server-side support for AutoConfig and AutoDiscover, allowing compatible mail clients to configure connection settings automatically using your email address and password.

  • AutoConfig: Used by Thunderbird, K-9 Mail, and other Mozilla-compatible clients. Clients query autoconfig.<domain>/mail/config-v1.1.xml to retrieve IMAP and SMTP hostnames, ports, and encryption protocols.
  • AutoDiscover: Used by Microsoft Outlook, Apple Mail, and standard mobile clients. Clients query autodiscover.<domain>/autodiscover/autodiscover.xml via an SRV record lookup to retrieve server configurations.

This works automatically for @purelymail.com addresses. To enable it for a custom domain, you can add two optional DNS records:

  • AutoConfig (CNAME): Host autoconfig pointing to autoconfig.purelymail.com.
  • AutoDiscover (SRV): Service _autodiscover._tcp with priority 0, weight 0, port 443, pointing to autodiscover.purelymail.com.

The DNS checklist on the Domains page in the account administration portal will verify both records once added.

Outbound Spam Checks & Deliverability

To protect sending reputation across our shared IP pool and prevent legitimate outgoing mail from landing in spam folders:

  • Outbound Spam Filtering: We re-enabled SpamAssassin checks on outgoing mail. If an account is compromised by a bot or leaked password, outbound filtering catches and halts spam runs before our server IPs get flagged on external blocklists.
  • RFC 5322 From-Address Verification: When sending mail through authenticated SMTP, if a From: header is specified, the sender must be authorized to send as that address (either by being that user or through configured Sending Restrictions rules; messages with an unset or omitted From header continue to default to the authenticated user). Malformed headers and unauthorized sender addresses are rejected at the protocol level with DSN 5.1.7.
  • RFC 7489 Inbound DMARC Alignment: We now enforce strict single From: header validation on incoming mail per RFC 7489, preventing multi-header exploits designed to bypass DMARC evaluation.
  • Rate Limiting Exemptions for Major Inbound Providers: We maintain IP connection rate limits on SMTP to prevent abuse. We’ve added an allowlist for major email providers (such as Gmail, Outlook, Apple, Yahoo, and others) so incoming mail from these providers is exempt from connection throttling and delivered without delays.
  • TLS 1.2 Default: New accounts now default to requiring at least TLS 1.2 for all encrypted connections, ensuring modern transport security across IMAP, POP3, and SMTP.

Webmail (Roundcube)

  • Upgraded to Roundcube 1.6.19: We’ve upgraded Roundcube across multiple releases from 1.6.14 up to 1.6.19, incorporating upstream security patches and fixes for mailbox searching and attachment handling.
  • Performance & Resource Tuning: Tuned backend process resources and web server limits to keep webmail responsive, isolate heavy mailbox operations, and prevent individual sessions from causing stalls.
  • Cleanup: Removed obsolete startup routines and simplified the webmail runtime environment.

Account Administration Portal

  • Account Status Banner: Added a prominent alert banner at the top of the portal when an account is restricted or disabled so you can immediately see the issue.
  • Dark Mode: Fixed contrast, background, and table striping bugs across tables, buttons, and navigation menus.
  • Translation-Safe Code Boxes: Added translation-exempt tags to DNS records and configuration snippets so browser translation tools do not alter technical values when copied.
  • Login Alerts: When attempting to log into the account administration portal, if an account has been restricted or has run out of credit, the login screen now clearly explains the account status rather than showing a generic error.
  • Signup & Phone Input Polish: Added your administrator username directly on the final signup confirmation screen, and updated our international phone number inputs with improved country code handling (including Lithuania).
  • Self-Service Refunds: Added an automated self-service refund and account closure tool in the billing section of the account administration portal for accounts within the refund window.

Database & Infrastructure Performance

  • Database Performance & Maintenance: Tuned PostgreSQL autovacuum settings specifically for high-churn mail and storage tables to prevent query latency during peak volumes.
  • Schema & Upgrade Preparation: Restructured production database tables with primary keys and indexes to support zero-downtime blue-green database upgrades.

Support & Feedback