Platform Updates

Posted on November 7, 2026 by Purelymail Team

Over the past two months since our last platform update, we’ve deployed several improvements across email deliverability, forwarding reliability, account security, and our backend infrastructure. Here is a breakdown of what’s new.

Email Deliverability & Forwarding

Forward Rejection Notifications & Privacy Protection

When forwarding incoming mail to an external provider (such as Gmail or Outlook) via routing rules or Webmail filters, destination servers may occasionally reject a message due to strict spam filters, rate limits, or full mailboxes.

Prior to this update, bounce notifications for rejected forwards were sent back to the original sender. This caused several issues:

  1. Privacy: The original sender could see your private forwarding destination (such as a personal @gmail.com address) in the rejection report.
  2. Backscatter: If an incoming message had a forged sender address, innocent third parties received bounce notifications for messages they never sent.
  3. Missing alerts: The account holder who set up the forward was never notified that their forwarded email failed to arrive.

We have updated this behavior so that when an external provider rejects a forwarded email:

  • Notifications go to you: The delivery failure report is sent directly to your Purelymail inbox instead of the original sender.
  • The original email is attached: The report includes the rejection reason along with the complete original message and any attachments, ensuring no mail is lost.
  • Privacy is preserved: The original sender is not contacted, keeping your destination address private and eliminating backscatter.

Spam Filtering for Forwarded Mail

Forwarding received spam downstream is one of the quickest ways for forwarding addresses to get throttled or blocked. To keep forwarding reliable across all accounts, incoming mail that our filters flag as spam is no longer forwarded out. Instead, it gets delivered safely to your Purelymail Junk folder so you can still check it if needed.

Automatic Header Generation (Date & Message-ID) & DKIM Signing

Receiving mail servers have become significantly stricter about requiring standard headers on all incoming mail. If an email is missing a Date or Message-ID header, destination servers will often reject it or send it straight to spam.

Most modern email apps include these automatically, but older devices (like office scanners, printers, and notification scripts) often leave them out. Our outgoing servers now automatically fill in these headers whenever they’re missing:

  • Date: Added with the current time if your mail client left it off.
  • Message-ID: Generated automatically with a unique identifier so destination servers don’t complain about malformed headers.
  • DKIM Signing: We also now include the Message-ID header in our DKIM signatures, helping your outgoing mail pass deliverability checks cleanly.

Dedicated Purelymail IP Range & Sender Reputation

We recently acquired our own dedicated IP block (167.104.49.0/24) and added it to our SPF records (_spf.purelymail.com).

We are warming up these IPs alongside our existing AWS sending IPs to build an independent sender reputation directly tied to Purelymail, giving us greater long-term control over email deliverability.

If your domain uses our standard SPF record (include:_spf.purelymail.com), no changes are needed on your end; it is already included automatically.

International Sender Address Support

We updated our sender address parser to better handle international characters, encoded text, and quoted names in From: headers so legitimate international mail passes verification smoothly.

Security & Account Controls

Scoped App Passwords

You can now set specific permissions on application passwords, such as Send-only (SMTP) or Read-only (IMAP).

This is especially helpful for devices or scripts that only need limited access:

  • Printers, scanners, and notification scripts: Give them a Send-only password. Even if someone extracts the password saved on the printer, they cannot read your emails or access your inbox.
  • Backup or archiving tools: Give them a Read-only password with sending disabled so they can’t send mail from your account.

You can choose these permissions when generating an app password in the user settings section of the account portal.

API Password Strength Standards

Our API endpoints for creating and updating users now enforce the same password strength requirements as our web portal, helping ensure all mailboxes use secure credentials.

Webmail & Admin Portal

  • Webmail Web Application Firewall (WAF): We deployed AWS WAF in front of Webmail, adding an extra layer of protection against common web vulnerabilities, PHP-specific exploits, and automated abuse.
  • Webmail Patched & Hardened: As detailed in our previous post, we promptly mitigated the upstream PHP zero-days (CVE-2026-109618 and CVE-2026-109619) with zero downtime, upgrading to Roundcube 1.6.20 on PHP 8.4.27 while tightening PHP container isolation.
  • Script-Blocker Fix: Fixed a bug in the account portal where visitors using strict script blockers could get stuck in an error notification loop.
  • Webmail IP Rate Limiting: Corrected client IP detection behind our load balancers so internal proxy IPs aren’t throttled during webmail logins.
  • Brand Favicon: Updated the site favicon across webmail and the admin portal to match our updated brand logo.

Core Infrastructure

  • PostgreSQL 18: We finished upgrading our production database to PostgreSQL 18, which gives us better query performance and smoother maintenance routines.
  • Apache James Modernization: Replaced our legacy detached fork with standard upstream Apache James, keeping Purelymail’s custom storage, routing, and performance tweaks cleanly organized as our own extensions.
  • Rspamd Shadow Testing: We set up a background testing system that runs the Rspamd filter alongside SpamAssassin on live mail. It doesn’t affect delivery or decide anything yet, but it lets us compare accuracy and rule scoring side-by-side as we look at spam filtering improvements.

Support & Feedback