v0.16.12

diffusionstudio/corev0.16.12Jul 6, 2026by github-actions[bot]

AI Summary

This release adds support for DKIM2 and DMARCbis protocols, while fixing critical bugs in OIDC, PostgreSQL, Registry, and Network listener modules.

Key Highlights

Added DKIM2 implementation
Added DMARCbis implementation and reporting
Fixed DANE to treat DNSSEC bogus as temporary failure
Fixed OIDC provider to support ECDSA SEC1 format
Fixed Network listener CPU spin on EMFILE errors

New Features

DKIM2 implementation
DMARCbis implementation (Aggregate Reporting and Failure Reporting)

Full Release Notes

## [0.16.12] - 2026-07-06

If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.

## Added
- DKIM2 implementation ([draft-ietf-dkim-dkim2-spec-03](https://datatracker.ietf.org/doc/draft-ietf-dkim-dkim2-spec/)).
- DMARCbis implementation:
  - Domain-based Message Authentication, Reporting, and Conformance (DMARC) ([RFC 9989](https://datatracker.ietf.org/doc/html/rfc9989))
  - DMARC Aggregate Reporting ([RFC 9990](https://datatracker.ietf.org/doc/html/rfc9990))
  - DMARC Failure Reporting ([RFC 9991](https://datatracker.ietf.org/doc/html/rfc9991))

## Changed

## Fixed
- DANE: Treat DNSSEC `bogus` as a temporary failures to prevent downgrade attacks.
- OIDC provider: 
  - `ECDSA` private key support for `SEC1` format.
  - Allow ports in `redirect_uri` for loopback addresses.
- OIDC directory: 
  - Removing a user from all groups does not sync the changes correctly.
  - Fetch `name` and `group` claims from userinfo endpoint when missing from the JWT token.
- PostgreSQL: Include error chain in error messages.
- Prometheus: event counters are exported with incorrect metric names.
- Registry: Changing the type of an existing account from `user` to `group` panics.
- Masked emails: Return `UnknownRecipient` only for disabled or expired masked emails.
- IDN: `sanitize_email` rejects valid Punycode domains.
- Auto-ban: IP block expiration ignores per-reason ban durations.
- Meilisearch: Limit the text search scope using `attributesToSearchOn`.
- CalDAV: `calendar-query` REPORT returns invalid HTTP `404` when no events match the query.
- Snowflake past id generation fails when the provided duration is longer than 4 years.
- Calendar scheduling: Wrong RSVP base URL is used.
- Network listener: Accept loop spins all CPU cores with no back-off when the process hits `EMFILE` (too many open files).
- Cluster: Broadcast MTA queue refresh events to all nodes.


<hr />

### Check binary attestation [here](https://github.com/stalwartlabs/stalwart/attestations/34033385)