Proxmox Mail Gateway 9.0: 20 years of experience, brand new features

Happy birthday, Proxmox! And for the birthday, there's a major update!

The digital bouncer is growing up

Proxmox celebrates its 20th anniversary. Birthday and presents us with a completely revised version of the mail gateway. Version 9.0 has just been released and brings a lot of improvements that should protect your mail server even better against spam, viruses and digital vermin.

For those who are not yet familiar with Proxmox: The mail gateway works as a proxy between your firewall and the mail server – almost as a bouncer who first checks thoroughly what you want in your inbox. And this bouncer has now properly upgraded!

This is under the hood: Debian 13 ‘Trixie’

The heart of the update is the switch to Debian 13.0 ‘Trixie’. Thus, the mail gateway joins the Proxmox family, which has already set with Proxmox VE 9.0 and the Backup Server 4.0 on the new Debian version.

Interesting detail: While Debian comes with a Linux kernel 6.12 LTS by default, Proxmox developers have opted for a custom kernel 6.14.11-2. More performance, more features – why not?

The all-round technical equipment

ZFS 2.3.4: The latest stable version of the popular file system (even though ZFS 2.4 is already in the second release candidate, Proxmox remains at the proven stability for the first time)
PostgreSQL 17: Fresh database engine for optimal performance
ClamAV 1.4.3: Your virus monitor with up-to-date signatures
SpamAssassin 4.0.2: With freshly updated rulesets against spam, phishing and other nasty tricks

The new quarantine interface: Finally mobile-friendly!

This is where it gets really exciting: The quarantine interface has been completely redesigned using the Rust-based Yew framework. Sounds technical? It is, but the result counts:

You can now manage your quarantined messages comfortably on your smartphone or tablet! No more teasing with tiny buttons and illegible texts. The new interface is optimized for mobile devices and completely replaces the previous implementation.

Check on the way whether the mail from the boss has accidentally landed in the spam? No more problems!

Single sign-on: Welcome to 2025

The authentication features have been properly upgraded. OpenID Connect realms can now be fully configured via the graphical interface, including claim assignments and automatic role assignment.

What does that mean in comprehensible? You can now seamlessly connect the Mail Gateway to popular identity and access management solutions:

Keycloak
Citadel
LemonLDAP::NG

One login for everything – your IT department will love you (or at least curse you less).

Statistics view: The overview that does not overwhelm

The new statistics view shows you at a glance:

Incoming and outgoing mails
Junk mails (aka the spam mountain)
Virus emails (which hopefully never get through)
Bounces (the emails that come back like a boomerang)

Perfect to see how much digital garbage your gateway captures every day. Spoilers: Probably more than you think!

Support period: Don't panic about upgrading.

Still on Proxmox Mail Gateway 8.2? No stress – the version will be provided with security updates and critical bug fixes until August 2026. This gives you a whole year of overlap to switch to version 9.0 in peace.

Open Source as it should be

A big plus point: The Proxmox Mail Gateway is open source. This means not only transparency and community support, but also that you don't have to pay any licensing costs for basic features. Enterprise support is optional for businesses, but the software itself is freely available.

Is the update worth it?

Clear answer: Yes, yes! Especially if:

You often use the quarantine interface (finally mobile-friendly!)
You want to integrate SSO/OpenID-Connect
You want to stay up-to-date with security tools
You want to use the stability and performance of Debian 13

Even if you don't currently have any urgent issues, the usability improvements and the updated software base are reason enough for an upgrade.

Important Configuration options at a glance

Central administration: GUI, API or CLI

Proxmox gives you the choice: Web GUI for fast settings, REST API for automation, or the pmgconfig CLI tool for command line fans.

Mail proxy: The basic settings

Relaying & Transports: Defines different internal mail servers for different domains – practically for several departments or clients.

Relay domains: Determines for which domains your gateway accepts mails at all. Important protection against abuse.

ports: By default, port 25 for incoming (untrusted) and port 26 for outgoing mails (trusted).

Greylisting: The clever spam stoper

New senders get a temporary error code (450) and have to try again later. Real mail servers do this, spam bots often don't. After 2 days of retry and 36 days for known compounds, everything runs smoothly.

TLS encryption & Certificates

Opportunistic TLS is standard, but you can also define stricter policies. The highlight: Integrated ACME/Let’s Encrypt support makes TLS certificates a breeze - automatic renewal included! http-01 and dns-01 challenges are supported, even wildcard certificates are possible.

DKIM signing: Prove authenticity

Sign your outgoing mails cryptographically to prove that they really come from your domain. Choose between envelope or header domain and decide whether all mails or only certain domains are signed.

Before-Queue vs. After-Queue Filtering

Before-queue (recommended): Scanning during the SMTP session, direct rejection possible, prevents backscatter spam.

After-queue: Faster mail capture, but your server needs to send NDRs.

Welcome and Blocklists: Triple protection

SMTP Welcomelist: Disables greylisting, SPF and DNSBL checks
Rule-based lists: Predefined rules with priorities
User lists: Individual lists per user (spam score +100 at block)

Important Config Files for CLI Friends

/etc/pmg/pmg.conf is the Central Admin Options
/etc/pmg/domains for relay domains
/etc/pmg/dkim/domains for DKIM signing domains
/etc/pmg/tls_policy for TLS policies per destination

Pro tip: Always after manual config changes pmgconfig sync --restart 1 Execute!

Conclusion: Old rabbit, new tricks

20 years of Proxmox, and the company shows that experience does not mean stagnation. The Mail Gateway 9.0 It's a worthy birthday present to all of us who want to know our emails for sure.

The combination of proven open source tools (ClamAV, SpamAssassin), modern base (Debian 13, current kernel) and up-to-date features (mobile interface, SSO integration) makes the update a real win.

So, what are you waiting for? The ISO installer is ready, and your mail servers will thank you for the protection!