OpenEFA

We are preparing v1.6.3 with important bug fixes for quarantine email release and DNS spam scoring. These changes are currently in testing and will be included in the next release.

---

RELEASE AVAILABILITY

EFAcollective registered instances of OpenEFA will receive this release within days of general availability.

Instances of OpenEFA not registered with EFAcollective can download the updates per the 30-day release schedule from our GitHub repository.

---

WHAT IS COMING

1. Quarantine Release Delivery Fix

We have identified and fixed an issue where releasing emails from quarantine showed "success" but the email never arrived at the destination mail server. The root cause was how raw emails were stored in the database - newline characters were being escaped, resulting in malformed emails when sent via SMTP.

2. Relay Server Selection Fix

Fixed an issue where released emails could be sent to a placeholder relay instead of the domain-specific relay configured in your settings. This occurred when recipient addresses contained angle brackets (e.g., ).

3. DNS Scoring Improvements for Hosted Email Providers

We have improved how the DNS module handles emails from hosted email providers (Zimbra, Google Workspace, Microsoft 365, etc.). Previously, these were incorrectly flagged with high spam scores (+12 points) because the "spoofing detection" triggered when the sending server hostname did not match the sender domain - which is completely normal for hosted email.

The improvement: When SPF, DKIM, and DMARC all pass, the DNS spoofing penalty will now be bypassed. Passing all three authentication methods proves the email is legitimate, regardless of which server actually sent it.

---

EXPECTED IMPACT

Email from hosted provider (auth passes):
- Current: DNS: +12, Total: ~13, Quarantined
- After v1.6.3: DNS: 0, Total: ~1, Delivered

Quarantine release:
- Current: May appear successful but not delivered
- After v1.6.3: Reliably delivered to relay

---

RELEASE TIMELINE

These fixes are currently being tested and will be included in the next official release. Stay tuned for the update announcement.

How do I register for EFACollective?

@adrastosefa Any news on the release of v1.6.3 ?

Working on it now and hoping for the late Sunday.

@adrastosefa Any news on the new version?

still waiting...

@Woger, @MauriceW67, @saktie — you've been waiting on v1.6.3 since I promised "late Sunday" back in December. It never shipped. I went quiet for
four months instead of posting an update. That's on me.

Longer story is in the "Status and future of OpenEFA?" thread — short version: I couldn't reconcile full open-source release with a commercial
side, went private to rethink the model, and took way too long to come back.

Where it landed: v1.6.3 as a point release isn't shipping — the code direction moved past it. What's coming is OpenEFA-CN (Community Node),
AGPL-3.0, rebuilt around a shared threat-intelligence Commons. The quarantine and DNS-scoring fixes that were queued for 1.6.3 are absorbed into
it. Concrete milestones in the next few weeks.

@Woger — your EFACollective registration question: that's built into the new Commons model. Every Community Node that runs contributes
automatically. I'll post registration instructions when the repo is live.

Sorry for the silence.

— Scott