chore(main): release 3.4.0

feat(dkim): make key size configurable and allow keys to be rotated
feat: add configurable Postal logger level defaulting to INFO (#3626 )
2026-10-18 18:26:06 +00:00 · 2026-10-01 11:33:18 +00:00 · 2026-10-01 12:32:46 +01:00 · 2026-09-13 13:12:57 +01:00 · 2026-09-13 13:11:42 +01:00 · 2026-06-03 16:24:45 +01:00
80 changed files with 3165 additions and 845 deletions
@@ -52,10 +52,10 @@ jobs:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - run: docker-compose pull
+      - run: docker compose pull
        env:
          POSTAL_IMAGE: ghcr.io/postalserver/postal:ci-${{ github.sha }}
-      - run: docker-compose run postal sh -c 'bundle exec rspec'
+      - run: docker compose run postal sh -c 'bundle exec rspec'
        env:
          POSTAL_IMAGE: ghcr.io/postalserver/postal:ci-${{ github.sha }}

@@ -63,9 +63,14 @@ jobs:
    name: Release (branch)
    runs-on: ubuntu-latest
    needs: [build]
-    if: startsWith(github.ref, 'refs/heads/')
+    if: >-
+      startsWith(github.ref, 'refs/heads/') &&
+      startsWith(github.ref, 'refs/heads/release-please-') != true &&
+      startsWith(github.ref, 'refs/heads/dependabot/') != true
    steps:
      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v2
      - uses: docker/login-action@v2
@@ -73,22 +78,35 @@ jobs:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - id: tag
+      - id: info
        run: |
-          TAG="${GITHUB_REF#refs/heads/}"
-          if [ -z "$TAG" ]; then exit 1; fi
-          if [[ $TAG == "main" ]]; then TAG="latest"; else TAG="branch-${TAG}"; fi
-          echo "tag=${TAG}" >> $GITHUB_OUTPUT
+          IMAGE=ghcr.io/postalserver/postal
+
+          REF="${GITHUB_REF#refs/heads/}"
+          if [ -z "$REF" ]; then exit 1; fi
+
+          VER="$(git describe --tags 2>/dev/null)"
+          echo "version=${VER}" >> "$GITHUB_OUTPUT"
+          echo "branch=${REF}" >> "$GITHUB_OUTPUT"
+
+          echo 'tags<<EOF' >> "$GITHUB_OUTPUT"
+          if [[ "$REF" == "main" ]]; then
+            echo "${IMAGE}:latest" >> "$GITHUB_OUTPUT"
+          else
+            echo "${IMAGE}:branch-${REF}" >> "$GITHUB_OUTPUT"
+          fi
+          echo 'EOF' >> "$GITHUB_OUTPUT"
      - uses: docker/build-push-action@v4
        with:
          push: true
-          tags: |
-            ghcr.io/postalserver/postal:${{ steps.tag.outputs.tag }}
-            ghcr.io/postalserver/postal:commit-${{ github.sha }}
+          tags: ${{ steps.info.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          target: full
          platforms: linux/amd64
+          build-args: |
+            VERSION=${{ steps.info.outputs.version }}
+            BRANCH=${{ steps.info.outputs.branch }}

  publish-image:
    name: Publish Image
@@ -29,7 +29,11 @@ vendor/bundle

 Procfile.local
 VERSION
+BRANCH

 .rubocop-https*
 .env*

+node_modules
+yarn.lock
+
@@ -1,3 +1,3 @@
 {
-  ".": "3.2.2"
+  ".": "3.4.0"
 }
@@ -1 +1 @@
-3.2.2
+3.4.6
@@ -2,6 +2,145 @@

 This file contains all the latest changes and updates to Postal.

+## [3.4.0](https://github.com/postalserver/postal/compare/3.3.7...3.4.0) (2026-10-01)
+
+
+### Features
+
+* add configurable Postal logger level defaulting to INFO ([#3626](https://github.com/postalserver/postal/issues/3626)) ([ced77a3](https://github.com/postalserver/postal/commit/ced77a3860c23779889aec8dacd2642f20d10cea))
+* **dkim:** make key size configurable and allow keys to be rotated ([d96eddb](https://github.com/postalserver/postal/commit/d96eddbadeda600595d6247486f9ceb8e99cbc15))
+
+
+### Bug Fixes
+
+* give each worker process a unique locker identity ([#3628](https://github.com/postalserver/postal/issues/3628)) ([3be663d](https://github.com/postalserver/postal/commit/3be663dc8931bd731516bafd6edff6b0fbd03df2))
+
+## [3.3.7](https://github.com/postalserver/postal/compare/3.3.6...3.3.7) (2026-06-03)
+
+
+### Bug Fixes
+
+* **http:** prevent SSRF in outbound webhook and HTTP endpoint requests ([11c9814](https://github.com/postalserver/postal/commit/11c9814474f956619da35e8385ef7fab9f304de0))
+* **message-db:** prevent SQL injection via condition keys (GHSA-x2hq-rfpg-3xr5) ([4314a6e](https://github.com/postalserver/postal/commit/4314a6ec1e2812daa67dd20effd1db1769c1f8e8))
+* **specs:** stub IPv6 support in address guard IPv6 literal spec ([029bfe0](https://github.com/postalserver/postal/commit/029bfe098d9b8c0b5cafc49eac33e767f5748cd3))
+
+
+### Miscellaneous Chores
+
+* **deps:** upgrade rack & rails ([0445e5c](https://github.com/postalserver/postal/commit/0445e5c509870dfe9c16366c53dee3fc02ad3904))
+* update security vulnerability reporting instructions ([8be1e27](https://github.com/postalserver/postal/commit/8be1e27fec489ab659ef5e909f705932028b1694))
+
+## [3.3.6](https://github.com/postalserver/postal/compare/3.3.5...3.3.6) (2026-04-28)
+
+
+### Bug Fixes
+
+* **messages:** sandbox rendered email HTML as extra XSS defence ([cad2aa6](https://github.com/postalserver/postal/commit/cad2aa6808519a3ff25215f09f4966d9fa3bb372))
+
+
+### Miscellaneous Chores
+
+* ignore node modules and yarn.lock ([b611d57](https://github.com/postalserver/postal/commit/b611d577af79b8e1e75b6d47fa04d1ba03e34eec))
+
+
+### Code Refactoring
+
+* **auth:** tighten return_to validation ([84f4e20](https://github.com/postalserver/postal/commit/84f4e20f05db2d11b0144f95960c956f8221e657))
+* **helpers:** escape interpolated values in select options ([9243524](https://github.com/postalserver/postal/commit/924352403553dcfcc569876ca76c219493fac9d6))
+* **tracking:** remove unused src image proxy ([dca7f90](https://github.com/postalserver/postal/commit/dca7f90b9046247c0d953567be35921167e79d87))
+
+## [3.3.5](https://github.com/postalserver/postal/compare/3.3.4...3.3.5) (2026-02-01)
+
+
+### Bug Fixes
+
+* **deliveries:** escape delivery details to prevent HTML injection ([11419f9](https://github.com/postalserver/postal/commit/11419f99140e13688a9613cab3ee03f8d3cbae45))
+* **health_server:** use rackup handler instead of rack handler ([7c47422](https://github.com/postalserver/postal/commit/7c47422c865e738c4d6af0fed1cca4405288341f))
+* oidc scopes are invalid when concatenated ([#3332](https://github.com/postalserver/postal/issues/3332)) ([9c5f96a](https://github.com/postalserver/postal/commit/9c5f96ae90cf06dcd5db776806865752f667bd95))
+* typo in process logging ([#3212](https://github.com/postalserver/postal/issues/3212)) ([b7e5232](https://github.com/postalserver/postal/commit/b7e5232e077b3c9b7a999dcb6676fba0ec61458e))
+* typo in the credentials page ([fd3c7cc](https://github.com/postalserver/postal/commit/fd3c7ccdf6dc4ee0a76c9523cbd735159e4b8000))
+* update url for v2 config ([#3225](https://github.com/postalserver/postal/issues/3225)) ([e00098b](https://github.com/postalserver/postal/commit/e00098b8003cf37f2708f536871b3ade377aed2d))
+
+
+### Documentation
+
+* **process.rb:** add help about time unit used by metric ([#3339](https://github.com/postalserver/postal/issues/3339)) ([f5325c4](https://github.com/postalserver/postal/commit/f5325c49ff1152ad53eaaec98717ad3412d379ae))
+
+
+### Miscellaneous Chores
+
+* **deps:** upgrade puma, net-imap and other deps ([c03c44b](https://github.com/postalserver/postal/commit/c03c44b442a29aa9881c1e1aae60bead9776a6b6))
+* **dockerfile:** reduce container size ([86de372](https://github.com/postalserver/postal/commit/86de372382bd62bdd5d1372254f8817b0360bd56))
+* remove version from docker-compose.yml ([c78000c](https://github.com/postalserver/postal/commit/c78000ca8f2998aa04648f465060768db6467de6))
+* upgrade resolv to 0.6.2 ([d00d978](https://github.com/postalserver/postal/commit/d00d978872a96369544303d08f6a9d11cdf56b62))
+* upgrade to rails 7.1 and ruby 3.4 ([#3457](https://github.com/postalserver/postal/issues/3457)) ([ab6d443](https://github.com/postalserver/postal/commit/ab6d4430baa33a05f1aa66e776cc2a5bcaa0ede8))
+* upgrade uri gem to 1.0.3 ([f193b8e](https://github.com/postalserver/postal/commit/f193b8e77fc096382ab7aaa6a2c29641b4cb12df))
+
+## [3.3.4](https://github.com/postalserver/postal/compare/3.3.3...3.3.4) (2024-06-20)
+
+
+### Bug Fixes
+
+* fix `postal version` command ([4fa88ac](https://github.com/postalserver/postal/commit/4fa88acea0dececd0eae485506a2ad8268fbea59))
+* fix issue running message pruning task ([3a33e53](https://github.com/postalserver/postal/commit/3a33e53d843584757bb00898746aa059d7616db4))
+* raise NotImplementedError when no call method on a scheduled task ([2b0919c](https://github.com/postalserver/postal/commit/2b0919c1454eabea93db96f50ecbd8e36bb89f1f))
+
+## [3.3.3](https://github.com/postalserver/postal/compare/3.3.2...3.3.3) (2024-04-18)
+
+
+### Bug Fixes
+
+* **legacy-api:** allow _expansions to be provided as true to return all expansions ([39f704c](https://github.com/postalserver/postal/commit/39f704c256fc3e71a1dc009acc77796a1efffead)), closes [#2932](https://github.com/postalserver/postal/issues/2932)
+
+## [3.3.2](https://github.com/postalserver/postal/compare/3.3.1...3.3.2) (2024-03-21)
+
+
+### Code Refactoring
+
+* **versioning:** improve how current version and branch is determined and set ([07c6b31](https://github.com/postalserver/postal/commit/07c6b317f2b9dc04b6a8c88df1e6aa9e54597504))
+
+## [3.3.1](https://github.com/postalserver/postal/compare/3.3.0...3.3.1) (2024-03-21)
+
+
+### Bug Fixes
+
+* **smtp-sender:** ensure relays without a host are excluded ([3a56ec8](https://github.com/postalserver/postal/commit/3a56ec8a74950e0162d98f1af5f58a67a82d6455))
+* **smtp-sender:** fixes `SMTPSender.smtp_relays` ([b3264b9](https://github.com/postalserver/postal/commit/b3264b942776e254d3c351c94c435d172a514e18))
+
+
+### Miscellaneous Chores
+
+* **container:** add the branch name to the container ([bee5098](https://github.com/postalserver/postal/commit/bee509832edc151d97fe5bfc48c4973452873fc8))
+* **github-actions:** don't generate commit- tags ([d65bbe0](https://github.com/postalserver/postal/commit/d65bbe0579037c5df962a18134bc007f5159d7e5))
+* **github-actions:** don't run for dependabot or release-please PRs and fetch whole repo ([adaf2b0](https://github.com/postalserver/postal/commit/adaf2b07502e9ed91290873ad8465051c6fd814f))
+* **github-actions:** include a version string on branch-*/latest images ([64bc7dc](https://github.com/postalserver/postal/commit/64bc7dcf7c0a8e006ab6eb6e8b4a52ad5e7e6528))
+* **ui:** display branch in footer if present ([1823617](https://github.com/postalserver/postal/commit/18236171ebc398c157f2e61b15c7df9f91205284))
+
+
+### Code Refactoring
+
+* remove moonrope but maintain legacy API actions ([#2889](https://github.com/postalserver/postal/issues/2889)) ([4d9654d](https://github.com/postalserver/postal/commit/4d9654dac47d59c760be96388d0421de74d3e6ac))
+
+## [3.3.0](https://github.com/postalserver/postal/compare/3.2.2...3.3.0) (2024-03-18)
+
+
+### Features
+
+* **prometheus:** add `postal_message_queue_latency` metric ([ee8d829](https://github.com/postalserver/postal/commit/ee8d829a854f91e476167869cafe35c2d37bb314))
+* **worker:** allow number of threads to be configured ([7e2accc](https://github.com/postalserver/postal/commit/7e2acccd1ebd80750a3ebdb96cb5c36b5263cc24))
+* **worker:** scale connection pool with worker threads ([ea542a0](https://github.com/postalserver/postal/commit/ea542a0694b3465b04fd3ebc439837df414deb1e))
+
+
+### Bug Fixes
+
+* **message-dequeuer:** ability to disable batching ([4fcb9e9](https://github.com/postalserver/postal/commit/4fcb9e9a2e34be5aa4bdf13f0529f40e564b72b4))
+
+
+### Miscellaneous Chores
+
+* **config-docs:** update docs for latest oidc defaults ([364eba6](https://github.com/postalserver/postal/commit/364eba6c5fce2f08a36489f42856ad5024a2062c))
+* **config-docs:** update proxy protocol to mention v1 ([45dd8aa](https://github.com/postalserver/postal/commit/45dd8aaac56f15481cb7bf9081401cb28dc1e707))
+
 ## [3.2.2](https://github.com/postalserver/postal/compare/3.2.1...3.2.2) (2024-03-14)


@@ -1,22 +1,25 @@
-FROM ruby:3.2.2-bullseye AS base
+FROM ruby:3.4.6-slim-bookworm AS base

 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 RUN apt-get update \
-  && apt-get install -y --no-install-recommends \
-  software-properties-common dirmngr apt-transport-https \
-  && (curl -sL https://deb.nodesource.com/setup_20.x | bash -) \
+  && apt-get install --no-install-recommends -y curl \
+  && apt-get clean \
  && rm -rf /var/lib/apt/lists/*

+RUN (curl -sL https://deb.nodesource.com/setup_20.x | bash -)
+
 # Install main dependencies
 RUN apt-get update && \
  apt-get install -y --no-install-recommends \
    build-essential  \
-  netcat \
-  curl \
+    netcat-openbsd \
    libmariadb-dev \
    libcap2-bin \
    nano \
-  nodejs
+    libyaml-dev \
+    nodejs \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*

 RUN setcap 'cap_net_bind_service=+ep' /usr/local/bin/ruby

@@ -31,7 +34,7 @@ RUN mkdir -p /opt/postal/app /opt/postal/config
 WORKDIR /opt/postal/app

 # Install bundler
-RUN gem install bundler -v 2.5.6 --no-doc
+RUN gem install bundler -v 2.7.2 --no-doc

 # Install the latest and active gem dependencies and re-run
 # the appropriate commands to handle installs.
@@ -43,8 +46,10 @@ COPY ./docker/wait-for.sh /docker-entrypoint.sh
 COPY --chown=postal . .

 # Export the version
-ARG VERSION=unspecified
-RUN echo $VERSION > VERSION
+ARG VERSION
+ARG BRANCH
+RUN if [ "$VERSION" != "" ]; then echo $VERSION > VERSION; fi \
+  && if [ "$BRANCH" != "" ]; then echo $BRANCH > BRANCH; fi

 # Set paths for when running in a container
 ENV POSTAL_CONFIG_FILE_PATH=/config/postal.yml
@@ -1,6 +1,7 @@
 # frozen_string_literal: true

 source "https://rubygems.org"
+gem "abbrev"
 gem "authie"
 gem "autoprefixer-rails"
 gem "bcrypt"
@@ -17,15 +18,18 @@ gem "jwt"
 gem "kaminari"
 gem "klogger-logger"
 gem "konfig-config", "~> 3.0"
+gem "logger"
 gem "mail"
-gem "moonrope"
+gem "mutex_m"
 gem "mysql2"
 gem "nifty-utils"
 gem "nilify_blanks"
 gem "nio4r"
+gem "ostruct"
 gem "prometheus-client"
 gem "puma"
-gem "rails", "= 7.0.8.1"
+gem "rackup"
+gem "rails", "= 7.1.6"
 gem "resolv"
 gem "secure_headers"
 gem "sentry-rails"
@@ -48,12 +52,15 @@ end

 group :development do
  gem "annotate"
-  gem "database_cleaner", require: false
-  gem "factory_bot_rails", require: false
-  gem "rspec", require: false
-  gem "rspec-rails", require: false
  gem "rubocop"
  gem "rubocop-rails"
+end
+
+group :test do
+  gem "database_cleaner-active_record"
+  gem "factory_bot_rails"
+  gem "rspec"
+  gem "rspec-rails"
  gem "shoulda-matchers"
  gem "timecop"
  gem "webmock"
@@ -1,70 +1,85 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    actioncable (7.0.8.1)
-      actionpack (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
+    abbrev (0.1.2)
+    actioncable (7.1.6)
+      actionpack (= 7.1.6)
+      activesupport (= 7.1.6)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
-    actionmailbox (7.0.8.1)
-      actionpack (= 7.0.8.1)
-      activejob (= 7.0.8.1)
-      activerecord (= 7.0.8.1)
-      activestorage (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
+      zeitwerk (~> 2.6)
+    actionmailbox (7.1.6)
+      actionpack (= 7.1.6)
+      activejob (= 7.1.6)
+      activerecord (= 7.1.6)
+      activestorage (= 7.1.6)
+      activesupport (= 7.1.6)
      mail (>= 2.7.1)
      net-imap
      net-pop
      net-smtp
-    actionmailer (7.0.8.1)
-      actionpack (= 7.0.8.1)
-      actionview (= 7.0.8.1)
-      activejob (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
+    actionmailer (7.1.6)
+      actionpack (= 7.1.6)
+      actionview (= 7.1.6)
+      activejob (= 7.1.6)
+      activesupport (= 7.1.6)
      mail (~> 2.5, >= 2.5.4)
      net-imap
      net-pop
      net-smtp
-      rails-dom-testing (~> 2.0)
-    actionpack (7.0.8.1)
-      actionview (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
-      rack (~> 2.0, >= 2.2.4)
+      rails-dom-testing (~> 2.2)
+    actionpack (7.1.6)
+      actionview (= 7.1.6)
+      activesupport (= 7.1.6)
+      cgi
+      nokogiri (>= 1.8.5)
+      racc
+      rack (>= 2.2.4)
+      rack-session (>= 1.0.1)
      rack-test (>= 0.6.3)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (7.0.8.1)
-      actionpack (= 7.0.8.1)
-      activerecord (= 7.0.8.1)
-      activestorage (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+    actiontext (7.1.6)
+      actionpack (= 7.1.6)
+      activerecord (= 7.1.6)
+      activestorage (= 7.1.6)
+      activesupport (= 7.1.6)
      globalid (>= 0.6.0)
      nokogiri (>= 1.8.5)
-    actionview (7.0.8.1)
-      activesupport (= 7.0.8.1)
+    actionview (7.1.6)
+      activesupport (= 7.1.6)
      builder (~> 3.1)
-      erubi (~> 1.4)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (7.0.8.1)
-      activesupport (= 7.0.8.1)
+      cgi
+      erubi (~> 1.11)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+    activejob (7.1.6)
+      activesupport (= 7.1.6)
      globalid (>= 0.3.6)
-    activemodel (7.0.8.1)
-      activesupport (= 7.0.8.1)
-    activerecord (7.0.8.1)
-      activemodel (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
-    activestorage (7.0.8.1)
-      actionpack (= 7.0.8.1)
-      activejob (= 7.0.8.1)
-      activerecord (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
+    activemodel (7.1.6)
+      activesupport (= 7.1.6)
+    activerecord (7.1.6)
+      activemodel (= 7.1.6)
+      activesupport (= 7.1.6)
+      timeout (>= 0.4.0)
+    activestorage (7.1.6)
+      actionpack (= 7.1.6)
+      activejob (= 7.1.6)
+      activerecord (= 7.1.6)
+      activesupport (= 7.1.6)
      marcel (~> 1.0)
-      mini_mime (>= 1.1.0)
-    activesupport (7.0.8.1)
+    activesupport (7.1.6)
+      base64
+      benchmark (>= 0.3)
+      bigdecimal
      concurrent-ruby (~> 1.0, >= 1.0.2)
+      connection_pool (>= 2.2.5)
+      drb
      i18n (>= 1.6, < 2)
+      logger (>= 1.4.2)
      minitest (>= 5.1)
+      mutex_m
+      securerandom (>= 0.3)
      tzinfo (~> 2.0)
    addressable (2.8.6)
      public_suffix (>= 2.0.2, < 6.0)
@@ -74,15 +89,17 @@ GEM
      rake (>= 10.4, < 14.0)
    ast (2.4.2)
    attr_required (1.0.2)
-    authie (4.1.3)
-      activerecord (>= 6.1, < 8.0)
+    authie (5.0.0)
+      activerecord (>= 6.1, < 9.0)
    autoprefixer-rails (10.4.13.0)
      execjs (~> 2)
-    base64 (0.2.0)
+    base64 (0.3.0)
    bcrypt (3.1.20)
-    bigdecimal (3.1.6)
+    benchmark (0.5.0)
+    bigdecimal (4.1.2)
    bindata (2.5.0)
-    builder (3.2.4)
+    builder (3.3.0)
+    cgi (0.5.1)
    chronic (0.10.2)
    coffee-rails (5.0.0)
      coffee-script (>= 2.2.0)
@@ -91,28 +108,26 @@ GEM
      coffee-script-source
      execjs
    coffee-script-source (1.12.2)
-    concurrent-ruby (1.2.3)
+    concurrent-ruby (1.3.6)
+    connection_pool (3.0.2)
    crack (1.0.0)
      bigdecimal
      rexml
    crass (1.0.6)
-    database_cleaner (2.0.2)
-      database_cleaner-active_record (>= 2, < 3)
-    database_cleaner-active_record (2.1.0)
+    database_cleaner-active_record (2.2.2)
      activerecord (>= 5.a)
-      database_cleaner-core (~> 2.0.0)
+      database_cleaner-core (~> 2.0)
    database_cleaner-core (2.0.1)
-    date (3.3.4)
-    deep_merge (1.2.2)
-    diff-lcs (1.5.0)
+    date (3.5.1)
+    diff-lcs (1.6.2)
    domain_name (0.6.20240107)
    dotenv (3.0.2)
-    dynamic_form (1.3.1)
-      actionview (> 5.2.0)
-      activemodel (> 5.2.0)
+    drb (2.2.3)
+    dynamic_form (1.2.0)
    email_validator (2.2.4)
      activemodel
-    erubi (1.12.0)
+    erb (6.0.4)
+    erubi (1.13.1)
    execjs (2.7.0)
    factory_bot (6.4.6)
      activesupport (>= 5.0.0)
@@ -128,7 +143,7 @@ GEM
    ffi (1.15.5)
    gelf (3.1.0)
      json
-    globalid (1.2.1)
+    globalid (1.3.0)
      activesupport (>= 6.1)
    haml (6.3.0)
      temple (>= 0.8.2)
@@ -137,8 +152,14 @@ GEM
    hashdiff (1.1.0)
    hashie (5.0.0)
    highline (2.1.0)
-    i18n (1.14.1)
+    i18n (1.14.8)
      concurrent-ruby (~> 1.0)
+    io-console (0.8.2)
+    irb (1.18.0)
+      pp (>= 0.6.0)
+      prism (>= 1.3.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
    jquery-rails (4.5.1)
      rails-dom-testing (>= 1, < 3)
      railties (>= 4.2.0)
@@ -171,50 +192,46 @@ GEM
      rouge (>= 3.30, < 5.0)
    konfig-config (3.0.0)
      hashie
-    loofah (2.22.0)
+    logger (1.7.0)
+    loofah (2.25.1)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
-    mail (2.8.1)
+    mail (2.9.0)
+      logger
      mini_mime (>= 0.1.1)
      net-imap
      net-pop
      net-smtp
-    marcel (1.0.2)
-    method_source (1.0.0)
+    marcel (1.2.1)
    mini_mime (1.1.5)
-    mini_portile2 (2.8.5)
-    minitest (5.22.2)
-    moonrope (2.0.2)
-      deep_merge (~> 1.0)
-      json
-      rack (>= 1.4)
+    minitest (6.0.6)
+      drb (~> 2.0)
+      prism (~> 1.5)
+    mutex_m (0.3.0)
    mysql2 (0.5.6)
    net-http (0.4.1)
      uri
-    net-imap (0.4.10)
+    net-imap (0.6.4)
      date
      net-protocol
    net-pop (0.1.2)
      net-protocol
    net-protocol (0.2.2)
      timeout
-    net-smtp (0.4.0.1)
+    net-smtp (0.5.1)
      net-protocol
    nifty-utils (1.1.7)
    nilify_blanks (1.4.0)
      activerecord (>= 4.0.0)
      activesupport (>= 4.0.0)
-    nio4r (2.7.0)
-    nokogiri (1.16.2)
-      mini_portile2 (~> 2.8.2)
+    nio4r (2.7.5)
+    nokogiri (1.19.3-aarch64-linux-gnu)
      racc (~> 1.4)
-    nokogiri (1.16.2-aarch64-linux)
+    nokogiri (1.19.3-arm64-darwin)
      racc (~> 1.4)
-    nokogiri (1.16.2-arm64-darwin)
+    nokogiri (1.19.3-x86_64-darwin)
      racc (~> 1.4)
-    nokogiri (1.16.2-x86_64-darwin)
-      racc (~> 1.4)
-    nokogiri (1.16.2-x86_64-linux)
+    nokogiri (1.19.3-x86_64-linux-gnu)
      racc (~> 1.4)
    omniauth (2.1.2)
      hashie (>= 3.4.6)
@@ -239,15 +256,23 @@ GEM
      tzinfo
      validate_url
      webfinger (~> 2.0)
+    ostruct (0.6.3)
    parallel (1.22.1)
    parser (3.2.1.1)
      ast (~> 2.4.1)
+    pp (0.6.3)
+      prettyprint
+    prettyprint (0.2.0)
+    prism (1.9.0)
    prometheus-client (4.2.2)
+    psych (5.4.0)
+      date
+      stringio
    public_suffix (5.0.4)
-    puma (6.4.2)
+    puma (7.0.4)
      nio4r (~> 2.0)
-    racc (1.7.3)
-    rack (2.2.8.1)
+    racc (1.8.1)
+    rack (3.2.6)
    rack-oauth2 (2.2.1)
      activesupport
      attr_required
@@ -255,57 +280,72 @@ GEM
      faraday-follow_redirects
      json-jwt (>= 1.11.0)
      rack (>= 2.1.0)
-    rack-protection (3.2.0)
+    rack-protection (4.1.1)
      base64 (>= 0.1.0)
-      rack (~> 2.2, >= 2.2.4)
-    rack-test (2.1.0)
+      logger (>= 1.6.0)
+      rack (>= 3.0.0, < 4)
+    rack-session (2.1.2)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0)
+    rack-test (2.2.0)
      rack (>= 1.3)
-    rails (7.0.8.1)
-      actioncable (= 7.0.8.1)
-      actionmailbox (= 7.0.8.1)
-      actionmailer (= 7.0.8.1)
-      actionpack (= 7.0.8.1)
-      actiontext (= 7.0.8.1)
-      actionview (= 7.0.8.1)
-      activejob (= 7.0.8.1)
-      activemodel (= 7.0.8.1)
-      activerecord (= 7.0.8.1)
-      activestorage (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
+    rackup (2.3.1)
+      rack (>= 3)
+    rails (7.1.6)
+      actioncable (= 7.1.6)
+      actionmailbox (= 7.1.6)
+      actionmailer (= 7.1.6)
+      actionpack (= 7.1.6)
+      actiontext (= 7.1.6)
+      actionview (= 7.1.6)
+      activejob (= 7.1.6)
+      activemodel (= 7.1.6)
+      activerecord (= 7.1.6)
+      activestorage (= 7.1.6)
+      activesupport (= 7.1.6)
      bundler (>= 1.15.0)
-      railties (= 7.0.8.1)
-    rails-dom-testing (2.2.0)
+      railties (= 7.1.6)
+    rails-dom-testing (2.3.0)
      activesupport (>= 5.0.0)
      minitest
      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.6.0)
-      loofah (~> 2.21)
-      nokogiri (~> 1.14)
-    railties (7.0.8.1)
-      actionpack (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
-      method_source
+    rails-html-sanitizer (1.7.0)
+      loofah (~> 2.25)
+      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
+    railties (7.1.6)
+      actionpack (= 7.1.6)
+      activesupport (= 7.1.6)
+      cgi
+      irb
+      rackup (>= 1.0.0)
      rake (>= 12.2)
-      thor (~> 1.0)
-      zeitwerk (~> 2.5)
+      thor (~> 1.0, >= 1.2.2)
+      tsort (>= 0.2)
+      zeitwerk (~> 2.6)
    rainbow (3.1.1)
-    rake (13.1.0)
+    rake (13.4.2)
+    rdoc (7.2.0)
+      erb
+      psych (>= 4.0.0)
+      tsort
    regexp_parser (2.7.0)
-    resolv (0.3.0)
-    rexml (3.2.5)
+    reline (0.6.3)
+      io-console (~> 0.5)
+    resolv (0.6.2)
+    rexml (3.4.4)
    rouge (4.2.0)
-    rspec (3.12.0)
-      rspec-core (~> 3.12.0)
-      rspec-expectations (~> 3.12.0)
-      rspec-mocks (~> 3.12.0)
-    rspec-core (3.12.1)
-      rspec-support (~> 3.12.0)
-    rspec-expectations (3.12.2)
+    rspec (3.13.1)
+      rspec-core (~> 3.13.0)
+      rspec-expectations (~> 3.13.0)
+      rspec-mocks (~> 3.13.0)
+    rspec-core (3.13.5)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.5)
      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.12.0)
-    rspec-mocks (3.12.4)
+      rspec-support (~> 3.13.0)
+    rspec-mocks (3.13.5)
      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.12.0)
+      rspec-support (~> 3.13.0)
    rspec-rails (6.1.1)
      actionpack (>= 6.1)
      activesupport (>= 6.1)
@@ -314,7 +354,7 @@ GEM
      rspec-expectations (~> 3.12)
      rspec-mocks (~> 3.12)
      rspec-support (~> 3.12)
-    rspec-support (3.12.0)
+    rspec-support (3.13.6)
    rubocop (1.48.1)
      json (~> 2.3)
      parallel (~> 1.10)
@@ -343,6 +383,7 @@ GEM
      sprockets-rails
      tilt
    secure_headers (6.5.0)
+    securerandom (0.4.1)
    sentry-rails (5.16.1)
      railties (>= 5.0)
      sentry-ruby (~> 5.16.1)
@@ -357,16 +398,18 @@ GEM
      actionpack (>= 5.2)
      activesupport (>= 5.2)
      sprockets (>= 3.0.0)
+    stringio (3.2.0)
    swd (2.0.3)
      activesupport (>= 3)
      attr_required (>= 0.0.5)
      faraday (~> 2.0)
      faraday-follow_redirects
    temple (0.10.3)
-    thor (1.3.0)
+    thor (1.5.0)
    tilt (2.3.0)
    timecop (0.9.8)
-    timeout (0.4.1)
+    timeout (0.6.1)
+    tsort (0.2.0)
    turbolinks (5.2.1)
      turbolinks-source (~> 5.2)
    turbolinks-source (5.2.0)
@@ -375,7 +418,7 @@ GEM
    uglifier (4.2.0)
      execjs (>= 0.3.0, < 3)
    unicode-display_width (2.4.2)
-    uri (0.13.0)
+    uri (1.0.3)
    validate_url (1.0.15)
      activemodel (>= 3.0.0)
      public_suffix
@@ -387,27 +430,28 @@ GEM
      addressable (>= 2.8.0)
      crack (>= 0.3.2)
      hashdiff (>= 0.4.0, < 2.0.0)
-    webrick (1.8.1)
-    websocket-driver (0.7.6)
+    webrick (1.9.1)
+    websocket-driver (0.8.0)
+      base64
      websocket-extensions (>= 0.1.0)
    websocket-extensions (0.1.5)
-    zeitwerk (2.6.13)
+    zeitwerk (2.8.2)

 PLATFORMS
  aarch64-linux
  arm64-darwin
-  ruby
  x86_64-darwin
  x86_64-linux

 DEPENDENCIES
+  abbrev
  annotate
  authie
  autoprefixer-rails
  bcrypt
  chronic
  coffee-rails (~> 5.0)
-  database_cleaner
+  database_cleaner-active_record
  domain_name
  dotenv
  dynamic_form
@@ -422,17 +466,20 @@ DEPENDENCIES
  kaminari
  klogger-logger
  konfig-config (~> 3.0)
+  logger
  mail
-  moonrope
+  mutex_m
  mysql2
  nifty-utils
  nilify_blanks
  nio4r
  omniauth-rails_csrf_protection
  omniauth_openid_connect
+  ostruct
  prometheus-client
  puma
-  rails (= 7.0.8.1)
+  rackup
+  rails (= 7.1.6)
  resolv
  rspec
  rspec-rails
@@ -449,4 +496,4 @@ DEPENDENCIES
  webrick

 BUNDLED WITH
-   2.5.6
+   2.7.2
@@ -11,5 +11,5 @@ We only support updates to the 3.x versions of Postal.

 ## Reporting a Vulnerability

-If you discover a vulnerability in Postal, please do not post an issue on GitHub. Instead you should send an
-e-mail to security@postalserver.io with details. We will get back to you directly.
+If you discover a vulnerability in Postal, please do not post an issue on GitHub. Please,
+instead, [create a new security advisory through GitHub](https://github.com/postalserver/postal/security/advisories/new).
@@ -1,31 +0,0 @@
-# frozen_string_literal: true
-
-authenticator :server do
-  friendly_name "Server Authenticator"
-  header "X-Server-API-Key", "The API token for a server that you wish to authenticate with.", example: "f29a45f0d4e1744ebaee"
-  error "InvalidServerAPIKey", "The API token provided in X-Server-API-Key was not valid.", attributes: { token: "The token that was looked up" }
-  error "ServerSuspended", "The mail server has been suspended"
-  lookup do
-    if key = request.headers["X-Server-API-Key"]
-      if credential = Credential.where(type: "API", key: key).first
-        if credential.server.suspended?
-          error "ServerSuspended"
-        else
-          credential.use
-          credential
-        end
-      else
-        error "InvalidServerAPIKey", token: key
-      end
-    end
-  end
-  rule :default, "AccessDenied", "Must be authenticated as a server." do
-    identity.is_a?(Credential)
-  end
-end
-
-authenticator :anonymous do
-  rule :default, "MustNotBeAuthenticated", "Must not be authenticated." do
-    identity.nil?
-  end
-end
@@ -1,41 +0,0 @@
-# frozen_string_literal: true
-
-controller :messages do
-  friendly_name "Messages API"
-  description "This API allows you to access message details"
-  authenticator :server
-
-  action :message do
-    title "Return message details"
-    description "Returns all details about a message"
-    param :id, "The ID of the message", type: Integer, required: true
-    returns Hash, structure: :message, structure_opts: { paramable: { expansions: false } }
-    error "MessageNotFound", "No message found matching provided ID", attributes: { id: "The ID of the message" }
-    action do
-      begin
-        message = identity.server.message(params.id)
-      rescue Postal::MessageDB::Message::NotFound
-        error "MessageNotFound", id: params.id
-      end
-      structure :message, message, return: true
-    end
-  end
-
-  action :deliveries do
-    title "Return deliveries for a message"
-    description "Returns an array of deliveries which have been attempted for this message"
-    param :id, "The ID of the message", type: Integer, required: true
-    returns Array, structure: :delivery, structure_opts: { full: true }
-    error "MessageNotFound", "No message found matching provided ID", attributes: { id: "The ID of the message" }
-    action do
-      begin
-        message = identity.server.message(params.id)
-      rescue Postal::MessageDB::Message::NotFound
-        error "MessageNotFound", id: params.id
-      end
-      message.deliveries.map do |d|
-        structure :delivery, d
-      end
-    end
-  end
-end
@@ -1,112 +0,0 @@
-# frozen_string_literal: true
-
-controller :send do
-  friendly_name "Send API"
-  description "This API allows you to send messages"
-  authenticator :server
-
-  action :message do
-    title "Send a message"
-    description "This action allows you to send a message by providing the appropriate options"
-    # Acceptable Parameters
-    param :to, "The e-mail addresses of the recipients (max 50)", type: Array
-    param :cc, "The e-mail addresses of any CC contacts (max 50)", type: Array
-    param :bcc, "The e-mail addresses of any BCC contacts (max 50)", type: Array
-    param :from, "The e-mail address for the From header", type: String
-    param :sender, "The e-mail address for the Sender header", type: String
-    param :subject, "The subject of the e-mail", type: String
-    param :tag, "The tag of the e-mail", type: String
-    param :reply_to, "Set the reply-to address for the mail", type: String
-    param :plain_body, "The plain text body of the e-mail", type: String
-    param :html_body, "The HTML body of the e-mail", type: String
-    param :attachments, "An array of attachments for this e-mail", type: Array
-    param :headers, "A hash of additional headers", type: Hash
-    param :bounce, "Is this message a bounce?", type: :boolean
-    # Errors
-    error "ValidationError", "The provided data was not sufficient to send an email", attributes: { errors: "A hash of error details" }
-    error "NoRecipients", "There are no recipients defined to receive this message"
-    error "NoContent", "There is no content defined for this e-mail"
-    error "TooManyToAddresses", "The maximum number of To addresses has been reached (maximum 50)"
-    error "TooManyCCAddresses", "The maximum number of CC addresses has been reached (maximum 50)"
-    error "TooManyBCCAddresses", "The maximum number of BCC addresses has been reached (maximum 50)"
-    error "FromAddressMissing", "The From address is missing and is required"
-    error "UnauthenticatedFromAddress", "The From address is not authorised to send mail from this server"
-    error "AttachmentMissingName", "An attachment is missing a name"
-    error "AttachmentMissingData", "An attachment is missing data"
-    # Return
-    returns Hash
-    # Action
-    action do
-      attributes = {}
-      attributes[:to] = params.to
-      attributes[:cc] = params.cc
-      attributes[:bcc] = params.bcc
-      attributes[:from] = params.from
-      attributes[:sender] = params.sender
-      attributes[:subject] = params.subject
-      attributes[:reply_to] = params.reply_to
-      attributes[:plain_body] = params.plain_body
-      attributes[:html_body] = params.html_body
-      attributes[:bounce] = params.bounce ? true : false
-      attributes[:tag] = params.tag
-      attributes[:custom_headers] = params.headers
-      attributes[:attachments] = []
-      (params.attachments || []).each do |attachment|
-        next unless attachment.is_a?(Hash)
-
-        attributes[:attachments] << { name: attachment["name"], content_type: attachment["content_type"], data: attachment["data"], base64: true }
-      end
-      message = OutgoingMessagePrototype.new(identity.server, request.ip, "api", attributes)
-      message.credential = identity
-      if message.valid?
-        result = message.create_messages
-        { message_id: message.message_id, messages: result }
-      else
-        error message.errors.first
-      end
-    end
-  end
-
-  action :raw do
-    title "Send a raw RFC2822 message"
-    description "This action allows you to send us a raw RFC2822 formatted message along with the recipients that it should be sent to. This is similar to sending a message through our SMTP service."
-    param :mail_from, "The address that should be logged as sending the message", type: String, required: true
-    param :rcpt_to, "The addresses this message should be sent to", type: Array, required: true
-    param :data, "A base64 encoded RFC2822 message to send", type: String, required: true
-    param :bounce, "Is this message a bounce?", type: :boolean
-    returns Hash
-    error "UnauthenticatedFromAddress", "The From address is not authorised to send mail from this server"
-    action do
-      # Decode the raw message
-      raw_message = Base64.decode64(params.data)
-
-      # Parse through mail to get the from/sender headers
-      mail = Mail.new(raw_message.split("\r\n\r\n", 2).first)
-      from_headers = { "from" => mail.from, "sender" => mail.sender }
-      authenticated_domain = identity.server.find_authenticated_domain_from_headers(from_headers)
-
-      # If we're not authenticated, don't continue
-      if authenticated_domain.nil?
-        error "UnauthenticatedFromAddress"
-      end
-
-      # Store the result ready to return
-      result = { message_id: nil, messages: {} }
-      params.rcpt_to.uniq.each do |rcpt_to|
-        message = identity.server.message_db.new_message
-        message.rcpt_to = rcpt_to
-        message.mail_from = params.mail_from
-        message.raw_message = raw_message
-        message.received_with_ssl = true
-        message.scope = "outgoing"
-        message.domain_id = authenticated_domain.id
-        message.credential_id = identity.id
-        message.bounce = params.bounce
-        message.save
-        result[:message_id] = message.message_id if result[:message_id].nil?
-        result[:messages][rcpt_to] = { id: message.id, token: message.token }
-      end
-      result
-    end
-  end
-end
@@ -1,12 +0,0 @@
-# frozen_string_literal: true
-
-structure :delivery do
-  basic :id
-  basic :status
-  basic :details
-  basic :output, value: proc { o.output&.strip }
-  basic :sent_with_ssl, value: proc { o.sent_with_ssl }
-  basic :log_id
-  basic :time, value: proc { o.time&.to_f }
-  basic :timestamp, value: proc { o.timestamp.to_f }
-end
@@ -1,68 +0,0 @@
-# frozen_string_literal: true
-
-structure :message do
-  basic :id
-  basic :token
-
-  expansion(:status) do
-    {
-      status: o.status,
-      last_delivery_attempt: o.last_delivery_attempt&.to_f,
-      held: o.held,
-      hold_expiry: o.hold_expiry&.to_f
-    }
-  end
-
-  expansion(:details) do
-    {
-      rcpt_to: o.rcpt_to,
-      mail_from: o.mail_from,
-      subject: o.subject,
-      message_id: o.message_id,
-      timestamp: o.timestamp.to_f,
-      direction: o.scope,
-      size: o.size,
-      bounce: o.bounce,
-      bounce_for_id: o.bounce_for_id,
-      tag: o.tag,
-      received_with_ssl: o.received_with_ssl
-    }
-  end
-
-  expansion(:inspection) do
-    {
-      inspected: o.inspected,
-      spam: o.spam,
-      spam_score: o.spam_score.to_f,
-      threat: o.threat,
-      threat_details: o.threat_details
-    }
-  end
-
-  expansion(:plain_body) { o.plain_body }
-
-  expansion(:html_body) { o.html_body }
-
-  expansion(:attachments) do
-    o.attachments.map do |attachment|
-      {
-        filename: attachment.filename.to_s,
-        content_type: attachment.mime_type,
-        data: Base64.encode64(attachment.body.to_s),
-        size: attachment.body.to_s.bytesize,
-        hash: Digest::SHA1.hexdigest(attachment.body.to_s)
-      }
-    end
-  end
-
-  expansion(:headers) { o.headers }
-
-  expansion(:raw_message) { Base64.encode64(o.raw_message) }
-
-  expansion(:activity_entries) do
-    {
-      loads: o.loads,
-      clicks: o.clicks
-    }
-  end
-end
@@ -62,10 +62,13 @@ class ApplicationController < ActionController::Base
  end

  def url_with_return_to(url)
-    if params[:return_to].blank? || !params[:return_to].starts_with?("/")
+    return_to = params[:return_to]
+    if return_to.blank? ||
+       !return_to.start_with?("/") ||
+       return_to.start_with?("//", "/\\")
      url_for(url)
    else
-      params[:return_to]
+      return_to
    end
  end

@@ -98,9 +98,48 @@ class DomainsController < ApplicationController
    redirect_to [:verify, organization, @server, @domain], alert: "You can't set up DNS for this domain until it has been verified."
  end

+  def regenerate_dkim
+    if @domain.pending_dkim_key?
+      redirect_to_with_json [:setup, organization, @server, @domain],
+                            alert: "A DKIM key change is already in progress for #{@domain.name}. Publish the new " \
+                                   "record shown below, or cancel the change, before generating another key."
+      return
+    end
+
+    was_verified = @domain.dkim_status == "OK"
+    @domain.regenerate_dkim_key!
+    if was_verified
+      redirect_to_with_json [:setup, organization, @server, @domain],
+                            notice: "A new DKIM key has been generated for #{@domain.name}. Add the new DNS record below — " \
+                                    "your existing key will remain active until the new record has been verified. Keep the " \
+                                    "old DNS record published afterward while messages signed with it may still be queued, " \
+                                    "held, or available for redelivery."
+    else
+      redirect_to_with_json [:setup, organization, @server, @domain], notice: "A new DKIM key has been generated for #{@domain.name}. Update your DKIM DNS record with the new value below."
+    end
+  end
+
+  def cancel_dkim_regeneration
+    @domain.cancel_pending_dkim_key!
+    redirect_to_with_json [:setup, organization, @server, @domain], notice: "The pending DKIM key for #{@domain.name} has been discarded. Your existing key remains active."
+  end
+
  def check
+    had_pending_dkim_key = @domain.pending_dkim_key?
+    previous_dkim_record_name = @domain.dkim_record_name
    if @domain.check_dns(:manual)
+      if had_pending_dkim_key && !@domain.pending_dkim_key?
+        redirect_to_with_json [:setup, organization, @server, @domain],
+                              notice: "Your DNS records for #{@domain.name} look good! Your new DKIM key is now active. " \
+                                      "Keep the old record at #{previous_dkim_record_name} published while messages " \
+                                      "signed with the old key may still be queued, held, or available for redelivery."
+      elsif @domain.pending_dkim_key?
+        redirect_to_with_json [:setup, organization, @server, @domain],
+                              alert: "We couldn't verify the record for your new DKIM key yet. Your existing key remains " \
+                                     "active. Check below for the expected record details."
+      else
        redirect_to_with_json [organization, @server, :domains], notice: "Your DNS records for #{@domain.name} look good!"
+      end
    else
      redirect_to_with_json [:setup, organization, @server, @domain], alert: "There seems to be something wrong with your DNS records. Check below for information."
    end
@@ -0,0 +1,133 @@
+# frozen_string_literal: true
+
+module LegacyAPI
+  # The Legacy API is the Postal v1 API which existed from the start with main
+  # aim of allowing e-mails to sent over HTTP rather than SMTP. The API itself
+  # did not feature much functionality. This API was implemented using Moonrope
+  # which was a self documenting API tool, however, is now no longer maintained.
+  # In light of that, these controllers now implement the same functionality as
+  # the original Moonrope API without the actual requirement to use any of the
+  # Moonrope components.
+  #
+  # Important things to note about the API:
+  #
+  #   * Moonrope allow params to be provided as JSON in the body of the request
+  #     along with the application/json content type. It also allowed for params
+  #     to be sent in the 'params' parameter when using the
+  #     application/x-www-form-urlencoded content type. Both methods are supported.
+  #
+  #   * Authentication is performed using a X-Server-API-Key variable.
+  #
+  #   * The method used to make the request is not important. Most clients use POST
+  #     but other methods should be supported. The routing for this legacvy
+  #     API supports GET, POST, PUT and PATCH.
+  #
+  #   * The status code for responses will always be 200 OK. The actual status of
+  #     a request is determined by the value of the 'status' attribute in the
+  #     returned JSON.
+  class BaseController < ActionController::Base
+
+    skip_before_action :set_browser_id
+    skip_before_action :verify_authenticity_token
+
+    before_action :start_timer
+    before_action :authenticate_as_server
+
+    private
+
+    # The Moonrope API spec allows for parameters to be provided in the body
+    # along with the application/json content type or they can be provided,
+    # as JSON, in the 'params' parameter when used with the
+    # application/x-www-form-urlencoded content type. This legacy API needs
+    # support both options for maximum compatibility.
+    #
+    # @return [Hash]
+    def api_params
+      if request.headers["content-type"] =~ /\Aapplication\/json/
+        return params.to_unsafe_hash
+      end
+
+      if params["params"].present?
+        return JSON.parse(params["params"])
+      end
+
+      {}
+    end
+
+    # The API returns a length of time to complete a request. We'll start
+    # a timer when the request starts and then use this method to calculate
+    # the time taken to complete the request.
+    #
+    # @return [void]
+    def start_timer
+      @start_time = Time.now.to_f
+    end
+
+    # The only method available to authenticate to the legacy API is using a
+    # credential from the server itself. This method will attempt to find
+    # that credential from the X-Server-API-Key header and will set the
+    # current_credential instance variable if a token is valid. Otherwise it
+    # will render an error to halt execution.
+    #
+    # @return [void]
+    def authenticate_as_server
+      key = request.headers["X-Server-API-Key"]
+      if key.blank?
+        render_error "AccessDenied",
+                     message: "Must be authenticated as a server."
+        return
+      end
+
+      credential = Credential.where(type: "API", key: key).first
+      if credential.nil?
+        render_error "InvalidServerAPIKey",
+                     message: "The API token provided in X-Server-API-Key was not valid.",
+                     token: key
+        return
+      end
+
+      if credential.server.suspended?
+        render_error "ServerSuspended"
+        return
+      end
+
+      credential.use
+      @current_credential = credential
+    end
+
+    # Render a successful response to the client
+    #
+    # @param [Hash] data
+    # @return [void]
+    def render_success(data)
+      render json: { status: "success",
+                     time: (Time.now.to_f - @start_time).round(3),
+                     flags: {},
+                     data: data }
+    end
+
+    # Render an error response to the client
+    #
+    # @param [String] code
+    # @param [Hash] data
+    # @return [void]
+    def render_error(code, data = {})
+      render json: { status: "error",
+                     time: (Time.now.to_f - @start_time).round(3),
+                     flags: {},
+                     data: data.merge(code: code) }
+    end
+
+    # Render a parameter error response to the client
+    #
+    # @param [String] message
+    # @return [void]
+    def render_parameter_error(message)
+      render json: { status: "parameter-error",
+                     time: (Time.now.to_f - @start_time).round(3),
+                     flags: {},
+                     data: { message: message } }
+    end
+
+  end
+end
@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+module LegacyAPI
+  class MessagesController < BaseController
+
+    # Returns details about a given message
+    #
+    #   URL:            /api/v1/messages/message
+    #
+    #   Parameters:     id              => REQ: The ID of the message
+    #                   _expansions     => An array of types of details t
+    #                                      to return
+    #
+    #   Response:       A hash containing message information
+    #                   OR an error if the message does not exist.
+    #
+    def message
+      message = find_message
+      return if performed?
+
+      message_hash = { id: message.id, token: message.token }
+      expansions = api_params["_expansions"]
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("status"))
+        message_hash[:status] = {
+          status: message.status,
+          last_delivery_attempt: message.last_delivery_attempt&.to_f,
+          held: message.held,
+          hold_expiry: message.hold_expiry&.to_f
+        }
+      end
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("details"))
+        message_hash[:details] = {
+          rcpt_to: message.rcpt_to,
+          mail_from: message.mail_from,
+          subject: message.subject,
+          message_id: message.message_id,
+          timestamp: message.timestamp.to_f,
+          direction: message.scope,
+          size: message.size,
+          bounce: message.bounce,
+          bounce_for_id: message.bounce_for_id,
+          tag: message.tag,
+          received_with_ssl: message.received_with_ssl
+        }
+      end
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("inspection"))
+        message_hash[:inspection] = {
+          inspected: message.inspected,
+          spam: message.spam,
+          spam_score: message.spam_score.to_f,
+          threat: message.threat,
+          threat_details: message.threat_details
+        }
+      end
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("plain_body"))
+        message_hash[:plain_body] = message.plain_body
+      end
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("html_body"))
+        message_hash[:html_body] = message.html_body
+      end
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("attachments"))
+        message_hash[:attachments] = message.attachments.map do |attachment|
+          {
+            filename: attachment.filename.to_s,
+            content_type: attachment.mime_type,
+            data: Base64.encode64(attachment.body.to_s),
+            size: attachment.body.to_s.bytesize,
+            hash: Digest::SHA1.hexdigest(attachment.body.to_s)
+          }
+        end
+      end
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("headers"))
+        message_hash[:headers] = message.headers
+      end
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("raw_message"))
+        message_hash[:raw_message] = Base64.encode64(message.raw_message)
+      end
+
+      if expansions == true || (expansions.is_a?(Array) && expansions.include?("activity_entries"))
+        message_hash[:activity_entries] = {
+          loads: message.loads,
+          clicks: message.clicks
+        }
+      end
+
+      render_success message_hash
+    rescue Postal::MessageDB::Message::NotFound
+      render_error "MessageNotFound",
+                   message: "No message found matching provided ID",
+                   id: api_params["id"]
+    end
+
+    # Returns all the deliveries for a given message
+    #
+    #   URL:            /api/v1/messages/deliveries
+    #
+    #   Parameters:     id              => REQ: The ID of the message
+    #
+    #   Response:       A array of hashes containing delivery information
+    #                   OR an error if the message does not exist.
+    #
+    def deliveries
+      message = find_message
+      return if performed?
+
+      deliveries = message.deliveries.map do |d|
+        {
+          id: d.id,
+          status: d.status,
+          details: d.details,
+          output: d.output&.strip,
+          sent_with_ssl: d.sent_with_ssl,
+          log_id: d.log_id,
+          time: d.time&.to_f,
+          timestamp: d.timestamp.to_f
+        }
+      end
+      render_success deliveries
+    rescue Postal::MessageDB::Message::NotFound
+      render_error "MessageNotFound",
+                   message: "No message found matching provided ID",
+                   id: api_params["id"]
+    end
+
+    private
+
+    # Look up the message referenced by the request's `id` parameter.
+    #
+    # The legacy API only ever identifies a message by its integer ID. The
+    # request body is parsed as JSON, so without validation a JSON object or
+    # array supplied for `id` would arrive as a Ruby Hash/Array and be passed
+    # straight through to the message database as a raw set of SQL conditions.
+    # We therefore reject anything that is not a simple scalar before it can
+    # reach the database and coerce the value to an integer ID.
+    #
+    # Renders an error and returns nil when the parameter is missing or is not
+    # a scalar; otherwise returns the matched message (raising NotFound when no
+    # message matches, which the actions rescue).
+    #
+    # @return [Postal::MessageDB::Message, nil]
+    def find_message
+      id = api_params["id"]
+
+      if id.blank?
+        render_parameter_error "`id` parameter is required but is missing"
+        return
+      end
+
+      unless id.is_a?(String) || id.is_a?(Integer)
+        render_parameter_error "`id` parameter must be a string or integer"
+        return
+      end
+
+      @current_credential.server.message(id.to_i)
+    end
+
+  end
+end
@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+module LegacyAPI
+  class SendController < BaseController
+
+    ERROR_MESSAGES = {
+      "NoRecipients" => "There are no recipients defined to receive this message",
+      "NoContent" => "There is no content defined for this e-mail",
+      "TooManyToAddresses" => "The maximum number of To addresses has been reached (maximum 50)",
+      "TooManyCCAddresses" => "The maximum number of CC addresses has been reached (maximum 50)",
+      "TooManyBCCAddresses" => "The maximum number of BCC addresses has been reached (maximum 50)",
+      "FromAddressMissing" => "The From address is missing and is required",
+      "UnauthenticatedFromAddress" => "The From address is not authorised to send mail from this server",
+      "AttachmentMissingName" => "An attachment is missing a name",
+      "AttachmentMissingData" => "An attachment is missing data"
+    }.freeze
+
+    # Send a message with the given options
+    #
+    #   URL:            /api/v1/send/message
+    #
+    #   Parameters:     to              => REQ: An array of emails addresses
+    #                   cc              => An array of email addresses to CC
+    #                   bcc             => An array of email addresses to BCC
+    #                   from            => The name/email to send the email from
+    #                   sender          => The name/email of the 'Sender'
+    #                   reply_to        => The name/email of the 'Reply-to'
+    #                   plain_body      => The plain body
+    #                   html_body       => The HTML body
+    #                   bounce          => Is this message a bounce?
+    #                   tag             => A custom tag to add to the message
+    #                   custom_headers  => A hash of custom headers
+    #                   attachments     => An array of attachments
+    #                                      (name, content_type and data (base64))
+    #
+    #   Response:       A array of hashes containing message information
+    #                   OR an error if there is an issue sending the message
+    #
+    def message
+      attributes = {}
+      attributes[:to] = api_params["to"]
+      attributes[:cc] = api_params["cc"]
+      attributes[:bcc] = api_params["bcc"]
+      attributes[:from] = api_params["from"]
+      attributes[:sender] = api_params["sender"]
+      attributes[:subject] = api_params["subject"]
+      attributes[:reply_to] = api_params["reply_to"]
+      attributes[:plain_body] = api_params["plain_body"]
+      attributes[:html_body] = api_params["html_body"]
+      attributes[:bounce] = api_params["bounce"] ? true : false
+      attributes[:tag] = api_params["tag"]
+      attributes[:custom_headers] = api_params["headers"] if api_params["headers"]
+      attributes[:attachments] = []
+
+      (api_params["attachments"] || []).each do |attachment|
+        next unless attachment.is_a?(Hash)
+
+        attributes[:attachments] << { name: attachment["name"], content_type: attachment["content_type"], data: attachment["data"], base64: true }
+      end
+
+      message = OutgoingMessagePrototype.new(@current_credential.server, request.ip, "api", attributes)
+      message.credential = @current_credential
+      if message.valid?
+        result = message.create_messages
+        render_success message_id: message.message_id, messages: result
+      else
+        render_error message.errors.first, message: ERROR_MESSAGES[message.errors.first]
+      end
+    end
+
+    # Send a message by providing a raw message
+    #
+    #   URL:            /api/v1/send/raw
+    #
+    #   Parameters:     rcpt_to         => REQ: An array of email addresses to send
+    #                                      the message to
+    #                   mail_from       => REQ: the address to send the email from
+    #                   data            => REQ: base64-encoded mail data
+    #
+    #   Response:       A array of hashes containing message information
+    #                   OR an error if there is an issue sending the message
+    #
+    def raw
+      unless api_params["rcpt_to"].is_a?(Array)
+        render_parameter_error "`rcpt_to` parameter is required but is missing"
+        return
+      end
+
+      if api_params["mail_from"].blank?
+        render_parameter_error "`mail_from` parameter is required but is missing"
+        return
+      end
+
+      if api_params["data"].blank?
+        render_parameter_error "`data` parameter is required but is missing"
+        return
+      end
+
+      # Decode the raw message
+      raw_message = Base64.decode64(api_params["data"])
+
+      # Parse through mail to get the from/sender headers
+      mail = Mail.new(raw_message.split("\r\n\r\n", 2).first)
+      from_headers = { "from" => mail.from, "sender" => mail.sender }
+      authenticated_domain = @current_credential.server.find_authenticated_domain_from_headers(from_headers)
+
+      # If we're not authenticated, don't continue
+      if authenticated_domain.nil?
+        render_error "UnauthenticatedFromAddress"
+        return
+      end
+
+      # Store the result ready to return
+      result = { message_id: nil, messages: {} }
+      if api_params["rcpt_to"].is_a?(Array)
+        api_params["rcpt_to"].uniq.each do |rcpt_to|
+          message = @current_credential.server.message_db.new_message
+          message.rcpt_to = rcpt_to
+          message.mail_from = api_params["mail_from"]
+          message.raw_message = raw_message
+          message.received_with_ssl = true
+          message.scope = "outgoing"
+          message.domain_id = authenticated_domain.id
+          message.credential_id = @current_credential.id
+          message.bounce = api_params["bounce"] ? true : false
+          message.save
+          result[:message_id] = message.message_id if result[:message_id].nil?
+          result[:messages][rcpt_to] = { id: message.id, token: message.token }
+        end
+      end
+      render_success result
+    end
+
+  end
+end
@@ -89,6 +89,18 @@ class MessagesController < ApplicationController
  end

  def html_raw
+    override_content_security_policy_directives(
+      default_src: %w('none'),
+      script_src: %w('none'),
+      style_src: %w('unsafe-inline'),
+      img_src: %w(* data:),
+      font_src: %w(*),
+      frame_ancestors: %w('self'),
+      form_action: %w('none'),
+      base_uri: %w('none')
+    )
+    response.headers["X-Content-Type-Options"] = "nosniff"
+    response.headers["Referrer-Policy"] = "no-referrer"
    render html: @message.html_body_without_tracking_image.html_safe
  end

@@ -3,6 +3,7 @@
 module ApplicationHelper

  def format_delivery_details(server, text)
+    text = h(text)
    text.gsub!(/<msg:(\d+)>/) do
      id = ::Regexp.last_match(1).to_i
      link_to("message ##{id}", organization_server_message_path(server.organization, server, id), class: "u-link")
@@ -32,7 +33,7 @@ module ApplicationHelper
        s << "<optgroup label='Server Domains'>"
        server_domains.each do |domain|
          selected = domain == selected_domain ? "selected='selected'" : ""
-          s << "<option value='#{domain.id}' #{selected}>#{domain.name}</option>"
+          s << "<option value='#{h(domain.id)}' #{selected}>#{h(domain.name)}</option>"
        end
        s << "</optgroup>"
      end
@@ -42,7 +43,7 @@ module ApplicationHelper
        s << "<optgroup label='Organization Domains'>"
        organization_domains.each do |domain|
          selected = domain == selected_domain ? "selected='selected'" : ""
-          s << "<option value='#{domain.id}' #{selected}>#{domain.name}</option>"
+          s << "<option value='#{h(domain.id)}' #{selected}>#{h(domain.name)}</option>"
        end
        s << "</optgroup>"
      end
@@ -59,7 +60,7 @@ module ApplicationHelper
        http_endpoints.each do |endpoint|
          value = "#{endpoint.class}##{endpoint.uuid}"
          selected = value == selected_value ? "selected='selected'" : ""
-          s << "<option value='#{value}' #{selected}>#{endpoint.description}</option>"
+          s << "<option value='#{h(value)}' #{selected}>#{h(endpoint.description)}</option>"
        end
        s << "</optgroup>"
      end
@@ -70,7 +71,7 @@ module ApplicationHelper
        smtp_endpoints.each do |endpoint|
          value = "#{endpoint.class}##{endpoint.uuid}"
          selected = value == selected_value ? "selected='selected'" : ""
-          s << "<option value='#{value}' #{selected}>#{endpoint.description}</option>"
+          s << "<option value='#{h(value)}' #{selected}>#{h(endpoint.description)}</option>"
        end
        s << "</optgroup>"
      end
@@ -81,7 +82,7 @@ module ApplicationHelper
        address_endpoints.each do |endpoint|
          value = "#{endpoint.class}##{endpoint.uuid}"
          selected = value == selected_value ? "selected='selected'" : ""
-          s << "<option value='#{value}' #{selected}>#{endpoint.address}</option>"
+          s << "<option value='#{h(value)}' #{selected}>#{h(endpoint.address)}</option>"
        end
        s << "</optgroup>"
      end
@@ -93,11 +94,18 @@ module ApplicationHelper

          selected = (selected_value == mode ? "selected='selected'" : "")
          text = t("route_modes.#{mode.underscore}")
-          s << "<option value='#{mode}' #{selected}>#{text}</option>"
+          s << "<option value='#{h(mode)}' #{selected}>#{h(text)}</option>"
        end
        s << "</optgroup>"
      end
    end.html_safe
  end

+  def postal_version_string
+    string = Postal.version
+    string += " (#{Postal.branch})" if Postal.branch &&
+                                       Postal.branch != "main"
+    string
+  end
+
 end
@@ -3,6 +3,8 @@
 module MessageDequeuer
  class InitialProcessor < Base

+    include HasPrometheusMetrics
+
    attr_accessor :send_result

    def process
@@ -10,6 +12,7 @@ module MessageDequeuer
        logger.info "starting message unqueue"
        begin
          catch_stops do
+            increment_dequeue_metric
            check_message_exists
            check_message_is_ready
            find_other_messages_for_batch
@@ -17,7 +20,7 @@ module MessageDequeuer
            # Process the original message and then all of those
            # found for batching.
            process_message(@queued_message)
-            @other_messages.each { |message| process_message(message) }
+            @other_messages&.each { |message| process_message(message) }
          end
        ensure
          @state.finished
@@ -28,6 +31,13 @@ module MessageDequeuer

    private

+    def increment_dequeue_metric
+      time_in_queue = Time.now.to_f - @queued_message.created_at.to_f
+      log "queue latency is #{time_in_queue}s"
+      observe_prometheus_histogram :postal_message_queue_latency,
+                                   time_in_queue
+    end
+
    def check_message_exists
      return if @queued_message.message

@@ -45,6 +55,8 @@ module MessageDequeuer
    end

    def find_other_messages_for_batch
+      return unless Postal::Config.postal.batch_queued_messages?
+
      @other_messages = @queued_message.batchable_messages(100)
      log "found #{@other_messages.size} associated messages to process at the same time", batch_key: @queued_message.batch_key
    rescue StandardError
@@ -45,7 +45,9 @@ module Worker
    ].freeze

    # @param [Integer] thread_count The number of worker threads to run in this process
-    def initialize(thread_count: 2, work_sleep_time: 5, task_sleep_time: 60)
+    def initialize(thread_count: Postal::Config.worker.threads,
+                   work_sleep_time: 5,
+                   task_sleep_time: 60)
      @thread_count = thread_count
      @exit_pipe_read, @exit_pipe_write = IO.pipe
      @work_sleep_time = work_sleep_time
@@ -58,6 +60,7 @@ module Worker
    def run
      logger.tagged(component: "worker") do
        setup_traps
+        ensure_connection_pool_size_is_suitable
        start_work_threads
        start_tasks_thread
        wait_for_threads
@@ -94,6 +97,23 @@ module Worker
      @exit_pipe_read.wait_readable(wait_time) ? true : false
    end

+    # Ensure that the connection pool is big enough for the number of threads
+    # configured.
+    #
+    # @return [void]
+    def ensure_connection_pool_size_is_suitable
+      current_pool_size = ActiveRecord::Base.connection_pool.size
+      desired_pool_size = @thread_count + 3
+
+      return if current_pool_size >= desired_pool_size
+
+      logger.warn "number of worker threads (#{@thread_count}) is more  " \
+                  "than the db connection pool size (#{current_pool_size}+3), " \
+                  "increasing connection pool size to #{desired_pool_size}"
+
+      Postal.change_database_connection_pool_size(desired_pool_size)
+    end
+
    # Wait for all threads to complete
    #
    # @return [void]
@@ -182,7 +202,7 @@ module Worker
          logger.info "stopping tasks thread"
          ActiveRecord::Base.connection_pool.with_connection do
            if WorkerRole.release(:tasks)
-              logger.info "releasesd tasks role"
+              logger.info "released tasks role"
            end
          end
        end
@@ -278,7 +298,7 @@ module Worker
                                  labels: [:thread, :job]

      register_prometheus_histogram :postal_worker_job_runtime,
-                                    docstring: "The time taken to process jobs",
+                                    docstring: "The time taken to process jobs (in seconds)",
                                    labels: [:thread, :job]

      register_prometheus_counter :postal_worker_errors,
@@ -286,8 +306,11 @@ module Worker
                                  labels: [:error]

      register_prometheus_histogram :postal_worker_task_runtime,
-                                    docstring: "The time taken to process tasks",
+                                    docstring: "The time taken to process tasks (in seconds)",
                                    labels: [:task]
+
+      register_prometheus_histogram :postal_message_queue_latency,
+                                    docstring: "The length of time between a message being queued and being dequeued (in seconds)"
    end

  end
@@ -72,6 +72,17 @@ module HasDNSChecks
  #

  def check_dkim_record
+    # If a new DKIM key is waiting to be activated, promote it to be the active
+    # key as soon as its DNS record is in place. The matching DNS response has
+    # already verified the key, so avoid a second lookup which could return a
+    # different answer while DNS changes are propagating.
+    if pending_dkim_key? && pending_dkim_record_live?
+      activate_pending_dkim_key
+      self.dkim_status = "OK"
+      self.dkim_error = nil
+      return true
+    end
+
    domain = "#{dkim_record_name}.#{name}"
    records = resolver.txt(domain)
    if records.empty?
@@ -98,6 +109,16 @@ module HasDNSChecks
    save!
  end

+  # Returns true if the DNS record for the pending DKIM key has been published
+  # correctly.
+  def pending_dkim_record_live?
+    records = resolver.txt("#{pending_dkim_record_name}.#{name}")
+    return false unless records.size == 1
+
+    sanitised_record = records.first.strip.ends_with?(";") ? records.first.strip : "#{records.first.strip};"
+    sanitised_record == pending_dkim_record
+  end
+
  #
  # MX
  #
@@ -31,7 +31,7 @@ class Credential < ApplicationRecord
  validate :validate_key_cannot_be_changed
  validate :validate_key_for_smtp_ip

-  serialize :options, Hash
+  serialize :options, type: Hash

  before_validation :generate_key

@@ -5,30 +5,32 @@
 # Table name: domains
 #
 #  id                             :integer          not null, primary key
-#  server_id              :integer
-#  uuid                   :string(255)
-#  name                   :string(255)
-#  verification_token     :string(255)
-#  verification_method    :string(255)
-#  verified_at            :datetime
+#  dkim_error                     :string(255)
+#  dkim_identifier_string         :string(255)
 #  dkim_private_key               :text(65535)
+#  dkim_status                    :string(255)
+#  dns_checked_at                 :datetime
+#  incoming                       :boolean          default(TRUE)
+#  mx_error                       :string(255)
+#  mx_status                      :string(255)
+#  name                           :string(255)
+#  outgoing                       :boolean          default(TRUE)
+#  owner_type                     :string(255)
+#  pending_dkim_identifier_string :string(255)
+#  pending_dkim_private_key       :text(65535)
+#  return_path_error              :string(255)
+#  return_path_status             :string(255)
+#  spf_error                      :string(255)
+#  spf_status                     :string(255)
+#  use_for_any                    :boolean
+#  uuid                           :string(255)
+#  verification_method            :string(255)
+#  verification_token             :string(255)
+#  verified_at                    :datetime
 #  created_at                     :datetime
 #  updated_at                     :datetime
-#  dns_checked_at         :datetime
-#  spf_status             :string(255)
-#  spf_error              :string(255)
-#  dkim_status            :string(255)
-#  dkim_error             :string(255)
-#  mx_status              :string(255)
-#  mx_error               :string(255)
-#  return_path_status     :string(255)
-#  return_path_error      :string(255)
-#  outgoing               :boolean          default(TRUE)
-#  incoming               :boolean          default(TRUE)
-#  owner_type             :string(255)
 #  owner_id                       :integer
-#  dkim_identifier_string :string(255)
-#  use_for_any            :boolean
+#  server_id                      :integer
 #
 # Indexes
 #
@@ -82,7 +84,7 @@ class Domain < ApplicationRecord
  end

  def generate_dkim_key
-    self.dkim_private_key = OpenSSL::PKey::RSA.new(1024).to_s
+    self.dkim_private_key = OpenSSL::PKey::RSA.new(Postal::Config.dns.dkim_key_size).to_s
  end

  def dkim_key
@@ -91,6 +93,57 @@ class Domain < ApplicationRecord
    @dkim_key ||= OpenSSL::PKey::RSA.new(dkim_private_key)
  end

+  def pending_dkim_key
+    return nil unless pending_dkim_private_key
+
+    @pending_dkim_key ||= OpenSSL::PKey::RSA.new(pending_dkim_private_key)
+  end
+
+  def pending_dkim_key?
+    pending_dkim_private_key.present?
+  end
+
+  # Generate a new DKIM key for this domain. If the current key is verified and
+  # in use for signing, the new key is stored as a pending key under a new
+  # identifier so that signing continues with the current key until the new
+  # key's DNS record has been published and verified. Otherwise, the key is
+  # replaced immediately and any in-flight key change is abandoned, since the
+  # new key supersedes it.
+  def regenerate_dkim_key!
+    if dkim_status == "OK"
+      self.pending_dkim_private_key = OpenSSL::PKey::RSA.new(Postal::Config.dns.dkim_key_size).to_s
+      self.pending_dkim_identifier_string = generate_unique_dkim_identifier_string
+    else
+      generate_dkim_key
+      self.dkim_status = nil
+      self.dkim_error = nil
+      self.pending_dkim_private_key = nil
+      self.pending_dkim_identifier_string = nil
+      @dkim_key = nil
+    end
+    @pending_dkim_key = nil
+    save!
+  end
+
+  # Promote the pending DKIM key to be the active key. Does not save the record.
+  def activate_pending_dkim_key
+    return unless pending_dkim_key?
+
+    self.dkim_private_key = pending_dkim_private_key
+    self.dkim_identifier_string = pending_dkim_identifier_string
+    self.pending_dkim_private_key = nil
+    self.pending_dkim_identifier_string = nil
+    @dkim_key = nil
+    @pending_dkim_key = nil
+  end
+
+  def cancel_pending_dkim_key!
+    self.pending_dkim_private_key = nil
+    self.pending_dkim_identifier_string = nil
+    @pending_dkim_key = nil
+    save!
+  end
+
  def to_param
    uuid
  end
@@ -108,23 +161,27 @@ class Domain < ApplicationRecord
  end

  def dkim_record
-    return if dkim_key.nil?
-
-    public_key = dkim_key.public_key.to_s.gsub(/-+[A-Z ]+-+\n/, "").gsub(/\n/, "")
-    "v=DKIM1; t=s; h=sha256; p=#{public_key};"
+    build_dkim_record(dkim_key)
  end

  def dkim_identifier
-    return nil unless dkim_identifier_string
-
-    Postal::Config.dns.dkim_identifier + "-#{dkim_identifier_string}"
+    build_dkim_identifier(dkim_identifier_string)
  end

  def dkim_record_name
-    identifier = dkim_identifier
-    return if identifier.nil?
+    build_dkim_record_name(dkim_identifier)
+  end

-    "#{identifier}._domainkey"
+  def pending_dkim_record
+    build_dkim_record(pending_dkim_key)
+  end
+
+  def pending_dkim_identifier
+    build_dkim_identifier(pending_dkim_identifier_string)
+  end
+
+  def pending_dkim_record_name
+    build_dkim_record_name(pending_dkim_identifier)
  end

  def return_path_domain
@@ -160,6 +217,36 @@ class Domain < ApplicationRecord

  private

+  def build_dkim_record(key)
+    return if key.nil?
+
+    public_key = key.public_key.to_s.gsub(/-+[A-Z ]+-+\n/, "").gsub(/\n/, "")
+    "v=DKIM1; t=s; h=sha256; p=#{public_key};"
+  end
+
+  def build_dkim_identifier(identifier_string)
+    return nil unless identifier_string
+
+    Postal::Config.dns.dkim_identifier + "-#{identifier_string}"
+  end
+
+  def build_dkim_record_name(identifier)
+    return if identifier.nil?
+
+    "#{identifier}._domainkey"
+  end
+
+  # Generates a random identifier string in the same format as the
+  # `random_string :dkim_identifier_string` declaration, unique across both the
+  # active and pending identifier columns.
+  def generate_unique_dkim_identifier_string
+    loop do
+      string = Nifty::Utils::RandomString.generate(length: 6, upper_letters_only: true)
+      scope = self.class.where(dkim_identifier_string: string).or(self.class.where(pending_dkim_identifier_string: string))
+      return string unless scope.exists?
+    end
+  end
+
  def update_verification_token_on_method_change
    return unless verification_method_changed?

@@ -1,5 +1,7 @@
 # frozen_string_literal: true

+require "uri"
+
 # == Schema Information
 #
 # Table name: http_endpoints
@@ -38,6 +40,7 @@ class HTTPEndpoint < ApplicationRecord

  validates :name, presence: true
  validates :url, presence: true
+  validate :url_must_be_http_or_https
  validates :encoding, inclusion: { in: ENCODINGS }
  validates :format, inclusion: { in: FORMATS }
  validates :timeout, numericality: { greater_than_or_equal_to: 5, less_than_or_equal_to: 60 }
@@ -56,4 +59,17 @@ class HTTPEndpoint < ApplicationRecord
    routes.each { |r| r.update(endpoint: nil, mode: "Reject") }
  end

+  private
+
+  def url_must_be_http_or_https
+    return if url.blank?
+
+    uri = URI.parse(url)
+    return if uri.is_a?(URI::HTTP) && uri.host.present?
+
+    errors.add(:url, "must be an HTTP or HTTPS URL")
+  rescue URI::InvalidURIError
+    errors.add(:url, "must be a valid HTTP or HTTPS URL")
+  end
+
 end
@@ -34,7 +34,7 @@ class WebhookRequest < ApplicationRecord
  validates :url, presence: true
  validates :event, presence: true

-  serialize :payload, Hash
+  serialize :payload, type: Hash

  class << self

@@ -7,7 +7,7 @@ class ApplicationScheduledTask
  end

  def call
-    # override me
+    raise NotImplementedError
  end

  attr_reader :logger
@@ -2,7 +2,7 @@

 class ProcessMessageRetentionScheduledTask < ApplicationScheduledTask

-  def perform
+  def call
    Server.all.each do |server|
      if server.raw_message_retention_days
        # If the server has a maximum number of retained raw messages, remove any that are older than this
@@ -244,11 +244,11 @@ class SMTPSender < BaseSender
      relays = Postal::Config.postal.smtp_relays
      return nil if relays.nil?

-      relays.map do |relay|
+      relays = relays.filter_map do |relay|
        next unless relay.host.present?

-        SMTPClient::Server.new(relay.host, relay.port, ssl_mode: relay.ssl_mode)
-      end.compact
+        SMTPClient::Server.new(relay.host, port: relay.port, ssl_mode: relay.ssl_mode)
+      end

      @smtp_relays = relays.empty? ? nil : relays
    end
@@ -1,7 +1,7 @@
 # frozen_string_literal: true

 require "socket"
-require "rack/handler/webrick"
+require "rackup/handler/webrick"
 require "prometheus/client/formats/text"

 class HealthServer
@@ -55,7 +55,7 @@ class HealthServer
      port = ENV.fetch("HEALTH_SERVER_PORT", default_port)
      bind_address = ENV.fetch("HEALTH_SERVER_BIND_ADDRESS", default_bind_address)

-      Rack::Handler::WEBrick.run(new(**options),
+      Rackup::Handler::WEBrick.run(new(**options),
                                   Port: port,
                                   BindAddress: bind_address,
                                   AccessLog: [],
@@ -95,7 +95,7 @@ class HealthServer
        Postal.logger.info "stopped health server", component: "health-server"
      when /\AWEBrick [\d.]+/,
           /\Aruby ([\d.]+)/,
-           /\ARack::Handler::WEBrick is mounted/,
+           /\ARackup::Handler::WEBrick is mounted/,
           /\Aclose TCPSocket/,
           /\Agoing to shutdown/
        # Don't actually print routine messages to avoid too much
@@ -38,7 +38,7 @@
        = f.select :hold, [["Process all messages", false], ["Hold messages from this credential", true]], {}, :class => 'input input--select'
        %p.fieldSet__text
          You may wish to automatically hold all messages that are sent by this credential. This allows you to preview them
-          for they are delivered to their recipients. This is useful for credentials for development environments.
+          before they are delivered to their recipients. This is useful for credentials for development environments.

  .fieldSetSubmit.buttonSet
    = f.submit @credential.new_record? ? "Create credential" : "Save credential", :class => 'button button--positive js-form-submit'
@@ -34,6 +34,8 @@
              = link_to domain.name, [:setup, organization, @server, domain]
              - if domain.use_for_any?
                %span.label.label--blue Any
+              - if domain.pending_dkim_key?
+                = link_to "New DKIM key pending", [:setup, organization, @server, domain], :class => "label label--orange", :title => "A new DKIM key is waiting for its DNS record to be published."
            %ul.domainList__checks
              - if domain.spf_status == 'OK'
                %li.domainList__check.domainList__check--ok SPF
@@ -47,7 +47,11 @@
  %pre.codeBlock.u-margin= @domain.spf_record

  %h3.pageContent__subTitle DKIM Record
-  - if @domain.dkim_status == 'OK'
+  - if @domain.pending_dkim_key?
+    %p.pageContent__text.u-orange.u-bold
+      %span.label.label--orange Key change in progress
+      You've generated a new DKIM key which isn't active yet. Both records are shown below.
+  - elsif @domain.dkim_status == 'OK'
    %p.pageContent__text.u-green.u-bold
      %span.label.label--green Good
      Your DKIM record looks good!
@@ -56,10 +60,34 @@
      %span.label.label--orange Warning
      = @domain.dkim_error

+  - if @domain.pending_dkim_key?
+    %p.pageContent__text.u-bold
+      %span.label.label--green Current
+      Keep this record exactly as it is
+    %p.pageContent__text
+      This is the record you already have published at <b>#{@domain.dkim_record_name}</b>.
+      It's signing your mail right now, so leave it in place.
+    %pre.codeBlock.u-margin= @domain.dkim_record
+
+    %p.pageContent__text.u-bold
+      %span.label.label--orange New
+      Add this record as well
+    %p.pageContent__text
+      Add a <b>second</b> TXT record with the name <b>#{@domain.pending_dkim_record_name}</b>
+      and the content below, alongside the record above rather than replacing it. Once we detect
+      it (checked hourly, or when you use the button above) we'll switch to signing with the new
+      key automatically. After the switch, keep the old record published while messages signed
+      with it may still be queued, held, or available for redelivery.
+    %pre.codeBlock.u-margin= @domain.pending_dkim_record
+    %p.pageContent__text
+      = link_to "Cancel new DKIM key", [:cancel_dkim_regeneration, organization, @server, @domain], :remote => true, :method => :post, :data => { :confirm => "Are you sure? The new key will be discarded and your existing key will remain active." }, :class => 'button button--neutral'
+  - else
    %p.pageContent__text
      You need to add a new TXT record with the name <b>#{@domain.dkim_record_name}</b>
      with the following content.
    %pre.codeBlock.u-margin= @domain.dkim_record
+    %p.pageContent__text
+      = link_to "Regenerate DKIM key", [:regenerate_dkim, organization, @server, @domain], :remote => true, :method => :post, :data => { :confirm => "Are you sure you wish to generate a new DKIM key? You'll need to add a new DNS record before the new key can be used." }, :class => 'button button--neutral'

  %h3.pageContent__subTitle Return Path
  - if @domain.return_path_status == 'OK'
@@ -55,6 +55,8 @@
        %footer.siteContent__footer
          %ul.footer__links
            %li.footer__name
-              Powered by #{link_to "Postal", "https://postalserver.io", target: '_blank'} #{Postal.version}.
+              Powered by
+              #{link_to "Postal", "https://postalserver.io", target: '_blank'}
+              #{postal_version_string}
            %li= link_to "Documentation", "https://docs.postalserver.io", target: '_blank'
            %li= link_to "Ask for help", "https://discussions.postalserver.io", target: '_blank'
@@ -14,4 +14,4 @@
        This means that we no longer store the raw data for this e-mail
        or the e-mail didn't include a HTML part.
 - else
-  %iframe{:width => "100%", :height => "100%", :src => html_raw_organization_server_message_path(organization, @server, @message.id)}
+  %iframe{:width => "100%", :height => "100%", :sandbox => "allow-popups allow-popups-to-escape-sandbox", :referrerpolicy => "no-referrer", :src => html_raw_organization_server_message_path(organization, @server, @message.id)}
@@ -6,7 +6,7 @@ Rails.application.configure do
  # In the development environment your application's code is reloaded on
  # every request. This slows down response time but is perfect for development
  # since you don't have to restart the web server when you make code changes.
-  config.cache_classes = false
+  config.enable_reloading = true

  # Do not eager load code on boot.
  config.eager_load = false
@@ -4,7 +4,7 @@ Rails.application.configure do
  # Settings specified here will take precedence over those in config/application.rb.

  # Code is not reloaded between requests.
-  config.cache_classes = true
+  config.enable_reloading = false

  # Eager load code on boot. This eager loads most of Rails and
  # your application in memory, allowing both threaded web servers
@@ -7,7 +7,7 @@ Rails.application.configure do
  # test suite. You never need to work with it otherwise. Remember that
  # your test database is "scratch space" for the test suite and is wiped
  # and recreated between test runs. Don't rely on the data there!
-  config.cache_classes = true
+  config.enable_reloading = false

  # Do not eager load code on boot. This avoids loading your whole application
  # just for the purpose of running a single test. If you are using a tool that
@@ -1,8 +1,8 @@
 # frozen_string_literal: true

 if Postal::Config.rails.secret_key
-  Rails.application.secrets.secret_key_base = Postal::Config.rails.secret_key
+  Rails.application.credentials.secret_key_base = Postal::Config.rails.secret_key
 else
  warn "No secret key was specified in the Postal config file. Using one for just this session"
-  Rails.application.secrets.secret_key_base = SecureRandom.hex(128)
+  Rails.application.credentials.secret_key_base = SecureRandom.hex(128)
 end
@@ -1,17 +1,27 @@
 # frozen_string_literal: true

 Rails.application.routes.draw do
+  # Legacy API Routes
+  match "/api/v1/send/message" => "legacy_api/send#message", via: [:get, :post, :patch, :put]
+  match "/api/v1/send/raw" => "legacy_api/send#raw", via: [:get, :post, :patch, :put]
+  match "/api/v1/messages/message" => "legacy_api/messages#message", via: [:get, :post, :patch, :put]
+  match "/api/v1/messages/deliveries" => "legacy_api/messages#deliveries", via: [:get, :post, :patch, :put]
+
  scope "org/:org_permalink", as: "organization" do
    resources :domains, only: [:index, :new, :create, :destroy] do
      match :verify, on: :member, via: [:get, :post]
      get :setup, on: :member
      post :check, on: :member
+      post :regenerate_dkim, on: :member
+      post :cancel_dkim_regeneration, on: :member
    end
    resources :servers, except: [:index] do
      resources :domains, only: [:index, :new, :create, :destroy] do
        match :verify, on: :member, via: [:get, :post]
        get :setup, on: :member
        post :check, on: :member
+        post :regenerate_dkim, on: :member
+        post :cancel_dkim_regeneration, on: :member
      end
      resources :track_domains do
        post :toggle_ssl, on: :member
@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+class AddPendingDKIMFieldsToDomains < ActiveRecord::Migration[7.0]
+
+  def change
+    add_column :domains, :pending_dkim_private_key, :text
+    add_column :domains, :pending_dkim_identifier_string, :string
+  end
+
+end
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.

-ActiveRecord::Schema[7.0].define(version: 2024_03_11_205229) do
+ActiveRecord::Schema[7.1].define(version: 2026_09_03_100000) do
  create_table "additional_route_endpoints", id: :integer, charset: "utf8mb4", collation: "utf8mb4_general_ci", force: :cascade do |t|
    t.integer "route_id"
    t.string "endpoint_type"
@@ -99,6 +99,8 @@ ActiveRecord::Schema[7.0].define(version: 2024_03_11_205229) do
    t.integer "owner_id"
    t.string "dkim_identifier_string"
    t.boolean "use_for_any"
+    t.text "pending_dkim_private_key"
+    t.string "pending_dkim_identifier_string"
    t.index ["server_id"], name: "index_domains_on_server_id"
    t.index ["uuid"], name: "index_domains_on_uuid", length: 8
  end
@@ -18,12 +18,15 @@ This document contains all the environment variables which are available for thi
 | `POSTAL_SIGNING_KEY_PATH` | String | Path to the private key used for signing | $config-file-root/signing.key |
 | `POSTAL_SMTP_RELAYS` | Array of strings | An array of SMTP relays in the format of smtp://host:port | [] |
 | `POSTAL_TRUSTED_PROXIES` | Array of strings | An array of IP addresses to trust for proxying requests to Postal (in addition to localhost addresses) | [] |
+| `POSTAL_ALLOWED_REQUEST_DESTINATIONS` | Array of strings | Hostnames or IP/CIDR ranges that outbound webhook and HTTP endpoint requests are permitted to reach even when they resolve to a private, loopback, link-local or otherwise reserved address. All other such destinations are blocked to prevent SSRF. | [] |
 | `POSTAL_QUEUED_MESSAGE_LOCK_STALE_DAYS` | Integer | The number of days after which to consider a lock as stale. Messages with stale locks will be removed and not retried. | 1 |
+| `POSTAL_BATCH_QUEUED_MESSAGES` | Boolean | When enabled queued messages will be de-queued in batches based on their destination | true |
 | `WEB_SERVER_DEFAULT_PORT` | Integer | The default port the web server should listen on unless overriden by the PORT environment variable | 5000 |
 | `WEB_SERVER_DEFAULT_BIND_ADDRESS` | String | The default bind address the web server should listen on unless overriden by the BIND_ADDRESS environment variable | 127.0.0.1 |
 | `WEB_SERVER_MAX_THREADS` | Integer | The maximum number of threads which can be used by the web server | 5 |
 | `WORKER_DEFAULT_HEALTH_SERVER_PORT` | Integer | The default port for the worker health server to listen on | 9090 |
 | `WORKER_DEFAULT_HEALTH_SERVER_BIND_ADDRESS` | String | The default bind address for the worker health server to listen on | 127.0.0.1 |
+| `WORKER_THREADS` | Integer | The number of threads to execute within each worker | 2 |
 | `MAIN_DB_HOST` | String | Hostname for the main MariaDB server | localhost |
 | `MAIN_DB_PORT` | Integer | The MariaDB port to connect to | 3306 |
 | `MAIN_DB_USERNAME` | String | The MariaDB username | postal |
@@ -40,6 +43,7 @@ This document contains all the environment variables which are available for thi
 | `LOGGING_RAILS_LOG_ENABLED` | Boolean | Enable the default Rails logger | false |
 | `LOGGING_SENTRY_DSN` | String | A DSN which should be used to report exceptions to Sentry |  |
 | `LOGGING_ENABLED` | Boolean | Enable the Postal logger to log to STDOUT | true |
+| `LOGGING_LEVEL` | String | The minimum log level for the Postal logger (debug, info, warn, error, fatal) | INFO |
 | `LOGGING_HIGHLIGHTING_ENABLED` | Boolean | Enable highlighting of log lines | false |
 | `GELF_HOST` | String | GELF-capable host to send logs to |  |
 | `GELF_PORT` | Integer | GELF port to send logs to | 12201 |
@@ -53,7 +57,7 @@ This document contains all the environment variables which are available for thi
 | `SMTP_SERVER_TLS_PRIVATE_KEY_PATH` | String | The path to the SMTP server's TLS private key | $config-file-root/smtp.key |
 | `SMTP_SERVER_TLS_CIPHERS` | String | Override ciphers to use for SSL |  |
 | `SMTP_SERVER_SSL_VERSION` | String | The SSL versions which are supported | SSLv23 |
-| `SMTP_SERVER_PROXY_PROTOCOL` | Boolean | Enable proxy protocol for use behind some load balancers | false |
+| `SMTP_SERVER_PROXY_PROTOCOL` | Boolean | Enable proxy protocol for use behind some load balancers (supports proxy protocol v1 only) | false |
 | `SMTP_SERVER_LOG_CONNECTIONS` | Boolean | Enable connection logging | false |
 | `SMTP_SERVER_MAX_MESSAGE_SIZE` | Integer | The maximum message size to accept from the SMTP server (in MB) | 14 |
 | `SMTP_SERVER_LOG_IP_ADDRESS_EXCLUSION_MATCHER` | String | A regular expression to use to exclude connections from logging |  |
@@ -64,6 +68,7 @@ This document contains all the environment variables which are available for thi
 | `DNS_TRACK_DOMAIN` | String | The CNAME which tracking domains should be pointed to | track.postal.example.com |
 | `DNS_HELO_HOSTNAME` | String | The hostname to use in HELO/EHLO when connecting to external SMTP servers |  |
 | `DNS_DKIM_IDENTIFIER` | String | The identifier to use for DKIM keys in DNS records | postal |
+| `DNS_DKIM_KEY_SIZE` | Integer | The size (in bits) of RSA key to generate for DKIM signing (one of 1024, 2048, 3072 or 4096). Note that records for 2048-bit and larger keys exceed 255 characters and must be published as a split (multi-string) TXT record. | 2048 |
 | `DNS_DOMAIN_VERIFY_PREFIX` | String | The prefix to add before TXT record verification string | postal-verification |
 | `DNS_CUSTOM_RETURN_PATH_PREFIX` | String | The domain to use on external domains which points to the Postal return path domain | psrp |
 | `DNS_TIMEOUT` | Integer | The timeout to wait for DNS resolution | 5 |
@@ -98,13 +103,14 @@ This document contains all the environment variables which are available for thi
 | `MIGRATION_WAITER_ATTEMPTS` | Integer | The number of attempts to try waiting for migrations to complete before start | 120 |
 | `MIGRATION_WAITER_SLEEP_TIME` | Integer | The number of seconds to wait between each migration check | 2 |
 | `OIDC_ENABLED` | Boolean | Enable OIDC authentication | false |
+| `OIDC_LOCAL_AUTHENTICATION_ENABLED` | Boolean | When enabled, users with passwords will still be able to login locally. If disable, only OpenID Connect will be available. | true |
 | `OIDC_NAME` | String | The name of the OIDC provider as shown in the UI | OIDC Provider |
 | `OIDC_ISSUER` | String | The OIDC issuer URL |  |
 | `OIDC_IDENTIFIER` | String | The client ID for OIDC |  |
 | `OIDC_SECRET` | String | The client secret for OIDC |  |
-| `OIDC_SCOPES` | Array of strings | Scopes to request from the OIDC server. | openid |
+| `OIDC_SCOPES` | Array of strings | Scopes to request from the OIDC server. | ["openid", "email"] |
 | `OIDC_UID_FIELD` | String | The field to use to determine the user's UID | sub |
-| `OIDC_EMAIL_ADDRESS_FIELD` | String | The field to use to determine the user's email address | sub |
+| `OIDC_EMAIL_ADDRESS_FIELD` | String | The field to use to determine the user's email address | email |
 | `OIDC_NAME_FIELD` | String | The field to use to determine the user's name | name |
 | `OIDC_DISCOVERY` | Boolean | Enable discovery to determine endpoints from .well-known/openid-configuration from the Issuer | true |
 | `OIDC_AUTHORIZATION_ENDPOINT` | String | The authorize endpoint on the authorization server (only used when discovery is false) |  |
@@ -29,8 +29,12 @@ postal:
  smtp_relays: []
  # An array of IP addresses to trust for proxying requests to Postal (in addition to localhost addresses)
  trusted_proxies: []
+  # Hostnames or IP/CIDR ranges that outbound webhook and HTTP endpoint requests are permitted to reach even when they resolve to a private, loopback, link-local or otherwise reserved address. All other such destinations are blocked to prevent SSRF.
+  allowed_request_destinations: []
  # The number of days after which to consider a lock as stale. Messages with stale locks will be removed and not retried.
  queued_message_lock_stale_days: 1
+  # When enabled queued messages will be de-queued in batches based on their destination
+  batch_queued_messages: true

 web_server:
  # The default port the web server should listen on unless overriden by the PORT environment variable
@@ -45,6 +49,8 @@ worker:
  default_health_server_port: 9090
  # The default bind address for the worker health server to listen on
  default_health_server_bind_address: 127.0.0.1
+  # The number of threads to execute within each worker
+  threads: 2

 main_db:
  # Hostname for the main MariaDB server
@@ -83,6 +89,8 @@ logging:
  sentry_dsn: 
  # Enable the Postal logger to log to STDOUT
  enabled: true
+  # The minimum log level for the Postal logger (debug, info, warn, error, fatal)
+  level: INFO
  # Enable highlighting of log lines
  highlighting_enabled: false

@@ -113,7 +121,7 @@ smtp_server:
  tls_ciphers: 
  # The SSL versions which are supported
  ssl_version: SSLv23
-  # Enable proxy protocol for use behind some load balancers
+  # Enable proxy protocol for use behind some load balancers (supports proxy protocol v1 only)
  proxy_protocol: false
  # Enable connection logging
  log_connections: false
@@ -139,6 +147,8 @@ dns:
  helo_hostname: 
  # The identifier to use for DKIM keys in DNS records
  dkim_identifier: postal
+  # The size (in bits) of RSA key to generate for DKIM signing (one of 1024, 2048, 3072 or 4096). Note that records for 2048-bit and larger keys exceed 255 characters and must be published as a split (multi-string) TXT record.
+  dkim_key_size: 2048
  # The prefix to add before TXT record verification string
  domain_verify_prefix: postal-verification
  # The domain to use on external domains which points to the Postal return path domain
@@ -223,6 +233,8 @@ migration_waiter:
 oidc:
  # Enable OIDC authentication
  enabled: false
+  # When enabled, users with passwords will still be able to login locally. If disable, only OpenID Connect will be available.
+  local_authentication_enabled: true
  # The name of the OIDC provider as shown in the UI
  name: OIDC Provider
  # The OIDC issuer URL
@@ -234,10 +246,11 @@ oidc:
  # Scopes to request from the OIDC server.
  scopes:
    - openid
+    - email
  # The field to use to determine the user's UID
  uid_field: sub
  # The field to use to determine the user's email address
-  email_address_field: sub
+  email_address_field: email
  # The field to use to determine the user's name
  name_field: name
  # Enable discovery to determine endpoints from .well-known/openid-configuration from the Issuer
@@ -1,4 +1,3 @@
-version: "3"
 services:
  postal:
    image: ${POSTAL_IMAGE}
@@ -11,9 +11,9 @@ require "konfig/sources/environment"
 require "konfig/sources/yaml"
 require "dotenv"
 require "klogger"
+require "securerandom"

 require_relative "error"
-require_relative "version"
 require_relative "config_schema"
 require_relative "legacy_config_source"
 require_relative "signer"
@@ -22,6 +22,8 @@ module Postal

  class << self

+    attr_writer :current_process_type
+
    # Return the path to the config file
    #
    # @return [String]
@@ -57,7 +59,7 @@ module Postal
          unless silence_config_messages
            warn "WARNING: Using legacy config file format. Upgrade your postal.yml to use"
            warn "version 2 of the Postal configuration or configure using environment"
-            warn "variables. See https://postalserver.io/config-v2 for details."
+            warn "variables. See https://docs.postalserver.io/config-v2 for details."
          end
          sources << LegacyConfigSource.new(yaml)
        when 2
@@ -81,16 +83,21 @@ module Postal
    def logger
      @logger ||= begin
        k = Klogger.new(nil, destination: Config.logging.enabled? ? $stdout : "/dev/null", highlight: Config.logging.highlighting_enabled?)
+        k.level = Config.logging.level
        k.add_destination(graylog_logging_destination) if Config.gelf.host.present?
        k
      end
    end

+    def process_identity
+      @process_identity ||= SecureRandom.hex(8)
+    end
+
    def process_name
      @process_name ||= begin
-        "host:#{Socket.gethostname} pid:#{Process.pid}"
+        "host:#{Socket.gethostname} pid:#{Process.pid} id:#{process_identity}"
      rescue StandardError
-        "pid:#{Process.pid}"
+        "pid:#{Process.pid} id:#{process_identity}"
      end
    end

@@ -129,13 +136,56 @@ module Postal
          notifier.notify!(short_message: short_message, **{
            facility: Config.gelf.facility,
            _environment: Config.rails.environment,
-            _version: Postal::VERSION.to_s,
+            _version: Postal.version.to_s,
            _group_ids: group_ids.join(" ")
          }.merge(payload.transform_keys { |k| "_#{k}".to_sym }.transform_values(&:to_s)))
        end
      end
    end

+    # Change the connection pool size to the given size.
+    #
+    # @param new_size [Integer]
+    # @return [void]
+    def change_database_connection_pool_size(new_size)
+      ActiveRecord::Base.connection_pool.disconnect!
+
+      config = ActiveRecord::Base.configurations
+                                 .configs_for(env_name: Config.rails.environment)
+                                 .first
+                                 .configuration_hash
+
+      ActiveRecord::Base.establish_connection(config.merge(pool: new_size))
+    end
+
+    # Return the branch name which created this release
+    #
+    # @return [String, nil]
+    def branch
+      return @branch if instance_variable_defined?("@branch")
+
+      @branch ||= read_version_file("BRANCH")
+    end
+
+    # Return the version
+    #
+    # @return [String, nil]
+    def version
+      return @version if instance_variable_defined?("@version")
+
+      @version ||= read_version_file("VERSION") || "0.0.0"
+    end
+
+    private
+
+    def read_version_file(file)
+      path = File.expand_path("../../../" + file, __FILE__)
+      return unless File.exist?(path)
+
+      value = File.read(path).strip
+      value.empty? ? nil : value
+    end
+
  end

  Config = initialize_config
@@ -92,10 +92,23 @@ module Postal
        transform { |ip| IPAddr.new(ip) }
      end

+      string :allowed_request_destinations do
+        array
+        description "Hostnames or IP/CIDR ranges that outbound webhook and HTTP " \
+                    "endpoint requests are permitted to reach even when they resolve " \
+                    "to a private, loopback, link-local or otherwise reserved address. " \
+                    "All other such destinations are blocked to prevent SSRF."
+      end
+
      integer :queued_message_lock_stale_days do
        description "The number of days after which to consider a lock as stale. Messages with stale locks will be removed and not retried."
        default 1
      end
+
+      boolean :batch_queued_messages do
+        description "When enabled queued messages will be de-queued in batches based on their destination"
+        default true
+      end
    end

    group :web_server do
@@ -125,6 +138,11 @@ module Postal
        description "The default bind address for the worker health server to listen on"
        default "127.0.0.1"
      end
+
+      integer :threads do
+        description "The number of threads to execute within each worker"
+        default 2
+      end
    end

    group :main_db do
@@ -209,6 +227,19 @@ module Postal
        default true
      end

+      string :level do
+        description "The minimum log level for the Postal logger (debug, info, warn, error, fatal)"
+        default "INFO"
+        transform do |value|
+          normalized = value.to_s.strip.downcase
+          normalized = "info" if normalized.empty?
+          unless %w[debug info warn error fatal].include?(normalized)
+            raise ArgumentError, "logging.level must be one of: debug, info, warn, error, fatal (got #{value.inspect})"
+          end
+          normalized
+        end
+      end
+
      boolean :highlighting_enabled do
        description "Enable highlighting of log lines"
        default false
@@ -334,6 +365,20 @@ module Postal
        default "postal"
      end

+      integer :dkim_key_size do
+        description "The size (in bits) of RSA key to generate for DKIM signing (one of 1024, 2048, 3072 or 4096). " \
+                    "Note that records for 2048-bit and larger keys exceed 255 characters and must be " \
+                    "published as a split (multi-string) TXT record."
+        default 2048
+        transform do |value|
+          unless value.nil? || [1024, 2048, 3072, 4096].include?(value)
+            raise Konfig::Error, "dns.dkim_key_size must be one of 1024, 2048, 3072 or 4096 (got #{value})"
+          end
+
+          value
+        end
+      end
+
      string :domain_verify_prefix do
        description "The prefix to add before TXT record verification string"
        default "postal-verification"
@@ -540,7 +585,7 @@ module Postal
      string :scopes do
        description "Scopes to request from the OIDC server."
        array
-        default "openid,email"
+        default ["openid", "email"]
      end

      string :uid_field do
@@ -1,6 +1,7 @@
 # frozen_string_literal: true

 require "net/https"
+require "resolv"
 require "uri"

 module Postal
@@ -47,19 +48,24 @@ module Postal

      request["User-Agent"] = options[:user_agent] || "Postal/#{Postal.version}"

+      timeout = options[:timeout] || 60
+      ssl = uri.scheme == "https"
+
+      begin
+        Timeout.timeout(timeout) do
+          connect_address = AddressGuard.safe_connect_address(uri.host)
+
          connection = Net::HTTP.new(uri.host, uri.port)
+          # Pin the connection to the address we validated above so that the socket
+          # cannot be redirected to a different (e.g. internal) address via a DNS
+          # rebinding race between the check and the connection.
+          connection.ipaddr = connect_address

          if uri.scheme == "https"
            connection.use_ssl = true
            connection.verify_mode = OpenSSL::SSL::VERIFY_PEER
-        ssl = true
-      else
-        ssl = false
          end

-      begin
-        timeout = options[:timeout] || 60
-        Timeout.timeout(timeout) do
          result = connection.request(request)
          {
            code: result.code.to_i,
@@ -68,6 +74,13 @@ module Postal
            secure: ssl
          }
        end
+      rescue BlockedDestinationError => e
+        {
+          code: -4,
+          body: e.message,
+          headers: {},
+          secure: ssl
+        }
      rescue OpenSSL::SSL::SSLError
        {
          code: -3,
@@ -75,7 +88,7 @@ module Postal
          headers: {},
          secure: ssl
        }
-      rescue SocketError, Errno::ECONNRESET, EOFError, Errno::EINVAL, Errno::ENETUNREACH, Errno::EHOSTUNREACH, Errno::ECONNREFUSED => e
+      rescue Resolv::ResolvError, SocketError, SystemCallError, EOFError => e
        {
          code: -2,
          body: e.message,
@@ -0,0 +1,202 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+require "resolv"
+require "socket"
+
+module Postal
+  module HTTP
+    # Guards outbound HTTP requests against SSRF by resolving the destination
+    # host and refusing to connect to private, loopback, link-local, multicast
+    # or otherwise reserved addresses (for example cloud metadata endpoints).
+    #
+    # Administrators can permit specific destinations by adding hostnames or
+    # IP/CIDR ranges to the `postal.allowed_request_destinations` config option.
+    class AddressGuard
+
+      # IP ranges that outbound requests are never allowed to reach unless the
+      # destination has been explicitly allowlisted.
+      BLOCKED_RANGES = [
+        # IPv4
+        "0.0.0.0/8",        # "this host on this network"
+        "10.0.0.0/8",       # RFC1918 private
+        "100.64.0.0/10",    # RFC6598 carrier-grade NAT
+        "127.0.0.0/8",      # loopback
+        "169.254.0.0/16",   # link-local (incl. 169.254.169.254 metadata)
+        "172.16.0.0/12",    # RFC1918 private
+        "192.0.0.0/24",     # IETF protocol assignments
+        "192.168.0.0/16",   # RFC1918 private
+        "198.18.0.0/15",    # benchmarking
+        "224.0.0.0/4",      # multicast
+        "240.0.0.0/4",      # reserved
+        # IPv6
+        "::/128",           # unspecified
+        "::1/128",          # loopback
+        "::ffff:0:0/96",    # IPv4-mapped (also re-checked against the v4 list)
+        "fc00::/7",         # unique-local
+        "fe80::/10",        # link-local
+        "ff00::/8", # multicast
+      ].map { |range| IPAddr.new(range) }.freeze
+
+      class << self
+
+        # Resolve and validate the given host, returning the IP address the
+        # connection should be pinned to (as a string). Pinning the connection
+        # to the validated address prevents a DNS-rebinding race between the
+        # check here and the actual connection.
+        #
+        # @param [String] host the hostname or IP literal from the request URL
+        # @raise [Postal::HTTP::BlockedDestinationError] if the host cannot be
+        #   resolved or any resolved address is not permitted
+        # @raise [SocketError] if the host only resolves to addresses whose
+        #   family this server cannot reach (e.g. IPv6 with no IPv6 support)
+        # @return [String] the validated IP address to connect to
+        def safe_connect_address(host)
+          new(host).safe_connect_address
+        end
+
+        # Whether this server has IPv6 connectivity (a global IPv6 address on
+        # one of its interfaces). Memoized as it does not change at runtime.
+        def ipv6_supported?
+          return @ipv6_supported unless @ipv6_supported.nil?
+
+          @ipv6_supported = local_families.include?(:ipv6)
+        end
+
+        # Whether this server has IPv4 connectivity. Defaults to true unless the
+        # host clearly only has IPv6, so that a host reporting no global
+        # addresses at all (e.g. inside a minimal container) still attempts IPv4
+        # as it did before this guard existed.
+        def ipv4_supported?
+          return @ipv4_supported unless @ipv4_supported.nil?
+
+          families = local_families
+          @ipv4_supported = families.include?(:ipv4) || !families.include?(:ipv6)
+        end
+
+        private
+
+        def local_families
+          families = []
+          Socket.ip_address_list.each do |address|
+            families << :ipv4 if address.ipv4? && !address.ipv4_loopback?
+            families << :ipv6 if address.ipv6? && !address.ipv6_loopback? && !address.ipv6_linklocal?
+          end
+          families.uniq
+        end
+
+      end
+
+      # @param [String] host
+      def initialize(host)
+        @host = host.to_s
+      end
+
+      def safe_connect_address
+        if @host.empty?
+          raise BlockedDestinationError, "No host was given for the request"
+        end
+
+        addresses = resolve
+        if addresses.empty?
+          raise BlockedDestinationError, "Could not resolve '#{@host}' to any IP address"
+        end
+
+        # Reject the whole request if *any* resolved address is blocked. This is
+        # checked before the reachability filtering below so that a blocked
+        # destination is always reported as such, regardless of which address
+        # families this particular server can reach. It also defeats DNS
+        # responses that mix a public and a private address to slip past.
+        addresses.each do |address|
+          next unless blocked?(address)
+
+          raise BlockedDestinationError,
+                "Destination '#{@host}' (#{address}) is not permitted"
+        end
+
+        # Only connect to an address whose family this server can actually
+        # reach. Otherwise we might pin the connection to an IPv6 address on a
+        # host without IPv6 connectivity and fail to connect even when a usable
+        # IPv4 address was available.
+        usable = addresses.select { |address| family_reachable?(address) }
+        if usable.empty?
+          raise SocketError,
+                "'#{@host}' only resolves to addresses this server cannot reach " \
+                "(#{addresses.join(', ')})"
+        end
+
+        # Prefer IPv4 for predictability; only use IPv6 when it is the only
+        # reachable option.
+        (usable.find(&:ipv4?) || usable.first).to_s
+      end
+
+      private
+
+      # @return [Array<IPAddr>]
+      def resolve
+        return [IPAddr.new(@host)] if ip_literal?
+
+        Resolv.getaddresses(@host).filter_map do |address|
+          IPAddr.new(address)
+        rescue IPAddr::InvalidAddressError
+          nil
+        end
+      end
+
+      def ip_literal?
+        IPAddr.new(@host)
+        true
+      rescue IPAddr::InvalidAddressError
+        false
+      end
+
+      # @param [IPAddr] address
+      def family_reachable?(address)
+        if address.ipv6? && !address.ipv4_mapped?
+          self.class.ipv6_supported?
+        else
+          self.class.ipv4_supported?
+        end
+      end
+
+      # @param [IPAddr] address
+      def blocked?(address)
+        return false if allowlisted?(address)
+
+        # IPv4-mapped IPv6 addresses (::ffff:a.b.c.d) must be checked against the
+        # IPv4 rules using the embedded address, otherwise they bypass the list.
+        if address.ipv6? && address.ipv4_mapped?
+          mapped = address.native
+          return true if mapped.ipv4? && BLOCKED_RANGES.any? { |range| range.include?(mapped) }
+        end
+
+        BLOCKED_RANGES.any? { |range| range.include?(address) }
+      end
+
+      # @param [IPAddr] address
+      def allowlisted?(address)
+        allowlist.any? do |entry|
+          if entry.is_a?(IPAddr)
+            entry.include?(address)
+          else
+            entry.casecmp?(@host)
+          end
+        end
+      end
+
+      # Allowlist entries are kept as strings in config. An entry that parses as
+      # an IP/CIDR is matched against the resolved address; anything else is
+      # matched against the request hostname (case-insensitively).
+      #
+      # @return [Array<IPAddr, String>]
+      def allowlist
+        @allowlist ||= Array(Postal::Config.postal.allowed_request_destinations).map do |entry|
+          IPAddr.new(entry.to_s)
+        rescue IPAddr::InvalidAddressError
+          entry.to_s
+        end
+      end
+
+    end
+  end
+end
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Postal
+  module HTTP
+    # Raised when an outbound request would be sent to an address that is not
+    # permitted (a private, loopback, link-local or otherwise reserved address
+    # that has not been explicitly allowlisted). Used as an SSRF guard.
+    class BlockedDestinationError < StandardError
+    end
+  end
+end
@@ -70,7 +70,7 @@ module Postal
      # Return the total size of all stored messages
      #
      def total_size
-        query("SELECT SUM(size) AS size FROM `#{database_name}`.`raw_message_sizes`").first["size"] || 0
+        query("SELECT SUM(size) AS size FROM #{escape_identifier(database_name)}.`raw_message_sizes`").first["size"] || 0
      end

      #
@@ -151,11 +151,11 @@ module Postal
        if options[:count]
          sql_query << " COUNT(id) AS count"
        elsif options[:fields]
-          sql_query << (" " + options[:fields].map { |f| "`#{f}`" }.join(", "))
+          sql_query << (" " + options[:fields].map { |f| escape_identifier(f) }.join(", "))
        else
          sql_query << " *"
        end
-        sql_query << " FROM `#{database_name}`.`#{table}`"
+        sql_query << " FROM #{escape_identifier(database_name)}.#{escape_identifier(table)}"
        if options[:where].present?
          sql_query << (" " + build_where_string(options[:where], " AND "))
        end
@@ -163,7 +163,7 @@ module Postal
          direction = (options[:direction] || "ASC").upcase
          raise Postal::Error, "Invalid direction #{options[:direction]}" unless %w[ASC DESC].include?(direction)

-          sql_query << " ORDER BY `#{options[:order]}` #{direction}"
+          sql_query << " ORDER BY #{escape_identifier(options[:order])} #{direction}"
        end

        if options[:limit]
@@ -211,7 +211,7 @@ module Postal
      # Will return the total number of affected rows.
      #
      def update(table, attributes, options = {})
-        sql_query = "UPDATE `#{database_name}`.`#{table}` SET"
+        sql_query = "UPDATE #{escape_identifier(database_name)}.#{escape_identifier(table)} SET"
        sql_query << " #{hash_to_sql(attributes)}"
        if options[:where]
          sql_query << (" " + build_where_string(options[:where]))
@@ -227,8 +227,8 @@ module Postal
      # Will return the ID of the new item.
      #
      def insert(table, attributes)
-        sql_query = "INSERT INTO `#{database_name}`.`#{table}`"
-        sql_query << (" (" + attributes.keys.map { |k| "`#{k}`" }.join(", ") + ")")
+        sql_query = "INSERT INTO #{escape_identifier(database_name)}.#{escape_identifier(table)}"
+        sql_query << (" (" + attributes.keys.map { |k| escape_identifier(k) }.join(", ") + ")")
        sql_query << (" VALUES (" + attributes.values.map { |v| escape(v) }.join(", ") + ")")
        with_mysql do |mysql|
          query_on_connection(mysql, sql_query)
@@ -243,8 +243,8 @@ module Postal
        if values.empty?
          nil
        else
-          sql_query = "INSERT INTO `#{database_name}`.`#{table}`"
-          sql_query << (" (" + keys.map { |k| "`#{k}`" }.join(", ") + ")")
+          sql_query = "INSERT INTO #{escape_identifier(database_name)}.#{escape_identifier(table)}"
+          sql_query << (" (" + keys.map { |k| escape_identifier(k) }.join(", ") + ")")
          sql_query << " VALUES "
          sql_query << values.map { |v| "(" + v.map { |r| escape(r) }.join(", ") + ")" }.join(", ")
          query(sql_query)
@@ -260,7 +260,7 @@ module Postal
      # Will return the total number of affected rows.
      #
      def delete(table, options = {})
-        sql_query = "DELETE FROM `#{database_name}`.`#{table}`"
+        sql_query = "DELETE FROM #{escape_identifier(database_name)}.#{escape_identifier(table)}"
        sql_query << (" " + build_where_string(options[:where], " AND "))
        with_mysql do |mysql|
          query_on_connection(mysql, sql_query)
@@ -351,32 +351,41 @@ module Postal

      def hash_to_sql(hash, joiner = ", ")
        hash.map do |key, value|
+          column = escape_identifier(key)
          if value.is_a?(Array) && value.all? { |v| v.is_a?(Integer) }
-            "`#{key}` IN (#{value.join(', ')})"
+            "#{column} IN (#{value.join(', ')})"
          elsif value.is_a?(Array)
            escaped_values = value.map { |v| escape(v) }.join(", ")
-            "`#{key}` IN (#{escaped_values})"
+            "#{column} IN (#{escaped_values})"
          elsif value.is_a?(Hash)
            sql = []
            value.each do |operator, inner_value|
              case operator
              when :less_than
-                sql << "`#{key}` < #{escape(inner_value)}"
+                sql << "#{column} < #{escape(inner_value)}"
              when :greater_than
-                sql << "`#{key}` > #{escape(inner_value)}"
+                sql << "#{column} > #{escape(inner_value)}"
              when :less_than_or_equal_to
-                sql << "`#{key}` <= #{escape(inner_value)}"
+                sql << "#{column} <= #{escape(inner_value)}"
              when :greater_than_or_equal_to
-                sql << "`#{key}` >= #{escape(inner_value)}"
+                sql << "#{column} >= #{escape(inner_value)}"
              end
            end
            sql.empty? ? "1=1" : sql.join(joiner)
          else
-            "`#{key}` = #{escape(value)}"
+            "#{column} = #{escape(value)}"
          end
        end.join(joiner)
      end

+      # Escape a value for safe use as a MySQL identifier (e.g. a column or
+      # table name). Identifiers are wrapped in backticks and any backtick
+      # within the identifier is doubled so it cannot break out of the quoting
+      # and inject arbitrary SQL.
+      def escape_identifier(identifier)
+        "`" + identifier.to_s.gsub("`", "``") + "`"
+      end
+
    end
  end
 end
@@ -1,18 +0,0 @@
-# frozen_string_literal: true
-
-module Postal
-
-  VERSION_PATH = File.expand_path("../../VERSION", __dir__)
-  if File.file?(VERSION_PATH)
-    VERSION = File.read(VERSION_PATH).strip.delete_prefix("v")
-  else
-    VERSION = "0.0.0-dev"
-  end
-
-  def self.version
-    VERSION
-  end
-
-  Version = VERSION
-
-end
@@ -48,25 +48,11 @@ class TrackingMiddleware
      Sentry.capture_exception(e) if defined?(Sentry)
    end

-    source_image = request.params["src"]
-    case source_image
-    when nil
+    if request.params["src"].nil?
      headers = {}
      headers["Content-Type"] = "image/png"
      headers["Content-Length"] = TRACKING_PIXEL.bytesize.to_s
      [200, headers, [TRACKING_PIXEL]]
-    when /\Ahttps?:\/\//
-      response = Postal::HTTP.get(source_image, timeout: 3)
-      return [404, {}, ["Not found"]] unless response[:code] == 200
-
-      headers = {}
-      headers["Content-Type"] = response[:headers]["content-type"]&.first
-      headers["Last-Modified"] = response[:headers]["last-modified"]&.first
-      headers["Cache-Control"] = response[:headers]["cache-control"]&.first
-      headers["Etag"] = response[:headers]["etag"]&.first
-      headers["Content-Length"] = response[:body].bytesize.to_s
-      [200, headers, [response[:body]]]
-
    else
      [400, {}, ["Invalid/missing source image"]]
    end
@@ -1,21 +0,0 @@
-#!/bin/bash
-
-set -e
-
-if [ ! -d /tmp/postal-api/.git ];
-then
-  git clone git@github.com:atech/postal-api /tmp/postal-api
-else
-  git -C /tmp/postal-api reset --hard HEAD
-  git -C /tmp/postal-api pull origin master
-fi
-
-rm -Rf /tmp/postal-api/*
-
-bundle exec moonrope api /tmp/postal-api
-
-cd /tmp/postal-api
-
-git add .
-git commit -m "update docs"
-git push origin master
@@ -1,5 +1,5 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true

-require File.expand_path("../lib/postal/version", __dir__)
+require File.expand_path("../lib/postal/config", __dir__)
 puts Postal.version
@@ -64,6 +64,23 @@ RSpec.describe "Legacy Messages API", type: :request do
        end
      end

+      # Regression test for GHSA-x2hq-rfpg-3xr5 (see message_spec.rb). A JSON
+      # object supplied for `id` must be rejected before reaching the database
+      # rather than being interpreted as a raw set of SQL conditions.
+      context "when the message ID is a JSON object (SQL injection attempt)" do
+        it "rejects it with a parameter error and never reaches the database" do
+          expect_any_instance_of(Server).not_to receive(:message)
+          post "/api/v1/messages/deliveries",
+               headers: { "x-server-api-key" => credential.key,
+                          "content-type" => "application/json" },
+               params: { id: { "id`=0 OR SLEEP(5)#" => "x" } }.to_json
+          expect(response.status).to eq 200
+          parsed_body = JSON.parse(response.body)
+          expect(parsed_body["status"]).to eq "parameter-error"
+          expect(parsed_body["data"]["message"]).to match(/must be a string or integer/)
+        end
+      end
+
      context "when the message ID exists" do
        let(:server) { create(:server) }
        let(:credential) { create(:credential, server: server) }
@@ -63,6 +63,56 @@ RSpec.describe "Legacy Messages API", type: :request do
        end
      end

+      # Regression tests for GHSA-x2hq-rfpg-3xr5. The request body is parsed as
+      # JSON, so a JSON object/array supplied for `id` would otherwise arrive as
+      # a Ruby Hash/Array and be passed straight through to the message database
+      # as a raw set of SQL conditions (blind SQL injection). These must be
+      # rejected before reaching the database.
+      context "when the message ID is a JSON object (SQL injection attempt)" do
+        it "rejects it with a parameter error and never reaches the database" do
+          expect_any_instance_of(Server).not_to receive(:message)
+          post "/api/v1/messages/message",
+               headers: { "x-server-api-key" => credential.key,
+                          "content-type" => "application/json" },
+               params: { id: { "id`=0 OR SLEEP(5)#" => "x" } }.to_json
+          expect(response.status).to eq 200
+          parsed_body = JSON.parse(response.body)
+          expect(parsed_body["status"]).to eq "parameter-error"
+          expect(parsed_body["data"]["message"]).to match(/must be a string or integer/)
+        end
+      end
+
+      context "when the message ID is a JSON array" do
+        it "rejects it with a parameter error" do
+          post "/api/v1/messages/message",
+               headers: { "x-server-api-key" => credential.key,
+                          "content-type" => "application/json" },
+               params: { id: [1, 2, 3] }.to_json
+          expect(response.status).to eq 200
+          parsed_body = JSON.parse(response.body)
+          expect(parsed_body["status"]).to eq "parameter-error"
+          expect(parsed_body["data"]["message"]).to match(/must be a string or integer/)
+        end
+      end
+
+      context "when the message ID is provided as a numeric string" do
+        let(:message) { MessageFactory.outgoing(server) }
+
+        it "is coerced to an integer and looks the message up" do
+          post "/api/v1/messages/message",
+               headers: { "x-server-api-key" => credential.key,
+                          "content-type" => "application/json" },
+               params: { id: message.id.to_s }.to_json
+          expect(response.status).to eq 200
+          parsed_body = JSON.parse(response.body)
+          expect(parsed_body["status"]).to eq "success"
+          expect(parsed_body["data"]).to match({
+            "id" => message.id,
+            "token" => message.token
+          })
+        end
+      end
+
      context "when the message ID exists" do
        let(:server) { create(:server) }
        let(:credential) { create(:credential, server: server) }
@@ -88,6 +138,49 @@ RSpec.describe "Legacy Messages API", type: :request do
          end
        end

+        context "when all expansions are requested" do
+          let(:expansions) { true }
+
+          it "returns details about the message" do
+            expect(response.status).to eq 200
+            parsed_body = JSON.parse(response.body)
+            expect(parsed_body["status"]).to eq "success"
+            expect(parsed_body["data"]).to match({
+              "id" => message.id,
+              "token" => message.token,
+              "status" => { "held" => false,
+                            "hold_expiry" => nil,
+                            "last_delivery_attempt" => nil,
+                            "status" => "Pending" },
+              "details" => { "bounce" => false,
+                             "bounce_for_id" => 0,
+                             "direction" => "outgoing",
+                             "mail_from" => "test@example.com",
+                             "message_id" => message.message_id,
+                             "rcpt_to" => "john@example.com",
+                             "received_with_ssl" => nil,
+                             "size" => kind_of(String),
+                             "subject" => "An example message",
+                             "tag" => nil,
+                             "timestamp" => kind_of(Float) },
+              "inspection" => { "inspected" => false,
+                                "spam" => false,
+                                "spam_score" => 0.0,
+                                "threat" => false,
+                                "threat_details" => nil },
+              "plain_body" => message.plain_body,
+              "html_body" => message.html_body,
+              "attachments" => [],
+              "headers" => message.headers,
+              "raw_message" => Base64.encode64(message.raw_message),
+              "activity_entries" => {
+                "loads" => [],
+                "clicks" => []
+              }
+            })
+          end
+        end
+
        context "when the status expansion is requested" do
          let(:expansions) { ["status"] }

@@ -40,6 +40,8 @@ RSpec.describe "Legacy Send API", type: :request do
      let(:server) { create(:server) }
      let(:credential) { create(:credential, server: server) }
      let(:domain) { create(:domain, owner: server) }
+
+      context "when parameters are provided in a JSON body" do
        let(:default_params) do
          {
            to: ["test@example.com"],
@@ -232,3 +234,4 @@ RSpec.describe "Legacy Send API", type: :request do
      end
    end
  end
+end
@@ -60,13 +60,14 @@ RSpec.describe "Legacy Send API", type: :request do
          bounce: false
        }
      end
+      let(:content_type) { "application/json" }
      let(:params) { default_params }

      before do
        post "/api/v1/send/raw",
             headers: { "x-server-api-key" => credential.key,
-                        "content-type" => "application/json" },
-             params: params.to_json
+                        "content-type" => content_type },
+             params: content_type == "application/json" ? params.to_json : params
      end

      context "when rcpt_to is not provided" do
@@ -146,6 +147,21 @@ RSpec.describe "Legacy Send API", type: :request do
            )
          end
        end
+
+        context "when params are provided as a param" do
+          let(:content_type) { nil }
+          let(:params) { { params: default_params.to_json } }
+
+          it "returns details of the messages created" do
+            parsed_body = JSON.parse(response.body)
+            expect(parsed_body["data"]["message_id"]).to be_a String
+            expect(parsed_body["data"]["messages"]).to be_a Hash
+            expect(parsed_body["data"]["messages"]).to match({
+              "test1@example.com" => { "id" => kind_of(Integer), "token" => /\A[a-zA-Z0-9]{16}\z/ },
+              "test2@example.com" => { "id" => kind_of(Integer), "token" => /\A[a-zA-Z0-9]{16}\z/ }
+            })
+          end
+        end
      end
    end
  end
@@ -5,30 +5,32 @@
 # Table name: domains
 #
 #  id                             :integer          not null, primary key
-#  server_id              :integer
-#  uuid                   :string(255)
-#  name                   :string(255)
-#  verification_token     :string(255)
-#  verification_method    :string(255)
-#  verified_at            :datetime
+#  dkim_error                     :string(255)
+#  dkim_identifier_string         :string(255)
 #  dkim_private_key               :text(65535)
+#  dkim_status                    :string(255)
+#  dns_checked_at                 :datetime
+#  incoming                       :boolean          default(TRUE)
+#  mx_error                       :string(255)
+#  mx_status                      :string(255)
+#  name                           :string(255)
+#  outgoing                       :boolean          default(TRUE)
+#  owner_type                     :string(255)
+#  pending_dkim_identifier_string :string(255)
+#  pending_dkim_private_key       :text(65535)
+#  return_path_error              :string(255)
+#  return_path_status             :string(255)
+#  spf_error                      :string(255)
+#  spf_status                     :string(255)
+#  use_for_any                    :boolean
+#  uuid                           :string(255)
+#  verification_method            :string(255)
+#  verification_token             :string(255)
+#  verified_at                    :datetime
 #  created_at                     :datetime
 #  updated_at                     :datetime
-#  dns_checked_at         :datetime
-#  spf_status             :string(255)
-#  spf_error              :string(255)
-#  dkim_status            :string(255)
-#  dkim_error             :string(255)
-#  mx_status              :string(255)
-#  mx_error               :string(255)
-#  return_path_status     :string(255)
-#  return_path_error      :string(255)
-#  outgoing               :boolean          default(TRUE)
-#  incoming               :boolean          default(TRUE)
-#  owner_type             :string(255)
 #  owner_id                       :integer
-#  dkim_identifier_string :string(255)
-#  use_for_any            :boolean
+#  server_id                      :integer
 #
 # Indexes
 #
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe ApplicationHelper, type: :helper do
+  describe "#endpoint_options_for_select" do
+    let(:server) { create(:server) }
+
+    context "when an endpoint has HTML characters in its description" do
+      let(:payload) { %q(x'"><script>alert(1)</script>) }
+
+      before do
+        create(:http_endpoint, server: server, name: payload)
+      end
+
+      it "HTML-escapes the endpoint description in the option text" do
+        html = helper.endpoint_options_for_select(server)
+
+        # The raw payload must not appear verbatim — if it does, the browser
+        # will execute the <script> tag.
+        expect(html).not_to include("<script>alert(1)</script>")
+
+        # Escaped form should appear instead.
+        expect(html).to include("&lt;script&gt;alert(1)&lt;/script&gt;")
+      end
+
+      it "does not allow the payload to break out of the option tag" do
+        html = helper.endpoint_options_for_select(server)
+
+        # The ' and > characters in the payload must be escaped so they
+        # cannot close the opening <option value='...'> or terminate the
+        # element early.
+        expect(html).not_to match(/<option[^>]*>[^<]*<script/)
+      end
+    end
+  end
+end
@@ -62,6 +62,7 @@ module MessageDequeuer
        @queued_message3 = create(:queued_message, message: @message3)
      end

+      context "when postal.batch_queued_messages is enabled" do
        it "calls the single message process for the initial message and all batchable messages" do
          [queued_message, @queued_message2, @queued_message3].each do |msg|
            expect(SingleMessageProcessor).to receive(:process).with(msg,
@@ -72,6 +73,20 @@ module MessageDequeuer
        end
      end

+      context "when postal.batch_queued_messages is disabled" do
+        before do
+          allow(Postal::Config.postal).to receive(:batch_queued_messages?) { false }
+        end
+
+        it "does not call the single message process more than once" do
+          expect(SingleMessageProcessor).to receive(:process).once.with(queued_message,
+                                                                        logger: logger,
+                                                                        state: processor.state)
+          processor.process
+        end
+      end
+    end
+
    context "when an error occurs while finding batchable messages" do
      before do
        allow(queued_message).to receive(:batchable_messages) { 1 / 0 }
@@ -0,0 +1,192 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe Postal::HTTP::AddressGuard do
+  describe ".safe_connect_address" do
+    subject(:call) { described_class.safe_connect_address(host) }
+
+    before do
+      allow(Postal::Config.postal).to receive(:allowed_request_destinations).and_return(allowlist)
+    end
+
+    let(:allowlist) { [] }
+
+    context "when given a public IP literal" do
+      let(:host) { "93.184.216.34" }
+
+      it "returns the address to connect to" do
+        expect(call).to eq "93.184.216.34"
+      end
+    end
+
+    context "when given a public IPv6 literal" do
+      let(:host) { "2606:2800:220:1:248:1893:25c8:1946" }
+
+      before { allow(described_class).to receive(:ipv6_supported?).and_return(true) }
+
+      it "returns the address to connect to" do
+        expect(call).to eq "2606:2800:220:1:248:1893:25c8:1946"
+      end
+    end
+
+    [
+      "127.0.0.1",
+      "10.0.0.1",
+      "172.16.5.4",
+      "192.168.1.1",
+      "169.254.169.254", # cloud metadata
+      "100.64.0.1",      # carrier-grade NAT
+      "0.0.0.0",
+      "::1",
+      "fd00::1",         # unique-local IPv6
+      "fe80::1",         # link-local IPv6
+      "::ffff:127.0.0.1", # IPv4-mapped loopback
+    ].each do |blocked|
+      context "when given the blocked address #{blocked}" do
+        let(:host) { blocked }
+
+        it "raises BlockedDestinationError" do
+          expect { call }.to raise_error(Postal::HTTP::BlockedDestinationError)
+        end
+      end
+    end
+
+    context "when given a hostname that resolves to a public address" do
+      let(:host) { "example.com" }
+
+      before do
+        allow(Resolv).to receive(:getaddresses).with(host).and_return(["93.184.216.34"])
+      end
+
+      it "returns the resolved address" do
+        expect(call).to eq "93.184.216.34"
+      end
+    end
+
+    context "when given a hostname that resolves to a private address" do
+      let(:host) { "internal.example.com" }
+
+      before do
+        allow(Resolv).to receive(:getaddresses).with(host).and_return(["10.1.2.3"])
+      end
+
+      it "raises BlockedDestinationError" do
+        expect { call }.to raise_error(Postal::HTTP::BlockedDestinationError)
+      end
+    end
+
+    context "when a hostname resolves to both a public and a private address" do
+      let(:host) { "rebind.example.com" }
+
+      before do
+        allow(Resolv).to receive(:getaddresses).with(host).and_return(["93.184.216.34", "127.0.0.1"])
+      end
+
+      it "raises BlockedDestinationError because one address is blocked" do
+        expect { call }.to raise_error(Postal::HTTP::BlockedDestinationError)
+      end
+    end
+
+    context "when a hostname resolves to both IPv4 and IPv6 addresses" do
+      let(:host) { "dualstack.example.com" }
+      let(:ipv6) { "2606:2800:220:1:248:1893:25c8:1946" }
+
+      before do
+        allow(Resolv).to receive(:getaddresses).with(host).and_return([ipv6, "93.184.216.34"])
+      end
+
+      context "and the server does not support IPv6" do
+        before { allow(described_class).to receive(:ipv6_supported?).and_return(false) }
+
+        it "connects over IPv4" do
+          expect(call).to eq "93.184.216.34"
+        end
+      end
+
+      context "and the server supports IPv6" do
+        before { allow(described_class).to receive(:ipv6_supported?).and_return(true) }
+
+        it "still prefers IPv4 for predictability" do
+          expect(call).to eq "93.184.216.34"
+        end
+      end
+    end
+
+    context "when a hostname resolves only to an IPv6 address" do
+      let(:host) { "v6only.example.com" }
+      let(:ipv6) { "2606:2800:220:1:248:1893:25c8:1946" }
+
+      before do
+        allow(Resolv).to receive(:getaddresses).with(host).and_return([ipv6])
+      end
+
+      context "and the server does not support IPv6" do
+        before { allow(described_class).to receive(:ipv6_supported?).and_return(false) }
+
+        it "raises a SocketError because the address is unreachable" do
+          expect { call }.to raise_error(SocketError)
+        end
+      end
+
+      context "and the server supports IPv6" do
+        before { allow(described_class).to receive(:ipv6_supported?).and_return(true) }
+
+        it "connects over IPv6" do
+          expect(call).to eq ipv6
+        end
+      end
+    end
+
+    context "when a hostname cannot be resolved" do
+      let(:host) { "nope.example.com" }
+
+      before do
+        allow(Resolv).to receive(:getaddresses).with(host).and_return([])
+      end
+
+      it "raises BlockedDestinationError" do
+        expect { call }.to raise_error(Postal::HTTP::BlockedDestinationError, /resolve/)
+      end
+    end
+
+    context "when the host is blank" do
+      let(:host) { "" }
+
+      it "raises BlockedDestinationError" do
+        expect { call }.to raise_error(Postal::HTTP::BlockedDestinationError)
+      end
+    end
+
+    context "when a blocked address is allowlisted by CIDR" do
+      let(:host) { "10.0.0.5" }
+      let(:allowlist) { ["10.0.0.0/8"] }
+
+      it "returns the address" do
+        expect(call).to eq "10.0.0.5"
+      end
+    end
+
+    context "when a blocked address is allowlisted by exact IP" do
+      let(:host) { "127.0.0.1" }
+      let(:allowlist) { ["127.0.0.1"] }
+
+      it "returns the address" do
+        expect(call).to eq "127.0.0.1"
+      end
+    end
+
+    context "when a hostname resolving to a private address is allowlisted by name" do
+      let(:host) { "internal.example.com" }
+      let(:allowlist) { ["internal.example.com"] }
+
+      before do
+        allow(Resolv).to receive(:getaddresses).with(host).and_return(["10.1.2.3"])
+      end
+
+      it "returns the resolved address" do
+        expect(call).to eq "10.1.2.3"
+      end
+    end
+  end
+end
@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe Postal::HTTP do
+  before do
+    allow(Postal::Config.postal).to receive(:allowed_request_destinations).and_return([])
+  end
+
+  describe ".post" do
+    context "when the host resolves to a blocked address" do
+      before do
+        allow(Resolv).to receive(:getaddresses).with("internal.example.com").and_return(["127.0.0.1"])
+      end
+
+      it "does not make a request and returns a blocked-destination result" do
+        result = described_class.post("http://internal.example.com/hook", json: "{}")
+        expect(result[:code]).to eq(-4)
+        expect(result[:body]).to match(/not permitted/)
+        expect(WebMock).not_to have_requested(:post, "http://internal.example.com/hook")
+      end
+    end
+
+    context "when resolving the host raises an error" do
+      before do
+        allow(Resolv).to receive(:getaddresses).with("example.com").and_raise(Resolv::ResolvError, "resolver failed")
+      end
+
+      it "returns a connection error result" do
+        result = described_class.post("http://example.com/hook", json: "{}")
+        expect(result[:code]).to eq(-2)
+        expect(result[:body]).to match(/resolver failed/)
+        expect(WebMock).not_to have_requested(:post, "http://example.com/hook")
+      end
+    end
+
+    context "when resolving the host exceeds the request timeout" do
+      before do
+        allow(Resolv).to receive(:getaddresses).with("example.com") do
+          sleep 0.2
+          ["93.184.216.34"]
+        end
+      end
+
+      it "returns a timeout result before making a request" do
+        result = described_class.post("http://example.com/hook", json: "{}", timeout: 0.05)
+        expect(result[:code]).to eq(-1)
+        expect(WebMock).not_to have_requested(:post, "http://example.com/hook")
+      end
+    end
+
+    context "when the host resolves to a public address" do
+      before do
+        allow(Resolv).to receive(:getaddresses).with("example.com").and_return(["93.184.216.34"])
+        stub_request(:post, "http://example.com/hook").to_return(status: 200, body: "OK")
+      end
+
+      it "pins the connection to the validated address and performs the request" do
+        expect_any_instance_of(Net::HTTP).to receive(:ipaddr=).with("93.184.216.34").and_call_original
+        result = described_class.post("http://example.com/hook", json: "{}")
+        expect(result[:code]).to eq(200)
+        expect(WebMock).to have_requested(:post, "http://example.com/hook")
+      end
+    end
+
+    context "when the blocked host is allowlisted" do
+      before do
+        allow(Postal::Config.postal).to receive(:allowed_request_destinations).and_return(["internal.example.com"])
+        allow(Resolv).to receive(:getaddresses).with("internal.example.com").and_return(["10.0.0.5"])
+        stub_request(:post, "http://internal.example.com/hook").to_return(status: 200, body: "OK")
+      end
+
+      it "performs the request" do
+        result = described_class.post("http://internal.example.com/hook", json: "{}")
+        expect(result[:code]).to eq(200)
+        expect(WebMock).to have_requested(:post, "http://internal.example.com/hook")
+      end
+    end
+  end
+end
@@ -14,5 +14,64 @@ describe Postal::MessageDB::Database do
    it "should return the current schema version" do
      expect(database.schema_version).to be_a Integer
    end
+
+    describe "#escape_identifier" do
+      it "wraps a plain identifier in backticks" do
+        expect(database.send(:escape_identifier, "id")).to eq "`id`"
+      end
+
+      it "doubles embedded backticks so the value cannot break out of the quoting" do
+        expect(database.send(:escape_identifier, "id`=0 OR SLEEP(5)#"))
+          .to eq "`id``=0 OR SLEEP(5)#`"
+      end
+
+      it "coerces non-string identifiers to a string" do
+        expect(database.send(:escape_identifier, :token)).to eq "`token`"
+      end
+    end
+
+    describe "#hash_to_sql" do
+      it "builds a simple equality condition" do
+        expect(database.send(:hash_to_sql, { "id" => 5 })).to eq "`id` = '5'"
+      end
+
+      it "builds an IN condition for an array of integers" do
+        expect(database.send(:hash_to_sql, { "id" => [1, 2] })).to eq "`id` IN (1, 2)"
+      end
+
+      it "builds operator conditions for a hash value" do
+        expect(database.send(:hash_to_sql, { "id" => { greater_than: 1 } }))
+          .to eq "`id` > '1'"
+      end
+
+      # Regression tests for GHSA-x2hq-rfpg-3xr5: a backtick in the condition
+      # key must be neutralised so it cannot close the identifier quoting and
+      # inject arbitrary SQL.
+      it "neutralises a backtick injection in an equality key" do
+        sql = database.send(:hash_to_sql, { "id`=0 OR SLEEP(5)#" => "x" })
+        expect(sql).to eq "`id``=0 OR SLEEP(5)#` = 'x'"
+      end
+
+      it "neutralises a backtick injection in an IN key" do
+        sql = database.send(:hash_to_sql, { "id`)#" => %w[a b] })
+        expect(sql).to eq "`id``)#` IN ('a', 'b')"
+      end
+
+      it "neutralises a backtick injection in an operator key" do
+        sql = database.send(:hash_to_sql, { "id`#" => { greater_than: 1 } })
+        expect(sql).to eq "`id``#` > '1'"
+      end
+    end
+
+    describe "#select with a hostile condition key" do
+      # End-to-end proof against the live test database: the injected key is
+      # treated as a single (non-existent) column identifier, so MySQL rejects
+      # the query instead of executing the injected SQL.
+      it "does not allow SQL injection via the condition key" do
+        expect do
+          database.select("messages", where: { "id`=0 OR 1=1#" => "x" }, limit: 1)
+        end.to raise_error(Mysql2::Error)
+      end
+    end
  end
 end
@@ -9,4 +9,10 @@ RSpec.describe Postal do
      expect(Postal.signer.private_key.to_pem).to eq OpenSSL::PKey::RSA.new(File.read(Postal::Config.postal.signing_key_path)).to_pem
    end
  end
+
+  describe "#change_database_connection_pool_size" do
+    it "changes the connection pool size" do
+      expect { Postal.change_database_connection_pool_size(8) }.to change { ActiveRecord::Base.connection_pool.size }.from(5).to(8)
+    end
+  end
 end
@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require "rack/test"
+
+RSpec.describe TrackingMiddleware do
+  include Rack::Test::Methods
+
+  let(:inner_app) { ->(_env) { [200, {}, ["inner"]] } }
+  let(:app) { described_class.new(inner_app) }
+
+  let(:server) { create(:server) }
+  let(:message) do
+    MessageFactory.incoming(server) do |_msg, mail|
+      mail.html_part = Mail::Part.new do
+        content_type "text/html; charset=UTF-8"
+        body "<html><body>hi</body></html>"
+      end
+    end
+  end
+
+  def track_headers
+    { "HTTP_X_POSTAL_TRACK_HOST" => "1" }
+  end
+
+  describe "GET /img/:server_token/:message_token (open tracking pixel)" do
+    before do
+      get "/img/#{server.token}/#{message.token}", {}, track_headers
+    end
+
+    it "returns the tracking pixel PNG" do
+      expect(last_response.status).to eq 200
+      expect(last_response.headers["Content-Type"]).to eq "image/png"
+      expect(last_response.body.bytesize).to be > 0
+    end
+
+    it "records a load for the message" do
+      # Re-fetch the message so loads are read fresh from the DB.
+      reloaded = server.message_db.message(message.id)
+      expect(reloaded.loads.size).to eq 1
+    end
+  end
+
+  describe "GET /img/:server_token/:message_token?src=<url> (image proxy)" do
+    let(:attacker_url) { "http://internal.example.com/secret" }
+
+    before do
+      stub_request(:get, attacker_url).to_return(status: 200, body: "internal-secret")
+    end
+
+    it "does not fetch the URL and returns 400" do
+      get "/img/#{server.token}/#{message.token}", { src: attacker_url }, track_headers
+
+      expect(last_response.status).to eq 400
+      expect(WebMock).not_to have_requested(:get, attacker_url)
+    end
+
+    it "does not fetch the URL even when the message token is invalid" do
+      get "/img/#{server.token}/nonexistent", { src: attacker_url }, track_headers
+
+      expect(WebMock).not_to have_requested(:get, attacker_url)
+    end
+  end
+
+  describe "when the track-host header is missing" do
+    it "passes the request through to the inner app untouched" do
+      get "/img/#{server.token}/#{message.token}"
+      expect(last_response.body).to eq "inner"
+    end
+  end
+end
@@ -16,6 +16,8 @@
 #  name                           :string(255)
 #  outgoing                       :boolean          default(TRUE)
 #  owner_type                     :string(255)
+#  pending_dkim_identifier_string :string(255)
+#  pending_dkim_private_key       :text(65535)
 #  return_path_error              :string(255)
 #  return_path_status             :string(255)
 #  spf_error                      :string(255)
@@ -162,6 +164,22 @@ describe Domain do
    it "generates a new dkim key" do
      expect { domain.generate_dkim_key }.to change { domain.dkim_private_key }.from(nil).to(match(/\A-+BEGIN RSA PRIVATE KEY-+/))
    end
+
+    it "generates a key of the configured size" do
+      domain.generate_dkim_key
+      expect(OpenSSL::PKey::RSA.new(domain.dkim_private_key).n.num_bits).to eq Postal::Config.dns.dkim_key_size
+    end
+
+    context "when a different key size is configured" do
+      before do
+        allow(Postal::Config.dns).to receive(:dkim_key_size).and_return(1024)
+      end
+
+      it "generates a key of that size" do
+        domain.generate_dkim_key
+        expect(OpenSSL::PKey::RSA.new(domain.dkim_private_key).n.num_bits).to eq 1024
+      end
+    end
  end

  describe "#dkim_key" do
@@ -183,6 +201,138 @@ describe Domain do
    end
  end

+  describe "#pending_dkim_key" do
+    context "when the domain has a pending DKIM key" do
+      let(:domain) { create(:domain, dkim_status: "OK") }
+
+      before do
+        domain.regenerate_dkim_key!
+      end
+
+      it "returns the pending dkim key as a OpenSSL::PKey::RSA" do
+        expect(domain.pending_dkim_key).to be_a OpenSSL::PKey::RSA
+        expect(domain.pending_dkim_key.to_s).to eq domain.pending_dkim_private_key
+      end
+    end
+
+    context "when the domain has no pending DKIM key" do
+      let(:domain) { create(:domain) }
+
+      it "returns nil" do
+        expect(domain.pending_dkim_key).to be_nil
+      end
+    end
+  end
+
+  describe "#regenerate_dkim_key!" do
+    context "when the current DKIM record is verified" do
+      let(:domain) { create(:domain, dkim_status: "OK") }
+
+      it "stores the new key as a pending key with a new identifier" do
+        domain.regenerate_dkim_key!
+        expect(domain.pending_dkim_private_key).to match(/\A-+BEGIN RSA PRIVATE KEY-+/)
+        expect(domain.pending_dkim_identifier_string).to be_present
+        expect(domain.pending_dkim_identifier_string).to_not eq domain.dkim_identifier_string
+      end
+
+      it "does not change the active key or status" do
+        expect { domain.regenerate_dkim_key! }.to_not(change { domain.reload.dkim_private_key })
+        expect(domain.dkim_status).to eq "OK"
+      end
+    end
+
+    context "when the current DKIM record is not verified" do
+      let(:domain) { create(:domain, dkim_status: "Missing", dkim_error: "No TXT records") }
+
+      it "replaces the active key immediately without creating a pending key" do
+        original_key = domain.dkim_key.to_s
+        domain.regenerate_dkim_key!
+        expect(domain.reload.dkim_private_key).to_not eq original_key
+        expect(domain.pending_dkim_private_key).to be_nil
+        expect(domain.dkim_key.to_s).to eq domain.dkim_private_key
+      end
+
+      it "resets the DKIM status" do
+        domain.regenerate_dkim_key!
+        expect(domain.dkim_status).to be_nil
+        expect(domain.dkim_error).to be_nil
+      end
+
+      context "when a key change was already in progress" do
+        # This happens when the active record breaks (so the status is no longer
+        # "OK") while a pending key is waiting to be activated. The immediate
+        # replacement supersedes the in-flight change, so the stale pending key
+        # must not be left behind to be activated later.
+        let(:domain) { create(:domain, dkim_status: "OK") }
+
+        before do
+          domain.regenerate_dkim_key!
+          domain.update!(dkim_status: "Missing", dkim_error: "No TXT records")
+        end
+
+        it "abandons the pending key" do
+          expect(domain.pending_dkim_private_key).to_not be_nil
+          domain.regenerate_dkim_key!
+          expect(domain.reload.pending_dkim_private_key).to be_nil
+          expect(domain.pending_dkim_identifier_string).to be_nil
+          expect(domain.pending_dkim_key).to be_nil
+        end
+
+        it "replaces the active key rather than promoting the pending one" do
+          stale_pending_key = domain.pending_dkim_private_key
+          original_key = domain.dkim_private_key
+          domain.regenerate_dkim_key!
+          expect(domain.reload.dkim_private_key).to_not eq original_key
+          expect(domain.dkim_private_key).to_not eq stale_pending_key
+        end
+      end
+    end
+  end
+
+  describe "#activate_pending_dkim_key" do
+    context "when there is no pending key" do
+      let(:domain) { create(:domain) }
+
+      it "does nothing" do
+        expect { domain.activate_pending_dkim_key }.to_not(change { domain.dkim_private_key })
+      end
+    end
+
+    context "when there is a pending key" do
+      let(:domain) { create(:domain, dkim_status: "OK") }
+
+      before do
+        domain.regenerate_dkim_key!
+      end
+
+      it "promotes the pending key and identifier and clears the pending values" do
+        pending_key = domain.pending_dkim_private_key
+        pending_identifier = domain.pending_dkim_identifier_string
+        domain.activate_pending_dkim_key
+        expect(domain.dkim_private_key).to eq pending_key
+        expect(domain.dkim_identifier_string).to eq pending_identifier
+        expect(domain.pending_dkim_private_key).to be_nil
+        expect(domain.pending_dkim_identifier_string).to be_nil
+        expect(domain.dkim_key.to_s).to eq pending_key
+        expect(domain.pending_dkim_key).to be_nil
+      end
+    end
+  end
+
+  describe "#cancel_pending_dkim_key!" do
+    let(:domain) { create(:domain, dkim_status: "OK") }
+
+    before do
+      domain.regenerate_dkim_key!
+    end
+
+    it "discards the pending key without changing the active key" do
+      expect { domain.cancel_pending_dkim_key! }.to_not(change { domain.reload.dkim_private_key })
+      expect(domain.pending_dkim_private_key).to be_nil
+      expect(domain.pending_dkim_identifier_string).to be_nil
+    end
+  end
+
  describe "#to_param" do
    context "when the domain has not been saved" do
      it "returns nil" do
@@ -274,6 +424,131 @@ describe Domain do
    end
  end

+  describe "#pending_dkim_record" do
+    context "when the domain has no pending DKIM key" do
+      it "returns nil" do
+        expect(domain.pending_dkim_record).to be_nil
+      end
+    end
+
+    context "when the domain has a pending DKIM key" do
+      let(:domain) { create(:domain, dkim_status: "OK") }
+
+      before do
+        domain.regenerate_dkim_key!
+      end
+
+      it "returns the DKIM record for the pending key" do
+        expect(domain.pending_dkim_record).to match(/\Av=DKIM1; t=s; h=sha256; p=.*;\z/)
+        expect(domain.pending_dkim_record).to_not eq domain.dkim_record
+      end
+
+      it "returns a record name using the pending identifier" do
+        expect(domain.pending_dkim_record_name).to eq "#{Postal::Config.dns.dkim_identifier}-#{domain.pending_dkim_identifier_string}._domainkey"
+      end
+    end
+  end
+
+  describe "#check_dkim_record" do
+    let(:domain) { create(:domain, dkim_status: "OK") }
+    let(:resolver) { instance_double(DNSResolver) }
+
+    before do
+      allow(domain).to receive(:resolver).and_return(resolver)
+    end
+
+    context "when there is a pending DKIM key" do
+      before do
+        domain.regenerate_dkim_key!
+      end
+
+      context "when the pending record has been published" do
+        it "activates and verifies the pending key from a single DNS response" do
+          responses = [[domain.pending_dkim_record], []]
+          allow(resolver).to receive(:txt).with("#{domain.pending_dkim_record_name}.#{domain.name}") { responses.shift }
+
+          pending_key = domain.pending_dkim_private_key
+          domain.check_dkim_record
+          expect(domain.dkim_private_key).to eq pending_key
+          expect(domain.pending_dkim_private_key).to be_nil
+          expect(domain.dkim_status).to eq "OK"
+          expect(domain.dkim_error).to be_nil
+          expect(responses).to eq([[]])
+        end
+      end
+
+      context "when multiple pending records have been published" do
+        before do
+          allow(resolver).to receive(:txt).with("#{domain.pending_dkim_record_name}.#{domain.name}").and_return([domain.pending_dkim_record, domain.pending_dkim_record])
+          allow(resolver).to receive(:txt).with("#{domain.dkim_record_name}.#{domain.name}").and_return([domain.dkim_record])
+        end
+
+        it "keeps the current key active and retains the pending key" do
+          original_key = domain.dkim_private_key
+          domain.check_dkim_record
+          expect(domain.dkim_private_key).to eq original_key
+          expect(domain.pending_dkim_private_key).to_not be_nil
+          expect(domain.dkim_status).to eq "OK"
+        end
+      end
+
+      context "when the pending record has not been published" do
+        before do
+          allow(resolver).to receive(:txt).with("#{domain.pending_dkim_record_name}.#{domain.name}").and_return([])
+          allow(resolver).to receive(:txt).with("#{domain.dkim_record_name}.#{domain.name}").and_return([domain.dkim_record])
+        end
+
+        it "keeps the current key active and retains the pending key" do
+          original_key = domain.dkim_private_key
+          domain.check_dkim_record
+          expect(domain.dkim_private_key).to eq original_key
+          expect(domain.pending_dkim_private_key).to_not be_nil
+          expect(domain.dkim_status).to eq "OK"
+        end
+      end
+
+      context "when the pending record does not match" do
+        before do
+          allow(resolver).to receive(:txt).with("#{domain.pending_dkim_record_name}.#{domain.name}").and_return(["v=DKIM1; t=s; h=sha256; p=something;"])
+          allow(resolver).to receive(:txt).with("#{domain.dkim_record_name}.#{domain.name}").and_return([domain.dkim_record])
+        end
+
+        it "keeps the current key active and retains the pending key" do
+          original_key = domain.dkim_private_key
+          domain.check_dkim_record
+          expect(domain.dkim_private_key).to eq original_key
+          expect(domain.pending_dkim_private_key).to_not be_nil
+          expect(domain.dkim_status).to eq "OK"
+        end
+      end
+    end
+
+    context "when there is no pending DKIM key" do
+      context "when the record is published" do
+        before do
+          allow(resolver).to receive(:txt).with("#{domain.dkim_record_name}.#{domain.name}").and_return([domain.dkim_record])
+        end
+
+        it "marks the record as OK" do
+          domain.check_dkim_record
+          expect(domain.dkim_status).to eq "OK"
+          expect(domain.dkim_error).to be_nil
+        end
+      end
+
+      context "when the record is missing" do
+        before do
+          allow(resolver).to receive(:txt).with("#{domain.dkim_record_name}.#{domain.name}").and_return([])
+        end
+
+        it "marks the record as missing" do
+          domain.check_dkim_record
+          expect(domain.dkim_status).to eq "Missing"
+        end
+      end
+    end
+  end
+
  describe "#return_path_domain" do
    it "returns the return path domain" do
      expect(domain.return_path_domain).to eq "#{Postal::Config.dns.custom_return_path_prefix}.#{domain.name}"
@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe HTTPEndpoint do
+  describe "validations" do
+    subject(:endpoint) { build(:http_endpoint, url: url) }
+
+    [
+      "https://example.com/messages/~user;v=1?token=a+b#section",
+      "http://example.com:8080/path?x=1&y=2",
+      "https://[2606:2800:220:1:248:1893:25c8:1946]/hook",
+    ].each do |valid_url|
+      context "with #{valid_url}" do
+        let(:url) { valid_url }
+
+        it "is valid" do
+          expect(endpoint).to be_valid
+        end
+      end
+    end
+
+    [
+      "ftp://example.com/hook",
+      "https:///missing-host",
+      "not a url",
+    ].each do |invalid_url|
+      context "with #{invalid_url}" do
+        let(:url) { invalid_url }
+
+        it "is invalid" do
+          expect(endpoint).not_to be_valid
+          expect(endpoint.errors[:url]).to be_present
+        end
+      end
+    end
+  end
+end
@@ -120,6 +120,8 @@ describe Server do
  end

  describe "deletion" do
+    let(:server) { create(:server) }
+
    it "removes the database" do
      expect(server.message_db.provisioner).to receive(:drop).once
      server.provision_database = true
@@ -10,15 +10,13 @@ require "rspec/rails"
 require "spec_helper"
 require "factory_bot"
 require "timecop"
-require "database_cleaner"
 require "webmock/rspec"
 require "shoulda-matchers"

 DatabaseCleaner.allow_remote_database_url = true
 ActiveRecord::Base.logger = Logger.new("/dev/null")

-Dir[File.expand_path("factories/*.rb", __dir__)].each { |f| require f }
-Dir[File.expand_path("helpers/**/*.rb", __dir__)].each { |f| require f }
+Dir[File.expand_path("helpers/**/*.rb", __dir__)].reject { |f| f.end_with?("_spec.rb") }.each { |f| require f }

 ActionMailer::Base.delivery_method = :test

@@ -0,0 +1,144 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe "DomainsController", type: :request do
+  let(:user) { create(:user, admin: true) }
+  let(:organization) { create(:organization, owner: user) }
+  let(:server) { create(:server, organization: organization) }
+
+  before do
+    post "/login", params: { email_address: user.email_address, password: "passw0rd" }
+  end
+
+  describe "POST /org/:org/servers/:server/domains/:domain/regenerate_dkim" do
+    context "when the domain's DKIM record is verified" do
+      let(:domain) { create(:domain, owner: server, dkim_status: "OK") }
+
+      it "generates a pending DKIM key without changing the active key" do
+        original_key = domain.dkim_private_key
+        post "/org/#{organization.permalink}/servers/#{server.permalink}/domains/#{domain.uuid}/regenerate_dkim"
+        expect(response).to redirect_to(setup_organization_server_domain_path(organization, server, domain))
+        expect(flash[:notice]).to include("Keep the old DNS record published afterward")
+        expect(flash[:notice]).to include("queued, held, or available for redelivery")
+        expect(flash[:notice]).to_not include("you can remove the old record")
+        domain.reload
+        expect(domain.dkim_private_key).to eq original_key
+        expect(domain.pending_dkim_private_key).to_not be_nil
+      end
+    end
+
+    context "when the domain's DKIM record is not verified" do
+      let(:domain) { create(:domain, owner: server, dkim_status: "Missing") }
+
+      it "replaces the active key immediately" do
+        original_key = domain.dkim_private_key
+        post "/org/#{organization.permalink}/servers/#{server.permalink}/domains/#{domain.uuid}/regenerate_dkim"
+        expect(response).to redirect_to(setup_organization_server_domain_path(organization, server, domain))
+        domain.reload
+        expect(domain.dkim_private_key).to_not eq original_key
+        expect(domain.pending_dkim_private_key).to be_nil
+        expect(domain.dkim_status).to be_nil
+      end
+    end
+
+    context "when a key change is already in progress" do
+      let(:domain) { create(:domain, owner: server, dkim_status: "OK") }
+
+      before do
+        domain.regenerate_dkim_key!
+      end
+
+      it "refuses and leaves the pending key untouched" do
+        existing_pending_key = domain.pending_dkim_private_key
+        existing_pending_identifier = domain.pending_dkim_identifier_string
+        post "/org/#{organization.permalink}/servers/#{server.permalink}/domains/#{domain.uuid}/regenerate_dkim"
+        expect(response).to redirect_to(setup_organization_server_domain_path(organization, server, domain))
+        expect(flash[:alert]).to include("already in progress")
+        domain.reload
+        expect(domain.pending_dkim_private_key).to eq existing_pending_key
+        expect(domain.pending_dkim_identifier_string).to eq existing_pending_identifier
+      end
+
+      it "does not change the active key" do
+        expect do
+          post "/org/#{organization.permalink}/servers/#{server.permalink}/domains/#{domain.uuid}/regenerate_dkim"
+        end.to_not(change { domain.reload.dkim_private_key })
+      end
+    end
+  end
+
+  describe "POST /org/:org/domains/:domain/regenerate_dkim" do
+    let(:domain) { create(:domain, owner: organization, dkim_status: "OK") }
+
+    it "generates a pending DKIM key for an organization-owned domain" do
+      post "/org/#{organization.permalink}/domains/#{domain.uuid}/regenerate_dkim"
+      expect(response).to redirect_to(setup_organization_domain_path(organization, domain))
+      expect(domain.reload.pending_dkim_private_key).to_not be_nil
+    end
+  end
+
+  describe "POST /org/:org/servers/:server/domains/:domain/check with a pending DKIM key" do
+    let(:domain) { create(:domain, owner: server, dkim_status: "OK") }
+    let(:resolver) { instance_double(DNSResolver) }
+
+    before do
+      domain.regenerate_dkim_key!
+      allow(DNSResolver).to receive(:for_domain).and_return(resolver)
+      allow(resolver).to receive(:txt).with(domain.name).and_return([domain.spf_record])
+      allow(resolver).to receive(:mx).with(domain.name).and_return([])
+      allow(resolver).to receive(:cname).and_return([])
+    end
+
+    context "when the pending DKIM record has been published" do
+      before do
+        allow(resolver).to receive(:txt).with("#{domain.pending_dkim_record_name}.#{domain.name}").and_return([domain.pending_dkim_record])
+      end
+
+      it "activates the pending key and tells the user to retain the old record" do
+        old_record_name = domain.dkim_record_name
+        new_key = domain.pending_dkim_private_key
+        post "/org/#{organization.permalink}/servers/#{server.permalink}/domains/#{domain.uuid}/check"
+        expect(response).to redirect_to(setup_organization_server_domain_path(organization, server, domain))
+        expect(flash[:notice]).to include("new DKIM key is now active")
+        expect(flash[:notice]).to include(old_record_name)
+        expect(flash[:notice]).to include("queued, held, or available for redelivery")
+        expect(flash[:notice]).to_not include("can remove")
+        domain.reload
+        expect(domain.dkim_private_key).to eq new_key
+        expect(domain.pending_dkim_private_key).to be_nil
+        expect(domain.dkim_status).to eq "OK"
+      end
+    end
+
+    context "when the pending DKIM record has not been published" do
+      before do
+        allow(resolver).to receive(:txt).with("#{domain.pending_dkim_record_name}.#{domain.name}").and_return([])
+        allow(resolver).to receive(:txt).with("#{domain.dkim_record_name}.#{domain.name}").and_return([domain.dkim_record])
+      end
+
+      it "keeps the current key active and tells the user the new record wasn't verified" do
+        post "/org/#{organization.permalink}/servers/#{server.permalink}/domains/#{domain.uuid}/check"
+        expect(response).to redirect_to(setup_organization_server_domain_path(organization, server, domain))
+        expect(flash[:alert]).to include("couldn't verify the record for your new DKIM key")
+        domain.reload
+        expect(domain.pending_dkim_private_key).to_not be_nil
+        expect(domain.dkim_status).to eq "OK"
+      end
+    end
+  end
+
+  describe "POST /org/:org/servers/:server/domains/:domain/cancel_dkim_regeneration" do
+    let(:domain) { create(:domain, owner: server, dkim_status: "OK") }
+
+    before do
+      domain.regenerate_dkim_key!
+    end
+
+    it "discards the pending DKIM key" do
+      post "/org/#{organization.permalink}/servers/#{server.permalink}/domains/#{domain.uuid}/cancel_dkim_regeneration"
+      expect(response).to redirect_to(setup_organization_server_domain_path(organization, server, domain))
+      expect(domain.reload.pending_dkim_private_key).to be_nil
+    end
+  end
+end
@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe "MessagesController", type: :request do
+  let(:user) { create(:user, admin: true) }
+  let(:organization) { create(:organization, owner: user) }
+  let(:server) { create(:server, organization: organization) }
+
+  before do
+    post "/login", params: { email_address: user.email_address, password: "passw0rd" }
+  end
+
+  describe "GET /org/:org/servers/:server/messages/:id/html_raw" do
+    let(:xss_payload) { %(<script>alert("XSS")</script>) }
+    let(:message) do
+      payload = xss_payload
+      MessageFactory.incoming(server) do |_msg, mail|
+        mail.html_part = Mail::Part.new do
+          content_type "text/html; charset=UTF-8"
+          body %(<html><body><p>hello</p>#{payload}</body></html>)
+        end
+      end
+    end
+
+    before do
+      get "/org/#{organization.permalink}/servers/#{server.permalink}/messages/#{message.id}/html_raw"
+    end
+
+    it "returns the stored email HTML" do
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include("hello")
+    end
+
+    it "serves a restrictive Content-Security-Policy that blocks scripts" do
+      csp = response.headers["Content-Security-Policy"]
+      expect(csp).to include("script-src 'none'")
+      expect(csp).to include("default-src 'none'")
+      expect(csp).to include("form-action 'none'")
+      expect(csp).to include("base-uri 'none'")
+    end
+
+    it "sets X-Content-Type-Options and Referrer-Policy on the response" do
+      expect(response.headers["X-Content-Type-Options"]).to eq "nosniff"
+      expect(response.headers["Referrer-Policy"]).to eq "no-referrer"
+    end
+  end
+
+  describe "messages/html view template" do
+    # We assert against the template source rather than rendering it in a
+    # request spec because the full application layout depends on the asset
+    # pipeline which is not configured in this test environment.
+    it "embeds the html_raw view inside a sandboxed iframe" do
+      template = Rails.root.join("app/views/messages/html.html.haml").read
+      expect(template).to match(/%iframe\{[^}]*:sandbox\s*=>/)
+    end
+  end
+end
@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe "SessionsController", type: :request do
+  let(:user) { create(:user) }
+
+  describe "POST /login with return_to" do
+    def login_with(return_to:)
+      post "/login", params: {
+        email_address: user.email_address,
+        password: "passw0rd",
+        return_to: return_to
+      }
+    end
+
+    shared_examples "rejects unsafe return_to" do
+      it "does not redirect to the attacker-controlled location" do
+        login_with(return_to: unsafe_path)
+
+        expect(response).to have_http_status(:found)
+        # Whatever the fallback is, it must be same-origin: a Location that
+        # either omits a host or points at our own host. A browser must not
+        # end up at attacker.example.
+        location = response.location
+        expect(location).not_to include("attacker.example")
+        # Reject protocol-relative and absolute redirects entirely.
+        expect(location).not_to match(%r{\A//})
+        expect(location).not_to match(%r{\Ahttps?://attacker})
+      end
+    end
+
+    context "with a protocol-relative URL (//host)" do
+      let(:unsafe_path) { "//attacker.example/phish" }
+      include_examples "rejects unsafe return_to"
+    end
+
+    context "with a backslash-prefixed URL (/\\host)" do
+      let(:unsafe_path) { "/\\attacker.example/phish" }
+      include_examples "rejects unsafe return_to"
+    end
+
+    context "with an absolute http(s) URL" do
+      let(:unsafe_path) { "https://attacker.example/phish" }
+      include_examples "rejects unsafe return_to"
+    end
+
+    context "with a javascript: URL" do
+      let(:unsafe_path) { "javascript:alert(1)" }
+      include_examples "rejects unsafe return_to"
+    end
+
+    context "with a safe relative path" do
+      it "honours the return_to" do
+        login_with(return_to: "/org/acme/settings")
+        expect(response).to redirect_to("/org/acme/settings")
+      end
+    end
+
+    context "with no return_to" do
+      it "redirects to the default root" do
+        post "/login", params: {
+          email_address: user.email_address,
+          password: "passw0rd"
+        }
+        expect(response).to have_http_status(:found)
+        expect(response.location).not_to match(%r{\A//})
+      end
+    end
+  end
+end
@@ -524,4 +524,41 @@ RSpec.describe SMTPSender do
      expect(sender.endpoints).to all have_received(:finish_smtp_session).at_least(:once)
    end
  end
+
+  describe ".smtp_relays" do
+    before do
+      if described_class.instance_variable_defined?("@smtp_relays")
+        described_class.remove_instance_variable("@smtp_relays")
+      end
+    end
+
+    it "returns nil if smtp relays is nil" do
+      allow(Postal::Config.postal).to receive(:smtp_relays).and_return(nil)
+      expect(described_class.smtp_relays).to be nil
+    end
+
+    it "returns nil if there are no smtp relays" do
+      allow(Postal::Config.postal).to receive(:smtp_relays).and_return([])
+      expect(described_class.smtp_relays).to be nil
+    end
+
+    it "does not return relays where the host is nil" do
+      allow(Postal::Config.postal).to receive(:smtp_relays).and_return([
+                                                                         Hashie::Mash.new(host: nil, port: 25, ssl_mode: "Auto"),
+                                                                         Hashie::Mash.new(host: "test.example.com", port: 25, ssl_mode: "Auto"),
+                                                                       ])
+      expect(described_class.smtp_relays).to match [kind_of(SMTPClient::Server)]
+    end
+
+    it "returns relays with options" do
+      allow(Postal::Config.postal).to receive(:smtp_relays).and_return([
+                                                                         Hashie::Mash.new(host: "test.example.com", port: 25, ssl_mode: "Auto"),
+                                                                         Hashie::Mash.new(host: "test2.example.com", port: 2525, ssl_mode: "TLS"),
+                                                                       ])
+      expect(described_class.smtp_relays).to match [
+        have_attributes(hostname: "test.example.com", port: 25, ssl_mode: "Auto"),
+        have_attributes(hostname: "test2.example.com", port: 2525, ssl_mode: "TLS"),
+      ]
+    end
+  end
 end
@@ -13,6 +13,7 @@ RSpec.describe WebhookDeliveryService do
  let(:response_body) { "OK" }

  before do
+    allow(Resolv).to receive(:getaddresses).with("example.com").and_return(["93.184.216.34"])
    stub_request(:post, webhook.url).to_return(status: response_status, body: response_body)
  end

@@ -59,8 +60,11 @@ RSpec.describe WebhookDeliveryService do
      end

      it "updates the last used at time on the webhook" do
+        frozen_time = Time.current.change(usec: 0)
+        Timecop.freeze(frozen_time) do
          service.call
-        expect(webhook.reload.last_used_at).to be_within(1.second).of(Time.current)
+          expect(webhook.reload.last_used_at).to eq(frozen_time)
+        end
      end
    end

@@ -113,5 +117,26 @@ RSpec.describe WebhookDeliveryService do
        expect { webhook_request.reload }.to raise_error(ActiveRecord::RecordNotFound)
      end
    end
+
+    context "when the webhook URL resolves to a blocked (private) address" do
+      let(:webhook_request) do
+        create(:webhook_request, :locked, webhook: webhook, url: "http://internal.example.com/hook")
+      end
+
+      before do
+        allow(Resolv).to receive(:getaddresses).with("internal.example.com").and_return(["127.0.0.1"])
+      end
+
+      it "does not make a request to the destination" do
+        service.call
+        expect(WebMock).not_to have_requested(:post, "http://internal.example.com/hook")
+      end
+
+      it "records the failure and schedules a retry" do
+        service.call
+        expect(webhook_request.reload.attempts).to eq(1)
+        expect(webhook_request.retry_after).to be_present
+      end
+    end
  end
 end
@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe "domains/index", type: :view do
+  let(:user) { create(:user, admin: true) }
+  let(:organization) { create(:organization, owner: user) }
+  let(:domain) { create(:domain, owner: organization, dkim_status: "OK") }
+
+  before do
+    assign(:organization, organization)
+    assign(:domains, [domain])
+    assign(:server, nil)
+    without_partial_double_verification do
+      allow(view).to receive(:organization).and_return(organization)
+      allow(view).to receive(:current_user).and_return(user)
+      allow(view).to receive(:page_title).and_return(["Postal"])
+    end
+  end
+
+  context "when no key change is in progress" do
+    it "does not flag a pending DKIM key" do
+      render
+      expect(rendered).to_not include("New DKIM key pending")
+    end
+  end
+
+  context "when a key change is in progress" do
+    before do
+      domain.regenerate_dkim_key!
+    end
+
+    it "flags the domain as having a pending DKIM key" do
+      render
+      expect(rendered).to include("New DKIM key pending")
+    end
+
+    it "links the flag to the DNS setup page" do
+      render
+      expect(rendered).to include(setup_organization_domain_path(organization, domain))
+    end
+
+    it "still shows DKIM as OK because the active key is unaffected" do
+      render
+      expect(rendered).to include("domainList__check--ok")
+    end
+  end
+end
@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe "domains/setup", type: :view do
+  let(:user) { create(:user, admin: true) }
+  let(:organization) { create(:organization, owner: user) }
+  let(:domain) { create(:domain, owner: organization, dkim_status: "OK") }
+
+  before do
+    assign(:organization, organization)
+    assign(:domain, domain)
+    assign(:server, nil)
+    without_partial_double_verification do
+      allow(view).to receive(:organization).and_return(organization)
+      allow(view).to receive(:current_user).and_return(user)
+      allow(view).to receive(:page_title).and_return(["Postal"])
+    end
+  end
+
+  context "when no key change is in progress" do
+    it "shows the active record and offers regeneration" do
+      render
+      expect(rendered).to include(domain.dkim_record_name)
+      expect(rendered).to include(domain.dkim_record)
+      expect(rendered).to include("Regenerate DKIM key")
+      expect(rendered).to_not include("Key change in progress")
+      expect(rendered).to_not include("Cancel new DKIM key")
+    end
+  end
+
+  context "when a key change is in progress" do
+    before do
+      domain.regenerate_dkim_key!
+    end
+
+    it "shows both the current and the new record" do
+      render
+      expect(rendered).to include(domain.dkim_record_name)
+      expect(rendered).to include(domain.dkim_record)
+      expect(rendered).to include(domain.pending_dkim_record_name)
+      expect(rendered).to include(domain.pending_dkim_record)
+    end
+
+    it "labels which record is active and which must be added" do
+      render
+      expect(rendered).to include("Key change in progress")
+      expect(rendered).to include("Keep this record exactly as it is")
+      expect(rendered).to include("Add this record as well")
+    end
+
+    it "tells the user to add the new record rather than replace the old one" do
+      render
+      expect(rendered).to include("alongside the record above rather than replacing it")
+    end
+
+    it "does not describe the active record as one which needs adding" do
+      render
+      expect(rendered).to_not include("You need to add a new TXT record")
+    end
+
+    it "offers cancellation instead of another regeneration" do
+      render
+      expect(rendered).to include("Cancel new DKIM key")
+      expect(rendered).to_not include("Regenerate DKIM key")
+    end
+
+    it "does not claim the DKIM record is fully good" do
+      render
+      expect(rendered).to_not include("Your DKIM record looks good!")
+    end
+  end
+end
Author	SHA1	Message	Date
github-actions[bot]	030e450a30	chore(main): release 3.4.0	2026-10-01 11:33:18 +00:00
Adam Cooke	d96eddbade	feat(dkim): make key size configurable and allow keys to be rotated	2026-10-01 12:32:46 +01:00
pplulee	ced77a3860	feat: add configurable Postal logger level defaulting to INFO (#3626 )	2026-09-13 13:12:57 +01:00
pplulee	3be663dc89	fix: give each worker process a unique locker identity (#3628 )	2026-09-13 13:11:42 +01:00
github-actions[bot]	d038eaa8c7	chore(main): release 3.3.7 (#3577 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-06-03 16:24:45 +01:00
Adam Cooke	3b3defe271	doc: update config with new allowed request destinations option	2026-06-03 15:52:46 +01:00
Adam Cooke	029bfe098d	fix(specs): stub IPv6 support in address guard IPv6 literal spec The spec relied on the test machine having real IPv6 connectivity, which GitHub Actions runners do not have.	2026-06-03 15:43:02 +01:00
Adam Cooke	0445e5c509	chore(deps): upgrade rack & rails	2026-06-03 15:40:29 +01:00
Adam Cooke	11c9814474	fix(http): prevent SSRF in outbound webhook and HTTP endpoint requests Webhook and HTTP message endpoint deliveries both flow through Postal::HTTP, which parsed the user-supplied URL and connected to its host with no address validation. An authenticated user could point a webhook or endpoint at a private, loopback or link-local address (e.g. 127.0.0.1, 169.254.169.254 cloud metadata, RFC1918 hosts) and make the server issue requests into its own internal network. Add Postal::HTTP::AddressGuard, which resolves the destination host and rejects private/loopback/link-local/reserved/multicast IPv4 and IPv6 addresses, then pins the connection to the validated address so it cannot be redirected via a DNS-rebinding race. Administrators can permit specific destinations via the new postal.allowed_request_destinations config option (hostnames or IP/CIDR ranges). Address selection only uses families this server can actually reach so we do not pin to an IPv6 address on a host without IPv6 connectivity; IPv4 is preferred for predictability. HTTPEndpoint now validates that its URL is a well-formed HTTP(S) URL with a host.	2026-06-03 15:09:18 +01:00
Adam Cooke	4314a6ec1e	fix(message-db): prevent SQL injection via condition keys (GHSA-x2hq-rfpg-3xr5) The Legacy API message lookup endpoints parsed the request body as JSON and passed the `id` parameter straight through to the message database. A JSON object supplied for `id` arrived as a Ruby Hash and was used as a raw set of SQL `WHERE` conditions. `hash_to_sql` interpolated each Hash key directly inside backtick identifier quoting while escaping only the value, so a key containing a backtick could break out of the identifier and inject arbitrary SQL into the SELECT (blind, time-based) against the message database. Fixes: - Escape all identifiers (columns, tables, database names) through a new `escape_identifier` helper that wraps in backticks and doubles embedded backticks. Applied across hash_to_sql, select, insert, insert_multi, update and delete so no caller can inject via an identifier. - Validate the Legacy API `id` parameter at the controller boundary: reject any non-scalar value before it reaches the database and coerce it to an integer. Internal Hash-based lookups (e.g. tracking middleware) are unaffected. Adds regression tests at the unit (hash_to_sql / escape_identifier) and request (legacy messages/deliveries) levels.	2026-06-03 15:06:35 +01:00
Adam Cooke	8be1e27fec	chore: update security vulnerability reporting instructions	2026-06-03 15:03:51 +01:00
github-actions[bot]	8ef89606bc	chore(main): release 3.3.6 (#3558 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-04-28 17:19:33 +01:00
Adam Cooke	84f4e20f05	refactor(auth): tighten return_to validation url_with_return_to only checked that return_to started with a forward slash, which also allowed protocol-relative values like //host and /\host. Rails 7.1 already refuses to follow those via redirect_to, so the user just saw a 500. Reject the same shapes in the helper instead so we fall back to the default URL cleanly. Adds a sessions request spec covering the rejected shapes plus the happy-path relative redirect.	2026-04-24 23:03:50 +01:00
Adam Cooke	9243524035	refactor(helpers): escape interpolated values in select options The endpoint and domain option helpers interpolated model attributes straight into an HTML string before marking the whole buffer html_safe. Wrap the interpolations in h() so untrusted attributes can't break out of the surrounding tag. Also stop the helpers glob in rails_helper from eagerly requiring _spec.rb files so helper specs can live under spec/helpers/, and add a small application helper spec covering the escape behaviour.	2026-04-24 22:55:46 +01:00
Adam Cooke	dca7f90b90	refactor(tracking): remove unused src image proxy The /img/<server>/<message> endpoint accepted a src=<url> query parameter and proxied the body of that URL back to the caller. Nothing in the codebase ever produces a src= parameter — the parser only inserts a plain tracking pixel and rewrites href links — so this branch is dead code inherited from the original AppMail import. Drop the src branch: requests with src now return 400. The no-src path that serves the tracking pixel and records loads is unchanged, and a spec covers both the pixel-serving path and the removed branch.	2026-04-24 22:24:18 +01:00
Adam Cooke	cad2aa6808	fix(messages): sandbox rendered email HTML as extra XSS defence The app-wide CSP already blocks inline script execution, but the HTML preview iframe for a stored email was same-origin and un-sandboxed, and the html_raw response had no per-action hardening. Add a sandbox on the iframe and tighten the CSP on html_raw to script-src 'none' with nosniff and no-referrer so the preview has defence in depth against a future CSP bypass or regression. Relates to GHSA-f6g9-8555-cw28.	2026-04-24 22:12:27 +01:00
Adam Cooke	b611d577af	chore: ignore node modules and yarn.lock	2026-04-24 21:34:57 +01:00
github-actions[bot]	d532922ff7	chore(main): release 3.3.5 (#3208 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-02-01 14:55:42 +00:00
Adam Cooke	11419f9914	fix(deliveries): escape delivery details to prevent HTML injection	2026-02-01 14:48:54 +00:00
Melle Douwsma	b7e5232e07	fix: typo in process logging (#3212 ) Signed-off-by: Melle Douwsma <melledouwsma@users.noreply.github.com>	2025-10-03 09:41:20 +01:00
Johan Kok	e00098b800	fix: update url for v2 config (#3225 ) This minor update resolves #3048 Signed-off-by: Johan Kok <johankok@users.noreply.github.com>	2025-10-03 09:40:22 +01:00
Adam Cooke	d00d978872	chore: upgrade resolv to 0.6.2	2025-10-02 14:39:27 +01:00
Adam Cooke	c78000ca8f	chore: remove version from docker-compose.yml	2025-10-02 14:38:42 +01:00
Adam Cooke	c03c44b442	chore(deps): upgrade puma, net-imap and other deps	2025-10-01 18:13:36 +01:00
Adam Cooke	86de372382	chore(dockerfile): reduce container size	2025-10-01 18:12:26 +01:00
Adam Cooke	7c47422c86	fix(health_server): use rackup handler instead of rack handler	2025-10-01 18:12:26 +01:00
Arthur Lutz	f5325c49ff	docs(process.rb): add help about time unit used by metric (#3339 ) Signed-off-by: Arthur Lutz <arthur.lutz@zenika.com>	2025-10-01 17:31:13 +01:00
Adam Cooke	f193b8e77f	chore: upgrade uri gem to 1.0.3	2025-10-01 16:47:59 +01:00
Adam Cooke	ab6d4430ba	chore: upgrade to rails 7.1 and ruby 3.4 (#3457 )	2025-10-01 16:42:39 +01:00
Matthieu Barthel	9c5f96ae90	fix: oidc scopes are invalid when concatenated (#3332 )	2025-05-08 07:51:46 +01:00
Som23Git	fd3c7ccdf6	fix: typo in the credentials page	2024-10-31 17:53:20 +00:00
github-actions[bot]	da90e75036	chore(main): release 3.3.4 (#3014 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-06-20 14:39:58 +01:00
Adam Cooke	2b0919c145	fix: raise NotImplementedError when no call method on a scheduled task	2024-06-20 14:27:20 +01:00
Adam Cooke	3a33e53d84	fix: fix issue running message pruning task	2024-06-20 14:27:20 +01:00
Adam Cooke	4fa88acea0	fix: fix `postal version` command	2024-06-20 14:27:18 +01:00
github-actions[bot]	d510499190	chore(main): release 3.3.3 (#2933 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-04-18 14:42:30 +01:00
Adam Cooke	39f704c256	fix(legacy-api): allow _expansions to be provided as true to return all expansions closes #2932	2024-04-18 14:38:44 +01:00
github-actions[bot]	c12f30e300	chore(main): release 3.3.2 (#2892 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-03-22 10:40:20 +00:00
Adam Cooke	5a2f31ed77	doc: fix doc for `Postal.version`	2024-03-21 14:58:11 +00:00
Adam Cooke	07c6b317f2	refactor(versioning): improve how current version and branch is determined and set Refactor `Postal.version`` and `Postal.branch` and remove `Postal::VERSION`.	2024-03-21 14:55:14 +00:00
github-actions[bot]	a3fab36da2	chore(main): release 3.3.1 (#2890 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-03-21 12:54:43 +00:00
Adam Cooke	3a56ec8a74	fix(smtp-sender): ensure relays without a host are excluded	2024-03-21 12:33:34 +00:00
Adam Cooke	b3264b9427	fix(smtp-sender): fixes `SMTPSender.smtp_relays`	2024-03-21 12:27:54 +00:00
Adam Cooke	6ef388577e	Merge pull request #2891 from postalserver/export-branch-to-image	2024-03-20 14:34:28 +00:00
Adam Cooke	18236171eb	chore(ui): display branch in footer if present	2024-03-20 14:30:32 +00:00
Adam Cooke	bee509832e	chore(container): add the branch name to the container	2024-03-20 14:28:44 +00:00
Adam Cooke	4d9654dac4	refactor: remove moonrope but maintain legacy API actions (#2889 )	2024-03-19 20:21:04 +00:00
Adam Cooke	adaf2b0750	chore(github-actions): don't run for dependabot or release-please PRs and fetch whole repo	2024-03-19 16:54:18 +00:00
Adam Cooke	64bc7dcf7c	chore(github-actions): include a version string on branch-*/latest images	2024-03-19 16:42:21 +00:00
Adam Cooke	d65bbe0579	chore(github-actions): don't generate commit- tags	2024-03-19 10:27:15 +00:00
github-actions[bot]	eded789c37	chore(main): release 3.3.0 (#2887 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2024-03-18 17:59:05 +00:00
Adam Cooke	ea542a0694	feat(worker): scale connection pool with worker threads This will automatically increase the DB connection pool size if the number of threads needed in a worker is less than the maximum pool size configured.	2024-03-18 08:12:42 +00:00
Adam Cooke	7e2acccd1e	feat(worker): allow number of threads to be configured This allows for more threads to be run. Care needs to be taken to ensure that database connection pool size is appropriate for this.	2024-03-17 18:41:26 +00:00
Adam Cooke	ee8d829a85	feat(prometheus): add `postal_message_queue_latency` metric	2024-03-17 09:29:22 +00:00
Adam Cooke	4fcb9e9a2e	fix(message-dequeuer): ability to disable batching	2024-03-16 15:31:46 +00:00
Adam Cooke	45dd8aaac5	chore(config-docs): update proxy protocol to mention v1	2024-03-16 15:31:14 +00:00
Adam Cooke	364eba6c5f	chore(config-docs): update docs for latest oidc defaults	2024-03-16 15:30:50 +00:00
@@ -1 +1 @@
 .2.2
 .4.6