v6.29.9 — WebMail Withdrawal Correlation & Active-Evidence Reconciliation2026-08-22
current- Treats WebMail Not-junk/trust withdrawal events as historical reversal evidence rather than new active spam reports.
- Links a withdrawal to the nearest matching original spam report using the stable message reference, sending IP and reporter identity when available.
- A spam row marked withdrawn-by-user is treated as retracted even if the companion withdrawal event is delayed or cannot be linked.
- Active WebMail correlation now counts only unretracted spam evidence; withdrawal events and retracted spam rows contribute zero active reports, reporters and score.
- The one-minute WebMail auto-list run reconciles withdrawal links first, records the original spam report as false-positive/retracted, reassesses the sending IP and uses the existing evidence-aware canonical auto-delist path when clean.
- Operator WebMail Gate now distinguishes ACTIVE, RETRACTED and NOT JUNK historical evidence and removes listing controls from inactive evidence.
- Original spam and withdrawal events remain retained as historical evidence; no evidence row is deleted by reconciliation.
- Threat Prevention, SMTP, Mail Feed, Fail2ban and the v6.29.8-R3 zonectl policy-authority/JSON framing contracts are unchanged.
v6.29.8-R3 — Transactional Auto-List Quiescence & Already-Listed Compatibility2026-08-22
- Quiesces the WebMail auto-list timer before any v6.29.8-R3 payload promotion or live validation so the transaction cannot race a real automatic listing.
- Restores the timer to its prior enabled/active state on rollback and only resumes it after all read-only release gates pass.
- Treats an already-listed WebMail target as a valid read-only compatibility state instead of requiring add-path-only fields such as dry_run, confidence_score and webmail_policy_approved.
- Retains deterministic zonectl JSON framing with dry-run diagnostics on stderr and stdout as one JSON document.
- Retains the WebMail-only policy-authority contract, real WebMail evidence scoring, threshold-only authority, truthful auto-run errors, and zonectl-only BIND mutation boundary.
- Threat Prevention remains untouched and semantically separate.
v6.29.7 — WebMail Auto-Listing Runtime Reconciliation2026-08-22
- Adds a lightweight systemd timer that wakes a one-shot WebMail auto-list runner once per minute; no resident daemon or polling loop is introduced.
- The runner invokes the existing WebMail policy broker auto-run action so eligible reports are actually submitted through the canonical listing path.
- Retains the WebMail correlation gate, WebMail auto-list switch, global mail auto-list brake, configured thresholds and max automatic listings per run.
- Runs with bounded execution and low scheduling priority; between timer firings it consumes no persistent worker resources.
- No WebMail retraction, auto-delist, scoring, SMTP, Mail Feed, Fail2ban, DNSBL or direct BIND policy semantics are changed.
v6.29.6 — WebMail Retraction & Evidence-Aware Auto-Delist2026-08-22
- Adds a narrow WebMail Not-junk retraction ingress accepting the stable original report reference prepared by the Webmail backend.
- Retains the original report and records a retraction/false-positive lifecycle state rather than deleting historical evidence.
- Recalculates active WebMail evidence and assesses 30-day adverse history plus independent current listing-source metadata.
- Automatically delists only when no remaining WebMail policy authority, independent current source or adverse history remains.
- Retains the listing with an explicit assessment when independent evidence remains.
- All delisting stays behind the canonical scotnet-dnsbl-zonectl boundary; no direct BIND mutation is introduced.
v6.29.5 — Terminology & Source-Health Reconciliation2026-08-22
- Normalises live ThreatMail/Threatmail presentation to Threat Prevention while preserving legacy internal source identifiers and paths.
- Makes source health distinguish Healthy/Quiet from Stale, Fault and Not configured so a fresh feed with zero events is no longer presented as if it were broken.
- Adds the same quiet-versus-fault distinction to the Threat Prevention card and clarifies its processing/source terminology.
- Keeps raw legacy source IDs visible where they are diagnostic identifiers; only operator-facing descriptive labels are reclassified.
- No ingestion, scoring, WebMail, SMTP, Mail Feed, Fail2ban, DNSBL or BIND enforcement semantics change.
v6.29.4 — WebMail One-Report Policy Reconciliation2026-08-22
- Makes one WebMail user spam report the production default: one report, one distinct reporter, score floor 0.
- Adds higher-threshold presets and keeps Custom configurable from 1 upward.
- Removes the policy broker hard-coded two-reporter eligibility floor; automatic listing uses the configured WebMail policy while retaining the WebMail gate, WebMail auto-list switch and global mail auto-list brake.
- Adds an audited Delete report operator action that removes the selected WebMail report evidence and its review state.
- Deleting a report does not delist an IP and does not directly mutate BIND or DNSBL state.
- Legacy manual one-report broker actions remain for compatibility but are no longer required when policy is set to one report.
v6.29.3 — Threat Prevention Reclassification2026-08-22
- Reclassifies the operator-facing ThreatMail/Threatmail presentation as Threat Prevention.
- Preserves legacy internal threatmail source identifiers, feed keys, section IDs, variable names, paths and backend contracts for compatibility.
- Updates visible operator headings and prefix-policy labels only; ingestion, scoring, DNSBL, BIND, Fail2ban and enforcement semantics are unchanged.
v6.29.2 — Source-Level Mail Gate Separation2026-08-22
- Replaces the v6.29.1 heuristic HTML splitter with explicit source-level WebMail Gate, Mail Feed Gate and Spam Intelligence renderers in the established mail backend.
- Moves IMAP host/port 993, mailbox username/password, polling interval, folder, ingestion type, decision mode, mailbox thresholds and mailbox verification queue exclusively into Mail Feed Gate.
- Keeps Roundcube/Webmail correlation policy, reported-spam evidence and Webmail review/list actions exclusively in WebMail Gate.
- Keeps cross-source scoring, campaigns, source health and replay exclusively in Spam Intelligence.
- Retains scotnet_render_spam_gate as a compatibility wrapper while operator.php calls the three source-level renderers directly.
- Removes the v6.29.1 heuristic adapter from the live surface.
- Does not change the current Webmail policy-broker two-reporter automatic/policy floor.
- SMTP Gate, SMTP Intelligence/Honeypots, DNSBL/BIND, Fail2ban and zonectl boundaries are unchanged.
v6.29.1 — Mail Gate Separation2026-08-22
- Separates the historical Spam Gate renderer into WebMail Gate, Mail Feed Gate and Spam Intelligence while retaining the established backend handlers, CSRF fields and action names.
- Keeps Roundcube/user-spam-report controls in WebMail Gate; moves IMAP/mailbox profile, polling and trusted-report/direct-spam feed controls to Mail Feed Gate; moves cross-source scoring/campaign/suppression/replay/source-health controls to Spam Intelligence.
- Routes successful legacy mail-gate actions back to the most relevant new section instead of always returning to WebMail Gate.
- Leaves SMTP Gate and v6.29 SMTP Intelligence & Passive Honeypots unchanged.
- This release is a presentation/ownership separation only and deliberately does not alter the established backend spam-report threshold semantics.
- No DNSBL, BIND, Fail2ban, crawler, scoring-engine or SMTP enforcement boundary is changed.
v6.29 R1 — HF1 Preimage Reconciliation2026-08-22
- Reissues v6.29 against the live v6.28 Revision 1 Hotfix 1 production lineage confirmed on Miko.
- Updates exact-preimage gates for Operator, workspace JavaScript, changelog, version include, integrity panel, component manifest, canonical integrity gate and integrity-status publisher.
- SMTP Intelligence & Passive Honeypots functionality is unchanged from the validated v6.29 payload.
- No DNSBL, BIND, Fail2ban, crawler, scoring, WebMail or SMTP enforcement semantics are changed by this reconciliation.
v6.29 — SMTP Intelligence & Passive Honeypots2026-08-22
- Adds SMTP attack classification for SASL failures, explicit unknown-user authentication, recipient probes, relay attempts, invalid senders, protocol abuse, postscreen/pregreet violations, TLS failures and DNS/reputation rejection.
- Adds passive honeypot usernames, recipients and senders. Honeypot hits are high-confidence evidence but never automatically ban, DNSBL-list or alter BIND.
- Adds top SMTP source scoring, distinct username counts, credential-spray/brute-force indicators and recent classified SMTP events in SMTP Gate.
- Adds a narrow audited root broker for honeypot configuration, root-only mode 0600 policy, one-minute collection and 30-day default retention.
- Does not retain passwords or AUTH payloads and does not create a listener or open relay.
- Rolls forward canonical integrity/recovery reconciliation and the separate SMTP Gate/WebMail Gate surfaces.
v6.28 R1 HF1 — Canonical Release Checker Correction2026-08-22
- Removes the stale v6.28 release-check assertion for the retired independent component-drift cache.
- Validates that Release confidence is wired to the canonical published component-integrity.json status instead.
- No production policy, SMTP/WebMail split, Fail2ban, crawler, scoring, DNSBL, zonectl or BIND behaviour is changed.
v6.28 R1 — Canonical Integrity & SMTP/WebMail Gate Reconciliation2026-08-22
- Splits the ambiguous Spam Gate workspace into separate SMTP Gate and WebMail Gate surfaces while preserving existing WebMail spam-report actions and SMTP telemetry.
- Makes the canonical integrity gate release-aware instead of hard-coding v6.26.3 Apache Feed wiring and version assertions.
- Treats dnsbl-access-policy.json as mutable policy: JSON validity, schema marker and restrictive permissions are checked without treating legitimate Operator edits as release drift.
- Publishes canonical integrity plus latest rollback and managed recovery-archive metadata through the root integrity-status publisher; the web user never gains directory access to /var/backups/scotnet-dnsbl.
- Makes Release confidence consume the canonical published integrity/recovery truth rather than independently hashing components or attempting to enumerate the root-only backup directory.
- Keeps the backup root at 0700 and preserves the zonectl-only DNSBL/BIND mutation boundary.
v6.28 — Operator Command Centre & Unified Intelligence2026-08-22
- Upgrades Operator Overview into a command centre with incidents, review load, feed attention, Fail2ban bans, blocked countries, verified crawlers, mapped DNSBL-listed IPs, release drift and latest rollback confidence.
- Adds Unified IP Intelligence: exact IP history, GeoLite2 country, DNSBL listed state, verified crawler identity, current Fail2ban bans, correlated Apache incident state and an effective website-access policy decision for a selected path.
- Adds a read-only policy-precedence simulator showing whether Fail2ban, verified crawler exception, country access policy or DNSBL-listed visitor routing wins for a specific IP/path.
- Adds country-policy overview, verified crawler identity table and Fail2ban operator audit history to Access Control.
- Adds release-confidence view with component-manifest drift checks, latest rollback/backup detection and recent operator changes.
- Adds Apache scoring threshold impact preview against current bounded exact-client evidence; preview does not list or block anything.
- Groups the long Operator workspace navigation into Command centre, Security, Policy, Operations & diagnostics, Configuration & data, and Other.
- Retains v6.27 R1 scoring, access-control, crawler FCrDNS, Fail2ban broker and zonectl-only DNSBL/BIND mutation boundaries.
v6.27 R1 UI1 — Scoring Threshold & Feed UI Reconciliation2026-08-22
- Adds directly editable exact-client and high-confidence enforcement thresholds to Apache Feed → Scoring, including the actual minimum score required before enforcement eligibility.
- Keeps advanced threshold controls available and switches to Custom policy only when the operator explicitly applies threshold changes.
- Fixes selected Apache Feed evidence/evaluation rows on desktop by rendering detail content inside a proper full-width table row and cell instead of inserting a DIV directly into TBODY.
- Replaces the obsolete lifecycle.json row in Feed health with the current retention-maintenance.json health source; the historical lifecycle.json file remains preserved but is no longer presented as a live feed.
- Retains v6.27 R1 Access Control, verified crawler exceptions, DNSBL-listed visitor policy, Fail2ban broker, scoring semantics and zonectl-only DNSBL/BIND mutation boundaries.
v6.27 R1 — Acceptance Gate Correction2026-08-22
- Removes the erroneous release requirement that a country must be actively blocked during installation.
- When no country is blocked, the live generated config correctly has no per-country forbidden rule; v6.27 now validates deterministic country denial through a read-only synthetic country preview instead.
- No access-control policy, crawler, listed-visitor, Fail2ban, DNSBL, zonectl or BIND behaviour is changed from v6.27.
v6.27 — Operator Access Policy & Fail2ban Controls2026-08-22
- Adds Operator Access Control for per-country allowed-page selections while retaining v6.26.3 HF7 deterministic country denial.
- Adds DNSBL-listed visitor policy with Normal, selected-page restriction, or redirect-to-delist modes; service API/integration routes remain independently exempt.
- Adds selected trusted crawler exceptions for Google and Bing using User-Agent discovery plus forward-confirmed reverse DNS before an IP receives a country-block bypass.
- Adds manual Fail2ban ban/unban controls through a narrow validated root broker; current operator and operator-allowlisted addresses are protected from manual bans.
- Adds read-only listed-IP and verified-crawler RewriteMaps refreshed by bounded systemd timers; these maps never mutate DNSBL/BIND state.
- Adds contextual Fail2ban actions to correlated security incidents and a central Access Control workspace in operator.php.
v6.26.3 HF7 — Deterministic Country Denial Enforcement2026-08-22
- Replaces Require-section country denial with deterministic Apache rewrite denial after live diagnostics proved country=US and blocked=1 while authorization merging still returned HTTP 200.
- The existing MaxMind/SetEnvIf classification path is retained; blocked countries are denied with RewriteRule [F,L] on protected paths.
- The explicit public DNSBL exemptions remain unchanged: root/index, Transparency, Integration, Policy, and public check/history API routes.
- Avoids Directory/Location authorization merging as an enforcement dependency while retaining transactional reconcile, configtest, reload and rollback.
- No DNSBL listing, zonectl or BIND mutation behaviour is changed.
v6.26.3 HF6 — Country Authorization Contract Correction2026-08-22
- Corrects country authorization after a GeoLite2-confirmed US source still received HTTP 200 on a protected path under HF5.
- Protected routes now require SCOTNET_COUNTRY_CODE to exist and require scotnet_country_blocked to be absent.
- Country evaluation therefore fails closed on protected routes if GeoIP attribution is unavailable, while public DNSBL route exemptions remain unchanged.
- Transactional reconcile, Apache configtest, reload and rollback behaviour are retained.
- No DNSBL listing, zonectl or BIND mutation behaviour is changed.
v6.26.3 HF5 — Country Enforcement Phase Correction2026-08-20
- Corrects country-block enforcement after a US-origin WebsitePulse request to /changelog.php returned HTTP 200 while GeoLite2 classified the source as US and the US block transaction was committed.
- Moves SetEnvIf evaluation for the MaxMind-exported country code inside the protected LocationMatch authorization container.
- Preserves existing public-route exemptions and transactional Apache configtest/reload/rollback behaviour.
- Makes no DNSBL listing, zonectl or BIND mutation change.
v6.26.3 HF4 — Retention Timer & Health Reconciliation2026-08-18
- Retires the obsolete hourly cron invocation that called the current lifecycle CLI with the removed --max-changes syntax.
- Preserves the old /var/lib/scotnet/dnsbl/lifecycle.json as historical evidence but removes it from required live feed-health and self-audit freshness checks.
- Adds a low-priority systemd oneshot retention-maintenance service and persistent daily timer; no resident daemon is introduced.
- Runs the current scotnet-dnsbl-lifecycle cleanup command and atomically records actual maintenance success/failure in /var/lib/scotnet/dnsbl/retention-maintenance.json.
- Feed health now monitors the real retention-maintenance status with a 36-hour freshness window.
- Keeps operator review JSON compatibility while sourcing its lifecycle field from the current retention-maintenance status.
- Makes no DNSBL listing, zonectl or BIND expiry-policy change.
v6.26.3 HF3 — Flag Proportions & Stable Live Operator UI2026-08-18
- Normalises the existing local 14x14 country-flag assets to a stable 3:2 display ratio on the podium and Transparency tables instead of enlarging them as square icons.
- Bumps the public stylesheet cache token so corrected flag dimensions are visible immediately on desktop and mobile.
- Stops background Operator polling from replacing generic active-panel innerHTML.
- Preserves open details, scoped-policy workflow controls, submenus, selections and scroll state while background live updates run.
- Keeps bounded live updates for Overview and Incident Centre while dedicated client-managed views continue to manage their own live state.
- Retains v6.26.3 HF2 public-card cleanup/PNG flag wiring and v6.26.3 HF1 operator-access/meta-zone fixes.
v6.26.3 HF2 — Public Flag Assets, Card Cleanup & Live Operator Workspace2026-08-18
- Removes the Lifetime service totals card from both the public index and Transparency page while retaining the underlying lifetime accounting data.
- Uses the existing /icon/flags PNG directory for country flags instead of emoji flags.
- Renders Latest 10 public-event flags on the first page response rather than waiting for the 45-second refresh.
- Uses the same local PNG flags for refreshed Transparency rows and the attacking-country podium on desktop and mobile.
- Removes the Operator workspace periodic full-page reload and replaces it with background in-place clean-GET updates.
- Pauses Operator live updates while editing, while unsaved fields exist, during mutations, and while the tab is hidden.
- Retains v6.26.3 HF1 meta/zone expiry reconciliation and operator-access ACL guard.
v6.26.3 HF1 — Meta/Zone Expiry Reconciliation & Operator Access2026-08-18
- Corrects zone-audit semantics so expired metadata listings are not reported as missing live-zone records.
- Preserves lifetime metadata while preventing retention cleanup from creating false Meta/zone listing mismatch incidents.
- Adds a constrained operator-access guard that grants scottie only traverse access to /etc/scotnet and read access to dnsbl-admin-allow.txt using POSIX ACLs.
- Repairs and continuously verifies operator allowlist readability without making /etc/scotnet directory contents listable.
- Restores the exact accepted operator-auth.php if it is absent, truncated or drifted.
- Does not add expired IPs back to BIND and does not introduce any direct BIND mutation path.
v6.26.3 — Incident Centre Correlation & Operator Overview2026-08-17
- Merges current Apache adaptive threat evidence into the established Incident Centre as grouped security incidents while retaining existing operational incident behaviour.
- Separates Security incidents from Operational incidents and keeps low-value individual requests in Apache Feed.
- Replaces the Operator Overview shortcut/button grid with live operational summary metrics.
- Adds Incident Centre deep links into Apache Feed search and event history.
- Security correlation is read-only and does not alter scoring, notifications, DNSBL or BIND state.
v6.26.2 — Apache Feed Operator Controls & Scoring2026-08-17
- Adds Apache Feed search across client, VHost, request path, class, status, reason and score.
- Adds per-event Evaluate, Allow client and Allow path actions. Client allows are exact-IP, VHost-scoped or all-Apache scope, retain evidence/history, and suppress only future Apache adaptive scoring.
- Adds an Apache Feed Scoring menu with editable per-event weights, retained hard floors for high-confidence signatures, existing threshold controls, and a visible client-allowlist manager.
- Adds read-only event evaluation with current exact-IP score, gate, class breakdown, matching events and allowlist state.
- Keeps authorised paths as context rather than a blanket bypass: high-confidence hostile signatures continue to score on authorised routes.
- Retains v6.26.1 public/operator fast paths, v6.26.1 HF1 lifecycle response compatibility, component integrity and zonectl-only DNSBL/BIND mutation boundaries.
v6.26.1 — Public & Operator Fast Path2026-08-17
- Removes full private meta.json decode and append-only audit JSONL scan from normal public homepage requests; uses existing transparency export and indexed public history.
- Caches parsed BIND listing snapshots by source mtime/size fingerprint, and adds bounded operator status/history caches invalidated by mutations.
- Adds Server-Timing diagnostics while retaining v6.26 integrity, HF4 fail-open, HF6 per-VHost controls and zonectl/BIND boundaries.
v6.26 — Operational Integrity & Component Manifest2026-08-17
- Adds a canonical machine-readable component manifest covering the active DNSBL code chain, ownership roles and exact immutable postimage hashes.
- Adds a unified operational integrity gate with static drift detection plus bounded runtime checks for PHP, Apache, BIND, SQLite, policy, registry, timers, public routes, Monitor and recovery state.
- Adds a five-minute integrity status publisher and an authenticated operator dashboard panel so partial-chain failures can be localised without relying on website-up alone.
- Keeps historical release checkers in place for rollback/compatibility evidence but makes the v6.26 manifest/integrity gate the current operational authority.
- Retains v6.25.2 retention truthfulness, HF4 public fail-open guards, HF6 per-VHost UI wiring, zonectl mutation boundaries and fail-closed staged recovery semantics.
- Adds exact v6.25.2 preimage gates, staged PHP/Python/systemd validation, atomic deployment and automatic file rollback if v6.26 postflight fails.
v6.25.2 — Canonical Roll-up, Retention Truthfulness & Recovery Safety2026-08-17
- Consolidates the accepted v6.25.1 production postimages through Hotfix 6 into one coherent release baseline without changing DNSBL return-code or zonectl mutation policy.
- Synchronises the public DNSBL/UI version surfaces to v6.25.2 and retains the Hotfix 4 fail-open Lifetime service totals card plus the Hotfix 6 Apache Feed JavaScript wiring.
- Makes every retention control shown in the operator lifecycle panel functional: detailed Apache/security/history data, VHost/path change audit, adaptive action diagnostics, terminal policy evidence and weekly-audit history.
- Adds operator-configurable recovery archive retention by count and maximum age while protecting unrelated release rollback snapshots.
- Runs a complete verified ScotNet recovery backup before lifecycle cleanup; cleanup fails closed if that pre-clean recovery backup cannot be created.
- Keeps restore fail-closed: operator recovery can verify or stage an isolated restore, while direct production overwrite remains intentionally unsupported.
- Adds staged preflight syntax validation, exact live preimage checks, automatic file rollback on failed postflight, canonical public-route checks and whole-public-tree PHP release gating.
6.17.5 — SMTP Metric Placement Correction2026-08-11
- Moves the SMTP abuse (24h) aggregate out of the homepage Zone updated statistic and into the existing Mail feeds card between Threatmail and User reports.
- Moves the SMTP abuse (24h) aggregate out of the transparency Delisted / expired statistic and into its own sibling statistic card in the Transparency snapshot.
- Retains v6.17.4 Hotfix 6 country flags, footer synchronisation, recursive operator-snapshot sanitisation and non-executing prefix parser capability checks unchanged.
- Changes presentation placement only; SMTP collection, exact listing, prefix approval thresholds, return codes, cron cadence and zonectl-only mutation boundaries are unchanged.
6.17.4 — Transparency Metrics, Country Flags & Footer Sync2026-08-11
- Removes the standalone SMTP abuse intelligence homepage card and standalone Postfix SMTP abuse feed transparency card introduced in v6.17.3.
- Integrates a privacy-minimised SMTP abuse 24-hour event/IP/session metric into the existing Transparency snapshot statistic grid on both the homepage and operational transparency page.
- Adds country flags beside IP addresses in Latest 10 public events using a bounded root-side country-code cache; the browser performs no third-party lookup and no public JSON feed is added.
- Synchronises the universal footer visual release from the stale ScotNet UI v6.14.4 label to the current v6.17.4 release while preserving the changelog link.
- Retains the authenticated v6.17.3 SMTP feed-health/operator visibility and all accepted exact/prefix enforcement policy, thresholds, return codes, approvals and zonectl-only mutation boundaries unchanged.
6.17.3 — SMTP Feed Integration & Enforcement Visibility2026-08-11
- Promotes Postfix SMTP abuse intelligence to a first-class feed across the authenticated operator feed-health view, public DNSBL homepage and transparency page.
- Adds coarse public SMTP source health without exposing candidate IPs, identity tokens, evidence hashes, approval records or private logs.
- Adds operator Healthy/Stale/Inactive/Fault state, last-ingest age, last-apply age, exact/prefix eligibility, approval state and recent enforcement-result visibility.
- Persists bounded sanitised scheduled-enforcement failures into the operator snapshot so runtime faults are visible without reading the cron log; a later healthy preview/apply clears the fault.
- Documents Postfix SMTP signal classes, HMAC identity minimisation, exact code 127.0.0.4, prefix code 127.0.0.8 and the zonectl-only mutation boundary on transparency.php.
- Preserves v6.17.2 Hotfix 3 live parser-contract corrections, exact/prefix thresholds, source-specific exceptions, approval requirements, return codes and five-minute enforcement cadence unchanged.
6.17.2 — SMTP Listing & Prefix Escalation2026-08-11
- Enables gated exact-IP SMTP abuse listing through the established scotnet-dnsbl-zonectl path; the collector itself remains non-mutating.
- Exact listing requires recurrence across attack sessions/active days or a bounded high-volume burst, and honours the existing Postfix allowlist and signed-delist suppression.
- Adds independent postfix-smtp /24 and /64 escalation gates requiring distinct addresses, distinct attack sessions, event/score/identity thresholds, plus cross-source corroboration or recurrent attackers.
- Requires explicit first-use approval for every SMTP prefix, binds approval to the exact evidence hash, and refuses stale or changed previews.
- Adds exact source-specific expiring SMTP prefix exceptions and retains the established return-code namespace: 127.0.0.4 exact security abuse and 127.0.0.8 prefix coverage.
- Keeps all browser controls read-only for SMTP enforcement and expands the authenticated Stats / Feeds panel with exact/prefix eligibility, approval and recent-action status.
- Preserves v6.17.1 history/correlation, v6.7 prefix safety principles, v6.8 recovery verification and v6.16 transactional rollback.
- Hotfix 2 retained the exact-IP-only check correction and prefix-state separation. Hotfix 3 corrects the live mutation adapter: zonectl event times are Unix epoch integers, exact mutations use add, prefix mutations use the native add-prefix command, and both complete argv contracts are proved through non-mutating zonectl dry-runs before activation.
6.17.1 — SMTP Intelligence History & Correlation2026-08-10
- Adds durable per-IP recurrence totals and attack-session history while keeping raw SMTP evidence retention bounded.
- Groups SMTP attacks into bounded sessions and reports first/last seen, lifetime events, lifetime sessions, active days and recurrence counts.
- Adds read-only correlation against the established sanitised DNSBL history index, including Apache-security and Threatmail evidence counts.
- Adds shadow-only IPv4 /24 and IPv6 /64 concentration aggregates with distinct-IP, event and score totals; prefix enforcement remains disabled.
- Publishes a sanitised operator-only snapshot with no HMAC identity tokens and integrates SMTP intelligence into the authenticated Feed quality and operational reports panel.
- Preserves v6.17.0 scoring thresholds, Postfix input backends, privacy controls, automatic-listing prohibition and v6.16 transactional rollback framework.
6.17.0 — Postfix & SMTP Abuse Intelligence2026-08-10
- Adds a dedicated private Postfix SMTP evidence plane with source IDs postfix-sasl and postfix-smtp-protocol.
- Ingests Postfix smtpd events from /var/log/mail.log with a bounded journald fallback and duplicate-resistant fingerprints.
- Recognises SASL authentication failures, AUTH session aborts, non-SMTP commands, improper command pipelining and too-many-errors events.
- Stores only timestamp, exact remote IP, event class, score and HMAC identity tokens; raw log lines and plaintext SASL identities are not retained.
- Generates exact-IP shadow review candidates using bounded windows and multi-event scoring; a single SASL failure cannot become a candidate.
- Automatic listing and IPv4 /24 or IPv6 /64 prefix escalation are hard-disabled for the v6.17.0 production soak.
- Adds private feed health/status, SQLite integrity checks, configurable CIDR allowlisting, retention and one-minute ingestion scheduling.
- Preserves v6.16 transactional promotion, verified recovery backup, automatic rollback and whole-site release version auditing.
6.16.0 — Transactional Release & Rollback Framework2026-08-10
- Introduces a persistent release transaction journal with atomic promotion and crash-visible phases.
- Requires preflight acceptance and a verified recovery backup before release-controlled files are changed.
- Automatically restores release-controlled preimages when promotion or post-install acceptance fails.
- Adds one-command rollback with post-image drift protection so later operator edits are never silently overwritten.
- Synchronises and audits current-version display surfaces across the DNSBL site while preserving historical release entries.
- Hotfix 1 corrects live acceptance probes for retained component versions, the canonical v6.15 parser contract, restricted web-bridge invocation and configured BIND validation.
- Hotfix 2 makes central-version discovery formatting-independent by locating the unique PHP definition/assignment statement and patching only its 6.x.x token.
- Hotfix 4 corrects the retained v6.15 manifest ownership proof to use the established owner/group name schema while preserving exact hash, mode and visudo validation.
- DNSBL listing policy, BIND data, SQLite schemas, feeds, return codes and notification semantics are unchanged.
v6.15.0 — Operator Configuration & Safe Remediation2026-08-10
- Adds authenticated operator configuration for the known prefix-alert thresholds with optimistic revision checks and transactional rollback.
- Adds preview/confirm safe remediation with one-time expiry-bound tokens, root-owned state fingerprints and an audit trail.
- Remediation is allow-listed: self-audit, prefix shadow, alert dry-run, recovery backup/drill and maintenance controls only.
- Does not expose prefix apply, zone edits, serial repair, production restore, force VACUUM, global allow-list mutation, arbitrary commands, paths or secrets.
v6.14.4 — Local Service Transparency8 Aug 2026
- Added a dedicated service-transparency page on bl.scott.ovh while keeping operational transparency separate.
- Corrected the footer Transparency link so it stays within the DNSBL site.
- Kept live evidence and exact-address accountability on /transparency.php.
- Hotfix 2 aligned service transparency with the established DNSBL theme and repaired this changelog entry after the Hotfix 1 preflight defect.
- Hotfix 3 corrected service-transparency CTA text contrast, hover/focus states and keyboard focus visibility in light and dark themes.
v6.14.3 — Attacking Countries Podium and Public Changelog7 Aug 2026
- Added a public-safe top-three attacking-country podium sourced from private aggregated country-abuse telemetry.
- The podium refreshes as rendered HTML without exposing a new public JSON feed.
- Footer version now links to this changelog.
- Added structural and HTTP validation for the podium and changelog.
v6.14.2 — Front Page Recovery and Safe API Retirement7 Aug 2026
- Recovered the complete front page after the v6.14.1 installer defect.
- Replaced broad front-page editing with bounded, structure-preserving patching.
- Production acceptance now smoke-tests the public homepage and retired history endpoint.
v6.14.1 — Public History Endpoint Retirement7 Aug 2026
- Retired the public per-IP JSON history endpoint and removed public references to it.
v6.14.0 — Notification Intelligence and Escalation7 Aug 2026
- Added warning persistence, escalation, flapping suppression, maintenance mode, acknowledgement-aware reminders and delivery-health monitoring.
v6.13.6 — Transparency Live Ordering and Mobile Presentation7 Aug 2026
- Corrected Latest 10 ordering to select the true newest public events and improved mobile presentation.
v6.13.5 — Prefix Escalation State and Notification Stability7 Aug 2026
- Classified changed preview tokens as safe deferrals instead of failures and shortened the shadow-to-apply gap.
v6.13.4 — Privacy-Preserving Live Transparency6 Aug 2026
- Limited the public transparency list to the latest ten events with HTML-only live refresh and exact-address search.
v6.13.3 — Incident Recovery Reconciliation6 Aug 2026
- Improved feed-health/self-audit reconciliation and incident recovery handling.
v6.13.2 — Prefix Escalation Alert Classification6 Aug 2026
- Stopped ordinary prefix-policy activity being misclassified as a generic component failure.
v6.13.1 — Operator Alerting Hotfix5 Aug 2026
- Stabilised Incident Centre notification delivery including application platform Chat integration.