Release Notes

Track what's new, improved, and fixed in every MailSpoof release.

v1.2.0 — June 11, 2026

Major release expanding from 45 to 62 built-in templates, adding an HTTP Tracking Server, bulk CSV target delivery, attachment payloads, and Docker support.

New Features

  • 17 new built-in phishing templates (46–62) — Logistics (DHL, FedEx), Document (DocuSign, SharePoint, Zoom), Crypto (Coinbase, Wise), Device Alerts (GitHub SSH, New Device Login), and more
  • HTTP Tracking Server — concurrent tracking server on port 8080 with 1x1 pixel injection into HTML templates for open-event detection
  • Bulk CSV targeting — --target-list targets.csv on test and custom commands to send to full departments
  • Attachment payloads — --attach file.pdf flag (repeatable) to test email gateway security against malicious attachments
  • Docker deployment — Dockerfile and docker-compose.yml for containerized VPS/red team infrastructure
  • Header injection — --reply-to and --x-mailer flags on test and custom for advanced spoofing scenarios
  • Termux one-line installer — curl -sL .../install_termux.sh | bash for Android deployment
  • PKGBUILD — Arch Linux package support added
  • CITATION.cff — academic citation metadata for the project

Bug Fixes & Improvements

  • MIME handling — attachment encoding improved for binary and text files
  • Template ID persistence — IDs now remain stable across sessions using the Id: header field
  • CSV reader — empty rows and malformed lines are skipped gracefully
  • Server stability — ThreadingHTTPServer replaces single-threaded handler for concurrent tracking requests

v1.1.0 — June 6, 2026

Major release expanding from 5 to 45 built-in templates, adding SMTP profile management, verbose diagnostics, and a complete template management toolkit.

New Features

  • 45 built-in phishing templates covering Social Media, SaaS/Cloud, Developer Platforms, Consumer Services, Financial, and BEC categories
  • Template preview — mailspoof preview <id> with rendered HTML and --raw source mode
  • Edit templates — mailspoof edit-template <id> opens in $EDITOR (default nano)
  • Remove custom templates — mailspoof remove-template <id>; built-ins protected
  • Filter templates — mailspoof list --filter <text> by name, category, tags, or body
  • SMTP profiles — profile add/list/remove with --profile <name> on start/test/custom
  • Verbose diagnostics — --verbose shows SMTP stage-by-stage output
  • CSV reporting — mailspoof report --format csv alongside JSON
  • Desktop integration — Linux .desktop entry with icon, auto-installed by install.sh

Bug Fixes

  • Installation — install.sh now installs via pip directly with system-wide and user support
  • Entry point — Console script correctly points to lib.cli:main
  • Template loading — Packaged templates load from lib/templates/builtins/ on any install type
  • Uninstall — Removes wrappers, config, templates, and pip package reliably
  • Custom templates — Now saved to dedicated ~/.mailspoof/templates/custom/ subfolder
  • Email format — Switched to multipart/alternative MIME with HTML + plain text fallback

v1.0.0 — June 4, 2026

Initial stable release with built-in SMTP server, 5 pre-built scenarios, audit logging, and Debian packaging.

Features

  • Built-in SMTP server with MX relay support
  • 5 pre-built spoofing scenarios
  • Custom template creation — mailspoof create
  • Audit logging — mailspoof logs
  • JSON report generation — mailspoof report
  • External SMTP relay with TLS and authentication
  • IP-blacklist error detection with actionable advice
  • Debian package — mailspoof-v1.0.0.deb
  • Shared banner module (lib/banner.py)
  • Apache-2.0 License
  • GitHub Actions CI pipeline
  • Issue templates — bug report and feature request

Bug Fixes

  • Direct MX delivery — Now returns specific SMTP error codes
  • Uninstaller — Handles /usr/bin/mailspoof from .deb installs
  • Package cleanup — Removed stray DEBIAN/ from contents
  • Build hygiene — Excluded __pycache__ and .pyc from .deb