DEEN
Start 30-day trial
Enterprise Trust, Maturity & Governance

Verifiable facts for CIOs, CISOs, and Compliance Auditors

Mail and groupware sit at the core of enterprise infrastructure. Here is our unvarnished documentation on release history, RFC 9116 vulnerability handling, source-code escrow, GoBD/IDW PS 880 compliance boundaries, and reproducible benchmarks.

Release History (v1.3.1) Admin Manual & Best Practices Security Disclosure (RFC 9116) Source-Code Escrow GoBD & IDW PS 880 Status SHA256SUMS.txt
Verifiable Engineering Cadence

Release History & Public Changelog

Every release passes automated protocol, cryptographic, and multi-engine integration suites (SQLite WAL, PostgreSQL® & Microsoft® SQL Server®) and ships with verifiable SHA-256 digests.

nextxch v1.3.0 · Protocol Logging, Statistics, Sessions, Phishing Protection & Self-Service Unblock

2026-10-31 · Preview
  • Protocol logging & statistics: Persistent logs for inbound and outbound SMTP (full dialogue), delivery, logins, IMAP, ActiveSync and application with live viewer, analysis and delisting report; statistics tabs per account, domain and server with a 30-day chart.
  • Login history, sessions & IP countries: Login history across all protocols, session list with sign-out per device or everywhere, idle auto-logout and a country flag next to every IP address (offline via DB-IP Lite).
  • Phishing protection & sending services: Brand and link heuristics, SPF/DKIM/DMARC on every inbound message with X-Spam-Rules header, "check for phishing" and phishing reports in webmail, detection of 69 sending services.
  • Self-service unblock, customer hostnames & more: IP unblock requests with automatic PTR/FCrDNS, MX and SPF checks, webmail on mail./webmail. hostnames with a dedicated Let's Encrypt certificate, Encrypted File Share per domain and account, visibly blocked external images, admin sub-tabs, plus CSP and HSTS headers.

nextxch v1.3.1 · Exchange migration, complete contacts with photo, domain rename & new brand

2026-11-01 · Latest
  • Exchange 2013 / 2016 / 2019 migration over EWS: Mail with folders and read/flag state, calendars, contacts, notes and tasks; creates missing domains, accounts and extra addresses (multi-domain too), re-runs fetch only what is new.
  • Contacts like on iPhone, Android, Outlook and Thunderbird: Photo, birthday and anniversary (also without year), multiple emails, numbers, addresses and websites, name parts, department, job title and categories via webmail, CardDAV and ActiveSync; fields written by other devices are kept when editing.
  • Admin: Rename a domain (old name kept as alias), delete TLS certificates, deep links for every page and sub-tab, clearer tab bars, exactly one primary address per account.
  • New name nextxch & SharpMailserver takeover: The MSI takes over an existing SharpMailserver installation with data, accounts and license, installs to C:\Data\Nextxch by default and opens the admin when finished.

nextxch v1.2.5 · nextxch-cli (IaC), Scoped API Keys, IP Warming, Reputation Shield, Outbound TLS Overrides & Outlook Calendar/People

2026-10-31 · Stable
  • Built-in nextxch-cli & Scoped API Keys (smk_...): Schema-driven management & GitOps IaC CLI pre-installed in PATH on Windows® (.msi), Debian®/Ubuntu® (.deb), Linux®/macOS®, and Docker® (describe, get, query NDJSON/jq, create, update, delete, dns --bind, snapshot & apply --dry-run) paired with CIDR-restricted Bearer API keys.
  • Transactional Send API (/api/v1/send) with IP Warming & Provider Quotas: Granular hourly and daily quotas per message category (critical, transactional, notification, marketing) and recipient provider (Google/Gmail, Microsoft, Yahoo/AOL, T-Online/GMX/WEB.DE, Apple iCloud, plus per-domain *) with 14/28-day IP warming ramps and DeferQueue pacing.
  • Optional Outbound Reputation Shield & Per-Domain TLS Overrides (StartTlsIgnoreCert): Individually toggleable deliverability safeguards (Suppression List, RFC 5965 ARF FBL, DKIM-signed RFC 8058 One-Click Unsubscribe, 24h Bounce/Complaint Circuit Breaker, adaptive 421 cooldowns, HMAC webhooks & *.sink.nextxch.local sandbox) plus 1-click StartTlsIgnoreCert overrides for shared-hosting MX peers.
  • Outlook-Style Webmail Calendar & People Cards + ActiveSync Sync Fixes: Upgraded Month, Week, Day, and Agenda calendar views with overlap columns and mini calendar, People contact cards with profile inspector, clean MIME unwrapping for forwarded message/rfc822 ActiveSync bodies, and multi-page documentation hub (/docs/ & /docs/cli/).

nextxch v1.2.4 · True Dual-Stack IPv6, SpamGuard Panel, Message Trace, Outbound MX Tester, WhatsApp Onboarding & Admin Redesign

2026-10-30 · Stable
  • True Dual-Stack IPv6 ([::]) & Happy-Eyeballs Outbound MX: Native Dual-Stack socket binding across ESMTP, IMAP4rev2, and ManageSieve with IPv4-mapped normalization, IPv6 /64 prefix greylisting, and SPF ip6: diagnostics.
  • pfSense / SSL-Gateway Hairpin-NAT Compensation & Wildcard DNS Guard: Split-path detection eliminates false firewall timeout alerts when web and mail hosts share a pfSense/SSL gateway, complemented by root/wildcard Autodiscover and *.domain wildcard collision warnings.
  • WhatsApp/Messenger-Safe Mobile Onboarding & 1-Click Admin Invite: New crawler-immune 24h setup page (/onboarding/setup/{token}) with in-app WebView Safari handoff plus 1-click user invite from /admin/ via WhatsApp, link, QR code, or direct email.
  • SpamGuard & ClamAV Panel, Live Outbound MX/DANE Tester, Message Trace & Global Disclaimers: Redesigned 4-group Admin Cockpit with Ctrl+K quick search, interactive .eml Spam Analyzer, ClamAV EICAR self-test, live MX/STARTTLS/DANE delivery tester, persistent Message Trace (CSV), API key manager, anti-stacking global disclaimers, and full Admin & Best-Practice Manual (/docs/).

nextxch v1.2.3 · Microsoft® SQL Server® Engine, Live Server Hostname & External Port/PTR Diagnostics

2026-10-30 · Stable
  • Native Microsoft® SQL Server® Support (2019–2025, Express, Docker® & Azure® SQL): Full IMailStore, ISearchEngine, and IClusterCoordinator implementation powered by Microsoft.Data.SqlClient, including automatic READ_COMMITTED_SNAPSHOT provisioning, sp_getapplock leader election, UPDLOCK/READPAST multi-node queue claiming, and zero-OS-dependency weighted prefix search (works out-of-the-box on SQL Server® Express).
  • 1-Click External Port & Reverse-DNS (PTR/FCrDNS) Diagnostics via nextxch.com: New 'Hostname & Ports' cockpit panel verifies external reachability of all 5 required ports (25, 443, 465, 587, 993) and 3 optional ports (80, 143, 4190) from nextxch.com, inspects public WAN IP + PTR/FCrDNS alignment, and runs a local Outbound Port 25 MX self-test.
  • Zero-Restart ServerHostName Hot-Reload (EHLO, MX Banner & Autodiscover): Update the public mail server hostname live inside /admin/ with zero service restart, persisted across network-settings.json, appsettings.Production.json, and cluster_kv across all cluster nodes.
  • Single-Node Let’s Encrypt ACME HTTP-01 Singleton Fix & Structured Validation Errors: Fixes AcmeCertificateManager singleton lifetime for single-node HTTP-01 challenge callbacks (/.well-known/acme-challenge/*) and surfaces structured HTTP 422 diagnostics on DNS/Port-80 validation errors.

nextxch v1.2.2 · Account, Alias & List Editor, DE/EN Admin, Source/Headers Inspector & Argon2id Config Hash

2026-10-30 · Stable
  • Complete Account, Alias, Distribution List & Domain Management (hMailServer + Stalwart Parity): New fixed-height left-navbar Account & Domain inspectors covering aliases, distribution lists (Public/MembersOnly/SpecificSender), forwarding, vacation auto-reply, quotas, 2FA reset, session revocation, app passwords, passkeys, inbound PGP/S-MIME encryption at rest, Catch-All, and domain aliases with instant DE/EN language switching.
  • Webmail Source & Headers Inspector + Canonical INBOX Ordering: Built-in RFC 5322 Header & verbatim Raw MIME Source viewer with live filter, copy, and .eml download; canonical folder sorting guarantees INBOX is always first across Webmail, IMAP, and JMAP.
  • Argon2id-Hashed AdminPasswordPhc in appsettings.Production.json: All installers (Windows® Service, MSI, Debian® .deb) persist exclusively RFC 9106 Argon2id PHC hashes (AdminPasswordPhc); any legacy plaintext bootstrap password on disk is automatically hashed and scrubbed at startup.

nextxch v1.2.1 · Admin 1-Click Self-Updater (SHA-256 Verified) & UI Polish

2026-10-30 · Stable
  • Built-in Version Monitor & 1-Click Updater in Admin Cockpit: Automatic version check against /api/releases/latest, instant release notification banner, and 1-click in-place service upgrades across Windows Server®, Linux® systemd, and macOS® with automatic live reconnect.
  • Mandatory SHA-256 Integrity Verification & Config Preservation: Every update archive is cryptographically verified against the official SHA-256 digest prior to staging while preserving all appsettings*.json configurations, TLS certificates, and mailbox stores.
  • Clean UI Typography: Streamlined arrow-free labels across the entire Admin Cockpit and nextxch Webmail PWA (v8).

nextxch v1.2.0 · Mobile Push Sync (WBXML / EAS-Compatible), IMAP Notes Bridge & Unified Tasks (VTODO/VJOURNAL)

2026-10-30
  • Independent Mobile Push Interface (WBXML 1.3 · compatible with ActiveSync® 12.1–16.1): Independent clean-room implementation based on publicly documented interoperability specifications ([MS-ASHTTP]/[MS-ASCMD]) for compatible Android™, iOS®, and desktop clients (Provision, FolderSync, Sync, SendMail, SmartReply/SmartForward, Search GAL, ResolveRecipients, Settings/Oof->Sieve, MoveItems, ItemOperations & real-time Ping push), featuring stateless cluster-safe SyncKeys and configurable via ActiveSync:Enabled.
  • Bidirectional IMAP Notes Bridge & CalDAV VJOURNAL / VTODO: Live cross-ecosystem sync bridging IMAP-based Notes clients on iOS®/macOS® (IMAP "Notes" com.apple.mail-note), WBXML Push Notes & Tasks, CalDAV VJOURNAL/VTODO (/notes/ & /tasks/), Thunderbird®, and nextxch Webmail PWA.
  • Extended Autodiscover & Compatible .mobileconfig Profiles: Added extended Autodiscover response schemas (XML & v2 JSON) plus PKCS#7/CMS-signed .mobileconfig configuration profiles.

nextxch v1.1.0 · Native CalDAV/CardDAV Groupware, GoBD Procedural Docs & Open Benchmarks

2026-10-30
  • Native CalDAV (RFC 4791) & CardDAV (RFC 6352) Engine: Complete WebDAV groupware router (/dav/ plus /.well-known/caldav and /.well-known/carddav) with RFC 6578 sync-collection tokens, optimistic ETag concurrency (If-Match / If-None-Match), and per-device App Passwords for iOS®, macOS®, Thunderbird®, and Android™ (DAVx⁵).
  • Webmail Calendar & Contacts + Unified Apple® QR Profile: Built-in Calendar and Contacts views inside the nextxch Webmail PWA (/mail/) backed by the live DAV store; PKCS#7-signed Apple® .mobileconfig QR profiles now provision Mail, CalDAV, and CardDAV in a single scan.
  • Automated GoBD Procedural Documentation Generator: New Admin Cockpit export (/api/compliance/gobd-verfahrensdokumentation?download=true) generates pre-populated technical GoBD procedural documentation (BMF GoBD Rz. 151 ff.) from live domain retention policies and auditor roles.
  • Pinned OCI Tags & Automated SHA-256 Verification: Both install.sh and install.ps1 automatically verify SHA256SUMS.txt, and install.sh seamlessly builds nextxch/server:1.1.0 locally from the verified tarball whenever a public registry mirror is offline.

nextxch v1.0.2 · Cryptographic License Hardening, Kernel Memory Unmapping & Mobile UX

2026-10-29
  • Multi-layer Ed25519 signature and challenge-nonce heartbeat sealing for cluster licenses while preserving zero-interruption mail flow.
  • Immediate OS-level unmapping of transient 19 MB Argon2id login buffers (~40 MB idle RSS including Webmail PWA).
  • Responsive mobile drawer and touch navigation across Admin Cockpit and Webmail PWA.

nextxch v1.0.0 · PostgreSQL® 18 Active-Active Clustering, S3 WORM & Windows® .msi

2026-10-18
  • Horizontal active-active clustering backed 100% by PostgreSQL® 18 (LISTEN/NOTIFY < 2 ms push, UNLOGGED coordination tables, pg_try_advisory_lock) with zero Redis dependency.
  • 3-stage full-text indexing across MIME, PDF, EN 16931 ZUGFeRD/XRechnung XML, and scan OCR, paired with S3 Object Lock (COMPLIANCE).
  • Interactive Windows Server® .msi Setup & Upgrade Wizard (no Docker®) alongside Debian®/Ubuntu® .deb and systemd/launchd packages.

nextxch v0.9.0 & v0.8.0 · JMAP, Webmail PWA, Dual-DKIM & Core Protocol Engine

2026-06 – 2026-08
  • v0.9.0 (08/2026): JMAP (RFC 8620/8621 + SSE), nextxch Webmail PWA, Dual-DKIM (Ed25519 + RSA-2048), DMARC/TLS-RPT analyzer, WebAuthn Passkeys, OIDC, SCIM 2.0 & 1-click hMailServer import.
  • v0.8.0 (06/2026): Streaming ESMTP (BDAT/CHUNKING, 0 ms SNI STARTTLS), IMAP4rev2 (RFC 9051), ManageSieve (port 4190), SQLite WAL + SHA-256 Zstandard blob deduplication.

Vulnerability Disclosure & Patch Targets (RFC 9116)

/.well-known/security.txt · security@nextxch.com

  • Direct Security Engineering Contact: Reports sent to security@nextxch.com go straight to core engineering at iqmeta GmbH.
  • Engineering Triage & Patch Targets: Our engineering target is human acknowledgment in < 24 hours, with hotfix releases for Critical issues (CVSS v4.0 >= 9.0) in < 48 hours and High severity (CVSS 7.0–8.9) in < 7 calendar days. Contractually binding Support SLAs are included starting at Tier 5 (10,000+ mailboxes).
  • Single-Command In-Place Patching: Monthly maintenance releases apply cleanly in seconds via install.sh --update, the Windows® .msi upgrade wizard, or pinned container tags.
  • Safe Harbor: Good-faith security research conducted under Coordinated Vulnerability Disclosure enjoys full legal Safe Harbor from iqmeta GmbH.

Source-Code Escrow & Continuity Guarantee

Protection against vendor lock-in & insolvency risk

  • Contractual Software Escrow in Germany: Upon request, iqmeta GmbH deposits the complete source tree and reproducible build toolchains (.sln, WiX .msi, Linux® packagers, SQL schemas) with an independent German escrow agent.
  • SLA & Escrow Terms (from Tier 5): Included upon request as an Enterprise contract schedule alongside our binding Enterprise SLA starting at Tier 5 (10,000+ mailboxes, plus external escrow agent fees), or available as an optional addendum in Tiers 1–4.
  • Zero Kill-Switch & Open Data Formats: Existing SMTP, IMAP, JMAP, and CalDAV/CardDAV service never halts even if our license servers are unreachable, and all data resides in standard PostgreSQL®/SQLite plus RFC .eml, .ics, and .vcf records.
Tax & Audit Compliance Transparency (German GoBD)

GoBD Controls, Procedural Documentation & Honest IDW PS 880 Status

Credible compliance requires precision: under German tax law (BMF GoBD), compliance is achieved jointly through technical immutability controls in software and organization-specific procedural documentation.

1. Technical Immutability Controls

Original-format retention of inbound/outbound MIME messages and embedded EN 16931 ZUGFeRD XML, cryptographic SHA-256 hash chaining, S3 Object Lock (COMPLIANCE) or filesystem WORM, Legal Hold, and a non-mutating ComplianceAuditor role.

2. Built-in Procedural Docs Generator

Starting in v1.1.0, the Admin Cockpit exports a pre-populated technical GoBD procedural documentation template (.md per GoBD Rz. 151 ff.) reflecting your live domains, retention periods, WORM backend, and auditor accounts.

3. Transparent IDW PS 880 Status

As of v1.3.1, an external auditor certificate under IDW PS 880 has not yet been issued and is currently in preparation at iqmeta GmbH. Our technical control matrix is available to compliance teams on request.

Recommended Enterprise Evaluation Path

Why we actively encourage methodical pilot testing

nextxch is a modern 2026 platform engineered by iqmeta GmbH in Waldenbuch near Stuttgart (Commercial Register HRB 748338 · VAT ID DE 294776335 · IT liability insured via exali). Validate every claim on your own hardware:

Step 1: Free Test-Domain Deployment

Deploy the Free Forever Community Edition (up to 10 mailboxes) or a 30-day Enterprise trial key on a staging domain. Verify ESMTP, JMAP, Webmail, CalDAV/CardDAV, and run run-benchmark.sh yourself.

Step 2: Non-Destructive Parallel Sync

Mirror live mailboxes from hMailServer, Exchange®, or Dovecot in read-only TLS IMAP delta mode without touching your production MX records.

Step 3: Governed Production Cutover

Cut over MX records using pinned v1.3.1 packages, exported GoBD procedural documentation, S3 WORM retention, and direct German engineering support (contractual SLA from Tier 5).

Governance, Audit & Security FAQ

Does nextxch hold an IDW PS 880 audit certificate?

As of v1.3.1 (November 2026), formal IDW PS 880 third-party certification is in preparation and not yet issued. Technically, nextxch implements full GoBD immutability controls (original MIME & ZUGFeRD XML retention, SHA-256 hash chaining, S3 Object Lock WORM, Legal Hold, non-mutating ComplianceAuditor role) and includes a built-in generator for the mandatory procedural documentation (GoBD Rz. 151 ff.).

Are Source-Code Escrow and a binding Enterprise SLA available?

Yes. iqmeta GmbH offers a binding Enterprise SLA and contractual source-code and reproducible build-pipeline escrow in Germany. Both are included at no extra license charge starting at Tier 5 (10,000+ licensed mailboxes), with Source-Code Escrow also available as an optional paid addendum in Tiers 1–4. Furthermore, nextxch contains no hard kill-switch: existing mail and CalDAV/CardDAV traffic continues indefinitely even if our license servers are unreachable.

How are security vulnerabilities handled and patched?

Reports sent to security@nextxch.com (published via RFC 9116 /.well-known/security.txt) receive human triage within 24 hours. Critical vulnerabilities (CVSS >= 9.0) receive a hotfix within 48 hours; high-severity issues (CVSS 7.0–8.9) within 7 calendar days. Every package is published with verifiable SHA-256 checksums.

How can we verify the published RAM and throughput benchmarks?

Download and run our open benchmark harness (/downloads/run-benchmark.sh) against your own VM or bare-metal server. It records CPU/kernel metadata, measures exact /proc VmRSS idle and post-load memory, drives parallel ESMTP delivery with ZUGFeRD XML payloads, and reports p50/p95/p99 search latency.

Is the WBXML Mobile Push interface affiliated with or licensed from Microsoft®?

No. nextxch is a 100% independent clean-room implementation engineered by iqmeta GmbH. The optional WBXML Mobile Push interface (configurable via ActiveSync:Enabled) implements publicly documented interoperability specifications ([MS-ASHTTP]/[MS-ASCMD]/[MS-ASWBXML]) strictly for client interoperability. nextxch is neither affiliated with nor endorsed, licensed, or certified by Microsoft®, Apple®, or Google®.

Request 30-Day Pilot Key & Control Matrix Download Open Benchmark Script (run-benchmark.sh) Read Fair System Comparison