github.com/wneessen/go-mail

Welcome to go-mail v0.8.1! 🎉

This release is only a small release, but fixes a regression on the 386 platform. We hope you enjoy!

Notable features / improvements / fixes

Fix regression on 386 platforms

The NTLM support introduced in v0.8.0 contained a bug affecting 386 platforms: a 32-bit integer could overflow because it wasn't cast to int64. This caused problems when cross-compiling to the 386 architecture. The bug is fixed in #589. In addition, the CI pipeline has been extended to run cross-compile tests for every platform supported by GitHub runners. Thanks to @firefart for reporting the issue.

Opportunistic SMTP authentication

PR #585 introduces an opportunistic authentication mechanism that lets users provide a list of preferred auth types. During SMTP authentication, the client checks the mechanisms the server supports and selects the first match from the preferred list. If the server supports none of the preferred mechanisms, the client falls back to Autodiscover mode and selects the strongest mechanism the server offers.

Convenience helpers for List-Unsubscribe and one-click List-Unsubscribe-Post

We already expose the HeaderListUnsubscribe and HeaderListUnsubscribePost header constants, but until now there was no dedicated function to construct these headers. Users had to assemble the angle-bracket URI list and the exact List-Unsubscribe=One-Click token by hand via SetGenHeader—something that's easy to get subtly wrong (missing <>, an incorrect POST token, or GET-triggerable URLs). Since February 2024, Gmail and Yahoo require a working RFC 8058 one-click unsubscribe for senders exceeding 5k messages per day, making this a common compliance requirement rather than a niche feature. PR #587 adds three convenience helpers to set these headers correctly:

• SetListUnsubscribe(uris ...string): sets an RFC 2369 List-Unsubscribe header only (mailto/https links).
• SetListUnsubscribePost(): sets List-Unsubscribe-Post: List-Unsubscribe=One-Click.
• SetListUnsubscribeOneClick(httpsURL string, additionalURIs ...string): the common case: sets both headers correctly, validating that at least one HTTPS URL is present as required by RFC 8058.

What's Changed

• Implement opportunistic auth mechanism by @wneessen in #585
• Add RFC 8058 one-click unsubscribe support by @wneessen in #587
• Fix toUint32 range check and add 64bit tests by @wneessen in #589
• Add cross-compile test to CI by @wneessen in #598

CI/CD maintenance changes

• Bump golang.org/x/text from 0.38.0 to 0.39.0 by @dependabot[bot] in #590
• Bump step-security/harden-runner from 2.19.4 to 2.20.0 by @dependabot[bot] in #591
• Bump github/codeql-action/autobuild from 4.36.3 to 4.37.0 by @dependabot[bot] in #595
• Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by @dependabot[bot] in #594
• Bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by @dependabot[bot] in #593
• Bump github/codeql-action/init from 4.36.3 to 4.37.0 by @dependabot[bot] in #592
• Bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot[bot] in #597

Full Changelog: v0.8.0...v0.8.1

Welcome to go-mail v0.8.0! 🎉

This release brings two big new features and a couple of improvements and fixes to go-mail. We hope you enjoy this release!

Notable features/improvements/fixes

Native NTLM authentication support

With PR #576 native NTLMv2 SMTP auth support has been added to go-mail. This feature has been requested several times and so far we've always resorted to a custom SMTP authentication provider using some 3rd party libraries. With go-mail v0.8.0 you can now natively authenticate with NTLM servers like any of the other supported authentication methods. Big thanks to @mkalus for providing some ground work in #549 and for helping to test the code. The development was mainly based on the excellent documentation of the cURL project.

Native DKIM support

PR #582 adds native DKIM signing support to go-mail. So far we only supported DKIM via go-mail middleware, which proved to very limited and had the caveat that it needs to be the last middleware to be executed, otherwise the signature would be invalid. With go-mail v0.8.0 you can now natively DKIM sign your mails. DKIM support has been added in the Msg as well as in the Client types. In the Msg type you can sign individual mail messages, while the DKIM support in the Client instructs the mail sender to sign every outgoing message that runs through it.

Named templates support

With PR #556 go-mail now has support for named templates. So far we've been executing a template as a whole, but with this new functions one is allowed to execute only a portion of the template. Thanks to @Maldiran for contributing this PR!

Option to skip RSET after mail delivery

PR #569 adds a new Client option: WithoutRset(). This instructs the client to skip the RSET we usually send after a successful mail delivery. This option can be useful for MTAs that do not support the RSET command and would fail because of that, even though the mail was successfully delivered.

What's Changed

• fix(random): drop the unreachable '-' character from cr by @c-tonneslan in #560
• Fix failing tests due to textproto change in 1.26.4 by @wneessen in #566
• Add Nix development flake by @wneessen in #567
• churn(tests): Fix failing test due to textproto change by @wneessen in #568
• New template functions that allow usage of named templates (template.ExecuteTemplate) by @Maldiran in #556
• feat(client): Add WithoutRset option to skip RSET after delivery by @wneessen in #569
• Generalize multipart detection and CTE handling by @wneessen in #575
• Add NTLMv2 support by @wneessen in #576
• Add native DKIM support by @wneessen in #582
• Renovate and modernize the code by @wneessen in #583
• Churn/bump version and readme by @wneessen in #584

CI/CD maintenance changes

• Bump step-security/harden-runner from 2.19.1 to 2.19.2 by @dependabot[bot] in #550
• Bump step-security/harden-runner from 2.19.2 to 2.19.3 by @dependabot[bot] in #553
• Bump github/codeql-action from 4.35.4 to 4.35.5 by @dependabot[bot] in #552
• Bump codecov/codecov-action from 6.0.0 to 6.0.1 by @dependabot[bot] in #555
• Bump github/codeql-action from 4.35.5 to 4.36.0 by @dependabot[bot] in #559
• Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @dependabot[bot] in #558
• Bump step-security/harden-runner from 2.19.3 to 2.19.4 by @dependabot[bot] in #557
• Bump vmactions/freebsd-vm from 1.4.5 to 1.4.6 by @dependabot[bot] in #561
• Bump golang.org/x/text from 0.37.0 to 0.38.0 by @dependabot[bot] in #565
• Bump codecov/codecov-action from 6.0.1 to 7.0.0 by @dependabot[bot] in #564
• Bump github/codeql-action from 4.36.0 to 4.36.2 by @dependabot[bot] in #563
• Bump vmactions/freebsd-vm from 1.4.6 to 1.4.7 by @dependabot[bot] in #570
• Bump vmactions/freebsd-vm from 1.4.7 to 1.4.8 by @dependabot[bot] in #571
• Bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #572
• Bump vmactions/freebsd-vm from 1.4.8 to 1.5.0 by @dependabot[bot] in #573
• Bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @dependabot[bot] in #574
• Bump github/codeql-action/init from 4.36.2 to 4.36.3 by @dependabot[bot] in #581
• Bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3 by @dependabot[bot] in #579
• Bump github/codeql-action/autobuild from 4.36.2 to 4.36.3 by @dependabot[bot] in #578
• Bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by @dependabot[bot] in #580

New Contributors

• @c-tonneslan made their first contribution in #560
• @Maldiran made their first contribution in #556

Full Changelog: v0.7.3...v0.8.0

Welcome to go-mail v0.7.3! 🎉

This release brings some cool improvements, new features, and fixes to go-mail. We hope you enjoy it!

Notable changes/improvements/features/fixes

Deadline fix for connections to a TLS port without TLS

PR #521 fixes a missing deadline in the Client that could cause a deadlock for connections to a TLS port without TLS enabled. Thanks to @james-d-elliott for finding and fixing this issue!

Preseve EHLO and HELO errors

PR #528 fixes an error for cases in which both the HELO and EHLO fail during a client connect. In this case the first error would be overwritten by the 2nd action, potentially deleting valuable information. In go-mail v0.7.3 both errors are now combined. Thanks to @Yanhu007 for their contribution!

Improved Base64LineBreaker

In PR #512 @srpvpn refactored the Base64LineBreaker type to be more performant and easier to read by removing the recursion. Thanks for your contribution!

Reduce binary size by making text/template and html/template support optional

In PR #518 @sblinch introduced a new compile time flag gomailnotpl which will make the text/template and html/template optional. Background is, that using reflect.Value.Method or reflect.Value.MethodByName prevents Go from performing full dead-code elimination because any exported method of any struct in the codebase could potentially be referenced at runtime. Unfortunately text/template and html/template do exactly this to allow method invocation from within templates. So in case your code does not need template support, you can use the new compile flag to remove the support for both packages completely and same some bytes in the resulting binary. Thanks for your contribution!

Fix nil pointer panic in partWriter

PR #543 fixes a potential nil pointer panic in the partWriter in case the underlying io.Writer returns an error during a multipart message write. Thanks to @UgurTheG for reporting and fixing the issue!

Provide access to HELO responses in the SMTP client

PR #530 adds support to access the HELO/EHLO responses via the smtp.Client. This feature is useful when using an SMTP servers pool behind a load balancer, to know which instance took the job. Thanks to @maxatome for submitting this feature!

Multiple addresses support in ReplyTo header

PR #517 adds support for multiple Reply-To addresses within a Msg, as permitted in RFC5322. Thanks to @christian-heusel for pointing this out and for comitting the PR!

Support to disable SMTPUTF8 in the MAIL FROM even if the server announces it

PR #548 adds support for skipping the SMTPUTF8 extension to MAIL FROM commands. By default, when a server announces SMTPUTF8 support in the EHLO, go-mail will add SMTPUTF8 to the MAIL FROM command. As pointed out in #545, some SMTP servers (e. g. specific MS Exchange versions) announce the SMTPUTF8 extension in the EHLO response but when adding the SMTPUTF8 to the MAIL FROM, they will fail with an error. The PR introduces a new WithoutSMTPUTF8() option for the Client which will make sure to skip the SMTPUTF8 extension in the MAIL FROM, even if the server announced it previously. Thanks @mkalus for reporting this issue and for their detailed analysis in #545.

What's Changed

• minor fix for func ResetWithSMTPClient and DialAndSendWithContext by @sarff in #500
• Refactored SendWithSMTPClient to improve error handling and added test cases by @wneessen in #502
• Refactored test and validation logic for message content checks by @wneessen in #503
• Fix a docstring typo by @mitar in #505
• Upstream sync: prevent test failures due to expired test certificate by @wneessen in #522
• fix: deadline not set for initial connection read by @james-d-elliott in #521
• Add deadlock test for client connections by @wneessen in #525
• fix: preserve EHLO error when both EHLO and HELO fail by @Yanhu007 in #528
• refactor: remove recursion from base64LineBreaker.Write by @srpvpn in #512
• Make text/template support optional to allow dead-code elimination by @sblinch in #518
• fix: prevent nil pointer panic in writeBody when partWriter is nil by @UgurTheG in #543
• feat: add (*smtp.Client).HelloResponse method to get EHLO/HELO response by @maxatome in #530
• feat: add option to skip SMTPUTF8 in "MAIL FROM" commands by @wneessen in #548
• Allow multiple Addresses in ReplyTo Header and add GetReplyTo() by @christian-heusel in #517

CI/CD maintenance changes

• Bump golang.org/x/text from 0.29.0 to 0.30.0 by @dependabot[bot] in #501
• Bump golang.org/x/text from 0.30.0 to 0.31.0 by @dependabot[bot] in #506
• Bump golang.org/x/text from 0.31.0 to 0.32.0 by @dependabot[bot] in #509
• Bump Go and golang.org/x/text module versions by @wneessen in #526
• Bump golang.org/x/text from 0.35.0 to 0.36.0 by @dependabot[bot] in #527
• Updated .golangci.toml for linter exclusions on specific use cases by @wneessen in #523
• Updated CI configuration for Go and OS versions in workflows by @wneessen in #524
• Bump golangci/golangci-lint-action from 7.0.0 to 9.2.0 by @dependabot[bot] in #535
• Bump ossf/scorecard-action from 2.4.0 to 2.4.3 by @dependabot[bot] in #534
• Bump fsfe/reuse-action from 5.0.0 to 6.0.0 by @dependabot[bot] in #533
• Bump vmactions/freebsd-vm from 1.1.5 to 1.4.5 by @dependabot[bot] in #532
• Bump step-security/harden-runner from 2.10.2 to 2.19.0 by @dependabot[bot] in #531
• Bump actions/dependency-review-action from 4.5.0 to 4.9.0 by @dependabot[bot] in #540
• Bump actions/setup-go from 5.2.0 to 6.4.0 by @dependabot[bot] in #539
• Bump codecov/codecov-action from 5.1.1 to 6.0.0 by @dependabot[bot] in #538
• Bump actions/upload-artifact from 4.5.0 to 7.0.1 by @dependabot[bot] in #537
• Bump github/codeql-action from 3.27.9 to 4.35.3 by @dependabot[bot] in #536
• Bump step-security/harden-runner from 2.19.0 to 2.19.1 by @dependabot[bot] in #541
• Bump golang.org/x/text from 0.36.0 to 0.37.0 by @dependabot[bot] in #547
• Bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in #546
• Bump github/codeql-action from 4.35.3 to 4.35.4 by @dependabot[bot] in #544

New Contributors

• @mitar made their first contribution in #505
• @Yanhu007 made their first contribution in #528
• @srpvpn made their first contribution in #512
• @sblinch made their first contribution in #518
• @UgurTheG made their first contribution in #543
• @maxatome made their first contribution in #530
• @christian-heusel made their first contribution in #517

Full Changelog: v0.7.2...v0.7.3

Welcome to go-mail v0.7.2!

Unfortunately with the v0.7.1 vulnerability fix, a regression was introduced when formatted mail address with full name ("Toni Tester" <[email protected]> were used, resulting in only the mail address (<[email protected]>) being handed over to the SMTP client. This bug was spotted and reported by @NCRonB in #497 - thank you very much for the report.

Sorry for any incovenience this might have caused!

What's Changed

• Refactored address handling for improved consistency and formatting by @wneessen in #498

Full Changelog: v0.7.1...v0.7.2

Welcome to go-mail v0.7.1!

This is a security release, which addresses a bug that causes insufficient address encoding when passing mail addresses to the SMTP client, which could lead to possible wrong address routing or even to ESMTP parameter smuggling.

The details of the bug are outlined in #495 and in the go-mail security advisory: GHSA-wpwj-69cm-q9c5
Github assigned the following CVE for this vulnerability: CVE-2025-59937

The vulnerability has been reported by xclow3n. Thank you very much for the detailed report and the thorough testing!

What's Changed

• Fix vulnerability in mail address passing to the smtp client by @wneessen in #496

Full Changelog: v0.7.0...v0.7.1

Welcome to go-mail v0.7.0! 🎉

This release brings important improvements, new features, and fixes to make working with go-mail more reliable and powerful.

Change in Supported Go Versions

With this release, go-mail will no longer commit to supporting the last four Go versions. Instead, we will follow the official Go release policy and only support versions that are actively maintained by the Go team.

Why this change?

• Security and Dependencies
  Even though go-mail currently has very few dependencies, keeping support for outdated Go versions would prevent us from safely updating them in the future. This creates the risk of leaving users exposed to unpatched security vulnerabilities and critical issues.

• Maintenance Costs
  Supporting unsupported Go versions requires extra workarounds, conditionals, and testing overhead. Every additional version increases maintenance complexity and takes valuable time away from adding new features, improving the code base, and fixing bugs.

• Alignment with the Go Ecosystem
  The Go team provides two releases per year, and each version receives about one year of official support. By aligning with this policy, go-mail ensures that users always benefit from current language features and security patches.

What this means for you

If you are already on a Go version that is actively maintained (at this point: 1.24 or 1.25), nothing changes. If you are on an older, unsupported version, you will not be able to run go-mail v0.7.0 or higher and we strongly encourage upgrading. This will not only allow you to continue using go-mail but will also ensure you benefit from the security and performance improvements provided by the Go team.

Change Reply-To header from generic header type to address header type

|Breaking change| With PR #441 we changed Reply-To header to an AddrHeader type. Since Reply-To is actually an address header which formats the mail address accordingly, and not a generic header, this could lead to potential double encoding if the address and name contain special characters. This change is potentially a breaking change, since we are changing a public type, but as long as the user makes use of msg.ReplyTo() or msg.ReplyToFormat() this should not cause any problems.

Fix "short writes" in Base64LineBreaker and make the type private

|Breaking change| With PRs #445, #448 and #443 we address an issue with the Base64LineBreaker.Write implementation which reports an incorrect count of bytes written ("short writes). While those short writes aren't noticed in practice, since we use base64.Encoder.Encode.Write under the hood, which ignores short writes, the issue was still fixed to make it future-proof against potential changes in the base64 package. This issue was reported and fixed by @dolmen. Thank you very much for your contribution! It was also pointed out, that our Base64LineBreaker was a public type without exposing any public methods, making it unusuable for any 3rd party library. Therefore the Base64LineBreaker type was made private (which in theory is a breaking change, but in practice should not affect any user, given that no public methods were exposed)

EML parsing

The EML parsing was made more robust by introducing several fixes/improvements:

• Fix nil map assignment in EML parser: PR #447 fixes a bug in the EML parser which was caused by a non-initialized map. Parsing an email could cause a panic: assignment to entry in nil map. This issue was reported by numerous users (see: #446, #462, #468, #482 and #490). Thanks to everybody who reported this issue!
• Fix multipart header parsing: PR #458 improves the handling of multipart headers by addressing edge cases where multiple parameters are present.
• Use the original EML boundary instead of generating a new one : PR #491 fixes an issue in which parsed multipart messages would hold two boundary headers, which would render the mail broken. This issue was reported and fixed by @termermc. Thanks for your contribution!

Support for mail.Address types

PR #472 adds support for directly providing *mail.Address instances by providing a SetAddrHeaderFromMailAddress method. It also provides methods for directly providing *mail.Address instances for all the various address types (From, To, CC, BCC, etc.). Additionally it adds a IsAddrHeader method, which checks if the provided string is an address header.

Error handler registry

PR #492 introduces ResponseErrorHandler and ErrorHandlerRegistry - an interface that defines a method for handling SMTP responses that do not comply with expected formats or behaviors and would cause errors during the SMTP communication. It is useful for implementing retry logic, logging, provider-specific error handling. It injects itself into the smtp.Client and is called whenever a server response does fail. This feature addresses #464 and #463. In our Wiki we will collect a currated list of known providers with issues and corresponding code examples on how to implement the error handler.

What's Changed

• BREAKING CHANGE: Refactor Reply-To header handling. by @wneessen in #441
• POTENTIAL BREAKING: More Base64LineBreaker fuzzing by @dolmen in #443
• Fix assignment to nil map in EML parser by @wneessen in #447
• Make Base64LineBreaker private by @wneessen in #448
• Fix multipart header parsing and add test for attachments with metadata by @wneessen in #458
• Fix "short writes" in Base64LineBreaker.Write by @dolmen in #445
• Update TLS test certificates to use 2048-bit RSA keys by @wneessen in #460
• Improve PKCS7 test suite by @wneessen in #423
• Add support for mail.Address instances by @wneessen in #472
• Add support for server responses by @wneessen in #475
• Update README compatibility policy for Go versions by @wneessen in #484
• Refactor codebase to align with updated Go version support by @wneessen in #486
• When decoding a multipart message from EML, use the original EML boundary instead of generating a new one by @termermc in #491
• smtp: Implement ErrorHandlerRegistry for handling errors in SMTP responses by @wneessen in #492
• v0.7.0 release preparation by @wneessen in #493
• Removed internal PBKDF2 implementation and replaced with Go's stdlib by @wneessen in #494

CI/CD maintenance changes

• Remove SonarQube integration from CI workflow. by @wneessen in #442
• Migrate golangci-lint to v2 by @wneessen in #461
• Update CI configuration to support Go 1.25 and disable older versions by @wneessen in #485
• Bump golang.org/x/text from 0.22.0 to 0.28.0 by @dependabot[bot] in #481
• Enable macOS builds in CI test matrix by @wneessen in #487
• Bump golang.org/x/text from 0.28.0 to 0.29.0 by @dependabot[bot] in #488

New Contributors

• @dolmen made their first contribution in #443
• @termermc made their first contribution in #491

Full Changelog: v0.6.2...v0.7.0

Welcome to go-mail v0.6.2! This release fixes some bugs and makes go-mail ready for Go 1.24.

Fix regression of custom SMTP authentication handling

PR #429 fixes a regression in the handling of custom smtp.Auth methods that was introduced with the v0.6.0 release. Basically, if a custom SMTP auth method was provided, it was simply ignored. Thanks to @james-d-elliott of the Authelia project for reporting this.

Fix possible nil pointer derefernece in SendWithSMTPClient

With commit 4641da4 we fixed a possible nil pointer dereference in the SendWithSMTPClient method. This would happen if a nil message would be provided to the method. This bug was reported using Github's private vulnerability reporting feature by @younes199511. Thanks for the report!

Header count logic improvements

PR #421 fixed an issue in the header count logic that is used for S/MIME signing. If a header was broken into mutliple lines due to its lenght, the count logic was giving false results, resulting into false content for the S/MIME signature. Thanks to @theexiile1305 for reporting the issue and helping to debug the issue!

Go 1.24 readiness

The PRs #431 and #433 make go-mail and its CI ready for Go 1.24.

What's Changed

• Refactor header count logic for accurate line tracking by @wneessen in #421
• chore: improve tests for multipart messages by @wneessen in #422
• Add tests for handling nil messages in email client by @wneessen in #427
• Fix regression of custom smtp.Auth not working by @wneessen in #429
• Skip tests for broken rand.Reader on Go 1.24+. by @wneessen in #433
• chore: update CI to Go 1.24 by @wneessen in #431
• Update version to 0.6.2 and fix typo in documentation by @wneessen in #434

CI/CD maintenance changes

• Bump golang.org/x/text from 0.21.0 to 0.22.0 by @dependabot in #425
• Bump golang.org/x/crypto from 0.32.0 to 0.33.0 by @dependabot in #426

Full Changelog: v0.6.1...v0.6.2

Welcome to go-mail v0.6.1! This release is a bug-fix release that addresses a regression introduced in v0.6.0.

Fix missing new-lines in multipart rendering

The v0.6.0 release introduced a regression in the multipart message generation (See #412). The boundary lines were not correctly seperated with a new line. This bug was introduced while working on the S/MIME handling. The issue has been fixed in #413. I am sorry for any inconveniences this might have caused. Thanks to @Thomas2500 for reporting the issue!

Multipart boundary handling refactoring

While working on #412, I noticed a general issue with the boundary handling when fixed boundaries are set for the message. This bug was present already since the introduction of Msg.WithBoundary/Msg.SetBoundary, but was only brought to light with the new S/MIME feature introduced in v0.6.0. Since the S/MIME signing needs to set a fixed boundary, it was using the Msg.SetBoundary feature. If more than one multipart parts were used with a fixed boundary, this would render the mail broken (since it was using the same boundary for multiple parts). This has been fixed in #414 and #416. The GoDoc for Msg.WithBoundary/Msg.SetBoundary has also been updated with a warning that using the feature with more than one parts will break the message rendering.

Removal of XOAUTH2 from Auto-Discovery feature

Since XOAUTH2 works with Bearer tokens instead of passwords but the Auto-Discovery SMTP auth feature makes use of a username/password pair having XOAUTH2 in the prefered mechanisms list could cause authentication failures. Therefore the XOAUTH2 mechanism has been removed from the feature completely. Thanks to @james-d-elliott for pointing this out!

What's Changed

• Fix regression in multipart boundary writing by @wneessen in #413
• Refactor multipart boundary handling in message rendering by @wneessen in #416
• Remove XOAUTH2 from Auto-Discovery SMTP auth feature by @wneessen in #417
• chore: prepare 061 release by @wneessen in #418

Full Changelog: v0.6.0...v0.6.1