The older Proxmox Mail Gateway tutorials on this site cover installing PMG and pointing Ubuntu or Windows mail workloads through it. This new guide is for the version path that came after those posts: Proxmox Mail Gateway 8.2 to 9.0 on Debian 13 Trixie.
Proxmox Mail Gateway 8.2 landed in February 2025. Proxmox Mail Gateway 9.0 followed on October 1, 2025 with Debian 13 Trixie, kernel 6.14, ClamAV 1.4.3, SpamAssassin 4.0.2, a redesigned mobile quarantine interface, and expanded SSO/OpenID Connect controls. The upgrade is not just apt dist-upgrade; it includes PMG-specific checks, mail service downtime, and a PostgreSQL 15 to 17 upgrade.
Preflight On PMG 8.2
Run this from SSH inside tmux or from a real console. Do not use the PMG web console for the major upgrade. Plan for mail to queue upstream while PMG services are stopped.
tmux new -s pmg9-upgrade
apt update
apt dist-upgrade
pmgversion -v
df -h /
pmgbackup backup
pmg8to9
If this is a PMG cluster, stop and mask cluster daemons on all nodes before upgrading the first node. Upgrade nodes sequentially.
systemctl stop pmgmirror pmgtunnel
systemctl mask pmgmirror pmgtunnel
Switch To Trixie Repositories
Install the new keyring, switch Debian base repositories to Trixie, then add either the enterprise repository or the no-subscription lab repository.
apt install proxmox-archive-keyring
sed -i 's/bookworm/trixie/g' /etc/apt/sources.list
grep -R bookworm /etc/apt/sources.list /etc/apt/sources.list.d 2>/dev/null || true
Enterprise repository:
cat > /etc/apt/sources.list.d/pmg-enterprise.sources << 'EOF'
Types: deb
URIs: https://enterprise.proxmox.com/debian/pmg
Suites: trixie
Components: pmg-enterprise
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
EOF
No-subscription lab repository:
cat > /etc/apt/sources.list.d/proxmox.sources << 'EOF'
Types: deb
URIs: http://download.proxmox.com/debian/pmg
Suites: trixie
Components: pmg-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
EOF
Stop Mail Services And Upgrade Packages
Stop and mask mail and PMG services so the database and filtering state do not change during the upgrade. Upstream mail servers should queue while PMG is down.
systemctl stop postfix pmg-smtp-filter pmgpolicy pmgdaemon pmgproxy pmgmirror pmgtunnel
systemctl mask postfix pmg-smtp-filter pmgpolicy pmgdaemon pmgproxy pmgmirror pmgtunnel
apt update
apt policy
apt dist-upgrade
Upgrade PostgreSQL From 15 To 17
Before rebooting, upgrade the PostgreSQL cluster. Use a clean root login shell so SSH locale variables do not break the database migration.
su -
env | grep -E 'LC|LANG' || true
pg_upgradecluster -v 17 15 main
systemctl unmask postfix pmg-smtp-filter pmgpolicy pmgdaemon pmgproxy
reboot
Bring PMG Back And Verify Mail Flow
After reboot, check PMG, Postfix, the filter services, and the queue. If the node is clustered, unmask and start cluster services after all nodes have been handled.
pmgversion -v
pmg8to9
systemctl status postfix pmg-smtp-filter pmgpolicy pmgdaemon pmgproxy --no-pager
mailq
journalctl -u pmg-smtp-filter -n 80 --no-pager
systemctl unmask pmgmirror pmgtunnel
systemctl start pmgmirror pmgtunnel
After confirming PMG 9 is healthy, remove old PostgreSQL 15 packages only when you are confident the database migration is clean.
apt purge postgresql-15 postgresql-client-15
apt autoremove
Watch Points
- If you use an external Avast scanner integration, check vendor support before upgrading to PMG 9.
- Reverse proxies in front of the quarantine interface may need path updates for the redesigned mobile quarantine UI.
- Network interface names can change after the kernel update. Have console access before reboot.
- Template customizations in
/etc/pmg/templatesrequire careful diff review during package prompts.
Related Catch-Up Guides
- Proxmox VE 8.2 to 8.4 catch-up guide
- Proxmox VE 8.4 to 9.1 upgrade guide
- Proxmox Backup Server 3.4 to 4.2 upgrade guide
