Proxmox Mail Gateway 9.1: Upgrade and Install Checklist

June 12, 2026 update: Proxmox Mail Gateway 9.1 is available. Proxmox says the release is based on Debian 13.5 “Trixie” and ships Linux kernel 7.0, ZFS 2.4, PostgreSQL 17, SpamAssassin 4.0.2 with updated rulesets, and ClamAV 1.4.4.

For web hosts, agencies, and small businesses that filter mail before Microsoft 365, Google Workspace, cPanel, Plesk, Exchange, Postfix, or other downstream mail systems, this is worth planning as an operations change. Mail filters are not just appliances you reboot and forget. They hold quarantine state, filtering policy, backup keys, mail queues, TLS behavior, and customer-visible delivery rules.

What changed in PMG 9.1

• New platform baseline: Debian 13.5, kernel 7.0, ZFS 2.4, PostgreSQL 17, SpamAssassin 4.0.2, and ClamAV 1.4.4.
• Quarantine handling: shared mailboxes can mark messages as seen, and recipients can receive or use a copied quarantine login link.
• Privacy-aware image loading: external images in HTML mail can be loaded only on demand.
• Optional audit logging: PMG can log envelope and decoded From, To, and Subject header details, but Proxmox leaves this disabled by default because those headers can contain personal data.
• Mail parser hardening: Proxmox says PMG now rejects nonconforming MIME messages by default, with an override available for legacy mail sources that must be handled selectively.
• Fresh install media: the PMG 9.1 ISO is listed on the official Proxmox Mail Gateway downloads page as version 9.1-1.

Upgrade checklist

1. Confirm the starting point. PMG 9.0 can move to 9.1 through the normal updater. PMG 8.2 can move to the 9.x line, but follow Proxmox’s 8-to-9 upgrade instructions first.
2. Confirm support timing. Proxmox says PMG 8.2 receives security updates and critical bug fixes until August 2026, so there is planning room if the mail gateway is business-critical.
3. Back up before touching mail filtering. Export the PMG configuration, confirm Proxmox Backup Server or other backup jobs, and make sure the restore path is tested.
4. Check clusters carefully. Upgrade one node at a time, keep quorum and mail routing in mind, and verify quarantine and policy synchronization before moving to the next node.
5. Review custom rules and templates. Pay attention to local SpamAssassin customizations, custom check scripts, report templates, LDAP/OIDC settings, and any downstream routing assumptions.
6. Plan a mail-flow window. Watch inbound and outbound queues, downstream smarthost delivery, TLS policy, DKIM signing, quarantine reports, and customer-facing mailbox delivery.
7. Review privacy before enabling header logging. Header logging can help audits, but From, To, and Subject values can include personal or sensitive business information.
8. Verify after reboot. Confirm the PMG version, services, ClamAV updates, SpamAssassin rule updates, quarantine access, mail tracking, queue behavior, and sample delivery to downstream mailboxes.

Fresh install checklist

1. Download from Proxmox. Use the official PMG downloads page and verify you are using the PMG 9.1 ISO installer, listed as 9.1-1 at publication time.
2. Prepare networking first. Decide the host name, management address, mail relay path, DNS, reverse DNS, firewall rules, and upstream and downstream mail systems before installing.
3. Virtualize deliberately. Proxmox says PMG can run as a VM on Proxmox VE, VMware, or Hyper-V. For Hyper-V generation 2 VMs, Proxmox notes that Secure Boot should use the Microsoft UEFI Certificate Authority option.
4. Install updates before production mail. Apply the current package updates, confirm repository configuration, and check ClamAV and SpamAssassin updates before moving MX records or routing production traffic.
5. Set backup and recovery early. Store backup keys safely, connect PMG backups to Proxmox Backup Server or your chosen backup path, and verify a backup before the gateway becomes critical.
6. Test with a pilot domain. Validate inbound mail, outbound relay, spam quarantine, attachment filtering, TLS behavior, DKIM/DMARC alignment, and reporting before moving all users.
7. Document customer impact. Tell users where quarantine links come from, what changed in image loading, and how to report false positives or missing messages.

Hosting and business notes

If PMG sits in front of customer domains, treat this like a customer-impacting maintenance window. Mail can queue, routing can fail, quarantine links can confuse users, and overly strict filtering can block real business mail. Keep a rollback plan, preserve current configuration exports, and make sure someone can reach the gateway console if network access changes during the reboot.

The most important new setting to discuss internally is header logging. It can make mail audits easier, but it can also store names, addresses, customer subjects, ticket references, invoices, and HR-related subject lines. Turn it on only when you have a reason and a retention plan.

Related Fix I.T. Phill reading

• Proxmox Mail Gateway 8.2 to 9.0 upgrade guide
• How to install and configure Proxmox Mail Gateway
• Configure Windows Server 2022 VM to use Proxmox Mail Gateway
• Proxmox May 2026 operations roundup

Sources

• Proxmox forum announcement: PMG 9.1 released
• Proxmox Mail Gateway roadmap and release notes
• Official Proxmox Mail Gateway downloads
• Proxmox upgrade instructions from PMG 8 to 9
• Proxmox Mail Gateway administration guide

Need help planning a Proxmox Mail Gateway upgrade or mail-filter migration? Fix I.T. Phill can help review backups, routing, quarantine behavior, MX cutover, and post-upgrade mail-flow testing before business mail depends on the new gateway.