A guide for anyone running a Mailman list
GNU Mailman 2 is end-of-life. Here’s what it means for your mailing list.
Last reviewed: October 2026
GNU Mailman is free, open-source mailing list software that has run university, open-source and community lists since the late 1990s. Mailman 2.1, the version most people still have, reached end-of-life in 2020 and no longer gets upstream fixes. Mailman 3 is its replacement, but it is a different program rather than an upgrade.
Looking for what to use instead? Compare hosted services
To see the collection of prior postings to the list, visit the Volunteers Archives.
version 2.1.39
Volunteers
volunteers@lists.example.org
Your email address
SubscribeHow we got here
-
1999
Mailman 1.0 released
-
2015
Mailman 3.0 released
-
2020
Mailman 2.1 end-of-life (needs Python 2)
-
Dec 2021
Last 2.1 release: 2.1.39
-
Apr 2025
Three disputed CVEs filed against 2.1.39
-
Autumn 2025
Ohio State moves to Mailman 3
-
Mar 2026
Georgia Tech moves to Mailman 3
-
Aug 2026
Debian 11 end-of-life — servers get rebuilt
-
Today · Oct 2026
Your list is still on 2.1
1 · The short version
What “end-of-life” means for Mailman 2.1
The Mailman project declared 2.1 end-of-life in 2020. The reason was practical: Mailman 2.1 is written for Python 2, and Python 2 itself stopped getting fixes at the start of that year. A few more patch releases followed, ending with 2.1.39 in December 2021. There has been no upstream release since.
In April 2025, three vulnerabilities were published against 2.1.39 as bundled with cPanel and WHM. cPanel and the Mailman developers dispute them, and others couldn’t reproduce them, but either way no upstream fix is coming: nobody maintains 2.1 any more. The discussion on the oss-security list made the larger point: this is orphaned software, and retiring it takes a major migration.
Hosting panels still ship it, so plenty of lists keep running without anyone noticing. End-of-life doesn’t mean your list stops tomorrow. It means upstream isn’t fixing it, every server rebuild is a chance to lose it, and the deadline is set by your operating system and your host rather than by you.
2 · Check by eye
How to tell which Mailman you’re running
Open your list’s web page. The two versions look nothing alike, and the address gives it away before the page has even loaded.
Coordination list for event volunteers.
To see the collection of prior postings to the list, visit the Volunteers Archives.
Subscribe to Volunteers by filling out the following form.
Volunteers administrative interface (requires authorization) Delivered by Mailman
version 2.1.39
Volunteers
volunteers@lists.example.org
Coordination list for event volunteers.
Subscription / Unsubscription
Your email address
Display name (optional)
SubscribeGNU Mailman · Postorius Version 1.3
| Clue | Mailman 2.1 | Mailman 3 |
|---|---|---|
| The URL path | /mailman/listinfo/ or /mailman/admin/ |
/postorius/ or /hyperkitty/ |
| The page footer | “Delivered by Mailman version 2.1.x” | Postorius or HyperKitty, with a version number |
| Your hosting panel | cPanel’s Mailing Lists panel is always 2.1.x | Never in cPanel; in Plesk only on Debian 11 or 12 |
3 · The honest answer
Is Mailman 3 an upgrade?
Not in the way the name suggests. Mailman 3 isn’t 2.1 with new features; it’s a rewrite with a different shape. The list engine is separate from the web interface and the archive, both of which are Django applications with a database behind them. Sign-in works differently, archives are stored differently, and settings don’t map one-to-one.
The migration tooling exists, and it works — but look at who uses it. Georgia Tech scheduled a weekend for it in March 2026. Ohio State ran its move in autumn 2025. Both have full IT teams.
For a list run by one volunteer on one server, it’s a rebuild, not an update — and afterwards you’re still the person who keeps it running. The architecture in detail is in our Mailman comparison.
Mailman 2.1
One program
Lists, web pages and the archive, all in one install
Mailman 3
Postorius
web interface
HyperKitty
archive
Django
web framework
Mailman Core
list engine
A database
you install and maintain
4 · Where the list goes next
Your four options
Every Mailman 2 list ends up in one of four places. The useful question isn’t which is best — it’s who will be running the list in two years’ time.
Upgrade to Mailman 3 in-house
Who runs it afterwards
You
Ask your host or university
Who runs it afterwards
Them — if they agree to
Google Groups or Microsoft 365 Groups
Who runs it afterwards
Your organization’s admin
A hosted list service
Who runs it afterwards
The service — you just run the list
| Option | Fits when | Catch |
|---|---|---|
| 1. Upgrade to Mailman 3 in-house | You have a sysadmin, a server and a weekend | It’s a new install with an import step, and you keep running it |
| 2. Ask your host or university to do it | Someone else already runs the server | Many won’t: cPanel doesn’t offer Mailman 3, and a Plesk upgrade doesn’t move Mailman 2 lists |
| 3. Move to Google Groups or Microsoft 365 Groups | Everyone on the list has an account in one organization | Outside members, archives and moderation get awkward |
| 4. Move to a hosted list service | You want the list to keep working without running a server | A monthly bill above the free tier. compare hosted services |
5 · Where most stranded lists live
If your list is on cPanel or Plesk
cPanel still ships Mailman 2.1, now as its own maintained build, and has said it won’t implement Mailman 3 for now. Plesk has supported Mailman 3 on Debian 11 and 12 since Plesk 18.0.59, but a server upgrade doesn’t carry Mailman 2 lists across: Plesk’s advice is a new server and a migration you run yourself.
The pressure is coming from underneath. Debian 11 reached end-of-life in August 2026, and hosts are rebuilding servers onto newer systems. When a server is rebuilt, the mailing list is usually what gets lost — it sits in a directory nobody thought to copy.
If your host has written to you about a migration, export your list before the date, not after.
cPanel
Mailing Lists panel = Mailman 2.1.x, cPanel’s own build
Plesk
Mailman 3 on Debian 11/12; upgrades don’t move 2.1 lists
Debian 11
End-of-life since August 2026
6 · Whatever you decide
Export your list before anything else
Four things make a list: the members, who gets the digest, the settings, and the archive. Save these and any move is an import. Lose them and it’s a rebuild from memory.
| What | Command or file | Why it matters |
|---|---|---|
| Members | bin/list_members -f yourlist > members.txt |
Everyone on the list, with their names. The one thing you can’t recreate. |
| Digest readers | bin/list_members -d yourlist > digest-members.txt |
So people who chose one email a day don’t suddenly get every message. |
| Settings | bin/config_list -o settings.txt yourlist |
Who may post, moderation and reply-to, written out as text you can read. |
| Archive | archives/private/yourlist.mbox/yourlist.mbox |
Every message the list has ever sent, in one file. Copy it somewhere safe. |
Run the commands from your Mailman install directory, replacing yourlist with your list’s name.
7 · Option 4, done for you
Moving a Mailman list to Gaggle Mail
Gaggle Mail runs the servers, delivery and archive; you run the list from a web page. It’s free up to 200 members. Standard, at $0.10 per member per month, adds sending from members’ own inboxes and archive search. Members keep the inbox they already use — no accounts, nothing to install.
Send us your mbox file and we import the archive free, private to the list. Your members keep their digest choice, moderation and reply-to settings carry over, and on any paid plan the list can use your own domain. Most lists move over in minutes.
If your list lives on a university server that’s being retired, start with listserv hosting for lists your institution is retiring.
- members.txt 1,284 members
- digest-members.txt 212 on daily digest
- settings.txt moderation, reply-to
- yourlist.mbox 9,410 messages
- 17,000+ groups run on Gaggle Mail
- 4.8/5 on G2
- SOC 2 Type 1 audited
- Data Processing Agreement included
Questions about Mailman 2
Is Mailman 2 still safe to run?
Treat it as unsupported. The Mailman project declared 2.1 end-of-life in 2020, and its last release, 2.1.39, came out in December 2021. cPanel patches its own build; anywhere else, nobody is fixing it.
Can I upgrade Mailman 2 to 3 in place?
No. Mailman 3 is a separate install with an import step. cPanel doesn't offer it, and a Plesk server upgrade doesn't carry Mailman 2 lists across.
Who still uses Mailman?
Universities, open-source projects and community lists, many of them on shared hosting with cPanel or Plesk. A lot of them are moving off Mailman 2 in 2025–27.
Is Mailman free?
The software is free and open source. You pay for the server it runs on and the time it takes to keep it running.
Does Gaggle Mail import Mailman archives?
Yes. Send us the mbox file and we import it for free. The archive stays private to the list, and members can search it on any paid plan.
What happens to my list address?
Keep it by pointing your own domain at the new list, on any paid plan, or ask whoever runs the old server to forward the old address for a while; 90 days is a good minimum.