Announcements & releases

hMailServer 6.2.10 fixed an authorization defect in the COM API. Fifteen methods rejected an unauthorized caller with return false. These functions return HRESULT, where false is 0, which is S_OK, so each one reported success for a call it had just refused. Anyone administering the server through a COM client or script was affected. What the upgrade involved Drop-in over 6.2.9. No database change, schema version 6005, and no configuration change. Two administration front-ends were removed, so a custom install that ticked "Administrative tools" for the WebAdmin or hMailAdmin.exe had nothing left to run. The component is now "Remote administration support (registers the COM API for scripts)", which is what it always did. COM scripts against a remote instance still work. The changes: InterfaceCache's five getters returned before writing *pVal, so a caller without server-admin rights got S_OK and read uninitialized memory. InterfaceSettings::SetAdministratorPassword and five siblings skipped the write and reported success, so the caller was told the administrator password had changed when it had not. InterfaceMessageIndexing's four methods did the same. (0d01a55) Found by running CodeQL's C++ suite locally. The workflow analysed C# only, so 4.65 MB of network-facing code had never been scanned. It returned 16 high-severity findings, 15 of them these. A re-run after the fix returns 1, a verified false positive in FileUtilities.cpp. The PHP WebAdmin is gone (53f52eb). It stored the administrator password in plaintext in a PHP session and replayed it to Authenticate() on every request. The installer dropped from 400 payload files to 255. Code-quality findings in shipped, hand-written code: 958 to 0. DBUpdater rethrew with throw ex, resetting the stack trace on the database-upgrade failure path. Three as casts dereferenced without a null check. PngByteQRCode was built per render in the two-factor dialog and never disposed. OpenTelemetryTracing bound its OTLP collector to port 9099, the port the server's own metrics listener uses. With NUnit running 32 workers in parallel it could not bind. It now uses 9096. Full release notes, checksums and signatures

6.2.9 is a follow-up to 6.2.8. It completes what that release deliberately left out: the LiveCharts upgrade 6.2.8 had to pin back. No server-core changes, and the regression suite still stands at 898/898. LiveCharts 2.0.5 (#11) 6.2.8 pinned LiveCharts to 2.0.0-rc2 because upgrading painted both dashboard charts as an opaque white block over the dark theme, taking the "No delivery activity yet" and "No active sessions" labels with them. CartesianChart derives from Control, and 2.0.x gives that Control a solid default Background where the release candidate left it unset, so the chart painted a white rectangle across the dark card. The overlay labels were never actually hidden. They are light-grey text that happened to land on that white. Setting Background explicitly fixes both symptoms. Verified in both light and dark themes. Worth recording what it was not. 2.0.5 pulls SkiaSharp.Views.WPF, OpenTK and OpenTK.GLWpfControl, which looks exactly like a GL-hosted surface and the usual WPF airspace problem. It is not that. LiveCharts.RenderingSettings.UseGPU defaults to false, so rendering stays on the software path and ordinary WPF layering applies. Control Panel tests (#12) The GUI previously had no test coverage at all. CI compiled it and stopped there. A ControlPanel.Core library exposes the side-effect-free services (PasswordStrength, NumericField, PasswordGenerator) through shared compile links, so no code moved and the Control Panel project itself is untouched. ControlPanel.Tests runs 17 xUnit tests against them, with coverlet emitting Cobertura coverage that CI publishes on every push. The three .NET 8 projects also gained a solution, ControlPanel.sln. Repository Release tags are now protected against being moved or deleted, and master against force-pushes. Secret scanning and push protection are enabled. A Code of Conduct was added, and the issue chooser routes questions to Discussions. It was a drop-in over 6.2.8: no database change (schema version 6005), no configuration change, no server-core change. Full release notes, checksums and signatures

A Control Panel bug-fix release. Both defects made a healthy server look broken, and they hit every Windows GUI administrator. There are no server-core changes since 6.2.6, and the regression suite still stands at 898/898. What the upgrade involved Drop-in over 6.2.7. No database change (schema version 6005) and no configuration change. #6: list editors showed blank rows Every data-driven list pane rendered the right number of rows with nothing in them. Adding an entry appeared to create an empty row, and only the Edit dialog showed the value you had typed. The row model exposed its data as a field, and WPF data binding resolves properties only, so every generated column silently bound to nothing. It was reported against domain aliases, but the same control backs SURBL servers, DNS blacklists, the anti-spam and greylisting white lists, blocked attachments, groups, server messages, external POP3 accounts and account rules. #7: the Control Panel died after a service restart The COM server lives inside the hMailServer service process, so restarting the service invalidated every interface pointer the GUI held, including restarts the Control Panel performed itself after saving a setting. Every page then failed with "The RPC server is unavailable" until you closed and reopened it. The session now verifies the link before use and re-authenticates transparently. A restart triggered from the Control Panel waits for the server to report Running rather than latching onto a service that has registered with Windows but is still opening its database. A restart by anyone else is detected on your next action and healed, with a "Connection restored" notification. The liveness check reads ServerState rather than Version, because a shutting-down service keeps answering Version from a static string after closing its database. The superseded COM proxy is released, and the Control Panel no longer starts a service the administrator deliberately stopped. Both fixes were reproduced on the previous build and verified against a live server: unit assertions on the session logic, a harness driving the real CollectionEditorView and DomainDialog, and UI automation over the running Control Panel. Full release notes, checksums and signatures

6.2.7 was a Control Panel usability release. The server core was unchanged since 6.2.6, so nothing in message handling moved. Every change sat in the .NET 8 administration Control Panel, closing the gaps that still forced hand-typed paths, external tools or guesswork. What it changed: File and folder pickers everywhere. Every field holding a file-system path gained a browse button: the backup destination and restore file, the archive folder, the ACME certificate folder, the OAuth2 public key, the REST API / Web Services TLS certificate and key files, the ClamWin executable and database folder, and the DKIM private key. One-click DKIM. Domain > DKIM gained Generate key pair. It creates an RSA-2048 key, saves the private key, fills in the path, and shows the exact selector._domainkey DNS TXT record (v=DKIM1; k=rsa; p=…) with a Copy button. No more running OpenSSL by hand. Passwords. All password boxes got a reveal toggle. The account editor and the quick-create form got a Generate strong password button, using a cryptographic RNG and copying to the clipboard. The external POP3 fetch-account password is masked rather than shown in clear text. Inputs. The auto-reply expiry became a date picker. Numeric server settings and the collection editors use up/down number boxes. Every editor dialog obeys Enter to save and Esc to cancel. MX query and Diagnostics output got a Copy button. Window state. The main window remembers its size, position and maximized state between sessions, and a save-confirmation toast appears after saving. Because the core was untouched, the regression suite result carried over from 6.2.6: 898 of 898 tests passing, zero failures, zero inconclusive, including live SpamAssassin, ClamAV with real EICAR detection, DMARC evaluation against live DNS, and TLS 1.2/1.3 handshakes end to end. One package shipped, hMailServer-6.2.7-x64.exe, 64-bit Windows only. Full release notes, checksums and signatures

hMailServer 6.2.6 added IMAP4rev2 (RFC 9051) as an opt-in session mode. The server advertises IMAP4rev2, and a client that issues ENABLE IMAP4rev2 gets RFC 9051 semantics for that connection. IMAP4rev1 behaviour is unchanged until a client opts in. The rest of the release is Control Panel and installer work. IMAP4rev2 In the opt-in mode: ESEARCH by default, \Recent and RECENT dropped from SELECT, EXAMINE and STATUS, the obsolete [UNSEEN] response code suppressed, and UTF-8 acceptance. Control Panel A central theme-aware colour-token system replaced scattered hardcoded colours. Success, warning, danger and info, and the log palette, now adapt to light, dark and high-contrast themes. A Fluent nav selection style and a brand keyboard-focus ring. Live-log colours legible on the light theme, readable data grids with balanced columns, and settings forms capped to a readable column with right-sized inputs. KPI colours that encode state, softened destructive buttons, "no activity" chart placeholders, and a Welcome page of clickable quick-action tiles. Every configurable server setting now has a GUI control: OAuth2 and external-token auth, SRS and BATV, submission and outbound rate limits, OpenTelemetry and the slow-query log, connection timeouts, delivery and queue tuning, search indexing, message archiving and other INI knobs, Logging.Device and LogFormat, cache size caps, the domain Active Directory link, and a write-only secret editor. Documented in settings.md. Two-factor authentication setup renders a real scannable QR code, with a grouped manual key and a copy button, and a larger verification field. Installer A DPI-scaled custom database-type page, modernised copy and refreshed brand imagery. The dead legacy dependency installers were removed: MSI, IE6, MDAC, JET and .NET 2.0. The server core was validated by the full regression suite, 898 of 898 tests passing, including live SpamAssassin, ClamAV against EICAR, DMARC against live DNS, and TLS 1.2 and 1.3 handshakes end to end. Full release notes, checksums and signatures

hMailServer 6.2.5 fixed two faults that stopped a default install from connecting to its own database. Anyone who installed with the shipped defaults, an internal SQL Server Compact database with DPAPI secret protection, was affected. Critical fixes DPAPI database-password truncation (SQL CE error 25028). IniFileSettings::ReadIniSettingString_ used a fixed 255-character buffer, so GetPrivateProfileString truncated the ~356-character DPAPI-protected database-password envelope. The truncated blob failed to decrypt, which yielded an empty password and SQL CE error 25028, Authentication failed. The buffer is now 4096 characters, which also covers long OAuth2 HMAC secrets and the password pepper. Fresh-install database version, 6004 to 6005. The CreateTables scripts for MSSQL, MySQL and PostgreSQL still stamped hm_dbversion = 6004 while the server required 6005, so a brand-new install reported "database too old". SQL CE uses the MSSQL script, so it was caught by this too. The recipientdsnnotify column was already present. Only the version row was stale. Validation Checked end to end on a Windows Server 2025 Active Directory domain controller. A default internal-database install connects. AD authentication passes through COM ValidatePassword in both the DNS domain.tld and NetBIOS DOMAIN\user forms, and through a real IMAP LOGIN, correct password returning OK and wrong returning NO. Control Panel The .NET 8 WPF Control Panel (hMailCP.exe) reached full settings parity with the classic Administrator here. The Server Status page (version, server state, database details, statistics, session counts, uptime, and a configuration-warnings panel that includes open-relay detection) and the per-account rule criteria and action editor are validated and wired into navigation. Windows x64 only: one installer, hMailServer-6.2.5-x64.exe, bundling the server, the Control Panel and the .NET 8 Desktop Runtime bootstrapper. Full release notes, checksums and signatures

The Control Panel gained a read-only Active Directory browser, which was the last functional-parity item left from the classic Administrator. The whole product is stamped 6.2.4: the server, the Control Panel window header and About page, and the installer all report the same version. Active Directory account pickers Services/ActiveDirectoryService.cs enumerates every domain in the current forest from the RootDSE defaultNamingContext and the Partitions container's domain crossRefs, so there is no dependency on System.DirectoryServices.ActiveDirectory. A domain's users are searched with a single LDAP-escaped DirectorySearcher matching sAMAccountName, displayName, mail and userPrincipalName. It is built on System.DirectoryServices, which net8.0-windows resolves from the Windows Desktop shared framework the installer already bundles. On a machine that is not domain-joined it reports the reason instead of throwing. Account then Directory carries "Browse Active Directory…". The picked account fills ADDomain and ADUsername and ticks linked to Active Directory. Distribution-list recipients gained "Add from AD…", which multi-selects accounts and imports their e-mail addresses into the list. Validated end to end against a live domain controller (progressiverobot.local): domain enumeration, the all-users query and the name and e-mail filters all returned the expected results. Other changes A generic TargetInvocationException from the server is now unwrapped and the real cause explained: connect with the server-administrator account, or the server cannot reach its database. That is what produced the misleading "26 settings could not be read" message on the Protocols page over a non-admin connection. The vendored MariaDB Connector/C client (libmysql.dll and its auth plugins) is staged into the build output by the server post-build step, so MySQL and MariaDB back ends work out of the box. The About page carries maintainer and company details. The Control Panel requires the .NET 8 Desktop Runtime, which the installer bundles and installs silently when missing. Full release notes, checksums and signatures

6.2.3 is the first server-focused release since 6.2.2, which shipped Control Panel changes against an unchanged server. The headline is a complete Sieve filtering subsystem (RFC 5228) with an optional ManageSieve service (RFC 5804), running alongside the existing proprietary rules engine. Every new behaviour is additive and default-off, so an existing installation upgraded with no functional change until the new settings were turned on. What the upgrade involved The installer no longer ships the classic Administrator. The .NET 8 Control Panel is the sole bundled GUI and needs the .NET 8 Desktop Runtime, which the installer carries and installs silently when missing. DBSetup, DBUpdater and the Data Directory Synchronizer are retained. Sieve and ManageSieve RFC 5228 parser covering if/elsif/else/stop, the core tests (header, address, exists, size, allof, anyof, not, with :is/:contains/:matches), address parts, the default and i;octet comparators, and keep/fileinto/discard/redirect plus implicit keep. Evaluated during local delivery. An account with no script has zero overhead. An unparseable script is logged and falls through to keep rather than breaking delivery. Scripts stored per account under {DataDirectory}\Sieve\{domain}\{localpart}\ and exposed as Account.SieveScript, Utilities.CheckSieveSyntax and Utilities.EvaluateSieveScript. The account dialog gained a Sieve editor tab. ManageSieve listener on [Settings] ManageSieveServerPort, disabled by default, with SASL PLAIN against the normal account database. SMTP BATV (prvs) backscatter protection, wire-only so SPF and DKIM stay aligned. Off by default via BATVEnabled / BATVSecret. CHUNKING / BDAT (RFC 3030). DATA after BDAT is rejected 503, a non-numeric chunk size 501. The existing DATA path is untouched. Operability /livez, /readyz and /healthz on the metrics listener, plus Prometheus series for pool state, query latency, TLS handshakes, auth success and failure, delivery outcomes and command latency. New keys, all defaulting to 0: SlowQueryLogMilliseconds, ShutdownDrainSeconds, MessageStoreFsync, MessageStoreConsistencyCheck, LogDeleteDays. The Received header now carries an RFC 5321 id clause equal to the numeric TCP session id, and that id prefixes every line of the session log. Full release notes, checksums and signatures

The server binary is unchanged from the original 6.2.2. Everything new in this installer, apart from two pieces of authentication hardening, is a substantial upgrade to the Control Panel, the .NET 8 admin app. Server Full RFC 4013 SASLprep for non-ASCII SASL credentials: RFC 3454 mapping, Unicode NFKC normalization, the complete prohibited-output tables (C.2.1/C.2.2, C.3 to C.9) and the RFC 3454 section 6 bidirectional check. NFKC is a no-op on ASCII, so existing credentials are unaffected. Automated RS256 public-key OAuth2 bearer-token regression coverage over POP3 and SMTP, including a tampered-signature rejection check. Control Panel A new Advanced hardening page exposes previously hidden hMailServer.INI knobs: greylisting expiration, SpamAssassin and ClamAV scanner timeouts, DNS cache/server/DNSBL timing, authenticated-user IP replacement, the AUTH disable list, X-AuthUser and X-OriginalRcptTo headers, blocked-IP hold, envelope-from rewrite, and a password-hash-algorithm picker covering Argon2id, PBKDF2, SHA-256, MD5 and Blowfish. The anti-virus page gains live "Test ClamAV connection", "Test ClamWin scanner" and "Test custom scanner" checks, a preset picker for Microsoft Defender, Sophos, ESET, Bitdefender and Kaspersky, and ClamWin auto-detect. Event scripts get an "Insert template" picker with ready-made OnAcceptMessage handlers for an external AV/DLP scanner, a SIEM/Slack/Teams webhook and an external HTTP API verdict. Search and filter on the long list pages: Domains, Accounts, Rules, Delivery queue, TCP/IP ports, SSL certificates, IP ranges and Routes. Deleting aliases, distribution lists, list recipients and incoming relays now prompts for confirmation, and the Domain, Account and Route dialogs report bad numeric input instead of dropping it silently. Cached settings pages refresh on navigation, empty and error placeholders are standardised across the list and grid pages, and the overloaded Advanced group is split into Security, Network and Maintenance. Unhandled errors are logged to %LOCALAPPDATA%\hMailServer\ControlPanel with a restart offered. Screen-reader names on icon-only controls, search boxes and the navigation tree, and a stable AutomationId on every navigation node and data-driven settings editor, took the in-app UI-automation audit from grade F to grade A. Builds clean at 0 warnings and 0 errors. The Control Panel requires the .NET 8 Desktop Runtime, which the installer bundles. Full release notes, checksums and signatures

6.2.1 completed Track B4, the deliverability and modern SMTP standards work. It added four ESMTP extensions, SRS for forwarded mail and SMTP rate shaping. PIPELINING (RFC 2920) advertised in EHLO. SMTPUTF8 / EAI (RFC 6531/6532): internationalised addresses accepted and relayed. ENHANCEDSTATUSCODES (RFC 2034): x.y.z codes on ESMTP replies. DSN (RFC 3461/3464): RET, ENVID, NOTIFY and ORCPT accepted. Per-recipient NOTIFY is honoured, and NOTIFY=NEVER suppresses failure DSNs. SRS (Sender Rewriting Scheme): HMAC-signed, reversible envelope rewrite on forwarding, for SPF alignment. Bounces are decoded back to the original sender. Opt-in via [Settings] SRSEnabled and SRSSecret. SMTP rate shaping, per-IP and per-destination, via [Settings] MaxSubmissionsPerIPPerMinute and MaxOutboundPerDestinationPerMinute. Both default to off. One fix: Unicode::WideToMultiByte returned a trailing NUL that could corrupt DPAPI-protected stored secrets. The result is now trimmed to the exact byte length. Everything new here defaults to off and is back-compatible, so the release changed nothing about an existing configuration until a setting was turned on. The build was clean, 0 warnings and 0 errors, with the SMTP regression suite and the in-server self-tests green. Full release notes, checksums and signatures

hMailServer 6.2.0 introduces the hMailServer Control Panel, a new desktop administration application shipped alongside the full 6.x server. The .NET 8 Desktop Runtime is bundled and installed automatically when it is missing, so there are no separate downloads. The Control Panel A .NET 8 WPF application with Fluent/Windows 11 design (Mica window), light and dark themes, animated live charts, and the familiar navigation tree from the classic Administrator: Welcome, Status, Domains, Rules, Settings > Advanced, Utilities. Animated dashboard with KPI cards plus live delivery-throughput and session charts. Domains and accounts, with an account editor for quota, password, forwarding and vacation, plus aliases and distribution lists with member management. Delivery queue with Deliver now and Remove, plus live log streaming. Rules with a graphical IF/THEN editor covering criteria and actions. Settings: Protocols, Delivery, Routes, Anti-spam (SPF/DKIM/DMARC/greylisting/SpamAssassin), Anti-virus, Logging. Advanced: Auto-ban and SSL/TLS, Performance and scripting, SSL certificates, TCP/IP ports, IP ranges with a permission editor, Incoming relays, and DANE/DNSSEC, MTA-STS, ARC, TLS-RPT, ACME, REST API, web services and metrics. Utilities: Backup and restore, MX query, Server sendout, Diagnostics. Ctrl+K command palette, guaranteed text contrast, consistent spacing. The classic Administrator remains included. So does the Web Control Deck, the browser admin served at the REST listener root. Quality Server core 6.2.0 build 6 was validated by the full regression suite: 898/898 tests passing, zero failures, on a MariaDB backend with live SpamAssassin and ClamAV and TLS 1.2/1.3 end to end. Full release notes, checksums and signatures

6.1.0 is a user interface release. It adds the Web Control Deck, a web admin UI served directly by the built-in REST API listener, and rebuilds the desktop Administrator around a full light/dark theme engine. The server core is unchanged from 6.0.0 build 4 apart from the new web-page endpoint. Web Control Deck Enable RestApiPort in hMailServer.INI and browse to the server. No extra components are required. It carries a live dashboard with animated counters and session stats, domain and account management, retry and delete on the delivery queue, and publish-ready DANE TLSA records. Light and dark themes with a toggle. Sign-in uses the administrator credential. Administrator (desktop) Deep-space dark and clean light palettes applied across every pane and dialog, including dark window title bars, native dark scrollbars and themed menus Theme toggle in the View menu. It follows the Windows app-mode preference by default, and the choice is persisted Ctrl+K command palette, fuzzy-searching every settings page and jumping straight to it Modernised dashboard with glow accents, eased value animations and hover-highlight stat cards Installer Modern wizard branding, and it ships the WebAdmin payload. The release was validated by the full regression suite: 898/898 tests passing, zero failures, against a MariaDB backend with live SpamAssassin and ClamAV and TLS 1.2/1.3 end to end. Full release notes, checksums and signatures

6.0.0 is the first modernised release of the fork: 64-bit only, built with the VS2026 toolchain, with OpenSSL 4 and TLS 1.2 and 1.3 underneath. Build 4 is the production build, and it fixes the installer defect that made build 3 unusable on fresh installations. What the upgrade involved 6.0 was 64-bit only. The installer dropped the obsolete 2015-era UCRT, which had been included in Windows since Server 2016 / Windows 10. Upgrade notes and the full feature list are in the README. The installer fix Build 3 bundled VS2019-era VC++ runtime DLLs. The service loaded those instead of the current ones and crashed at startup with an access violation in msvcp140.dll on fresh installations. Build 4 ships the matching v145 (14.51) runtimes. Build 3 also fixed MySQL/MariaDB database creation, which was a script line-ending problem, and bundles libmysql.dll. What 6.0 brought OpenSSL 4, TLS 1.2 and 1.3 MTA-STS and DANE, with in-process DNSSEC validation ARC sealing and Ed25519 DKIM ACME (Let's Encrypt) built in REST admin API and Prometheus metrics IMAP MOVE, ID and SPECIAL-USE PBKDF2 password hashing The release was validated by the full regression suite: 898 of 898 tests passing, zero failures, run against a MariaDB (MySQL backend) instance, including live SpamAssassin, ClamAV with real EICAR detection, DMARC against live DNS, and TLS 1.2 and 1.3 end to end. Full release notes, checksums and signatures