---
title: "hMailServer 6.2.18: a stalled database bounced valid mail instead of retrying it"
url: https://www.hmailserver.co.uk/topic/28166/hmailserver-6.2.18-a-stalled-database-bounced-valid-mail-instead-of-retrying-it
author: "Progressiverobot"
published: 2026-08-12T05:29:19.000Z
updated: 2026-08-12T05:29:19.000Z
category: "Announcements & releases"
tags: ["release","bugfix","smtp","upgrade"]
site: hMailServer Community Forum
---

# hMailServer 6.2.18: a stalled database bounced valid mail instead of retrying it

A recipient lookup that failed because the database did not answer returned 550, exactly as a lookup that found nothing did. The two cases were indistinguishable inside the server, so a database briefly locked by a backup told the sending server that a valid mailbox did not exist and the mail was bounced instead of retried. That is mail loss with a delivery receipt. Anyone running against a database that stalls under backup, maintenance or load was affected. Those lookups now return 451.

**What the upgrade involved**

`DBConnectionAcquireTimeout` now defaults to 60 seconds rather than 0. It shipped disabled in 6.2.17 precisely because timing out an acquisition turned a slow database into a bounce. The 451 fix is what made it safe to turn on, but the pool deadline is live after this upgrade, so check the value if you set it explicitly.

**Bounded waits (GitHub issue 23, #24)**

- Outbound delivery sessions get an absolute ceiling, `ClientSessionCeiling`, 30 minutes, separate from the idle timeout. The idle timeout re-arms on every byte received, so a peer dribbling one byte at a time held a delivery thread indefinitely.
- ClamAV on the delivery path (GitHub issue 23) is bounded and reports a timeout rather than holding the thread.
- DNS queries, event scripts and external scanner processes (GitHub issue 24) are bounded by `DNSQueryTimeout` (10s), `ScriptTimeout` (60s) and `ExternalProcessTimeout` (300s).
- Work queue saturation is reported on a schedule and names the task holding each thread, with its session and peer IP.
- Pre-authentication IMAP command buffering is capped at 11 MB. An unauthenticated peer could previously buffer without limit.
- Backup restore validates the source archive before deleting the target. It deleted first, so a corrupt archive destroyed the data it was restoring over.

**Other**

A first static analysis pass fixed a buffer overrun on long paths in `GetExecutableName` and two MySQL path helpers, and a shadowed `fileExists` in `Logger::WriteLogFile` that made rotation test an uninitialised value.

A correction to the roadmap: ARC sealing is narrower than previously described. `Arc::Seal` sits after every early return in `DKIMSigner::Sign`, so relayed third-party mail is never sealed.

Discussion #18 is fixed and bounded, but not yet confirmed against the original reporter's Postfix/PMG setup. If you are affected, the per-stage timings in the troubleshooting guide will name the culprit in one log line. Please post it on the discussion.

[Full release notes, checksums and signatures](https://www.progressiverobot.com/hmailserver-downloads/)