---
title: "hMailServer 6.2.23-alpha2: Thunderbird could not save a single Sent copy"
url: https://www.hmailserver.co.uk/topic/28172/hmailserver-6.2.23-alpha2-thunderbird-could-not-save-a-single-sent-copy
author: "Progressiverobot"
published: 2026-09-04T17:45:14.000Z
updated: 2026-09-04T17:45:14.000Z
category: "Pre-release builds"
tags: ["release","prerelease","imap","security","smtp"]
site: hMailServer Community Forum
---

# hMailServer 6.2.23-alpha2: Thunderbird could not save a single Sent copy

This was an alpha. Everything in it shipped in 6.2.24. Nothing here should be installed today.

Thunderbird 128 and later could not save a single Sent copy. Every message went out over SMTP and nothing was ever stored, with only a per-machine client setting as a workaround (GitHub issue 53). Two ways a sender could steer the anti-spam tests are also closed here.

**What the upgrade involved**

This is an alpha because one of the fixes changes what a non-conforming client sees.

- **Relayed and fetched mail is now tested against a different address.** The Received parser takes the last observed address before `by`, ignores values marked as HELO-supplied, and keeps a header whose host name is not a valid domain name. If you sit behind an incoming relay and have tuned scores around the old behaviour, expect verdicts to move.
- **`MAIL FROM` straight after a STARTTLS handshake with no fresh `EHLO` now gets `503 Bad sequence of commands`**, as RFC 3207 section 4.2 requires. If you have a home-grown submission script that skips the second EHLO, this is the release that tells you.

**Changes**

- IMAP APPEND: once a client enables `UTF8=ACCEPT`, RFC 6855 lets it wrap the message as `UTF8 (~{n}` plus a closing `)`. The parser counted parentheses across the whole line and refused with `BAD APPEND Command requires at least 2 parameter` before reading a byte. The wrapper is now stripped ahead of the parser, including the non-synchronizing `~{n+}` form and later messages of a MULTIAPPEND.
- Anti-spam bypass: the parser took the first bracketed value after `from`, which is the HELO literal the client chose, and skipped any header whose host name was not a valid domain (`my_pc`). DNSBL, SPF and the HELO-host test could be skipped entirely. Two `assert(0)` on sender-reachable input are gone with it.
- `RSET` before `EHLO` no longer opens a transaction on its own. That had let `MAIL FROM` through with an empty HELO host, skipping the OnHELO/OnEHLO events.
- A PTR answer carrying the trailing dot (`1.0.0.127.in-addr.arpa.`) no longer empties the result. That had been failing open in the HELO and reverse-DNS spam tests.
- `hMailServer.exe` is built with `/guard:cf` in both configurations (GitHub issue 45).
- An unattended install whose database step fails now fails, rather than showing a suppressible message box and exiting 0.

Known limitation: the weekly C++ CodeQL analysis has not run since late August. It targets a self-hosted runner that is no longer registered.

[Full release notes, checksums and signatures](https://www.progressiverobot.com/hmailserver-downloads/)