---
title: "hMailServer 6.2.27: a stripped DS record turned a signed zone unsigned"
url: https://www.hmailserver.co.uk/topic/28181/hmailserver-6.2.27-a-stripped-ds-record-turned-a-signed-zone-unsigned
author: "Progressiverobot"
published: 2026-09-07T01:11:31.000Z
updated: 2026-09-07T01:11:31.000Z
category: "Announcements & releases"
tags: ["release","security","dns","schema","imap"]
site: hMailServer Community Forum
---

# hMailServer 6.2.27: a stripped DS record turned a signed zone unsigned

The DNSSEC validator that guards DANE and the SPF, DKIM and DMARC lookups treated a DS query answered with nothing as an unsigned delegation. That is exactly what an attacker stripping the DS in transit shows a resolver: a signed zone quietly became unsigned, and DANE and validated TXT went with it. Anyone relying on DANE or on DNSSEC-validated SPF, DKIM or DMARC was affected.

**What the upgrade involved**

Schema 6030 to 6031: one column on `hm_fetchaccounts`, added by the installer's database upgrade on every backend. From 6.2.25 or 6.2.26, run the installer. From earlier, read the 6.2.25 and 6.2.24 notes first.

**Security**

- A missing DS is now proved missing (RFC 4035 §5.2, RFC 5155 §8). The resolver keeps the authority section of a negative answer and requires the parent's proof there: an NSEC at the delegation name with NS set and DS clear, an NSEC3 whose hashed owner matches with the same bits, or an Opt-Out NSEC3 covering the hash, each signed by the parent's key.
- A proof that fails to verify, has expired, claims a DS exists, or belongs to another name is no proof, and a delegation without one under a signed parent is now Bogus and blocked rather than Insecure. An unsigned parent, or a resolver that cannot be reached, still yields Insecure. The chain result is exposed as `Diagnostics.DnssecChainStatus`.

**Mail flow**

- `FetchAccount.MirrorFolders` (schema 6031; "Mirror every folder" on an IMAP external account in the Control Panel) collects each remote mailbox into the local folder of the same name: every message byte for byte, with its `\Seen \Flagged \Answered \Draft \Deleted` flags, its internal date, and the remote hierarchy delimiter mapped to the local one. Nothing is delivered, so no rule, anti-spam or anti-virus touches a copy. Each folder records what it has collected, so a second poll takes only what is new. Days to keep messages 0 makes it a move.
- The Import Tool reads a Maildir: the INBOX and every Maildir++ folder beside it, with the flags the file names carry (`;2,` and `!2,` as well as `:2,`) and line endings made CRLF.
- An import into a folder a client has open now refreshes it, as a delivery does.
- `Migration.md` documents each route in and what it keeps: IMAP, mbox, Maildir, Outlook through IMAP (PST is deliberately not parsed), and bulk accounts.

[Full release notes, checksums and signatures](https://www.progressiverobot.com/hmailserver-downloads/)