---
title: "hMailServer 6.2.3: Sieve and ManageSieve filtering"
url: https://www.hmailserver.co.uk/topic/28196/hmailserver-6.2.3-sieve-and-managesieve-filtering
author: "Progressiverobot"
published: 2026-06-15T04:23:49.000Z
updated: 2026-06-15T04:23:49.000Z
category: "Announcements & releases"
tags: ["release","sieve","smtp","control-panel","windows"]
site: hMailServer Community Forum
---

# hMailServer 6.2.3: Sieve and ManageSieve filtering

6.2.3 is the first server-focused release since 6.2.2, which shipped Control Panel changes against an unchanged server. The headline is a complete Sieve filtering subsystem (RFC 5228) with an optional ManageSieve service (RFC 5804), running alongside the existing proprietary rules engine. Every new behaviour is additive and default-off, so an existing installation upgraded with no functional change until the new settings were turned on.

**What the upgrade involved**

The installer no longer ships the classic Administrator. The .NET 8 Control Panel is the sole bundled GUI and needs the .NET 8 Desktop Runtime, which the installer carries and installs silently when missing. DBSetup, DBUpdater and the Data Directory Synchronizer are retained.

**Sieve and ManageSieve**

- RFC 5228 parser covering if/elsif/else/stop, the core tests (header, address, exists, size, allof, anyof, not, with `:is`/`:contains`/`:matches`), address parts, the default and `i;octet` comparators, and keep/fileinto/discard/redirect plus implicit keep.
- Evaluated during local delivery. An account with no script has zero overhead. An unparseable script is logged and falls through to keep rather than breaking delivery.
- Scripts stored per account under `{DataDirectory}\Sieve\{domain}\{localpart}\` and exposed as `Account.SieveScript`, `Utilities.CheckSieveSyntax` and `Utilities.EvaluateSieveScript`. The account dialog gained a Sieve editor tab.
- ManageSieve listener on `[Settings] ManageSieveServerPort`, disabled by default, with SASL PLAIN against the normal account database.

**SMTP**

- BATV (prvs) backscatter protection, wire-only so SPF and DKIM stay aligned. Off by default via `BATVEnabled` / `BATVSecret`.
- CHUNKING / BDAT (RFC 3030). DATA after BDAT is rejected 503, a non-numeric chunk size 501. The existing DATA path is untouched.

**Operability**

- `/livez`, `/readyz` and `/healthz` on the metrics listener, plus Prometheus series for pool state, query latency, TLS handshakes, auth success and failure, delivery outcomes and command latency.
- New keys, all defaulting to 0: `SlowQueryLogMilliseconds`, `ShutdownDrainSeconds`, `MessageStoreFsync`, `MessageStoreConsistencyCheck`, `LogDeleteDays`.
- The Received header now carries an RFC 5321 id clause equal to the numeric TCP session id, and that id prefixes every line of the session log.

[Full release notes, checksums and signatures](https://www.progressiverobot.com/hmailserver-downloads/)