--- title: "Start here: hMailServer 6 is maintained, and this is its community forum" url: https://www.hmailserver.co.uk/topic/28217/start-here-hmailserver-6-is-maintained-and-this-is-its-community-forum author: "Progressiverobot" published: 2026-09-23T06:41:51.932Z updated: 2026-09-23T06:41:51.952Z category: "Announcements & releases" tags: ["announcement"] site: hMailServer Community Forum --- # Start here: hMailServer 6 is maintained, and this is its community forum hMailServer is a free, open-source (AGPL-3.0) mail server for Windows and Linux, and this is its community support forum, run by Progressive Robot Ltd, which maintains the hMailServer 6 line. The current release is hMailServer 6.3.8, released on 2 November 2026. 6.3.6 was the last release planned by date: the releases since are security releases, each cut from `master`, and the 6.3 line receives security fixes until 30 September 2027. 6.3.8 is a security release. It fixes vulnerabilities the project found in its own code, each a work item with a CVE request, and the four narrower cases of work item 78 that 6.3.7's notes left open; between them they reach back to 6.0.0's first beta. One of its fixes, work item 100's, was public on GitLab from 19 October 2026 and on `master` from 20 October 2026, a week before it was judged a vulnerability, longer than the project's rule of about a day between a fix becoming public and its release allows; the rule holds again after 6.3.8 (SECURITY.md, "What gets a release"). 6.3.8 also starts a server from the Helm chart, which the charts of 6.3.6 and 6.3.7 did not, and reaches MariaDB from the container image. Upgrade every server running 6.3.7 or earlier. ## What changed in hMailServer 6 hMailServer was created by Martin Knafve. In 2026 Progressive Robot Ltd forked it and released hMailServer 6.0.0 on 12 June 2026; this forum is the fork's. The original, Martin Knafve's, has since resumed development separately, with releases of its own (5.7.0 on 28 September 2026); [ForkAndOriginal.md](https://gitlab.com/hmailserver/hmailserver/-/blob/master/hmailserver/docs/ForkAndOriginal.md) says which is which. - **Platforms:** Windows 10 version 1607 or later, Windows 11 and Windows Server 2016 or newer, on x64. hMailServer 6.3.6 is the first release with an ARM64 installer, for Windows on ARM, and it is a preview: it has never run on ARM64 hardware, and a new ARM64 installation is set up against SQL Server or PostgreSQL, since SQL Server Compact has no ARM64 build. Linux on x86-64 and AArch64 since hMailServer 6.3.0, released on 10 September 2026. The Linux packages of hMailServer 6.3.8 are for both: a .deb for each of Debian 12 and 13 and Ubuntu 24.04 and an .rpm for each of Fedora 43 and 44, Enterprise Linux 9 and 10 and openSUSE Leap 16.0 and Tumbleweed, each built for that release, beside the generic .deb (Ubuntu 26.04's) and .rpm that an installed server's update check asks for, and an AppImage for each architecture. The AArch64 files are cross-compiled and tested under emulation: no AArch64 machine has run them. The container image, `registry.gitlab.com/hmailserver/hmailserver:6.3.8` (also tagged `6.3` and `latest`), is for linux/amd64 and linux/arm64. A Helm chart for Kubernetes is in the project's Helm repository, `https://updates.progressiverobot.com/helm/`, from 6.3.8 one that starts a server. - **Upgrades:** the hMailServer 6.3.8 x64 Windows installer upgrades in place every earlier release of this fork, and of the original hMailServer up to 5.6 and its 5.7 development builds up to schema 5708, keeping mail, accounts, domains and settings. It refuses the original's 5.7 releases (5.7.0 and its pre-release builds 2788 and 2843, 5.7.1 and 5.7.2) before it changes anything; the installers of 6.3.7 and earlier do not look, and must never be run over one: move such a server's mail over IMAP instead ([Migration.md](https://gitlab.com/hmailserver/hmailserver/-/blob/master/hmailserver/docs/Migration.md)). 6.3.8 is a security release: upgrade every server running 6.3.7 or earlier. It is signed by the project's GitLab pipeline, a signer compiled into every server from 6.3.4 on, so a server on 6.3.7 or 6.3.6 installs it by its live update, with its own file as its rollback image; a Windows service that runs as `NT SERVICE\hMailServer` has an administrator press Install update in the Control Panel on the server, and on 6.3.4 or 6.3.5 such a service still leaves the install to an administrator, by hand, once. On Linux, from 6.3.6 the live update applies it to the generic packages and the AppImages; from 6.3.4 or 6.3.5, or from a per-distribution package, install it with `apt`, `dnf` or `zypper`. A server from 6.2.28 to 6.3.3 trusts only the GitHub signer, and is upgraded by hand, once, as is a Linux server installed from 6.3.3's AArch64 packages or AppImages. Read "Before you upgrade" in [the 6.3.8 announcement](/topic/28278), and back up the database and the data directory first. - **Security:** TLS 1.2 and 1.3 only, with MTA-STS, DANE and DNSSEC validation enforced on outbound mail by default, and a built-in ACME v2 client for Let's Encrypt. Since hMailServer 6.3.4 a new installation offers STARTTLS on 25, 587, 110 and 143 with a self-signed certificate and requires TLS for sign-in from the Internet, and on Windows runs the service as `NT SERVICE\hMailServer`; an upgrade keeps what it had. - **Off by default:** the REST API, the browser Control Deck and the webmail at `/portal` stay off until `RestApiPort` is set. Since hMailServer 6.3.4 the database is the settings store, so it is set in the Control Panel on Windows or with `sudo hmailserver --set-setting RestApiPort=` on Linux, not by editing hMailServer.ini. Windows is the more complete platform: Linux has no Control Panel and no COM API. Since hMailServer 6.3.4 Linux runs event scripts too, in JavaScript rather than VBScript or JScript, once scripting is switched on, and per-domain DKIM is configured there over the REST API or on the Control Deck. Moving a Windows installation to Linux is not a supported migration: treat it as a new installation plus a mailbox-level migration. ## Where things are - **Downloads and release notes:** the [releases on GitLab](https://gitlab.com/hmailserver/hmailserver/-/releases) and [hMailServer downloads](https://www.progressiverobot.com/hmailserver-downloads/). https://updates.progressiverobot.com/download/ always leads to the newest stable release. Releases from 6.2.19 to 6.3.3, and from 6.3.5, carry Sigstore signatures, and the Windows installer is Authenticode-signed since 6.3.1, as is the ARM64 installer 6.3.6 adds. 6.3.4 carries no Sigstore bundle: its SHA-256 checksums are in a file signed with the release tags' SSH key. From 6.3.4 the installer and each package have an SBOM of their own; in 6.3.6 so do the AppImages and the source tarball, and SLSA build provenance names every file of the release by its SHA-256. The container image is signed with cosign, each platform's image with its SBOM attested to it. From 6.3.8 the release also carries its provenance as one line of JSON, `hmailserver-.intoto.jsonl`. "Verifying a release" in the [security policy](https://gitlab.com/hmailserver/hmailserver/-/blob/master/SECURITY.md#verifying-a-release) has the commands that check a download. The pinned release history topic in Announcements summarises every version. - **Documentation:** [hMailServer documentation](https://www.progressiverobot.com/hmailserver-documentation/), 37 chapters. - **Source code and issues:** [GitLab](https://gitlab.com/hmailserver/hmailserver); since 18 October 2026 the source and every release are mirrored on [GitHub](https://github.com/RainbowWizard-coder/hMailServer), where issues are off: they and merge requests stay on GitLab. Without a GitLab account, email a bug report or a question for the maintainers to the project's Service Desk address, [contact-project+hmailserver-hmailserver-86730559-issue-@incoming.gitlab.com](mailto:contact-project+hmailserver-hmailserver-86730559-issue-@incoming.gitlab.com): GitLab files the message as a confidential issue, which only the maintainers see, and their replies reach you by email. - **Forum pages:** [about](/about), [FAQ](/faq), [rules](/rules) and [how to ask](/how-to-ask). - **Categories:** [Announcements & releases](/category/1), [General support](/category/8), [Installation, migration & upgrades](/category/15), [Linux](/category/16), [Webmail, portal & Control Deck](/category/17), [TLS, certificates & deliverability](/category/18), [REST API & integrations](/category/20) and [Bug reports](/category/23). - **Commercial support:** [Managed hMailServer](/category/24), the [managed hMailServer page](https://www.progressiverobot.com/hmailserver-services/), [support plans](https://www.progressiverobot.com/support-plans) and [contact](https://www.progressiverobot.com/contact/). hMailServer has no per-mailbox fees and no paid tiers, and no answer on this forum depends on buying anything. ## Asking for help Post in [General support](/category/8) or the matching category, using the template in [how to ask](/how-to-ask): the exact version, the platform, the database and a log excerpt with credentials redacted, because the forum is public and indexed. Give the full build stamp on Windows (6.3.8.47 for hMailServer 6.3.8) or the exact package version on Linux. Never post a suspected security vulnerability in a thread or public issue. Report it privately, as the project's [security policy](https://gitlab.com/hmailserver/hmailserver/-/blob/master/SECURITY.md#reporting-a-vulnerability) says: open a [confidential issue on GitLab](https://gitlab.com/hmailserver/hmailserver/-/issues/new?issue[confidential]=true), check that it is still marked confidential before you submit it, and choose the Security template; or, without a GitLab account, email contact-project+hmailserver-hmailserver-86730559-issue-@incoming.gitlab.com, which GitLab files as a confidential issue. Give the version, the platform and enough detail to reproduce it.