hMailServer 6.2.23-alpha2: Thunderbird could not save a single Sent copy
-
This was an alpha. Everything in it shipped in 6.2.24. Nothing here should be installed today.
Thunderbird 128 and later could not save a single Sent copy. Every message went out over SMTP and nothing was ever stored, with only a per-machine client setting as a workaround (#53). Two ways a sender could steer the anti-spam tests are also closed here.
What the upgrade involved
This is an alpha because one of the fixes changes what a non-conforming client sees.
- Relayed and fetched mail is now tested against a different address. The Received parser takes the last observed address before
by, ignores values marked as HELO-supplied, and keeps a header whose host name is not a valid domain name. If you sit behind an incoming relay and have tuned scores around the old behaviour, expect verdicts to move. MAIL FROMstraight after a STARTTLS handshake with no freshEHLOnow gets503 Bad sequence of commands, as RFC 3207 section 4.2 requires. If you have a home-grown submission script that skips the second EHLO, this is the release that tells you.
Changes
- IMAP APPEND: once a client enables
UTF8=ACCEPT, RFC 6855 lets it wrap the message asUTF8 (~{n}plus a closing). The parser counted parentheses across the whole line and refused withBAD APPEND Command requires at least 2 parameterbefore reading a byte. The wrapper is now stripped ahead of the parser, including the non-synchronizing~{n+}form and later messages of a MULTIAPPEND. - Anti-spam bypass: the parser took the first bracketed value after
from, which is the HELO literal the client chose, and skipped any header whose host name was not a valid domain (my_pc). DNSBL, SPF and the HELO-host test could be skipped entirely. Twoassert(0)on sender-reachable input are gone with it. RSETbeforeEHLOno longer opens a transaction on its own. That had letMAIL FROMthrough with an empty HELO host, skipping the OnHELO/OnEHLO events.- A PTR answer carrying the trailing dot (
1.0.0.127.in-addr.arpa.) no longer empties the result. That had been failing open in the HELO and reverse-DNS spam tests. hMailServer.exeis built with/guard:cfin both configurations (#45).- An unattended install whose database step fails now fails, rather than showing a suppressible message box and exiting 0.
Known limitation: the weekly C++ CodeQL analysis has not run since late August. It targets a self-hosted runner that is no longer registered.
- Relayed and fetched mail is now tested against a different address. The Received parser takes the last observed address before
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login