hMailServer 6.2.22-pre6: pre4 was withdrawn, a fresh install listened on nothing
-
This was the last pre-release in the 6.2.22 line. Everything in it shipped in 6.2.24. Nothing here should be installed today.
pre4 was withdrawn. Its installer could not create its own database: two SQL statements were written on consecutive lines, the script parser splits commands on a blank line, and SQL Server Compact, which a default install uses, rejected the pair as one command. The install succeeded, the service started, and it listened on nothing. Anyone who ran a fresh pre4 install was affected. The
v6.2.22-pre4tag still exists but has no release. Do not build from it.What the upgrade involved
This is pre-alpha. Nobody has run it on a production server, and the installer is smoke-tested on a throwaway CI runner only. Use a spare box. Upgrading from pre3 requires DBUpdater: the schema moves from 6019 to 6022 in three steps.
DMARC, brought up to DMARCbis
- The DNS tree walk (RFC 9989 §4.10) replaces the Public Suffix List for deciding organizational domain. Bounded at eight queries per domain, cached five minutes.
DmarcTreeWalkEnabled=0keeps the list, which is also used whenever a lookup fails transiently. - The
np=tag (RFC 9989 §5.5.4) is honoured, so the resolver now reports the RCODE to tell NXDOMAIN from NODATA. - Aggregate reports now emit the DKIM
<selector>and SPF<scope>from RFC 7489, never sent before.
Algorithms
- DKIM rsa-sha1 is refused (RFC 8301), on signing and verification. A domain configured to sign with it is signed rsa-sha256 instead and told so.
DkimAcceptSha1=1restores both halves. - DKIM keys below 1024 bits are refused (RFC 8301 §3.2).
- SPF void lookups are capped at two (RFC 7208 §4.6.4).
SpfVoidLookupLimitto change or disable.
Certificates and delivery
- ACME renewal begins two thirds through the certificate's lifetime with a one-day floor, instead of a fixed 30 days. ARI (RFC 9773) is consulted hourly and the CA's window wins when offered, clamped to a day before expiry.
- A full mailbox is refused at RCPT with 452 4.2.2, ending the backscatter to forged envelope senders.
RejectFullMailboxAtRcpt=0restores the old behaviour. QuotaWarningPercent(default 90, 0 disables) sends one notice per crossing. Schema 6022.
Operations
- Per-domain outbound relay, discussion #31. Order is route, then the sending domain's relay, then the server-wide relayer. Schema 6021.
- Queryable message trace, off by default. Schema 6020.
ArchiveRetentionDaysprunes ArchiveDir, 0 by default,.emlfiles only.
The DMARCbis aggregate-report namespace (RFC 9990) is not implemented. Reports remain the RFC 7489 form.
- The DNS tree walk (RFC 9989 §4.10) replaces the Public Suffix List for deciding organizational domain. Bounded at eight queries per domain, cached five minutes.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login