If you run hMailServer on SQL Server Compact, the 6.2.25 installer told you the database could not be upgraded. It had been upgraded. Every Compact Edition upgrade through schema 6030 was reported as failed after it had succeeded (GitHub issue 114), and two seconds later the service ended and service recovery started it again. What the upgrade involved If the 6.2.25 installer failed on your database, that database is at schema 6030 with its foreign keys in place, and this installer finds nothing left to upgrade. If you restored a backup from before the attempt, the whole chain runs and the verification passes. From 6.2.24 or earlier, the 6.2.25 notes and the 6.2.24 notes before them describe what changes on the way, and everything there still applies. What was wrong After each upgrade script the database updater proves the schema changed by running a probe statement, and reads a failed probe as a missing object. The four probes for schema 6030, the foreign keys, used case when exists (subquery) in the SET expression. That is valid on SQL Server, MySQL and PostgreSQL. On SQL Server Compact it is an access violation inside the OLE DB provider, on a correct database with every constraint present. The server reported HM10045 Unknown error, the updater declared that Upgrade6029to6030MSSQLCE.sql had not created fk_hm_accounts_domain and blamed an [IGNORE-ERRORS] marker the statement does not carry. The fix The probes now read update hm_dbversion set value = value / (value - value) where not exists (select 1 from information_schema.table_constraints where constraint_name = '...' and constraint_type = 'FOREIGN KEY'). With the constraint present no row matches and nothing is evaluated. With it absent the one row matches and the division by zero fails the statement on every backend, leaving hm_dbversion untouched. The updater's message no longer asserts a cause it cannot see. It gives the backend's own words and says how to read them. This was reproduced from a Compact Edition database created at schema 6011 and upgraded with the shipped scripts: it reaches 6030 with all seventeen foreign keys, and the probe then faults the provider. build/check-db-scripts.ps1 now runs every probe through the provider the server uses, with a negative control that must fail, and a regression fixture runs them through the same COM path the updater takes. Both fail on the 6.2.25 statement. Full release notes, checksums and signatures

ACME issuance and renewal ended the hMailServer process (GitHub issue 93). Anyone running automatic certificates on 6.2.24 lost the service on every issuance and every renewal. Two calls in the ACME client handed the OpenSSL DLL a FILE* opened by the server's own C runtime: the DANE TLSA line logged straight after issuance, and the re-read of the existing private key at the start of every renewal (the default, AcmeReuseKey). With no OPENSSL_Applink export in the executable, OpenSSL does not return an error. It writes OPENSSL_Uplink(...): no OPENSSL_Applink to the Windows Application log under the source "OpenSSL" and calls TerminateProcess. The symptoms: an OpenSSL event whose message looks blank, a 7031 from the service control manager in the same second, no crash dump, and no "ACME (automatic)" certificate record. Both calls now go through OpenSSL's own file I/O, and the deployment runs before the TLSA line. If 6.2.24 issued you a certificate before it died, the files under Data\ACME are valid. 6.2.25 deploys them at its first ACME check after start-up and logs "issued but never deployed". What the upgrade involved The schema moves from 6025 to 6030 in five steps, one way. DBUpdater runs them in order and resumes from a partial upgrade; there is no downgrade. The 6029 to 6030 step adds seventeen FOREIGN KEY constraints with ON DELETE CASCADE and removes the orphan rows they would refuse. On a large database it reads every child table once, so plan for it like an index build. If you are on 6.2.21 or a 6.2.22/6.2.23 pre-release, read the 6.2.24 notes first. Everything there still applies. Behaviour that changes without a switch The Apple .mobileconfig profile is served over HTTPS only. Plain HTTP gets a 301 to the WebServicesHttpsPort listener, or a 403 when none is configured. A TLS-terminating proxy must send X-Forwarded-Proto: https. A Message-ID is added only to submissions (upstream #552). Relayed mail keeps its headers, so a filter counting on the header will now see messages without one. IMAP sequence numbers are stable within a session (upstream #602). Another session's expunge no longer renumbers a client's messages under it. Also fixed: two restarts at once, one over COM and one from an ACME deployment or backup restore, rebuilt the same queues under each other and could end in an access violation. Restarts now run in sequence. Full release notes, checksums and signatures

6.2.24 is the stable release of the work carried by the 6.2.22 pre-releases and the 6.2.23 alphas. If you are on 6.2.21, all of it arrives at once. The headline is mail that was being lost silently. A delegated IMAP APPEND, COPY or MOVE filed the bytes under the wrong account, and a delegated MOVE destroyed the only readable copy. Anyone using shared or delegated mailboxes was exposed. Thunderbird also had every Sent copy refused once UTF8=ACCEPT was enabled (GitHub issue 53). What the upgrade involved The schema moves from 6011 to 6025 in fourteen one-way steps. DBUpdater runs them in order and resumes from wherever a partial upgrade stopped. There is no downgrade: an older server refuses a newer database rather than misreading it. Take a database backup and a data-directory backup with your backend's own tools first. Step 6024 to 6025 rewrites hm_messages.messageflags from tinyint to smallint on MS SQL, SQL Server Compact and MySQL/MariaDB. That is a table rewrite on the largest table you have, holding locks for its duration, so size the maintenance window by your message count. PostgreSQL is already smallint and unaffected. Changes that take effect without a switch MAIL FROM or AUTH straight after the STARTTLS handshake, with no second EHLO, now gets 503 Bad sequence of commands. RFC 3207 has always required that EHLO. A home-grown submission script will find out here. For mail arriving through a relay or fetched from an external account, the DNSBL, SPF and HELO tests now run against the address the relay observed, not the first bracketed value in the Received header, which the sender could set. If you tuned scores around the old behaviour, expect verdicts to move. Mail is refused with a temporary error when free space falls below 100 MB (MinimumFreeDiskSpaceMB, Server settings). Set it to 0 for the old behaviour. Per-account out-of-office now honours the RFC 3834 suppressions that previously applied only to the domain-wide reply. Early-bound COM clients built against a 6.2.22 pre-release interop assembly must be recompiled. Anything built against 6.2.21, and all late-bound scripts, are unaffected. Two further anti-spam bypasses are closed. A forged header could steer a per-account spam override into un-marking the sender's own mail. RSET before EHLO, or STARTTLS without a fresh EHLO, opened a transaction with an empty HELO host, skipping the HELO-host test and the script events. Full release notes, checksums and signatures

This was an alpha. Everything in it shipped in 6.2.24. Nothing here should be installed today. Thunderbird 128 and later could not save a single Sent copy. Every message went out over SMTP and nothing was ever stored, with only a per-machine client setting as a workaround (GitHub issue 53). Two ways a sender could steer the anti-spam tests are also closed here. What the upgrade involved This is an alpha because one of the fixes changes what a non-conforming client sees. Relayed and fetched mail is now tested against a different address. The Received parser takes the last observed address before by, ignores values marked as HELO-supplied, and keeps a header whose host name is not a valid domain name. If you sit behind an incoming relay and have tuned scores around the old behaviour, expect verdicts to move. MAIL FROM straight after a STARTTLS handshake with no fresh EHLO now gets 503 Bad sequence of commands, as RFC 3207 section 4.2 requires. If you have a home-grown submission script that skips the second EHLO, this is the release that tells you. Changes IMAP APPEND: once a client enables UTF8=ACCEPT, RFC 6855 lets it wrap the message as UTF8 (~{n} plus a closing ). The parser counted parentheses across the whole line and refused with BAD APPEND Command requires at least 2 parameter before reading a byte. The wrapper is now stripped ahead of the parser, including the non-synchronizing ~{n+} form and later messages of a MULTIAPPEND. Anti-spam bypass: the parser took the first bracketed value after from, which is the HELO literal the client chose, and skipped any header whose host name was not a valid domain (my_pc). DNSBL, SPF and the HELO-host test could be skipped entirely. Two assert(0) on sender-reachable input are gone with it. RSET before EHLO no longer opens a transaction on its own. That had let MAIL FROM through with an empty HELO host, skipping the OnHELO/OnEHLO events. A PTR answer carrying the trailing dot (1.0.0.127.in-addr.arpa.) no longer empties the result. That had been failing open in the HELO and reverse-DNS spam tests. hMailServer.exe is built with /guard:cf in both configurations (GitHub issue 45). An unattended install whose database step fails now fails, rather than showing a suppressible message box and exiting 0. Known limitation: the weekly C++ CodeQL analysis has not run since late August. It targets a self-hosted runner that is no longer registered. Full release notes, checksums and signatures

This was an alpha. Everything in it shipped in 6.2.24. Nothing here should be installed today. Local delivery could lose a message with no trace. When the account-level copy could not be written, LocalDelivery reported HM5209 and returned, but the recipient row was deleted anyway and the queued message with it. The sender had already been given 250 and the recipient never heard of it. Anyone running a message store near full was exposed. The sender is now told. This is an alpha. Do not put it on a production mail server. What the upgrade involved The schema moves 6022 to 6025 in three registered steps, and it is one way. An older server refuses to run against a newer dbversion, so rollback needs a pre-upgrade database backup and a data-directory backup. The 6024 to 6025 step widens hm_messages.messageflags from tinyint to smallint on MS SQL, SQL CE and MySQL/MariaDB. That is a table rewrite on your largest table, holding locks throughout. Size the maintenance window to your hm_messages row count. PostgreSQL is unaffected. Silent upgrades with /VERYSILENT previously hung forever on a modal password dialog. Fixed. Five COM properties added during the 6.2.22 pre-releases were declared mid-interface, shifting the vtable on AntiSpam, Account, Application and GlobalObjects. They are appended now, restoring binary compatibility with 6.2.21. Late-bound scripts were never affected. Recompile anything early-bound against a 6.2.22 pre-release. Three new defaults change behaviour. MinimumFreeDiskSpaceMB=100 refuses new mail below the floor, 452 4.3.1 at MAIL FROM and NO [UNAVAILABLE] at IMAP APPEND. WindowsEventLogEnabled=1 forwards errors to the Windows Application log under the source hMailServer. DatabaseStatementTimeout=30 is untested on MySQL and PostgreSQL, the two backends it was built for. Existing per-account out-of-office replies now apply RFC 3834 suppression and stop answering bounces, list traffic and anything carrying Auto-Submitted or List-* headers. Also in this release PROXY protocol v1/v2 and XCLIENT in front of SMTP, so DNSBL, SPF, greylisting and auto-ban see the real client. Both ship off with empty trust lists. Shared and delegated IMAP mailboxes at #[email protected], gated on RFC 4314 ACLs. On by default, enableimapacl ships as 1. RFC 3030 BINARYMIME. Relay of a binary message is refused 554 5.6.3 rather than converted. RFC 3464 bounces. Every NDR is now multipart/report. Re-check anything parsing whole bounce bodies. External HTTP filtering hook (FilterHookUrl, FilterHookTimeoutSeconds default 10), plain HTTP only. Sender blacklist, per-account spam thresholds, distribution-list moderation, domain-wide out-of-office, IPv6 on the REST and metrics listeners. Full release notes, checksums and signatures

This was the last pre-release in the 6.2.22 line. Everything in it shipped in 6.2.24. Nothing here should be installed today. pre4 was withdrawn. Its installer could not create its own database: two SQL statements were written on consecutive lines, the script parser splits commands on a blank line, and SQL Server Compact, which a default install uses, rejected the pair as one command. The install succeeded, the service started, and it listened on nothing. Anyone who ran a fresh pre4 install was affected. The v6.2.22-pre4 tag still exists but has no release. Do not build from it. What the upgrade involved This is pre-alpha. Nobody has run it on a production server, and the installer is smoke-tested on a throwaway CI runner only. Use a spare box. Upgrading from pre3 requires DBUpdater: the schema moves from 6019 to 6022 in three steps. DMARC, brought up to DMARCbis The DNS tree walk (RFC 9989 §4.10) replaces the Public Suffix List for deciding organizational domain. Bounded at eight queries per domain, cached five minutes. DmarcTreeWalkEnabled=0 keeps the list, which is also used whenever a lookup fails transiently. The np= tag (RFC 9989 §5.5.4) is honoured, so the resolver now reports the RCODE to tell NXDOMAIN from NODATA. Aggregate reports now emit the DKIM <selector> and SPF <scope> from RFC 7489, never sent before. Algorithms DKIM rsa-sha1 is refused (RFC 8301), on signing and verification. A domain configured to sign with it is signed rsa-sha256 instead and told so. DkimAcceptSha1=1 restores both halves. DKIM keys below 1024 bits are refused (RFC 8301 §3.2). SPF void lookups are capped at two (RFC 7208 §4.6.4). SpfVoidLookupLimit to change or disable. Certificates and delivery ACME renewal begins two thirds through the certificate's lifetime with a one-day floor, instead of a fixed 30 days. ARI (RFC 9773) is consulted hourly and the CA's window wins when offered, clamped to a day before expiry. A full mailbox is refused at RCPT with 452 4.2.2, ending the backscatter to forged envelope senders. RejectFullMailboxAtRcpt=0 restores the old behaviour. QuotaWarningPercent (default 90, 0 disables) sends one notice per crossing. Schema 6022. Operations Per-domain outbound relay, GitHub discussion 31. Order is route, then the sending domain's relay, then the server-wide relayer. Schema 6021. Queryable message trace, off by default. Schema 6020. ArchiveRetentionDays prunes ArchiveDir, 0 by default, .eml files only. The DMARCbis aggregate-report namespace (RFC 9990) is not implemented. Reports remain the RFC 7489 form. Full release notes, checksums and signatures

This was the third pre-release in the 6.2.22 line. Everything in it shipped in 6.2.24. Nothing here should be installed today. Per-account two-factor authentication now works at the server. TOTP has been in this product for years and protected exactly one thing: the Control Panel's own logon, checked after the server had already accepted the password. The server had no idea the feature existed. It does now (schema 6017). Once a secret is enrolled, the account password stops being a mailbox credential and an app password becomes the only one. What the upgrade involved Upgrading from pre2 requires DBUpdater. The database schema moves from 6015 to 6019 in four steps. Password expiry ships with a caveat: this server has no self-service password change, so an expired password can only be reset by an administrator. Existing app passwords keep working, Active Directory accounts are exempt, and an unreadable stamp is never treated as expired. App passwords (schema 6016). A per-account credential, revocable on its own, that authenticates over IMAP, POP3 and SMTP alongside the account's own password. 20 symbols from a 30-character alphabet, about 98 bits, from OpenSSL's CSPRNG. They are tried only after the account password has failed. Password policy. IsStrongPassword has existed for years and nothing in the server has ever called it. Every mailbox on every installation could be test. Five settings now decide, plus one rule that is always on: a password may not contain the account name. Enforced where a password is chosen, never where an existing one is verified. Quarantine (schema 6018). Refused messages can now be held in a store an administrator can list, read, release or delete, with a review queue in the Control Panel. Quarantining answers 250 instead of 550, so the sender will not retry and this store is the only place the message exists. A quarantine that fails to store falls through to refusing. Off by default. IMAP and POP3. FETCH BINARY on a composite section returned an empty literal and BINARY.SIZE agreed with it. Documented as a limitation in pre2, fixed here. BINARY now announces content with literal8 (~{n}) as RFC 3516 requires. POP3 answers EXPIRE with NEVER and can enforce LOGIN-DELAY (RFC 2449). Off by default. OAuth2. ES256 tokens now verify. JWS carries an ECDSA signature as a raw R||S pair while OpenSSL verifies X9.62 DER. A key that does not match the algorithm named is refused on the key type. A valid ES256 token is still refused while the allow-list omits it. Full release notes, checksums and signatures

This was the second pre-release in the 6.2.22 line. Everything in it shipped in 6.2.24. Nothing here should be installed today. hMailServer has consumed DMARC policy for years and produced nothing for the domains whose mail it receives. This pre-release adds DMARC aggregate reporting (rua, RFC 7489). Every evaluation is aggregated per UTC day and per policy domain, passes included, and the Appendix C XML is mailed to the addresses a domain asks for with rua=. It stays inert until DmarcRptFromAddress is set. What the upgrade involved The database schema moves to 6015. Upgrading from pre1 requires DBUpdater. Known limitations: FETCH BINARY on a composite section returns an empty literal, so BINARY[], multipart and message/rfc822 sections come back empty (leaf parts are correct). DMARC report data lives in memory, so a restart before the daily send loses that day's statistics. Reporting RFC 7489 §7.1 external-destination verification is enforced. A rua target outside the policy domain's own organizational domain is used only when <policy-domain>._report._dmarc.<target-domain> says it wants the reports. Forensic (ruf) reports are deliberately not implemented. Utilities.SendTlsRptReports(IncludeCurrentDay) and its twin SendDmarcReports send what has been collected so far, not just days that are over. Both refuse, statistics preserved, when the From address is unset. Authentication AccountLockoutThreshold counts failures by the name being guessed at, so a distributed attack that never crosses any single IP's auto-ban threshold is still caught. Off by default, enforced on every path including SCRAM. A locked name gets the ordinary invalid-credentials reply, and that refusal is kept out of the per-IP auto-ban. POP3 AUTH-RESP-CODE (RFC 3206): credential failures carry [AUTH], a failed inbox load carries [SYS/TEMP]. A transient database problem made scheduled clients nag for a password that was never wrong. Anti-virus A scan that could not run was delivered with one line in the error log, indistinguishable from a clean scan. AVFailAction 0 (the default) keeps today's behaviour. 1 holds the message, re-attempts it and returns it to the sender rather than delivering it unscanned. IMAP BINARY (RFC 3516) decodes a part's Content-Transfer-Encoding server-side, and APPEND accepts the literal8 (~{n}) form. OBJECTID (RFC 8474): EMAILID follows a message through copies, MAILBOXID survives RENAME, THREADID is answered NIL. Fixes /Test no longer terminates on an unhandled exception when the machine has no network or a third party's DNS breaks. An idle server stops in about half a second rather than up to two. Nine settings reachable only by editing the ini now have Control Panel fields. Full release notes, checksums and signatures

This was the first pre-release in the 6.2.22 line. Everything in it shipped in 6.2.24. Nothing here should be installed today. The built-in ACME client has never completed an order against a real Let's Encrypt. If you issued certificates through hMailServer rather than an external client, it failed every time. That is fixed here (GitHub issue 34). What the upgrade involved This is a pre-release. Take a backup before installing it. Databases upgrade automatically from schema 6012 to 6014 via the bundled DBUpdater. ACME (GitHub issue 34) Boulder, the software behind Let's Encrypt staging and production, pretty-prints its JSON: "type": "http-01", with a space after the colon. The challenge locator searched for the compact form, "type":"http-01", which can never match a real response. Every issuance failed at the first authorization with "Authorization offers no http-01 challenge". The locator now tolerates any whitespace and checks that the string is genuinely a type key's value, and the real CA response shape is pinned by self-tests. Failure messages now name the domain they concern, and the no-challenge refusal includes the CA's actual response. Log lines going missing (GitHub issue 33) With Keep log files open enabled, each line sat in a ~4 KB write buffer until later lines pushed it out. On a quiet server the tail of a session stayed invisible; the reporter measured forty minutes. The logger now hands every line to the operating system as it is written. Installations without the setting were never affected. Microsoft 365 Microsoft shuts off Basic authentication for SMTP relay in December 2026. XOAUTH2 bearer login is implemented for outbound relay and for POP3 collection from external accounts. Tokens use the client-credentials flow and are cached to 80% of their lifetime. Bearer auth applies only to destinations on the configured OAuth host list; unlisted relays keep password login unchanged. POP3 collection has no password fallback, deliberately. Sieve and IMAP Sieve now implements variables (RFC 5229), editheader (5293), duplicate (7352), reject/ereject (5429), include (6609), enotify (5435), date/currentdate (5260), spamtest (5235), mailboxexists and :regex. ManageSieve gains RENAMESCRIPT and machine-readable response codes. Eleven IMAP extensions, including APPENDLIMIT (7889), LITERAL- (7888), LIST-STATUS (5819), UNAUTHENTICATE (8437), QUOTA=RES-STORAGE (9208), PREVIEW (8970), MULTIAPPEND (3502), REPLACE (8508), SAVEDATE (8514, schema 6013) and METADATA (5464, schema 6014). The delivery client now opens with EHLO on every delivery, not just routes needing TLS or authentication, and declares SIZE (RFC 1870). Still unimplemented: BINARYMIME, IMAP BINARY, CATENATE/URLAUTH, COMPRESS=DEFLATE, OBJECTID and outbound PIPELINING/CHUNKING. Equal-preference MX records are still not randomised (RFC 5321 5.1). Full release notes, checksums and signatures

Inbound mail from a Postfix-based relay could hang forever. The connection logs 354 OK, send., stops dead, and the sender eventually gives up with "timed out while sending end of data", leaving a zero-byte file in the Data folder. Anyone taking mail from Postfix or a Proxmox Mail Gateway was affected, and a same-host relay hits it almost every time. Three previous releases claimed to fix it and did not. This one was settled by running a real Postfix 3.10 against the server and reading the bytes on the wire. What the upgrade involved Two known issues stand. Equal-preference MX records are not randomised (RFC 5321 5.1); the server always tries them in the order the resolver returned, and a comment and COM help string that claimed otherwise have been corrected. One-click unsubscribe (RFC 8058) is not implemented. RFC 2369 List-* headers are still emitted for distribution-list postings. Changes Postfix pipelines the terminating dot and QUIT into one segment, so the terminator sits mid-buffer and every tail-only end-of-data check missed it. The receive path now searches for <CRLF>.<CRLF> anywhere in what arrived and returns the remainder to the command parser. Bare-LF terminators are still recognised only at the very end of the buffer, with anything behind them discarded, which is the CVE-2023-51764 rule. SMTP dot transparency (RFC 5321 4.5.2) now carries line-start context across buffer boundaries in both directions. Previously a line-leading dot landing a byte or two into a chunk went unstuffed, silently truncating messages. Sieve scripts were left behind by domain and account renames and deletes. Recreating an address could reactivate the previous holder's filter, redirects included. Renames now move the Sieve tree, deletes remove it, and the Control Panel writes the script only after the save succeeds. Sieve body test (RFC 5173) implemented and advertised over ManageSieve, with :text, :content and :raw. SORT () US-ASCII ALL spun a connection thread at 100% of a core forever. Empty sort criteria are now rejected per RFC 5256. The 512 MB message-list cache never evicted and only counted upwards. Eviction now measures entries as they are. Malformed DNS answers are retried once over TCP. The Control Panel MX tool (GitHub issue 29) now uses the server's resolver via Utilities.ResolveMXRecords. Control Panel: seven Administrator functions restored, plus Welcome page icon alignment (GitHub issue 30). Everything in the 6.2.20 notes is in this release too. Full release notes, checksums and signatures

6.2.20 fixes a fresh-install failure introduced in 6.2.19. Database creation failed on a new install, and the installer then hung instead of reporting the failure. Fresh installations of 6.2.19 on the built-in database, which is the default, were affected, and most likely fresh installations onto MySQL. What the upgrade involved Upgrades of an existing installation were never affected. Upgrades run the upgrade scripts, and those were clean, and existing servers already have their databases. Only fresh installs hit this. If an unattended 6.2.19 install is still sitting there doing nothing, it is waiting on a message box. What was wrong The SQL script runner splits a script into commands on blank lines. SQL Server Compact, the embedded database a fresh install uses, executes one statement per command and refuses a batch. A recent change added settings to the create scripts with a single newline between inserts, so three statements arrived as one command. Full SQL Server accepts that batch, so the development database and the 1,490-test regression suite saw nothing wrong. The same adjacency was in the MySQL and PostgreSQL create scripts. All three are fixed, and a mechanical sweep of all 199 SQL scripts confirms no multi-statement command remains in any create script or any SQL CE script. Five upgrade scripts from the 5.x era keep their batches for the full-server backends that accept them. The error raised a plain message box, and /VERYSILENT /SUPPRESSMSGBOXES suppresses only the suppressible kind. A silent install did not report the failure, it waited on a dialog with nobody at the keyboard. In CI that was ninety minutes until a person cancelled it. All 28 dialogs in the installer now take their default button under /SUPPRESSMSGBOXES, and the installer proceeds to an exit code a deployment script can read. Interactive installs see exactly the dialogs they always saw. Also in this release IMAP THREAD (RFC 5256), both algorithms, THREAD=ORDEREDSUBJECT and THREAD=REFERENCES, with real References-chain threading. It is bounded by the same per-command ceilings as SEARCH and SORT. An adversarial review found and fixed a stack overflow reachable through a deep reply chain, an uninterruptible header pass and a malformed-Date sort inversion. The installer smoke test now bounds the silent-install step at ten minutes, keeps the installer's own log, and on a database failure re-runs the setup tool and prints its stderr. Full release notes, checksums and signatures

Fresh installations of this build failed. Database creation broke on the built-in SQL Server Compact backend, which is the default, and most likely on MySQL, and a silent install then hung on a hidden message box instead of reporting the failure. Upgrades of existing installations were unaffected. 6.2.20 fixed both. For anyone already running it: if a custom DNS server was configured, every DNS lookup hMailServer made had been failing since 6.2.16. This release fixed that. Installations with no custom DNS server were never affected, because the server list is only built when one is set. 6.2.16 moved name resolution onto the asynchronous DnsQueryEx and gave the custom-DNS-server entry a destination port of 53. A DNS_ADDR carries a full SOCKADDR, so setting the port looks correct. It is not: the DNS client supplies the port itself, and with port 53 every query returns status 87 and no records. MX lookups for outbound delivery, DNSBL, SPF and SURBL all failed. It surfaced loudest as HM5507 The IP address for SpamAssassin could not be resolved, which is how #25 came in. A regression test now points DNSServer at TEST-NET-1 (192.0.2.1) and requires the lookup to time out; a timeout proves a packet left the machine. What the upgrade involved The database schema moves from 6005 to 6011. DBUpdater applies it. Take a backup first. Settings are preserved. The [Settings] INI values move into the database for remote administration; the file still wins where both carry a value. Also in this release Active Directory can now create accounts, not just link them. Settings.PreviewDirectorySync and Settings.ApplyDirectorySync read an LDAP directory and create or update the mailboxes it says should exist, with a Control Panel page and an optional unattended schedule. A domain takes part only if its Active Directory domain name is set, so provisioning is opt-in per domain. Nothing is ever deleted. Sieve imap4flags now reaches the message. setflag, addflag, removeflag and the :flags tag were parsed and evaluated, then discarded at delivery. They are now applied to the stored message, and imap4flags has moved into the ManageSieve capability line. Only the five system flags can be stored; a keyword is logged rather than dropped in silence. GetUniqueMessageID could hand out the same UID twice, which makes a client show one message in place of another. An account address containing a colon accepted mail at RCPT TO, then failed when the message was filed: the local part becomes a directory name in the message store. Known issue: #26, partial FETCH BODY[]<offset.length> against 6.2.18, does not reproduce here against new tests that reassemble whole messages from chunks over FETCH and UID FETCH. If you can still reproduce it, post an IMAP protocol log. Full release notes, checksums and signatures

A recipient lookup that failed because the database did not answer returned 550, exactly as a lookup that found nothing did. The two cases were indistinguishable inside the server, so a database briefly locked by a backup told the sending server that a valid mailbox did not exist and the mail was bounced instead of retried. That is mail loss with a delivery receipt. Anyone running against a database that stalls under backup, maintenance or load was affected. Those lookups now return 451. What the upgrade involved DBConnectionAcquireTimeout now defaults to 60 seconds rather than 0. It shipped disabled in 6.2.17 precisely because timing out an acquisition turned a slow database into a bounce. The 451 fix is what made it safe to turn on, but the pool deadline is live after this upgrade, so check the value if you set it explicitly. Bounded waits (GitHub issue 23, #24) Outbound delivery sessions get an absolute ceiling, ClientSessionCeiling, 30 minutes, separate from the idle timeout. The idle timeout re-arms on every byte received, so a peer dribbling one byte at a time held a delivery thread indefinitely. ClamAV on the delivery path (GitHub issue 23) is bounded and reports a timeout rather than holding the thread. DNS queries, event scripts and external scanner processes (GitHub issue 24) are bounded by DNSQueryTimeout (10s), ScriptTimeout (60s) and ExternalProcessTimeout (300s). Work queue saturation is reported on a schedule and names the task holding each thread, with its session and peer IP. Pre-authentication IMAP command buffering is capped at 11 MB. An unauthenticated peer could previously buffer without limit. Backup restore validates the source archive before deleting the target. It deleted first, so a corrupt archive destroyed the data it was restoring over. Other A first static analysis pass fixed a buffer overrun on long paths in GetExecutableName and two MySQL path helpers, and a shadowed fileExists in Logger::WriteLogFile that made rotation test an uninitialised value. A correction to the roadmap: ARC sealing is narrower than previously described. Arc::Seal sits after every early return in DKIMSigner::Sign, so relayed third-party mail is never sealed. Discussion #18 is fixed and bounded, but not yet confirmed against the original reporter's Postfix/PMG setup. If you are affected, the per-stage timings in the troubleshooting guide will name the culprit in one log line. Please post it on the discussion. Full release notes, checksums and signatures

If your server accepts inbound mail from a trusted relay, a Proxmox/Postfix front end for example, and you run SpamAssassin, messages could stall after end-of-data and never get a 250. Reception was never the problem. The stall was in the accept/save work that runs after the terminating dot and before the reply. What the upgrade involved No database change. Schema version stays at 6005. The same audit found other unbounded waits, not fixed here: synchronous DNS lookups in the spam tests have no application-level timeout, the database connection pool has no acquisition deadline, event scripts have no execution limit, and the ClamAV read/write timeout on delivery is ineffective. Why it only ever hit relayed mail For a trusted incoming relay, hMailServer defers the whole spam battery to after end-of-data. For a direct or authenticated sender those tests run earlier, during MAIL FROM/RCPT TO, on the connection thread. The post-DATA work runs on a bounded pool, 15 threads by default, and holds the thread that sends the 250. SpamAssassin's wait had no overall ceiling: the connection's idle timeout is re-armed on every byte received, so a scanner that stalls or dribbles holds the thread indefinitely. Against a blackholed SpamAssassin endpoint, one message was acknowledged after 120 s. Eighteen concurrent messages produced zero acknowledgements: 15 workers blocked, the rest with no worker at all. The fixes SpamAssassin's wait is bounded. Hard ceiling of SAMaxTimeout + 30 s, after which the message is accepted without a verdict, the same outcome as spamd being down. New FinalizationTimeout, default 240 s, inside Postfix's 600 s data-done timeout, 0 disables it. Acceptance past that answers 451 4.3.1 and the sender retries. The check runs on the accepting thread and only before anything is saved, so it cannot duplicate mail. Acceptance is timed per stage and each spam test timed individually. A slow stage is logged at APPLICATION level, not only under debug: Spam test: SpamTestSpamAssassin, Score: 0, Time: 120031 ms. Upgrading is enough to turn silent stalls into either a completed delivery or a clean 451 retry. Enable debug logging and the per-stage timings name the scanner, DNS lookup or event script responsible. Also in this release: regression coverage for clients that vanish mid-operation (aborted DATA, truncated BDAT, IMAP APPEND literals cut short, POP3 disconnects during RETR), plus an installer smoke test on a clean machine. Full release notes, checksums and signatures

The Control Panel raised an error dialog every time you dismissed the Ctrl+K settings palette (GitHub issue 21, reported by grumpymojo). It was present in both 6.2.14 and 6.2.15, and because choosing a result and pressing Esc both went through the same path, it appeared on essentially every search rather than on any particular search term or configuration. What the upgrade involved No server change and no database change. Schema version stays at 6005. Anyone coming from 6.2.14 or earlier should read the 6.2.15 notes as well, because everything in them applies here. Fixed Closing the palette moves the focus away, which raised the deactivation handler while the close was still in progress, and that handler closed the window a second time. WPF refuses that outright: System.InvalidOperationException: Cannot set Visibility to Visible or call Show, ShowDialog, Close, or WindowInteropHelper.EnsureHandle while a Window is closing. The deactivation handler now closes the palette only when a close is not already under way. Nothing was lost to this defect. The navigation had already happened by the time the dialog appeared, so no setting was misapplied. It was noise in the one feature added to make settings easier to find. Still open at this release Discussion #18, the stall after 354 when relaying from Postfix or Proxmox Mail Gateway, remained open and unreproduced. 6.2.15 added debug logging to the SMTP DATA path that distinguishes the three candidate stages, and that log is what will identify the cause. Tracked in #20. Validated by the full regression suite: 1040 of 1040 passing, zero failures. The download is hMailServer-6.2.16-x64.exe. Full release notes, checksums and signatures

The IMAP sequence-set parsers only recognised * as the end of a range. Anywhere else it was parsed as zero, so UID STORE *:* +FLAGS (\Deleted) flagged every message in the mailbox, UID EXPUNGE * deleted every \Deleted message, and FETCH * returned nothing while answering OK. Any client using * outside a range was affected. What the upgrade involved No database change. The schema stays at version 6005. Issue #18 is not fixed and remains open, see #20. All four sequence-set parsers now resolve * on either side of a colon and normalise descending ranges, so 3:1 is the same set as 1:3, per RFC 3501. Twelve regression tests cover it, all twelve failing against 6.2.14. Also fixed: Restoring messages emptied the live data directory before checking the backup's message store existed. A settings-only backup restored with the messages option ticked, or a failed extraction, left an empty data directory and the only copy of the mail in a GUID-named temporary folder. It now checks first. A message whose file could not be read hung the outbound connection after the remote answered 354, idle until the client timeout of up to ten minutes, then re-queued and repeated. It now fails immediately. Only a genuinely missing file fails the delivery permanently. BDAT exact-length reads padded short chunks with NUL bytes. A sender announcing BDAT 100000 LAST that vanished after 40,000 octets had the truncated message delivered as complete. DKIM signing hashed the header name in lower case while writing it capitalised (upstream PR 530), so signatures using simple canonicalization failed strict verifiers. Several paths left files with no database row: rejected POP3 RETR, header rewrites leaving .eml.tmp, downloads with no local recipient, unsendable bounces. The account cache had no size cap. ManageSieve now disconnects after three failed authentication attempts and registers them with auto-ban. STATUS (RECENT) reported the selected folder's count for every folder. Settings configurable only in hMailServer.ini gained Control Panel pages: authentication, administrative access, DNS resolver, web services and autoconfiguration, and the consistency scan results. Full release notes, checksums and signatures

A message file that could not be written was treated as success. IMAP APPEND answered OK [APPENDUID ...] for messages that were never stored, so Sent Items copies, drafts and migration uploads were lost while the client showed them saved. Anyone hitting a full volume, or a file locked by antivirus or backup, lost mail silently. A failed message copy killed the delivery task in local delivery, forwarding, Sieve redirect and mirroring, leaving the message locked in the queue to fail again on every restart. Both came from an adversarial audit that found and fixed 21 defects. No database change: schema version 6005, unchanged. The regression suite passed 1026 of 1026. Mail loss and stability Every string SQL parameter on MS SQL and SQL CE was bound from freed memory. A failed transaction start leaked its pooled connection, and after a few occurrences SMTP, IMAP and POP3 blocked until a service restart. A failed IMAP folder insert was reported as success, so messages filed into it were written to disk with nothing to find them by. Security DKIM test mode (t=y) turned a failed signature into a pass, which then satisfied DMARC alignment. A failure in test mode is now neutral, per RFC 6376. IMAP SASL credentials were logged verbatim: AUTHENTICATE PLAIN passwords and XOAUTH2/OAUTHBEARER tokens. Only the first DKIM key record at a selector was read, so roughly half of a rotating sender's mail failed verification. MTA-STS enforcement and MX failover were lost for recipients past the first batch. Protocol and Control Panel SELECT/EXAMINE report a sequence number in [UNSEEN], as RFC 3501 requires, not a UID. Reverse-DNS lookups for the Received header moved to their own thread pool, completing the 6.2.13 fix. Backup would not start (GitHub issue 19): a Control Panel call to a method the backup interface does not have. Ctrl+K now searches settings, all 227 indexed by label and INI key. Logging, scanner timeout, indexing and retry settings moved to the pages that own them, which is where #16 went. Full release notes, checksums and signatures

The headline fix is an SMTP DATA stall that only affected relayed mail. Relaying from Postfix or Proxmox Mail Gateway, the connection could hang after 354 OK, send. until the sending MTA gave up with "timed out while sending end of data", leaving a zero-byte spool file. The cause was a reverse-DNS (PTR) lookup on the network I/O thread while generating the Received header, so an internal relay with no reverse zone stalled the session through DNS retries. That lookup now runs on a worker thread and header generation never waits on it. Direct sending was unaffected. What the upgrade involved No database change. Schema version stays at 6005. Minimum OS is Windows 10 1607 / Server 2016, 64-bit, which the installer's version check now names. SMTP. A parse exception no longer wedges a connection, data pipelined in the same segment as DATA is consumed correctly, a rejected BDAT/CHUNKING command drains or terminates its payload instead of desyncing the session (it matters for Exchange), the EHLO SIZE keyword no longer overflows, and TCP_NODELAY is set on every connection. IMAP. A malformed partial-fetch range such as BODY[]<0.-1> could drive a near-SIZE_MAX allocation, or read heap memory from before the buffer and send it to an authenticated client. The octet range is now clamped and normalized. OnClientLogon now fires from every AUTHENTICATE mechanism (PLAIN, SCRAM-SHA-256, XOAUTH2/OAUTHBEARER). SpamAssassin. A malformed or truncated spamd response could spin a core and hang the session, write the raw SPAMD header into the message, or overwrite it with a zero-byte file. The 256 MB scan ceiling is now clamped to the 80 MB MIME parser limit, and the original message is preserved on any failure. Upgrade and installer. DBUpdater labels database versions 6002-6005, a failed database create or upgrade returns a real exit code instead of a false success, and a customised EventHandlers.vbs survives reinstall. Control Panel. Diagnostics no longer reports every test as FAILED, and restarting the service is elevation-aware. The regression suite passed 1026 of 1026 against the rebuilt 6.2.13 service. Full release notes, checksums and signatures

The .NET modernisation of the tooling is finished. Every C# component now targets .NET 8. There are no server-core changes and no database change: the schema stays at 6005. What the upgrade involved The supported-OS floor moved to Windows 10 1607, the .NET 8 runtime's own minimum, and the obsolete .NET Framework 4.5 gate is gone. The .NET 8 Desktop Runtime became a server-component prerequisite, not just a Control Panel one, and its exit code is checked before the database tools run at post-install. Changes DBSetup, DBSetupQuick, DBUpdater, DataDirectorySynchronizer and the Shared library moved from .NET Framework 4.8.1 to SDK-style net8.0-windows. The COM API is consumed through a checked-in tlbimp wrapper in source/Tools/Interop/, so the tools build with plain dotnet build and no registered typelib. The silent command-line contract the installer depends on is unchanged. The five VB6 migration wizards are gone. None could be built, their shared VB6 sources were never in the repository, and three migrated from products dead for two decades. The two worth keeping return as one .NET 8 Import Tool under Addons. Accounts from a comma-separated text file get per-line validation and a created/updated/failed summary instead of a crash on the first malformed line. Messages from mbox files stream through the supported COM API, Utilities.ImportMessageFromFileToIMAPFolder, one IMAP folder per file, rather than raw MySQL INSERTs. The silently dropped last message, CRLF mailboxes parsing as one giant message, mboxrd >From quoting and SMTP dot-stuffing corrupting stored messages are all fixed. CI now builds every C# project, with warnings-as-errors on the tools solution. Previously only the Control Panel was built, which let the NUnit 4 bump break the test and tool projects invisibly. The test suite runs on NUnit 4.6.1, with the 2,200+ classic assert call sites kept compiling through NUnit 4.6's C# 14 extension members. Local-address selection now probes for an address the server answers on instead of trusting interface enumeration order, which broke under a connected VPN. The full regression suite passed 1026 of 1026 against the rebuilt service, with live SpamAssassin and ClamAV. Full release notes, checksums and signatures

Two lists in the Control Panel announced their CLR type name to screen readers instead of their contents. The alias list on the Domains page read hMailServer.ControlPanel.Views.DomainsView+AliasRow for every row, and Live logs read LogsView+LogLine for every line. The live log is the worse of the two. It is the page an administrator is most likely to be reading with a screen reader when something has gone wrong. Both lists use an ItemTemplate, so the text a sighted user sees comes from a binding, while a ListViewItem's accessible name falls back to ToString(). Neither class overrode it. Scope is genuinely those two. Every other list in the application is a DataGrid, which builds a row's name from its cells. The Domains page now reports [email protected] → [email protected], and the live log reports 37 items, none announcing a type name. (16184ce) The regression suite now runs in full 27 of the suite's 1026 tests had never executed on the release machine. They reported inconclusive because SpamAssassin and ClamAV were not installed. Installing both ran them for the first time and two failed, both defects in the tests rather than the server. TestWithVirus put the EICAR string in the plain body of a non-MIME message. Current ClamAV does not extract a plain body as a scannable part, so the message scanned clean and was delivered, failing its own "no messages" assertion. It now sends EICAR as a base64 attachment and matches the signature family rather than one exact name. TestSANotRunning called ServiceController.Stop() and returned immediately. Stop() only asks, so spamd was still answering on port 783 and the message came back with the X-Spam-Status header. It now waits for the port to refuse connections. It also asserted error 5157, reported only when a connection is established then lost mid-read. With spamd stopped, only 5508 is reported. 1026 of 1026 now pass, zero inconclusive, with live SpamAssassin and ClamAV, DMARC against live DNS and TLS 1.2/1.3 handshakes. Drop-in over 6.2.10. No database change (schema version 6005), no configuration change, no server-core change. Full release notes, checksums and signatures