The Control Panel raised an error dialog every time you dismissed the Ctrl+K settings palette (#21, reported by grumpymojo). It was present in both 6.2.14 and 6.2.15, and because choosing a result and pressing Esc both went through the same path, it appeared on essentially every search rather than on any particular search term or configuration. What the upgrade involved No server change and no database change. Schema version stays at 6005. Anyone coming from 6.2.14 or earlier should read the 6.2.15 notes as well, because everything in them applies here. Fixed Closing the palette moves the focus away, which raised the deactivation handler while the close was still in progress, and that handler closed the window a second time. WPF refuses that outright: System.InvalidOperationException: Cannot set Visibility to Visible or call Show, ShowDialog, Close, or WindowInteropHelper.EnsureHandle while a Window is closing. The deactivation handler now closes the palette only when a close is not already under way. Nothing was lost to this defect. The navigation had already happened by the time the dialog appeared, so no setting was misapplied. It was noise in the one feature added to make settings easier to find. Still open at this release Discussion #18, the stall after 354 when relaying from Postfix or Proxmox Mail Gateway, remained open and unreproduced. 6.2.15 added debug logging to the SMTP DATA path that distinguishes the three candidate stages, and that log is what will identify the cause. Tracked in #20. Validated by the full regression suite: 1040 of 1040 passing, zero failures. The download is hMailServer-6.2.16-x64.exe. Full release notes, checksums and signatures

The IMAP sequence-set parsers only recognised * as the end of a range. Anywhere else it was parsed as zero, so UID STORE *:* +FLAGS (\Deleted) flagged every message in the mailbox, UID EXPUNGE * deleted every \Deleted message, and FETCH * returned nothing while answering OK. Any client using * outside a range was affected. What the upgrade involved No database change. The schema stays at version 6005. Issue #18 is not fixed and remains open, see #20. All four sequence-set parsers now resolve * on either side of a colon and normalise descending ranges, so 3:1 is the same set as 1:3, per RFC 3501. Twelve regression tests cover it, all twelve failing against 6.2.14. Also fixed: Restoring messages emptied the live data directory before checking the backup's message store existed. A settings-only backup restored with the messages option ticked, or a failed extraction, left an empty data directory and the only copy of the mail in a GUID-named temporary folder. It now checks first. A message whose file could not be read hung the outbound connection after the remote answered 354, idle until the client timeout of up to ten minutes, then re-queued and repeated. It now fails immediately. Only a genuinely missing file fails the delivery permanently. BDAT exact-length reads padded short chunks with NUL bytes. A sender announcing BDAT 100000 LAST that vanished after 40,000 octets had the truncated message delivered as complete. DKIM signing hashed the header name in lower case while writing it capitalised (upstream PR #530), so signatures using simple canonicalization failed strict verifiers. Several paths left files with no database row: rejected POP3 RETR, header rewrites leaving .eml.tmp, downloads with no local recipient, unsendable bounces. The account cache had no size cap. ManageSieve now disconnects after three failed authentication attempts and registers them with auto-ban. STATUS (RECENT) reported the selected folder's count for every folder. Settings configurable only in hMailServer.ini gained Control Panel pages: authentication, administrative access, DNS resolver, web services and autoconfiguration, and the consistency scan results. Full release notes, checksums and signatures

A message file that could not be written was treated as success. IMAP APPEND answered OK [APPENDUID ...] for messages that were never stored, so Sent Items copies, drafts and migration uploads were lost while the client showed them saved. Anyone hitting a full volume, or a file locked by antivirus or backup, lost mail silently. A failed message copy killed the delivery task in local delivery, forwarding, Sieve redirect and mirroring, leaving the message locked in the queue to fail again on every restart. Both came from an adversarial audit that found and fixed 21 defects. No database change: schema version 6005, unchanged. The regression suite passed 1026 of 1026. Mail loss and stability Every string SQL parameter on MS SQL and SQL CE was bound from freed memory. A failed transaction start leaked its pooled connection, and after a few occurrences SMTP, IMAP and POP3 blocked until a service restart. A failed IMAP folder insert was reported as success, so messages filed into it were written to disk with nothing to find them by. Security DKIM test mode (t=y) turned a failed signature into a pass, which then satisfied DMARC alignment. A failure in test mode is now neutral, per RFC 6376. IMAP SASL credentials were logged verbatim: AUTHENTICATE PLAIN passwords and XOAUTH2/OAUTHBEARER tokens. Only the first DKIM key record at a selector was read, so roughly half of a rotating sender's mail failed verification. MTA-STS enforcement and MX failover were lost for recipients past the first batch. Protocol and Control Panel SELECT/EXAMINE report a sequence number in [UNSEEN], as RFC 3501 requires, not a UID. Reverse-DNS lookups for the Received header moved to their own thread pool, completing the 6.2.13 fix. Backup would not start (#19): a Control Panel call to a method the backup interface does not have. Ctrl+K now searches settings, all 227 indexed by label and INI key. Logging, scanner timeout, indexing and retry settings moved to the pages that own them, which is where #16 went. Full release notes, checksums and signatures

Two lists in the Control Panel announced their CLR type name to screen readers instead of their contents. The alias list on the Domains page read hMailServer.ControlPanel.Views.DomainsView+AliasRow for every row, and Live logs read LogsView+LogLine for every line. The live log is the worse of the two. It is the page an administrator is most likely to be reading with a screen reader when something has gone wrong. Both lists use an ItemTemplate, so the text a sighted user sees comes from a binding, while a ListViewItem's accessible name falls back to ToString(). Neither class overrode it. Scope is genuinely those two. Every other list in the application is a DataGrid, which builds a row's name from its cells. The Domains page now reports [email protected] → [email protected], and the live log reports 37 items, none announcing a type name. (16184ce) The regression suite now runs in full 27 of the suite's 1026 tests had never executed on the release machine. They reported inconclusive because SpamAssassin and ClamAV were not installed. Installing both ran them for the first time and two failed, both defects in the tests rather than the server. TestWithVirus put the EICAR string in the plain body of a non-MIME message. Current ClamAV does not extract a plain body as a scannable part, so the message scanned clean and was delivered, failing its own "no messages" assertion. It now sends EICAR as a base64 attachment and matches the signature family rather than one exact name. TestSANotRunning called ServiceController.Stop() and returned immediately. Stop() only asks, so spamd was still answering on port 783 and the message came back with the X-Spam-Status header. It now waits for the port to refuse connections. It also asserted error 5157, reported only when a connection is established then lost mid-read. With spamd stopped, only 5508 is reported. 1026 of 1026 now pass, zero inconclusive, with live SpamAssassin and ClamAV, DMARC against live DNS and TLS 1.2/1.3 handshakes. Drop-in over 6.2.10. No database change (schema version 6005), no configuration change, no server-core change. Full release notes, checksums and signatures

6.2.9 is a follow-up to 6.2.8. It completes what that release deliberately left out: the LiveCharts upgrade 6.2.8 had to pin back. No server-core changes, and the regression suite still stands at 898/898. LiveCharts 2.0.5 (#11) 6.2.8 pinned LiveCharts to 2.0.0-rc2 because upgrading painted both dashboard charts as an opaque white block over the dark theme, taking the "No delivery activity yet" and "No active sessions" labels with them. CartesianChart derives from Control, and 2.0.x gives that Control a solid default Background where the release candidate left it unset, so the chart painted a white rectangle across the dark card. The overlay labels were never actually hidden. They are light-grey text that happened to land on that white. Setting Background explicitly fixes both symptoms. Verified in both light and dark themes. Worth recording what it was not. 2.0.5 pulls SkiaSharp.Views.WPF, OpenTK and OpenTK.GLWpfControl, which looks exactly like a GL-hosted surface and the usual WPF airspace problem. It is not that. LiveCharts.RenderingSettings.UseGPU defaults to false, so rendering stays on the software path and ordinary WPF layering applies. Control Panel tests (#12) The GUI previously had no test coverage at all. CI compiled it and stopped there. A ControlPanel.Core library exposes the side-effect-free services (PasswordStrength, NumericField, PasswordGenerator) through shared compile links, so no code moved and the Control Panel project itself is untouched. ControlPanel.Tests runs 17 xUnit tests against them, with coverlet emitting Cobertura coverage that CI publishes on every push. The three .NET 8 projects also gained a solution, ControlPanel.sln. Repository Release tags are now protected against being moved or deleted, and master against force-pushes. Secret scanning and push protection are enabled. A Code of Conduct was added, and the issue chooser routes questions to Discussions. It was a drop-in over 6.2.8: no database change (schema version 6005), no configuration change, no server-core change. Full release notes, checksums and signatures

A Control Panel bug-fix release. Both defects made a healthy server look broken, and they hit every Windows GUI administrator. There are no server-core changes since 6.2.6, and the regression suite still stands at 898/898. What the upgrade involved Drop-in over 6.2.7. No database change (schema version 6005) and no configuration change. #6: list editors showed blank rows Every data-driven list pane rendered the right number of rows with nothing in them. Adding an entry appeared to create an empty row, and only the Edit dialog showed the value you had typed. The row model exposed its data as a field, and WPF data binding resolves properties only, so every generated column silently bound to nothing. It was reported against domain aliases, but the same control backs SURBL servers, DNS blacklists, the anti-spam and greylisting white lists, blocked attachments, groups, server messages, external POP3 accounts and account rules. #7: the Control Panel died after a service restart The COM server lives inside the hMailServer service process, so restarting the service invalidated every interface pointer the GUI held, including restarts the Control Panel performed itself after saving a setting. Every page then failed with "The RPC server is unavailable" until you closed and reopened it. The session now verifies the link before use and re-authenticates transparently. A restart triggered from the Control Panel waits for the server to report Running rather than latching onto a service that has registered with Windows but is still opening its database. A restart by anyone else is detected on your next action and healed, with a "Connection restored" notification. The liveness check reads ServerState rather than Version, because a shutting-down service keeps answering Version from a static string after closing its database. The superseded COM proxy is released, and the Control Panel no longer starts a service the administrator deliberately stopped. Both fixes were reproduced on the previous build and verified against a live server: unit assertions on the session logic, a harness driving the real CollectionEditorView and DomainDialog, and UI automation over the running Control Panel. Full release notes, checksums and signatures

6.2.7 was a Control Panel usability release. The server core was unchanged since 6.2.6, so nothing in message handling moved. Every change sat in the .NET 8 administration Control Panel, closing the gaps that still forced hand-typed paths, external tools or guesswork. What it changed: File and folder pickers everywhere. Every field holding a file-system path gained a browse button: the backup destination and restore file, the archive folder, the ACME certificate folder, the OAuth2 public key, the REST API / Web Services TLS certificate and key files, the ClamWin executable and database folder, and the DKIM private key. One-click DKIM. Domain > DKIM gained Generate key pair. It creates an RSA-2048 key, saves the private key, fills in the path, and shows the exact selector._domainkey DNS TXT record (v=DKIM1; k=rsa; p=…) with a Copy button. No more running OpenSSL by hand. Passwords. All password boxes got a reveal toggle. The account editor and the quick-create form got a Generate strong password button, using a cryptographic RNG and copying to the clipboard. The external POP3 fetch-account password is masked rather than shown in clear text. Inputs. The auto-reply expiry became a date picker. Numeric server settings and the collection editors use up/down number boxes. Every editor dialog obeys Enter to save and Esc to cancel. MX query and Diagnostics output got a Copy button. Window state. The main window remembers its size, position and maximized state between sessions, and a save-confirmation toast appears after saving. Because the core was untouched, the regression suite result carried over from 6.2.6: 898 of 898 tests passing, zero failures, zero inconclusive, including live SpamAssassin, ClamAV with real EICAR detection, DMARC evaluation against live DNS, and TLS 1.2/1.3 handshakes end to end. One package shipped, hMailServer-6.2.7-x64.exe, 64-bit Windows only. Full release notes, checksums and signatures

hMailServer 6.2.6 added IMAP4rev2 (RFC 9051) as an opt-in session mode. The server advertises IMAP4rev2, and a client that issues ENABLE IMAP4rev2 gets RFC 9051 semantics for that connection. IMAP4rev1 behaviour is unchanged until a client opts in. The rest of the release is Control Panel and installer work. IMAP4rev2 In the opt-in mode: ESEARCH by default, \Recent and RECENT dropped from SELECT, EXAMINE and STATUS, the obsolete [UNSEEN] response code suppressed, and UTF-8 acceptance. Control Panel A central theme-aware colour-token system replaced scattered hardcoded colours. Success, warning, danger and info, and the log palette, now adapt to light, dark and high-contrast themes. A Fluent nav selection style and a brand keyboard-focus ring. Live-log colours legible on the light theme, readable data grids with balanced columns, and settings forms capped to a readable column with right-sized inputs. KPI colours that encode state, softened destructive buttons, "no activity" chart placeholders, and a Welcome page of clickable quick-action tiles. Every configurable server setting now has a GUI control: OAuth2 and external-token auth, SRS and BATV, submission and outbound rate limits, OpenTelemetry and the slow-query log, connection timeouts, delivery and queue tuning, search indexing, message archiving and other INI knobs, Logging.Device and LogFormat, cache size caps, the domain Active Directory link, and a write-only secret editor. Documented in settings.md. Two-factor authentication setup renders a real scannable QR code, with a grouped manual key and a copy button, and a larger verification field. Installer A DPI-scaled custom database-type page, modernised copy and refreshed brand imagery. The dead legacy dependency installers were removed: MSI, IE6, MDAC, JET and .NET 2.0. The server core was validated by the full regression suite, 898 of 898 tests passing, including live SpamAssassin, ClamAV against EICAR, DMARC against live DNS, and TLS 1.2 and 1.3 handshakes end to end. Full release notes, checksums and signatures

hMailServer 6.2.5 fixed two faults that stopped a default install from connecting to its own database. Anyone who installed with the shipped defaults, an internal SQL Server Compact database with DPAPI secret protection, was affected. Critical fixes DPAPI database-password truncation (SQL CE error 25028). IniFileSettings::ReadIniSettingString_ used a fixed 255-character buffer, so GetPrivateProfileString truncated the ~356-character DPAPI-protected database-password envelope. The truncated blob failed to decrypt, which yielded an empty password and SQL CE error 25028, Authentication failed. The buffer is now 4096 characters, which also covers long OAuth2 HMAC secrets and the password pepper. Fresh-install database version, 6004 to 6005. The CreateTables scripts for MSSQL, MySQL and PostgreSQL still stamped hm_dbversion = 6004 while the server required 6005, so a brand-new install reported "database too old". SQL CE uses the MSSQL script, so it was caught by this too. The recipientdsnnotify column was already present. Only the version row was stale. Validation Checked end to end on a Windows Server 2025 Active Directory domain controller. A default internal-database install connects. AD authentication passes through COM ValidatePassword in both the DNS domain.tld and NetBIOS DOMAIN\user forms, and through a real IMAP LOGIN, correct password returning OK and wrong returning NO. Control Panel The .NET 8 WPF Control Panel (hMailCP.exe) reached full settings parity with the classic Administrator here. The Server Status page (version, server state, database details, statistics, session counts, uptime, and a configuration-warnings panel that includes open-relay detection) and the per-account rule criteria and action editor are validated and wired into navigation. Windows x64 only: one installer, hMailServer-6.2.5-x64.exe, bundling the server, the Control Panel and the .NET 8 Desktop Runtime bootstrapper. Full release notes, checksums and signatures

The Control Panel gained a read-only Active Directory browser, which was the last functional-parity item left from the classic Administrator. The whole product is stamped 6.2.4: the server, the Control Panel window header and About page, and the installer all report the same version. Active Directory account pickers Services/ActiveDirectoryService.cs enumerates every domain in the current forest from the RootDSE defaultNamingContext and the Partitions container's domain crossRefs, so there is no dependency on System.DirectoryServices.ActiveDirectory. A domain's users are searched with a single LDAP-escaped DirectorySearcher matching sAMAccountName, displayName, mail and userPrincipalName. It is built on System.DirectoryServices, which net8.0-windows resolves from the Windows Desktop shared framework the installer already bundles. On a machine that is not domain-joined it reports the reason instead of throwing. Account then Directory carries "Browse Active Directory…". The picked account fills ADDomain and ADUsername and ticks linked to Active Directory. Distribution-list recipients gained "Add from AD…", which multi-selects accounts and imports their e-mail addresses into the list. Validated end to end against a live domain controller (progressiverobot.local): domain enumeration, the all-users query and the name and e-mail filters all returned the expected results. Other changes A generic TargetInvocationException from the server is now unwrapped and the real cause explained: connect with the server-administrator account, or the server cannot reach its database. That is what produced the misleading "26 settings could not be read" message on the Protocols page over a non-admin connection. The vendored MariaDB Connector/C client (libmysql.dll and its auth plugins) is staged into the build output by the server post-build step, so MySQL and MariaDB back ends work out of the box. The About page carries maintainer and company details. The Control Panel requires the .NET 8 Desktop Runtime, which the installer bundles and installs silently when missing. Full release notes, checksums and signatures

6.2.3 is the first server-focused release since 6.2.2, which shipped Control Panel changes against an unchanged server. The headline is a complete Sieve filtering subsystem (RFC 5228) with an optional ManageSieve service (RFC 5804), running alongside the existing proprietary rules engine. Every new behaviour is additive and default-off, so an existing installation upgraded with no functional change until the new settings were turned on. What the upgrade involved The installer no longer ships the classic Administrator. The .NET 8 Control Panel is the sole bundled GUI and needs the .NET 8 Desktop Runtime, which the installer carries and installs silently when missing. DBSetup, DBUpdater and the Data Directory Synchronizer are retained. Sieve and ManageSieve RFC 5228 parser covering if/elsif/else/stop, the core tests (header, address, exists, size, allof, anyof, not, with :is/:contains/:matches), address parts, the default and i;octet comparators, and keep/fileinto/discard/redirect plus implicit keep. Evaluated during local delivery. An account with no script has zero overhead. An unparseable script is logged and falls through to keep rather than breaking delivery. Scripts stored per account under {DataDirectory}\Sieve\{domain}\{localpart}\ and exposed as Account.SieveScript, Utilities.CheckSieveSyntax and Utilities.EvaluateSieveScript. The account dialog gained a Sieve editor tab. ManageSieve listener on [Settings] ManageSieveServerPort, disabled by default, with SASL PLAIN against the normal account database. SMTP BATV (prvs) backscatter protection, wire-only so SPF and DKIM stay aligned. Off by default via BATVEnabled / BATVSecret. CHUNKING / BDAT (RFC 3030). DATA after BDAT is rejected 503, a non-numeric chunk size 501. The existing DATA path is untouched. Operability /livez, /readyz and /healthz on the metrics listener, plus Prometheus series for pool state, query latency, TLS handshakes, auth success and failure, delivery outcomes and command latency. New keys, all defaulting to 0: SlowQueryLogMilliseconds, ShutdownDrainSeconds, MessageStoreFsync, MessageStoreConsistencyCheck, LogDeleteDays. The Received header now carries an RFC 5321 id clause equal to the numeric TCP session id, and that id prefixes every line of the session log. Full release notes, checksums and signatures

The server binary is unchanged from the original 6.2.2. Everything new in this installer, apart from two pieces of authentication hardening, is a substantial upgrade to the Control Panel, the .NET 8 admin app. Server Full RFC 4013 SASLprep for non-ASCII SASL credentials: RFC 3454 mapping, Unicode NFKC normalization, the complete prohibited-output tables (C.2.1/C.2.2, C.3 to C.9) and the RFC 3454 section 6 bidirectional check. NFKC is a no-op on ASCII, so existing credentials are unaffected. Automated RS256 public-key OAuth2 bearer-token regression coverage over POP3 and SMTP, including a tampered-signature rejection check. Control Panel A new Advanced hardening page exposes previously hidden hMailServer.INI knobs: greylisting expiration, SpamAssassin and ClamAV scanner timeouts, DNS cache/server/DNSBL timing, authenticated-user IP replacement, the AUTH disable list, X-AuthUser and X-OriginalRcptTo headers, blocked-IP hold, envelope-from rewrite, and a password-hash-algorithm picker covering Argon2id, PBKDF2, SHA-256, MD5 and Blowfish. The anti-virus page gains live "Test ClamAV connection", "Test ClamWin scanner" and "Test custom scanner" checks, a preset picker for Microsoft Defender, Sophos, ESET, Bitdefender and Kaspersky, and ClamWin auto-detect. Event scripts get an "Insert template" picker with ready-made OnAcceptMessage handlers for an external AV/DLP scanner, a SIEM/Slack/Teams webhook and an external HTTP API verdict. Search and filter on the long list pages: Domains, Accounts, Rules, Delivery queue, TCP/IP ports, SSL certificates, IP ranges and Routes. Deleting aliases, distribution lists, list recipients and incoming relays now prompts for confirmation, and the Domain, Account and Route dialogs report bad numeric input instead of dropping it silently. Cached settings pages refresh on navigation, empty and error placeholders are standardised across the list and grid pages, and the overloaded Advanced group is split into Security, Network and Maintenance. Unhandled errors are logged to %LOCALAPPDATA%\hMailServer\ControlPanel with a restart offered. Screen-reader names on icon-only controls, search boxes and the navigation tree, and a stable AutomationId on every navigation node and data-driven settings editor, took the in-app UI-automation audit from grade F to grade A. Builds clean at 0 warnings and 0 errors. The Control Panel requires the .NET 8 Desktop Runtime, which the installer bundles. Full release notes, checksums and signatures

hMailServer 6.2.0 introduces the hMailServer Control Panel, a new desktop administration application shipped alongside the full 6.x server. The .NET 8 Desktop Runtime is bundled and installed automatically when it is missing, so there are no separate downloads. The Control Panel A .NET 8 WPF application with Fluent/Windows 11 design (Mica window), light and dark themes, animated live charts, and the familiar navigation tree from the classic Administrator: Welcome, Status, Domains, Rules, Settings > Advanced, Utilities. Animated dashboard with KPI cards plus live delivery-throughput and session charts. Domains and accounts, with an account editor for quota, password, forwarding and vacation, plus aliases and distribution lists with member management. Delivery queue with Deliver now and Remove, plus live log streaming. Rules with a graphical IF/THEN editor covering criteria and actions. Settings: Protocols, Delivery, Routes, Anti-spam (SPF/DKIM/DMARC/greylisting/SpamAssassin), Anti-virus, Logging. Advanced: Auto-ban and SSL/TLS, Performance and scripting, SSL certificates, TCP/IP ports, IP ranges with a permission editor, Incoming relays, and DANE/DNSSEC, MTA-STS, ARC, TLS-RPT, ACME, REST API, web services and metrics. Utilities: Backup and restore, MX query, Server sendout, Diagnostics. Ctrl+K command palette, guaranteed text contrast, consistent spacing. The classic Administrator remains included. So does the Web Control Deck, the browser admin served at the REST listener root. Quality Server core 6.2.0 build 6 was validated by the full regression suite: 898/898 tests passing, zero failures, on a MariaDB backend with live SpamAssassin and ClamAV and TLS 1.2/1.3 end to end. Full release notes, checksums and signatures

6.1.0 is a user interface release. It adds the Web Control Deck, a web admin UI served directly by the built-in REST API listener, and rebuilds the desktop Administrator around a full light/dark theme engine. The server core is unchanged from 6.0.0 build 4 apart from the new web-page endpoint. Web Control Deck Enable RestApiPort in hMailServer.INI and browse to the server. No extra components are required. It carries a live dashboard with animated counters and session stats, domain and account management, retry and delete on the delivery queue, and publish-ready DANE TLSA records. Light and dark themes with a toggle. Sign-in uses the administrator credential. Administrator (desktop) Deep-space dark and clean light palettes applied across every pane and dialog, including dark window title bars, native dark scrollbars and themed menus Theme toggle in the View menu. It follows the Windows app-mode preference by default, and the choice is persisted Ctrl+K command palette, fuzzy-searching every settings page and jumping straight to it Modernised dashboard with glow accents, eased value animations and hover-highlight stat cards Installer Modern wizard branding, and it ships the WebAdmin payload. The release was validated by the full regression suite: 898/898 tests passing, zero failures, against a MariaDB backend with live SpamAssassin and ClamAV and TLS 1.2/1.3 end to end. Full release notes, checksums and signatures