Moving to new hardware is a restore onto fresh metal. Chapter 15 is the prerequisite, and the first time, rehearse onto a test machine. The plan (§33.2) Check the new machine against the chapter 3 checklist. Size the disk for the mail store you have now, not the one you had at installation. Install the same version, in the same path. The database records absolute paths to message files, so a different version or directory is where these go wrong. Back up the old server. The built-in backup does not include messages unless you tick the option. For a large store, stop the service, copy Data\, dump the database natively, and take hMailServer.INI, Events\ and your DKIM keys. Stop the old service for good and set it to Disabled. Anything it accepts after the backup is stranded. Restore the data directory, the database and hMailServer.INI, in chapter 15's order. Re-enter the protected secrets. Keep the host name if you can. Update the A record with a lowered TTL, get a PTR on the new IP, re-run the firewall rules, repoint your port forwards, and run Utilities, Diagnostics last. Leave the old machine powered off but intact for a week or two. It is the rollback. Budget for step 6. With ProtectStoredSecretsWithDPAPI=1, the default, stored passwords are encrypted with machine-scoped Windows DPAPI and cannot be decrypted on the new machine. Re-enter the database connection password with Bin\DBSetup.exe, then route, smart-host relayer and external-account passwords in the Control Panel. Forget this and you get a server that cannot reach its own database. Linux to Linux is easier: secrets sit under <DataFolder>/.hmailserver-secret-key, so copy that file too, preserving mode 0600 and its ownership. Windows to Linux is not a migration It is not supported and the project does not claim it is. The schema is the same on both, 6.3.3 needs 6040 either way, and the message store's on-disk format is the same. What is missing is a tested path: nobody has run a Windows installation onto Linux and verified the result (§35.14). What is known to break: SQL Server. An INI with Type=MSSQL or Type=MSSQLCE is refused by name. Move to PostgreSQL or MySQL on Windows first. Every DPAPI secret. Route, fetch-account and per-domain relay passwords, private-key passphrases and the administrator's TOTP secret. Each is reported once as HM6414 and answers empty. Event scripts and COM integrations. Neither exists on Linux. DKIM key paths. The per-domain key-file setting holds a Windows path such as C:\keys\mail.pem, which resolves to nothing on Linux. Copy the keys and re-point every signing domain. Directory case. The Linux build lower-cases directory names derived from an address; Windows leaves them as found. A store carrying Test.com is one this server looks for under test.com, and everything under it must end up owned by hmailserver. So treat it as a rebuild and a cutover. A new installation on Linux, accounts and mail brought over at mailbox level by mirroring folders over IMAP from the running Windows server. The Import Tool is not an option here: it is a Windows .NET program that drives the COM API, and Linux has neither (§33.8), verified against a still-running Windows server, DNS moved last.

Nothing in the server changes. The compiled server differs from 6.3.0 by its version stamp and one comment line. What changes is the installer: the Windows installer is now Authenticode-signed with Azure Artifact Signing, against a certificate profile issued to Progressive Robot Ltd. If you run with UpdateRequireAuthenticode=1, which has existed since 6.2.28, the server's own update path has been refusing every release of this project, because none carried a signature. From 6.3.1 the installer it downloads carries one. What the upgrade involved The orphan sweep in the 6029 to 6030 upgrade step runs children before parents. Before it adds seventeen foreign keys it deletes rows whose parent is gone, and three of those parent tables are pruned by the same deletes, so pruning an orphaned account, fetch account or distribution list re-orphans rows nothing revisits and the constraint that follows is refused. It affects only an upgrade from a schema below 6030 on a database that already holds orphaned rows, in all four database backends. No installation has reported hitting it, and when it fires it fails loudly with the engine's own words and rolls back. The fix is held for 6.3.2. The rest Only the Windows installer is signed. There is no Authenticode for a .deb, an .rpm or an AppImage. The elevation prompt now reads the publisher's name. SmartScreen still warns. Microsoft flags a signed installer as unrecognised until reputation accumulates. An EV certificate would not help; Microsoft removed EV's SmartScreen bypass in 2024. The UpdateRequireAuthenticode check is WinVerifyTrust on the downloaded installer, and it is Windows-only. On Linux the server says so rather than reporting a pass, and updating is the package manager's job. The signing gate asked for four of the six settings it guards and never asked about ARTIFACT_SIGNING_ENDPOINT or ARTIFACT_SIGNING_PROFILE. Three outcomes now: none of the six set is a silent no-op, all six signs, anything in between stops and names what is missing. 6.3.0's tagged run attached no Linux packages because the package-install check ran without sudo against /etc/hmailserver, which the package makes 0750 root:hmailserver. It runs under sudo now. Documentation: the README offers the Linux packages on its download line, and two files that named 6.2.29, a version that does not exist, now say 6.3.0. Full suite on the stamped binary: 2,175 tests, 2,166 passed, 0 failed, 9 skipped. Full release notes, checksums and signatures

If you run hMailServer on SQL Server Compact, the 6.2.25 installer told you the database could not be upgraded. It had been upgraded. Every Compact Edition upgrade through schema 6030 was reported as failed after it had succeeded (#114), and two seconds later the service ended and service recovery started it again. What the upgrade involved If the 6.2.25 installer failed on your database, that database is at schema 6030 with its foreign keys in place, and this installer finds nothing left to upgrade. If you restored a backup from before the attempt, the whole chain runs and the verification passes. From 6.2.24 or earlier, the 6.2.25 notes and the 6.2.24 notes before them describe what changes on the way, and everything there still applies. What was wrong After each upgrade script the database updater proves the schema changed by running a probe statement, and reads a failed probe as a missing object. The four probes for schema 6030, the foreign keys, used case when exists (subquery) in the SET expression. That is valid on SQL Server, MySQL and PostgreSQL. On SQL Server Compact it is an access violation inside the OLE DB provider, on a correct database with every constraint present. The server reported HM10045 Unknown error, the updater declared that Upgrade6029to6030MSSQLCE.sql had not created fk_hm_accounts_domain and blamed an [IGNORE-ERRORS] marker the statement does not carry. The fix The probes now read update hm_dbversion set value = value / (value - value) where not exists (select 1 from information_schema.table_constraints where constraint_name = '...' and constraint_type = 'FOREIGN KEY'). With the constraint present no row matches and nothing is evaluated. With it absent the one row matches and the division by zero fails the statement on every backend, leaving hm_dbversion untouched. The updater's message no longer asserts a cause it cannot see. It gives the backend's own words and says how to read them. This was reproduced from a Compact Edition database created at schema 6011 and upgraded with the shipped scripts: it reaches 6030 with all seventeen foreign keys, and the probe then faults the provider. build/check-db-scripts.ps1 now runs every probe through the provider the server uses, with a negative control that must fail, and a regression fixture runs them through the same COM path the updater takes. Both fail on the 6.2.25 statement. Full release notes, checksums and signatures

6.2.20 fixes a fresh-install failure introduced in 6.2.19. Database creation failed on a new install, and the installer then hung instead of reporting the failure. Fresh installations of 6.2.19 on the built-in database, which is the default, were affected, and most likely fresh installations onto MySQL. What the upgrade involved Upgrades of an existing installation were never affected. Upgrades run the upgrade scripts, and those were clean, and existing servers already have their databases. Only fresh installs hit this. If an unattended 6.2.19 install is still sitting there doing nothing, it is waiting on a message box. What was wrong The SQL script runner splits a script into commands on blank lines. SQL Server Compact, the embedded database a fresh install uses, executes one statement per command and refuses a batch. A recent change added settings to the create scripts with a single newline between inserts, so three statements arrived as one command. Full SQL Server accepts that batch, so the development database and the 1,490-test regression suite saw nothing wrong. The same adjacency was in the MySQL and PostgreSQL create scripts. All three are fixed, and a mechanical sweep of all 199 SQL scripts confirms no multi-statement command remains in any create script or any SQL CE script. Five upgrade scripts from the 5.x era keep their batches for the full-server backends that accept them. The error raised a plain message box, and /VERYSILENT /SUPPRESSMSGBOXES suppresses only the suppressible kind. A silent install did not report the failure, it waited on a dialog with nobody at the keyboard. In CI that was ninety minutes until a person cancelled it. All 28 dialogs in the installer now take their default button under /SUPPRESSMSGBOXES, and the installer proceeds to an exit code a deployment script can read. Interactive installs see exactly the dialogs they always saw. Also in this release IMAP THREAD (RFC 5256), both algorithms, THREAD=ORDEREDSUBJECT and THREAD=REFERENCES, with real References-chain threading. It is bounded by the same per-command ceilings as SEARCH and SORT. An adversarial review found and fixed a stack overflow reachable through a deep reply chain, an uninterruptible header pass and a malformed-Date sort inversion. The installer smoke test now bounds the silent-install step at ten minutes, keeps the installer's own log, and on a database failure re-runs the setup tool and prints its stderr. Full release notes, checksums and signatures

The Control Panel raised an error dialog every time you dismissed the Ctrl+K settings palette (#21, reported by grumpymojo). It was present in both 6.2.14 and 6.2.15, and because choosing a result and pressing Esc both went through the same path, it appeared on essentially every search rather than on any particular search term or configuration. What the upgrade involved No server change and no database change. Schema version stays at 6005. Anyone coming from 6.2.14 or earlier should read the 6.2.15 notes as well, because everything in them applies here. Fixed Closing the palette moves the focus away, which raised the deactivation handler while the close was still in progress, and that handler closed the window a second time. WPF refuses that outright: System.InvalidOperationException: Cannot set Visibility to Visible or call Show, ShowDialog, Close, or WindowInteropHelper.EnsureHandle while a Window is closing. The deactivation handler now closes the palette only when a close is not already under way. Nothing was lost to this defect. The navigation had already happened by the time the dialog appeared, so no setting was misapplied. It was noise in the one feature added to make settings easier to find. Still open at this release Discussion #18, the stall after 354 when relaying from Postfix or Proxmox Mail Gateway, remained open and unreproduced. 6.2.15 added debug logging to the SMTP DATA path that distinguishes the three candidate stages, and that log is what will identify the cause. Tracked in #20. Validated by the full regression suite: 1040 of 1040 passing, zero failures. The download is hMailServer-6.2.16-x64.exe. Full release notes, checksums and signatures

The .NET modernisation of the tooling is finished. Every C# component now targets .NET 8. There are no server-core changes and no database change: the schema stays at 6005. What the upgrade involved The supported-OS floor moved to Windows 10 1607, the .NET 8 runtime's own minimum, and the obsolete .NET Framework 4.5 gate is gone. The .NET 8 Desktop Runtime became a server-component prerequisite, not just a Control Panel one, and its exit code is checked before the database tools run at post-install. Changes DBSetup, DBSetupQuick, DBUpdater, DataDirectorySynchronizer and the Shared library moved from .NET Framework 4.8.1 to SDK-style net8.0-windows. The COM API is consumed through a checked-in tlbimp wrapper in source/Tools/Interop/, so the tools build with plain dotnet build and no registered typelib. The silent command-line contract the installer depends on is unchanged. The five VB6 migration wizards are gone. None could be built, their shared VB6 sources were never in the repository, and three migrated from products dead for two decades. The two worth keeping return as one .NET 8 Import Tool under Addons. Accounts from a comma-separated text file get per-line validation and a created/updated/failed summary instead of a crash on the first malformed line. Messages from mbox files stream through the supported COM API, Utilities.ImportMessageFromFileToIMAPFolder, one IMAP folder per file, rather than raw MySQL INSERTs. The silently dropped last message, CRLF mailboxes parsing as one giant message, mboxrd >From quoting and SMTP dot-stuffing corrupting stored messages are all fixed. CI now builds every C# project, with warnings-as-errors on the tools solution. Previously only the Control Panel was built, which let the NUnit 4 bump break the test and tool projects invisibly. The test suite runs on NUnit 4.6.1, with the 2,200+ classic assert call sites kept compiling through NUnit 4.6's C# 14 extension members. Local-address selection now probes for an address the server answers on instead of trusting interface enumeration order, which broke under a connected VPN. The full regression suite passed 1026 of 1026 against the rebuilt service, with live SpamAssassin and ClamAV. Full release notes, checksums and signatures

hMailServer 6.2.10 fixed an authorization defect in the COM API. Fifteen methods rejected an unauthorized caller with return false. These functions return HRESULT, where false is 0, which is S_OK, so each one reported success for a call it had just refused. Anyone administering the server through a COM client or script was affected. What the upgrade involved Drop-in over 6.2.9. No database change, schema version 6005, and no configuration change. Two administration front-ends were removed, so a custom install that ticked "Administrative tools" for the WebAdmin or hMailAdmin.exe had nothing left to run. The component is now "Remote administration support (registers the COM API for scripts)", which is what it always did. COM scripts against a remote instance still work. The changes: InterfaceCache's five getters returned before writing *pVal, so a caller without server-admin rights got S_OK and read uninitialized memory. InterfaceSettings::SetAdministratorPassword and five siblings skipped the write and reported success, so the caller was told the administrator password had changed when it had not. InterfaceMessageIndexing's four methods did the same. (0d01a55) Found by running CodeQL's C++ suite locally. The workflow analysed C# only, so 4.65 MB of network-facing code had never been scanned. It returned 16 high-severity findings, 15 of them these. A re-run after the fix returns 1, a verified false positive in FileUtilities.cpp. The PHP WebAdmin is gone (53f52eb). It stored the administrator password in plaintext in a PHP session and replayed it to Authenticate() on every request. The installer dropped from 400 payload files to 255. Code-quality findings in shipped, hand-written code: 958 to 0. DBUpdater rethrew with throw ex, resetting the stack trace on the database-upgrade failure path. Three as casts dereferenced without a null check. PngByteQRCode was built per render in the two-factor dialog and never disposed. OpenTelemetryTracing bound its OTLP collector to port 9099, the port the server's own metrics listener uses. With NUnit running 32 workers in parallel it could not bind. It now uses 9096. Full release notes, checksums and signatures

6.2.9 is a follow-up to 6.2.8. It completes what that release deliberately left out: the LiveCharts upgrade 6.2.8 had to pin back. No server-core changes, and the regression suite still stands at 898/898. LiveCharts 2.0.5 (#11) 6.2.8 pinned LiveCharts to 2.0.0-rc2 because upgrading painted both dashboard charts as an opaque white block over the dark theme, taking the "No delivery activity yet" and "No active sessions" labels with them. CartesianChart derives from Control, and 2.0.x gives that Control a solid default Background where the release candidate left it unset, so the chart painted a white rectangle across the dark card. The overlay labels were never actually hidden. They are light-grey text that happened to land on that white. Setting Background explicitly fixes both symptoms. Verified in both light and dark themes. Worth recording what it was not. 2.0.5 pulls SkiaSharp.Views.WPF, OpenTK and OpenTK.GLWpfControl, which looks exactly like a GL-hosted surface and the usual WPF airspace problem. It is not that. LiveCharts.RenderingSettings.UseGPU defaults to false, so rendering stays on the software path and ordinary WPF layering applies. Control Panel tests (#12) The GUI previously had no test coverage at all. CI compiled it and stopped there. A ControlPanel.Core library exposes the side-effect-free services (PasswordStrength, NumericField, PasswordGenerator) through shared compile links, so no code moved and the Control Panel project itself is untouched. ControlPanel.Tests runs 17 xUnit tests against them, with coverlet emitting Cobertura coverage that CI publishes on every push. The three .NET 8 projects also gained a solution, ControlPanel.sln. Repository Release tags are now protected against being moved or deleted, and master against force-pushes. Secret scanning and push protection are enabled. A Code of Conduct was added, and the issue chooser routes questions to Discussions. It was a drop-in over 6.2.8: no database change (schema version 6005), no configuration change, no server-core change. Full release notes, checksums and signatures

A Control Panel bug-fix release. Both defects made a healthy server look broken, and they hit every Windows GUI administrator. There are no server-core changes since 6.2.6, and the regression suite still stands at 898/898. What the upgrade involved Drop-in over 6.2.7. No database change (schema version 6005) and no configuration change. #6: list editors showed blank rows Every data-driven list pane rendered the right number of rows with nothing in them. Adding an entry appeared to create an empty row, and only the Edit dialog showed the value you had typed. The row model exposed its data as a field, and WPF data binding resolves properties only, so every generated column silently bound to nothing. It was reported against domain aliases, but the same control backs SURBL servers, DNS blacklists, the anti-spam and greylisting white lists, blocked attachments, groups, server messages, external POP3 accounts and account rules. #7: the Control Panel died after a service restart The COM server lives inside the hMailServer service process, so restarting the service invalidated every interface pointer the GUI held, including restarts the Control Panel performed itself after saving a setting. Every page then failed with "The RPC server is unavailable" until you closed and reopened it. The session now verifies the link before use and re-authenticates transparently. A restart triggered from the Control Panel waits for the server to report Running rather than latching onto a service that has registered with Windows but is still opening its database. A restart by anyone else is detected on your next action and healed, with a "Connection restored" notification. The liveness check reads ServerState rather than Version, because a shutting-down service keeps answering Version from a static string after closing its database. The superseded COM proxy is released, and the Control Panel no longer starts a service the administrator deliberately stopped. Both fixes were reproduced on the previous build and verified against a live server: unit assertions on the session logic, a harness driving the real CollectionEditorView and DomainDialog, and UI automation over the running Control Panel. Full release notes, checksums and signatures

6.2.7 was a Control Panel usability release. The server core was unchanged since 6.2.6, so nothing in message handling moved. Every change sat in the .NET 8 administration Control Panel, closing the gaps that still forced hand-typed paths, external tools or guesswork. What it changed: File and folder pickers everywhere. Every field holding a file-system path gained a browse button: the backup destination and restore file, the archive folder, the ACME certificate folder, the OAuth2 public key, the REST API / Web Services TLS certificate and key files, the ClamWin executable and database folder, and the DKIM private key. One-click DKIM. Domain > DKIM gained Generate key pair. It creates an RSA-2048 key, saves the private key, fills in the path, and shows the exact selector._domainkey DNS TXT record (v=DKIM1; k=rsa; p=…) with a Copy button. No more running OpenSSL by hand. Passwords. All password boxes got a reveal toggle. The account editor and the quick-create form got a Generate strong password button, using a cryptographic RNG and copying to the clipboard. The external POP3 fetch-account password is masked rather than shown in clear text. Inputs. The auto-reply expiry became a date picker. Numeric server settings and the collection editors use up/down number boxes. Every editor dialog obeys Enter to save and Esc to cancel. MX query and Diagnostics output got a Copy button. Window state. The main window remembers its size, position and maximized state between sessions, and a save-confirmation toast appears after saving. Because the core was untouched, the regression suite result carried over from 6.2.6: 898 of 898 tests passing, zero failures, zero inconclusive, including live SpamAssassin, ClamAV with real EICAR detection, DMARC evaluation against live DNS, and TLS 1.2/1.3 handshakes end to end. One package shipped, hMailServer-6.2.7-x64.exe, 64-bit Windows only. Full release notes, checksums and signatures

hMailServer 6.2.6 added IMAP4rev2 (RFC 9051) as an opt-in session mode. The server advertises IMAP4rev2, and a client that issues ENABLE IMAP4rev2 gets RFC 9051 semantics for that connection. IMAP4rev1 behaviour is unchanged until a client opts in. The rest of the release is Control Panel and installer work. IMAP4rev2 In the opt-in mode: ESEARCH by default, \Recent and RECENT dropped from SELECT, EXAMINE and STATUS, the obsolete [UNSEEN] response code suppressed, and UTF-8 acceptance. Control Panel A central theme-aware colour-token system replaced scattered hardcoded colours. Success, warning, danger and info, and the log palette, now adapt to light, dark and high-contrast themes. A Fluent nav selection style and a brand keyboard-focus ring. Live-log colours legible on the light theme, readable data grids with balanced columns, and settings forms capped to a readable column with right-sized inputs. KPI colours that encode state, softened destructive buttons, "no activity" chart placeholders, and a Welcome page of clickable quick-action tiles. Every configurable server setting now has a GUI control: OAuth2 and external-token auth, SRS and BATV, submission and outbound rate limits, OpenTelemetry and the slow-query log, connection timeouts, delivery and queue tuning, search indexing, message archiving and other INI knobs, Logging.Device and LogFormat, cache size caps, the domain Active Directory link, and a write-only secret editor. Documented in settings.md. Two-factor authentication setup renders a real scannable QR code, with a grouped manual key and a copy button, and a larger verification field. Installer A DPI-scaled custom database-type page, modernised copy and refreshed brand imagery. The dead legacy dependency installers were removed: MSI, IE6, MDAC, JET and .NET 2.0. The server core was validated by the full regression suite, 898 of 898 tests passing, including live SpamAssassin, ClamAV against EICAR, DMARC against live DNS, and TLS 1.2 and 1.3 handshakes end to end. Full release notes, checksums and signatures

hMailServer 6.2.5 fixed two faults that stopped a default install from connecting to its own database. Anyone who installed with the shipped defaults, an internal SQL Server Compact database with DPAPI secret protection, was affected. Critical fixes DPAPI database-password truncation (SQL CE error 25028). IniFileSettings::ReadIniSettingString_ used a fixed 255-character buffer, so GetPrivateProfileString truncated the ~356-character DPAPI-protected database-password envelope. The truncated blob failed to decrypt, which yielded an empty password and SQL CE error 25028, Authentication failed. The buffer is now 4096 characters, which also covers long OAuth2 HMAC secrets and the password pepper. Fresh-install database version, 6004 to 6005. The CreateTables scripts for MSSQL, MySQL and PostgreSQL still stamped hm_dbversion = 6004 while the server required 6005, so a brand-new install reported "database too old". SQL CE uses the MSSQL script, so it was caught by this too. The recipientdsnnotify column was already present. Only the version row was stale. Validation Checked end to end on a Windows Server 2025 Active Directory domain controller. A default internal-database install connects. AD authentication passes through COM ValidatePassword in both the DNS domain.tld and NetBIOS DOMAIN\user forms, and through a real IMAP LOGIN, correct password returning OK and wrong returning NO. Control Panel The .NET 8 WPF Control Panel (hMailCP.exe) reached full settings parity with the classic Administrator here. The Server Status page (version, server state, database details, statistics, session counts, uptime, and a configuration-warnings panel that includes open-relay detection) and the per-account rule criteria and action editor are validated and wired into navigation. Windows x64 only: one installer, hMailServer-6.2.5-x64.exe, bundling the server, the Control Panel and the .NET 8 Desktop Runtime bootstrapper. Full release notes, checksums and signatures

The Control Panel gained a read-only Active Directory browser, which was the last functional-parity item left from the classic Administrator. The whole product is stamped 6.2.4: the server, the Control Panel window header and About page, and the installer all report the same version. Active Directory account pickers Services/ActiveDirectoryService.cs enumerates every domain in the current forest from the RootDSE defaultNamingContext and the Partitions container's domain crossRefs, so there is no dependency on System.DirectoryServices.ActiveDirectory. A domain's users are searched with a single LDAP-escaped DirectorySearcher matching sAMAccountName, displayName, mail and userPrincipalName. It is built on System.DirectoryServices, which net8.0-windows resolves from the Windows Desktop shared framework the installer already bundles. On a machine that is not domain-joined it reports the reason instead of throwing. Account then Directory carries "Browse Active Directory…". The picked account fills ADDomain and ADUsername and ticks linked to Active Directory. Distribution-list recipients gained "Add from AD…", which multi-selects accounts and imports their e-mail addresses into the list. Validated end to end against a live domain controller (progressiverobot.local): domain enumeration, the all-users query and the name and e-mail filters all returned the expected results. Other changes A generic TargetInvocationException from the server is now unwrapped and the real cause explained: connect with the server-administrator account, or the server cannot reach its database. That is what produced the misleading "26 settings could not be read" message on the Protocols page over a non-admin connection. The vendored MariaDB Connector/C client (libmysql.dll and its auth plugins) is staged into the build output by the server post-build step, so MySQL and MariaDB back ends work out of the box. The About page carries maintainer and company details. The Control Panel requires the .NET 8 Desktop Runtime, which the installer bundles and installs silently when missing. Full release notes, checksums and signatures

6.2.3 is the first server-focused release since 6.2.2, which shipped Control Panel changes against an unchanged server. The headline is a complete Sieve filtering subsystem (RFC 5228) with an optional ManageSieve service (RFC 5804), running alongside the existing proprietary rules engine. Every new behaviour is additive and default-off, so an existing installation upgraded with no functional change until the new settings were turned on. What the upgrade involved The installer no longer ships the classic Administrator. The .NET 8 Control Panel is the sole bundled GUI and needs the .NET 8 Desktop Runtime, which the installer carries and installs silently when missing. DBSetup, DBUpdater and the Data Directory Synchronizer are retained. Sieve and ManageSieve RFC 5228 parser covering if/elsif/else/stop, the core tests (header, address, exists, size, allof, anyof, not, with :is/:contains/:matches), address parts, the default and i;octet comparators, and keep/fileinto/discard/redirect plus implicit keep. Evaluated during local delivery. An account with no script has zero overhead. An unparseable script is logged and falls through to keep rather than breaking delivery. Scripts stored per account under {DataDirectory}\Sieve\{domain}\{localpart}\ and exposed as Account.SieveScript, Utilities.CheckSieveSyntax and Utilities.EvaluateSieveScript. The account dialog gained a Sieve editor tab. ManageSieve listener on [Settings] ManageSieveServerPort, disabled by default, with SASL PLAIN against the normal account database. SMTP BATV (prvs) backscatter protection, wire-only so SPF and DKIM stay aligned. Off by default via BATVEnabled / BATVSecret. CHUNKING / BDAT (RFC 3030). DATA after BDAT is rejected 503, a non-numeric chunk size 501. The existing DATA path is untouched. Operability /livez, /readyz and /healthz on the metrics listener, plus Prometheus series for pool state, query latency, TLS handshakes, auth success and failure, delivery outcomes and command latency. New keys, all defaulting to 0: SlowQueryLogMilliseconds, ShutdownDrainSeconds, MessageStoreFsync, MessageStoreConsistencyCheck, LogDeleteDays. The Received header now carries an RFC 5321 id clause equal to the numeric TCP session id, and that id prefixes every line of the session log. Full release notes, checksums and signatures

The server binary is unchanged from the original 6.2.2. Everything new in this installer, apart from two pieces of authentication hardening, is a substantial upgrade to the Control Panel, the .NET 8 admin app. Server Full RFC 4013 SASLprep for non-ASCII SASL credentials: RFC 3454 mapping, Unicode NFKC normalization, the complete prohibited-output tables (C.2.1/C.2.2, C.3 to C.9) and the RFC 3454 section 6 bidirectional check. NFKC is a no-op on ASCII, so existing credentials are unaffected. Automated RS256 public-key OAuth2 bearer-token regression coverage over POP3 and SMTP, including a tampered-signature rejection check. Control Panel A new Advanced hardening page exposes previously hidden hMailServer.INI knobs: greylisting expiration, SpamAssassin and ClamAV scanner timeouts, DNS cache/server/DNSBL timing, authenticated-user IP replacement, the AUTH disable list, X-AuthUser and X-OriginalRcptTo headers, blocked-IP hold, envelope-from rewrite, and a password-hash-algorithm picker covering Argon2id, PBKDF2, SHA-256, MD5 and Blowfish. The anti-virus page gains live "Test ClamAV connection", "Test ClamWin scanner" and "Test custom scanner" checks, a preset picker for Microsoft Defender, Sophos, ESET, Bitdefender and Kaspersky, and ClamWin auto-detect. Event scripts get an "Insert template" picker with ready-made OnAcceptMessage handlers for an external AV/DLP scanner, a SIEM/Slack/Teams webhook and an external HTTP API verdict. Search and filter on the long list pages: Domains, Accounts, Rules, Delivery queue, TCP/IP ports, SSL certificates, IP ranges and Routes. Deleting aliases, distribution lists, list recipients and incoming relays now prompts for confirmation, and the Domain, Account and Route dialogs report bad numeric input instead of dropping it silently. Cached settings pages refresh on navigation, empty and error placeholders are standardised across the list and grid pages, and the overloaded Advanced group is split into Security, Network and Maintenance. Unhandled errors are logged to %LOCALAPPDATA%\hMailServer\ControlPanel with a restart offered. Screen-reader names on icon-only controls, search boxes and the navigation tree, and a stable AutomationId on every navigation node and data-driven settings editor, took the in-app UI-automation audit from grade F to grade A. Builds clean at 0 warnings and 0 errors. The Control Panel requires the .NET 8 Desktop Runtime, which the installer bundles. Full release notes, checksums and signatures

hMailServer 6.2.0 introduces the hMailServer Control Panel, a new desktop administration application shipped alongside the full 6.x server. The .NET 8 Desktop Runtime is bundled and installed automatically when it is missing, so there are no separate downloads. The Control Panel A .NET 8 WPF application with Fluent/Windows 11 design (Mica window), light and dark themes, animated live charts, and the familiar navigation tree from the classic Administrator: Welcome, Status, Domains, Rules, Settings > Advanced, Utilities. Animated dashboard with KPI cards plus live delivery-throughput and session charts. Domains and accounts, with an account editor for quota, password, forwarding and vacation, plus aliases and distribution lists with member management. Delivery queue with Deliver now and Remove, plus live log streaming. Rules with a graphical IF/THEN editor covering criteria and actions. Settings: Protocols, Delivery, Routes, Anti-spam (SPF/DKIM/DMARC/greylisting/SpamAssassin), Anti-virus, Logging. Advanced: Auto-ban and SSL/TLS, Performance and scripting, SSL certificates, TCP/IP ports, IP ranges with a permission editor, Incoming relays, and DANE/DNSSEC, MTA-STS, ARC, TLS-RPT, ACME, REST API, web services and metrics. Utilities: Backup and restore, MX query, Server sendout, Diagnostics. Ctrl+K command palette, guaranteed text contrast, consistent spacing. The classic Administrator remains included. So does the Web Control Deck, the browser admin served at the REST listener root. Quality Server core 6.2.0 build 6 was validated by the full regression suite: 898/898 tests passing, zero failures, on a MariaDB backend with live SpamAssassin and ClamAV and TLS 1.2/1.3 end to end. Full release notes, checksums and signatures

6.1.0 is a user interface release. It adds the Web Control Deck, a web admin UI served directly by the built-in REST API listener, and rebuilds the desktop Administrator around a full light/dark theme engine. The server core is unchanged from 6.0.0 build 4 apart from the new web-page endpoint. Web Control Deck Enable RestApiPort in hMailServer.INI and browse to the server. No extra components are required. It carries a live dashboard with animated counters and session stats, domain and account management, retry and delete on the delivery queue, and publish-ready DANE TLSA records. Light and dark themes with a toggle. Sign-in uses the administrator credential. Administrator (desktop) Deep-space dark and clean light palettes applied across every pane and dialog, including dark window title bars, native dark scrollbars and themed menus Theme toggle in the View menu. It follows the Windows app-mode preference by default, and the choice is persisted Ctrl+K command palette, fuzzy-searching every settings page and jumping straight to it Modernised dashboard with glow accents, eased value animations and hover-highlight stat cards Installer Modern wizard branding, and it ships the WebAdmin payload. The release was validated by the full regression suite: 898/898 tests passing, zero failures, against a MariaDB backend with live SpamAssassin and ClamAV and TLS 1.2/1.3 end to end. Full release notes, checksums and signatures

This was a beta build of the 6.0 line. 6.0.0 was the production release. Nothing here should be installed today. Build 3 shipped VC++ runtime DLLs that did not match the toolset the binaries were built with, and the service crashed at startup on fresh installs. This build corrects the installer payload. The detail: hMailServer.exe is built with v145 (14.51), but build 3 bundled VS2019-era (14.25) VC++ runtime DLLs app-local in Bin\. Those app-local copies were loaded instead of the system runtimes, and the service died at startup with 0xC0000005 in msvcp140!mtx_do_lock, reached via boost regex and std::mutex. Fresh installs were the ones affected. Changes in this build: The installer now ships Microsoft.VC145.CRT (14.51.36231), matching the build toolset. The stale Microsoft.VC142.CRT payload has been removed. The bundled 2015-era UCRT has been removed. It has been in-box since Server 2016 and Windows 10. build/run-tests.ps1: fixed a stdout/stderr pipe deadlock in the test runner. The full regression gate ran against MariaDB on the MYSQL backend: 898 of 898 passed. Full release notes, checksums and signatures

6.0.0 is the first modernised release of the fork: 64-bit only, built with the VS2026 toolchain, with OpenSSL 4 and TLS 1.2 and 1.3 underneath. Build 4 is the production build, and it fixes the installer defect that made build 3 unusable on fresh installations. What the upgrade involved 6.0 was 64-bit only. The installer dropped the obsolete 2015-era UCRT, which had been included in Windows since Server 2016 / Windows 10. Upgrade notes and the full feature list are in the README. The installer fix Build 3 bundled VS2019-era VC++ runtime DLLs. The service loaded those instead of the current ones and crashed at startup with an access violation in msvcp140.dll on fresh installations. Build 4 ships the matching v145 (14.51) runtimes. Build 3 also fixed MySQL/MariaDB database creation, which was a script line-ending problem, and bundles libmysql.dll. What 6.0 brought OpenSSL 4, TLS 1.2 and 1.3 MTA-STS and DANE, with in-process DNSSEC validation ARC sealing and Ed25519 DKIM ACME (Let's Encrypt) built in REST admin API and Prometheus metrics IMAP MOVE, ID and SPECIAL-USE PBKDF2 password hashing The release was validated by the full regression suite: 898 of 898 tests passing, zero failures, run against a MariaDB (MySQL backend) instance, including live SpamAssassin, ClamAV with real EICAR detection, DMARC against live DNS, and TLS 1.2 and 1.3 end to end. Full release notes, checksums and signatures

This was a beta build of the 6.0 line. 6.0.0 was the production release. Nothing here should be installed today. This is the first build of the modernised 6.0 line to clear the full regression suite: 898 tests, 895 passed, 0 code failures. What the upgrade involved Database version was 6001. Upgrade from 5.7 was supported via DBUpdater. Toolchain for this build: VS2026 (v145), OpenSSL 4.0.1, Boost 1.91, PostgreSQL 18.3 libpq, .NET Framework 4.8.1. What 6.0 brings in: MTA-STS and DANE/DNSSEC outbound TLS policy, TLS-RPT reporting, TLS 1.2/1.3 defaults. ARC sealing, DMARC, Ed25519 DKIM. ACME (Let's Encrypt) with auto-apply. REST admin API, and an Administrator dashboard with TOTP 2FA. MTA-STS, autoconfig and autodiscover hosting. Prometheus metrics and JSON logging. PBKDF2 password hashing with transparent rehash. IMAP MOVE, ID and SPECIAL-USE, plus 8BITMIME. Fixed in this build: a latent CStdStr::FormatV buffer-count bug that crashed the service. Validation ran with live SpamAssassin (JAM Windows build), ClamAV 1.5.2 and all optional features enabled. The three non-passing tests are environment-bound rather than code defects. Two require an unfiltered DNS resolver for SURBL test queries, and one requires the service-based SpamAssassin variant. Installation is via the installer, against the internal database (SQL CE 4.0) or an external MySQL, MSSQL or PostgreSQL instance. IMPLEMENTATION-NOTES.md carries the feature and INI reference. Licensed AGPLv3. Based on hMailServer by Martin Knafve. Full release notes, checksums and signatures