pre4 was withdrawn. Its installer could not create its own database: two SQL statements were written on consecutive lines, the script parser splits commands on a blank line, and SQL Server Compact, which a default install uses, rejected the pair as one command. The install succeeded, the service started, and it listened on nothing. Anyone who ran a fresh pre4 install was affected. The v6.2.22-pre4 tag still exists but has no release. Do not build from it.

What the upgrade involved

This is pre-alpha. Nobody has run it on a production server, and the installer is smoke-tested on a throwaway CI runner only. Use a spare box. Upgrading from pre3 requires DBUpdater: the schema moves from 6019 to 6022 in three steps.

DMARC, brought up to DMARCbis

• The DNS tree walk (RFC 9989 §4.10) replaces the Public Suffix List for deciding organizational domain. Bounded at eight queries per domain, cached five minutes. DmarcTreeWalkEnabled=0 keeps the list, which is also used whenever a lookup fails transiently.
• The np= tag (RFC 9989 §5.5.4) is honoured, so the resolver now reports the RCODE to tell NXDOMAIN from NODATA.
• Aggregate reports now emit the DKIM <selector> and SPF <scope> from RFC 7489, never sent before.

Algorithms

• DKIM rsa-sha1 is refused (RFC 8301), on signing and verification. A domain configured to sign with it is signed rsa-sha256 instead and told so. DkimAcceptSha1=1 restores both halves.
• DKIM keys below 1024 bits are refused (RFC 8301 §3.2).
• SPF void lookups are capped at two (RFC 7208 §4.6.4). SpfVoidLookupLimit to change or disable.

Certificates and delivery

• ACME renewal begins two thirds through the certificate's lifetime with a one-day floor, instead of a fixed 30 days. ARI (RFC 9773) is consulted hourly and the CA's window wins when offered, clamped to a day before expiry.
• A full mailbox is refused at RCPT with 452 4.2.2, ending the backscatter to forged envelope senders. RejectFullMailboxAtRcpt=0 restores the old behaviour.
• QuotaWarningPercent (default 90, 0 disables) sends one notice per crossing. Schema 6022.

Operations

• Per-domain outbound relay, discussion #31. Order is route, then the sending domain's relay, then the server-wide relayer. Schema 6021.
• Queryable message trace, off by default. Schema 6020.
• ArchiveRetentionDays prunes ArchiveDir, 0 by default, .eml files only.

The DMARCbis aggregate-report namespace (RFC 9990) is not implemented. Reports remain the RFC 7489 form.

Full release notes, checksums and signatures