[0.16.22] - 2026-09-13

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

Fixed

• WebDAV: PROPFIND responses do not declare the namespace of every requested property on the DAV:multistatus element.
• MTA:
  • SMTP session state obtained before STARTTLS is discarded once the TLS handshake completes, as required by RFC 3207.
  • Inbound throttle, outbound throttle and queue quota match expressions evaluate their if/then conditions.
  • DMARC: Messages without an aligned SPF or DKIM pass from a domain that publishes a DMARC policy are reported as fail instead of none in logs.
  • DMARC: A temporary DNS error on an SPF or DKIM check whose identifier aligns with the author domain produces temperror instead of fail.
  • DMARC: A policy record without a p tag is only applied, as p=none, when it contains a rua tag, even if it declares sp or np.
• iMIP: Notification subjects and bodies omit the event start date, time and timezone for recurring events.
• OIDC: Discovery is retried for 30 seconds before the directory is marked as unavailable, so a provider that is still starting up no longer requires a restart.
• WebUI: The cached bundle of an Application is discarded when its resourceUrl changes or the record is deleted, so the next unpack fetches the new resource.
• DNS: Append . to MX record hostnames.
• Recovery mode: Automatic IP banning is disabled during recovery and initial setup.
• FoundationDB: The cached read version is invalidated when a queue refresh or registry change broadcast is received.
• Sieve: Messages filed with fileinto by a user script are treated as ham and are no longer moved to Junk when classified as spam.
• IMAP:
  • SELECT, EXAMINE and STATUS on a shared mailbox require the r (read) right.
  • AUTHENTICATE is refused on clear-text connections unless allowPlainTextAuth is enabled, and the greeting and CAPABILITY response advertise LOGINDISABLED instead of the AUTH= mechanisms in that case.
• IMAP, POP3, ManageSieve: Partial commands received before STARTTLS or STLS are discarded once the TLS handshake completes.
• Network: Inbound TLS handshakes, both implicit and STARTTLS, are aborted after the listener's tlsTimeout, releasing the connection slot.
• OAuth: A random key is used when the OIDC provider's encryptionKey or HMAC signatureKey cannot be read, instead of an empty key.
• LDAP: The {local} and {domain} filter placeholders are escaped.
• JMAP:
  • CalendarEvent/set stores useDefaultAlerts per user, and CalendarEvent/get returns false when it was never set.
  • CalendarEvent/get returns null for baseEventId unless the id is a synthetic recurrence instance.
  • CalendarEvent/get returns null for requested recurrenceRule and recurrenceOverrides properties on synthetic recurrence instances.
  • CalendarEvent/get and ContactCard/get return only id when the properties argument is an empty list, instead of every property.

Check binary attestation here

Features

• Added DMARC support: incoming messages can now be checked against the sender domain's DMARC policy.
• Passwords are now stored using Argon2id or PBKDF2, selectable by the administrator.
• Delivery status notifications (bounces) now include In-Reply-To and References headers, so mail clients thread them together with the original message.
• The IMAP OnClientLogon event is now fired for clients logging on with AUTHENTICATE PLAIN, not just LOGIN.

Bug fixes

• Backup and restore now compress and decompress using half of the available processor cores instead of all available.
• The bundled 7-Zip used for backup and restore was upgraded to 26.03.
• Fixed: several issues with concurrent access to the same IMAP mailbox from multiple clients.
• Fixed: an external POP3 fetch account could stay locked after a failed fetch, silently stopping mail collection for that account until the server was restarted.
• Fixed: a failed DNS lookup was treated as "no records found", which could cause a message to be scored as spam when the HELO host could not be looked up
• Fixed: the data directory synchronizer could have deleted live message files in public folders when run in delete mode.
• Fixed: a client could bypass the required HELO/EHLO greeting by sending RSET, or by sending MAIL FROM directly after a STARTTLS handshake

Installation

• New installations now run the hMailServer service as Network Service, with data and logs stored in C:\ProgramData\hMailServer
• Fixed: the installer overwrote the ValidLanguages setting, discarding any changes the administrator had made to it.