Security:

• Update to OpenSSL 3.5.9

Security:

• Fixed script injection in event scripts. With JScript, untrusted values passed to event handlers (such as the logon password in OnClientValidatePassword, or error text and UIDs sent by remote servers) could break out of their string. With either script language, a rule's "Run function" name could carry code. This would allow an attacker to run arbitrary code in the hMailServer process. Values are now escaped, and rule function names may only contain letters, digits and underscores.

If you are unable to install this version, disable JScript execution and do not give end-users access to the hMailServer COM API.

Archived hMailServer builds, from 4.1.1 to 5.6.9 build 2607. These versions are no longer supported and are kept for reference only. Use the latest release for new installations.

Features

• Added DMARC support: incoming messages can now be checked against the sender domain's DMARC policy.
• Passwords are now stored using Argon2id or PBKDF2, selectable by the administrator.
• Delivery status notifications (bounces) now include In-Reply-To and References headers, so mail clients thread them together with the original message.
• The IMAP OnClientLogon event is now fired for clients logging on with AUTHENTICATE PLAIN, not just LOGIN.

Bug fixes

• Backup and restore now compress and decompress using half of the available processor cores instead of all available.
• The bundled 7-Zip used for backup and restore was upgraded to 26.03.
• Fixed: several issues with concurrent access to the same IMAP mailbox from multiple clients.
• Fixed: an external POP3 fetch account could stay locked after a failed fetch, silently stopping mail collection for that account until the server was restarted.
• Fixed: a failed DNS lookup was treated as "no records found", which could cause a message to be scored as spam when the HELO host could not be looked up
• Fixed: the data directory synchronizer could have deleted live message files in public folders when run in delete mode.
• Fixed: a client could bypass the required HELO/EHLO greeting by sending RSET, or by sending MAIL FROM directly after a STARTTLS handshake

Installation

• New installations now run the hMailServer service as Network Service, with data and logs stored in C:\ProgramData\hMailServer
• Fixed: the installer overwrote the ValidLanguages setting, discarding any changes the administrator had made to it.

Installation

• Bundle libmariadb.dll with the installation (#479)
• Support for passing in the password during install (#570)
• Installer now propagates a non-zero exit code when DBSetup fails

Stability fixes

• Addressed race conditions during IMAP communication
• Fixed a file received over SMTP being left open
• Fixed memory leak when reloading and checking event scripts
• Upgraded to OpenSSL 3.5.8

Other

• Documentation refresh

• Experimental support for MariaDB Connector (C). To use, put libmariadb.dll in hMailServer\Bin. hMailServer will prefer it over libmysql.dll if both exists.
• IMAP improvements
  • Removed the ImapAuthAllowPlainText legacy option
  • Fixed invalid "Recent" count in IMAP notifications
  • Fixed FETCH not honoring the start.size partial-fetch clause
• DKIM improvements
  • DKIM signatures for domain aliases
  • DKIM-sign all email sent from a domain, not just per-account
  • Fixed signing failure for messages >10MB
  • DKIM verification when the published DNS record is a CNAME
  • Signing for NDR/bounce messages
• Optional X-Original-Rcpt-To header for incoming mail.
• IMAP improvements: RFC 6154 support - LIST extension for Special-Use Mailboxes (\Sent, \Drafts, \Junk, \Trash, etc.), including auto-creation of special-use folders on account creation.
• Security: TLS 1.3 support added
• Security: OpenSSL upgraded to 3.5.7
• 64-bit only. Support for x86/32-bit dropped.