Glossary

Glossary

This page began as a chapter of the 6.2.10 manual and has been corrected for 6.2.24, then completed on 8 September 2026 for 6.2.28: every entry now says where in hMailServer you meet the thing, and the acronyms the newer pages use are here too. The Control Panel's pages are grouped differently now, so the paths below use today's groups; the TLS ports 465, 993 and 995 exist only after you create them on the TCP/IP ports page (a fresh install seeds 25, 587, 110 and 143); and everything added since 6.2.10 is in Changes-Since-6210. Where a value here disagrees with the Settings Reference, which is generated from the code, the reference is right.

A glossary is only useful if it tells you where the word lives. Each entry below has three parts: what the term means, what it means here, and the Control Panel page, setting name or wiki page where you would go next. Terms in bold in the right-hand column are settings in hMailServer.ini — see the Settings Reference.

How the words fit together

Most of the vocabulary below is one of four things: a role a machine plays, a protocol it speaks, a check it performs on somebody else's mail, or a record it publishes in DNS so that other people can check its mail. This is how they relate.

flowchart LR
    subgraph roles["Roles"]
        MUA["MUA<br/>the mail client"]
        MSA["MSA<br/>submission server"]
        MTAA["MTA<br/>mail transfer agent"]
        MDA["MDA<br/>delivery agent"]
    end
    subgraph proto["Protocols"]
        SMTPP["SMTP / ESMTP"]
        IMAPP["IMAP"]
        POP3P["POP3"]
        SIEVEP["Sieve + ManageSieve"]
    end
    subgraph pub["What you publish in DNS"]
        MXR["MX"]
        SPFR["SPF"]
        DKIMR["DKIM selector"]
        DMARCR["DMARC"]
        MTASTSR["MTA-STS"]
        TLSAR["TLSA - DANE"]
        TLSRPTR["TLS-RPT"]
        PTRR["PTR"]
    end
    subgraph checks["What the server checks on arrival"]
        SPFC["SPF result"]
        DKIMC["DKIM signature"]
        DMARCC["DMARC alignment + policy"]
        DNSBLC["DNSBL / SURBL"]
        GREYC["Greylisting"]
        SAC["SpamAssassin score"]
        AVC["Anti-virus"]
    end

    MUA -->|"submits on 587"| MSA
    MSA --> MTAA
    MTAA -->|"relays on 25"| MTAA
    MTAA --> MDA
    MDA --> IMAPP
    MDA --> POP3P
    MDA --> SIEVEP
    MUA --- IMAPP
    MUA --- POP3P
    MSA --- SMTPP
    MTAA --- SMTPP

    MXR -.->|"tells senders where"| MTAA
    SPFR -.-> SPFC
    DKIMR -.-> DKIMC
    DMARCR -.-> DMARCC
    MTASTSR -.->|"require TLS to me"| SMTPP
    TLSAR -.->|"this is my certificate"| SMTPP
    TLSRPTR -.->|"tell me when TLS fails"| SMTPP
    PTRR -.->|"who this IP claims to be"| DNSBLC

    SPFC --> SAC
    DKIMC --> DMARCC
    DMARCC --> SAC
    DNSBLC --> SAC
    GREYC --> SAC
    SAC --> AVC
    AVC --> MDA

Loading

Roles and the shape of an email system

Term	Meaning	Where you meet it here
MTA	Mail Transfer Agent — a mail server that accepts and forwards messages	hMailServer is one. Connections & protocols → Protocols
MSA	Message Submission Agent (RFC 6409) — the server your own users hand mail to, normally on port 587, normally with authentication	The same process; the distinction is made at RCPT TO, and it decides whether hMailServer supplies a missing Message-ID
MUA	Mail User Agent — the mail client: Outlook, Thunderbird, a phone	Connecting a Mail Client
MDA	Mail Delivery Agent — the part that puts a message into a mailbox	LocalDelivery; this is where rules, Sieve, quotas and auto-replies run
Relay	Accepting a message for a domain you do not host and passing it on	Access & abuse protection → IP ranges, four separate permissions
Open relay	A server that relays for anyone. Never be one	The shipped IP ranges refuse it; Monitoring → External setup checks
Smart host	Another server you send all your outbound mail through, often your ISP's	Mail flow & delivery → Delivery of e-mail, "SMTP Relayer"
Route	A per-destination-domain override of where mail goes	Mail flow & delivery → Routes — beats the smart host
Incoming relay	An upstream gateway in front of you whose IP must not be treated as the real client by anti-spam checks	Mail flow & delivery → Incoming relays
Backscatter	Bounces sent to a forged sender address; you are the innocent third party	Avoided by refusing at RCPT TO rather than accepting and bouncing

Protocols and their extensions

Term	Meaning	Where you meet it here
SMTP	The protocol for transferring mail between servers (RFC 5321)	Ports 25 and 587 by default
ESMTP	SMTP after EHLO, with extensions advertised as keywords	The keyword list is in Capabilities and Configuration
HELO / EHLO	The greeting a sending server gives. EHLO asks for the extension list	A legacy HELO session gets plain, non-enhanced replies
IMAP	Protocol for reading mail that stays on the server (RFC 3501 / RFC 9051)	Port 143; TLS on 993 once you add the port
IMAP4rev2	RFC 9051, the current IMAP. Opt-in per session via ENABLE IMAP4rev2	Removes \Recent, makes SEARCH return ESEARCH
POP3	Protocol for downloading mail to one device (RFC 1939)	Port 110; TLS on 995 once you add the port
STARTTLS	Upgrading a plaintext connection to an encrypted one, in-band	Connections & protocols → TCP/IP ports, "STARTTLS optional/required"
Implicit TLS	TLS from the first byte, no upgrade step — ports 465, 993, 995	The same page, "SSL/TLS" security setting
PIPELINING	The client may send several commands without waiting for each reply	Advertised unconditionally inbound; outbound since 6.2.25
CHUNKING / BDAT	RFC 3030: send the message as counted binary chunks instead of dot-stuffed DATA	Advertised inbound; outbound behind OutboundChunking, default on
BINARYMIME	RFC 3030: 8-bit binary content with no transfer encoding	Accepted for local delivery; relayed onward only for an authenticated submission to a server advertising both
8BITMIME	The message body may contain 8-bit octets	Advertised unconditionally
SMTPUTF8 / EAI	Internationalised addresses — non-ASCII in the local part and domain	Advertised unconditionally
ENHANCEDSTATUSCODES	The three-part codes (4.2.2, 5.7.1) that accompany a reply	Advertised unconditionally; RFC 3463
DSN	Delivery Status Notification (RFC 3461/3464) — the machine-readable half of a bounce	NOTIFY= and ORCPT= on RCPT TO; NOTIFY=NEVER is honoured
ORCPT	The DSN parameter carrying the address the sender originally wrote	Validated for syntax, deliberately not retained
NDR	Non-Delivery Report — the bounce message itself	Mail flow & delivery → Server messages holds its text
IDLE	The IMAP command that lets a client wait for new mail instead of polling	Gated by the enableimapidle setting, seeded on
UID / UIDVALIDITY	The stable per-message and per-folder identifiers IMAP clients cache against	Changing a folder's identity invalidates every client's cache
EXPUNGE	Permanently removing messages an IMAP client marked \Deleted	Expunge history is kept for QRESYNC and pruned by a scheduled task
COMPRESS=DEFLATE	RFC 4978 — compress the whole IMAP session. New in 6.2.28	IMAPCompressionEnabled, default on; both directions once started, and there is no way back to plain text
XCLIENT	A Postfix extension letting a trusted upstream declare the real client's address	SMTPXClientTrustedIPs; never advertised to an untrusted peer
PROXY protocol	HAProxy's v1/v2 header carrying the original client address	SMTPProxyProtocolEnabled + SMTPProxyProtocolTrustedIPs
ManageSieve	RFC 5804 — the protocol a client uses to upload and manage its Sieve scripts	ManageSieveServerPort, 0 (off) by default
Sieve	The standard mail-filtering language (RFC 5228), evaluated during delivery	Accounts & domains → the account's Sieve tab; Rules and Sieve

Authentication and credentials

Term	Meaning	Where you meet it here
SASL	The framework mail protocols use to carry an authentication exchange	Everything below is a SASL mechanism
AUTH LOGIN / PLAIN	The two mechanisms that send the password itself	PLAIN needs the SMTP "allow plain text" setting; both should only run under TLS
SCRAM	A challenge-response mechanism where the password never crosses the wire	SCRAM-SHA-256 is offered whenever AUTH is
Channel binding (-PLUS)	A SCRAM variant that ties the exchange to the exact TLS connection, defeating a man in the middle	SCRAM-SHA-256-PLUS, offered on TLS only
XOAUTH2 / OAUTHBEARER	Signing in with an OAuth 2.0 access token instead of a password — how Microsoft 365 and Google want it done	OAuth2Enabled; Access & abuse protection → Authentication
SASL EXTERNAL	Authenticating by the client TLS certificate alone	Offered when the certificate verified against the port's CA and names an address
App password	A long random secondary password for one client, revocable on its own	Per account; stored in hm_apppasswords
TOTP	Time-based one-time password — the six digits from an authenticator app	Per account, and server-enforced for administrators since 6.2.25
PBKDF2	The default password hashing scheme here (PBKDF2-HMAC-SHA256)	PreferredHashAlgorithm = 4, the shipped default
Argon2id	A memory-hard password hash, stronger against GPU attack	PreferredHashAlgorithm = 5
scrypt	The other memory-hard option, with a tunable work factor	Added in 6.2.25
Pepper	A server-wide secret mixed into every password hash, kept outside the database	PasswordPepper, empty by default
LDAP / Active Directory	Checking mailbox passwords against a directory rather than the local database	Access & abuse protection → Directory authentication (LDAP)
ACL	Access Control List — who may do what to a shared IMAP folder	Accounts & domains → Public folders; all decisions go through ACLManager

Anti-spam, anti-abuse and content

Term	Meaning	Where you meet it here
SPF	A DNS record listing which servers may send mail for your domain	Spam & virus filtering → Anti-spam settings; publish yours from Monitoring → DNS records
DKIM	A cryptographic signature proving a message came from your domain unaltered	Per domain, with the DNS record shown and copyable. RSA and Ed25519
DKIM selector	The label in selector._domainkey.example.com that names one key, so keys can be rotated	Chosen when you generate the key
DMARC	A policy saying what to do when SPF and DKIM both fail, and where to send reports	Evaluated on arrival; aggregate (rua) reports sent hourly when a from-address is set
ARC	Authenticated Received Chain — preserves authentication results across a forwarder that breaks SPF	TLS & certificates → Transport security
DNSBL	DNS blacklist — a list of IP addresses known to send spam	Spam & virus filtering → DNS blacklists
SURBL	A blocklist of domains appearing in message bodies, rather than sending IPs	Spam & virus filtering → SURBL servers
Greylisting	Temporarily refusing an unknown sender with a 4xx; real servers retry, most spambots do not	Anti-spam settings; QuickRetries exists so your own deferred mail retries quickly
Tarpit	Deliberately slowing a connection that is behaving like an attack, to make it expensive	Recipient tarpit on Anti-spam settings; logon tarpit on Auto-ban
Auto-ban	Blocking an IP address after repeated failed logons	Access & abuse protection → Auto-ban
Quarantine	Holding a suspected-spam message for review instead of delivering or destroying it	Spam & virus filtering → Quarantine; QuarantineEnabled
SpamAssassin	An external scoring engine hMailServer can consult over spamd	Anti-spam settings; the bench runs it as a service named SpamAssassinJAM
ClamAV	The open-source virus scanner, spoken to over clamd on 3310 or run as clamscan	Spam & virus filtering → Anti-virus settings
EICAR	The harmless standard test string every scanner is required to detect	Used to prove a scanner is really loaded and warmed up
Blocked attachment	A file-name wildcard (*.exe) whose attachments are stripped	Spam & virus filtering → Blocked attachments
BATV	Bounce Address Tag Validation — signs your envelope sender so forged bounces can be spotted	BATV settings
SRS	Sender Rewriting Scheme — rewrites the envelope sender when you forward, so SPF still passes	Used on forwarding paths

Transport security and DNS

Term	Meaning	Where you meet it here
MX record	The DNS record saying which server receives a domain's mail	Monitoring → MX query looks any domain's up from this server
PTR record	Reverse DNS — maps an IP back to a host name. Many receivers require one that matches	Monitoring → External setup
MTA-STS	A policy, fetched over HTTPS and announced in DNS, telling other servers that mail to you must be encrypted and to which host names	TLS & certificates → Transport security; hosting the policy needs a port on the web services listener
DANE	Publishing your TLS certificate (or its issuer) in DNS as a TLSA record, secured by DNSSEC	Enforced outbound by default; DaneEnforcementEnabled
TLSA	The DNS record type DANE uses	Monitoring → DNS records shows what to publish
DNSSEC	Cryptographic signing of DNS, so answers cannot be forged. DANE is worthless without it	DnssecValidationEnabled, on by default; the resolver validates in-process
TLS-RPT	RFC 8460 reports telling a sending domain that TLS to them failed — and receiving the same about you	Sent hourly once TlsRptFromAddress is set
ACME	The protocol Let's Encrypt uses to issue certificates automatically	TLS & certificates → Certificates (ACME); renewal is checked hourly
ARI	ACME Renewal Information — the server telling the client when to renew	Honoured by the renewal task
Certificate chain	The server certificate plus the intermediates a client needs to build a path to a trusted root	fullchain.pem from ACME; the REST listener falls back to it when given no certificate of its own

Storage, accounts and delivery

Term	Meaning	Where you meet it here
Domain	A mail domain this server is authoritative for	Accounts & domains → Domains
Domain alias	A second name for a domain — mail to either lands in the same mailboxes	The Domains page
Account	One mailbox, with a password and a quota	The Domains page
Alias	A second address that resolves to an account, a list, or an external address	Aliases Lists and Public Folders
Distribution list	An address that fans out to many recipients, optionally moderated	The same page
Catch-all	An address that receives anything otherwise undeliverable in the domain	Set on the domain
Plus addressing	user+anything@example.com delivering to user, with the tag usable by rules and Sieve	Enabled per domain
Public folder	A shared IMAP folder, with per-group permissions	Accounts & domains → Public folders
Group	A named set of accounts, used to grant public-folder permissions	Accounts & domains → Groups
Fetch account	An account on someone else's server that this server logs into and collects mail from, over POP3 or IMAP	On the account; MaxNumberOfExternalFetchThreads bounds them
Mirror folders	A fetch-account mode that copies whole remote IMAP folders, flags and dates included, rather than delivering into the inbox	FetchAccount.MirrorFolders, new in 6.2.27 — the migration route
Delivery queue	Mail this server has accepted and not yet delivered, held as a database row plus a file on disk	Monitoring → Delivery queue
Deferral	Holding a message for a later attempt after a temporary failure. Always preferable to bouncing	The retry schedule is on Delivery of e-mail
Envelope vs header	The MAIL FROM/RCPT TO addresses the servers use, versus the From:/To: a person reads. They need not match	Why DMARC alignment exists at all
Return-Path	The header hMailServer writes at delivery, recording the envelope sender	Added by the trace-header writer
Received header	The trace line each server adds as a message passes through	Read them bottom-up: the oldest hop is last
Message-ID	The globally unique identifier of a message	Supplied by this server only when it is the submission server for the message
Retention	Automatically deleting mail, logs or archives older than a set age	Maintenance pages; four scheduled tasks - logs, archives, mailboxes, IMAP expunge history
Archive	A separate, indexed copy of mail kept for compliance, with legal hold	Maintenance → Advanced; added in 6.2.25

Administration, operations and the project

Term	Meaning	Where you meet it here
Control Panel	The .NET 10 WPF administration application (hMailCP) that replaced the old Administrator	The Control Panel
COM API	The scriptable object model every management surface goes through	The COM API and Scripting
REST API	The HTTP administration API at /api/v1, off until given a port	The REST API
Portal	The self-service page at /portal on the REST listener, where a user signs in with their mailbox password. New in 6.2.28	Monitoring → API & monitoring
Control Deck	The browser views the REST listener serves for read-only monitoring	The same page
Prometheus	The metrics format the metrics listener exposes	MetricsServerPort, 0 (off) by default
OpenTelemetry / OTLP	The vendor-neutral protocol for exporting traces, metrics and logs	OtelEndpoint; a no-op until set
Event script	A VBScript or JScript handler run at a named point in delivery (OnDeliveryStart, OnDeliverMessage, …)	Maintenance → Event scripts
Diagnostics	The built-in self-checks — DNS, ports, connectivity, data directory, backup directory	Monitoring → Diagnostics, and Diagnostics over COM
Schema version	The number in hm_dbversion that must equal REQUIRED_DB_VERSION in the binary. 6031 at 6.2.28	Mismatch is why a server "starts" and refuses its database
DBUpdater	The tool that walks the upgrade chain and moves a database forward one step at a time	Shipped with the installer; Upgrading hMailServer
SQL CE	SQL Server Compact 4.0, the embedded backend with no server to install	The default for small installations and the regression bench
DPAPI	The Windows API used to protect stored secrets with the machine or account key	Maintenance → Server limits & expert settings
SBOM	Software Bill of Materials — the machine-readable list of everything in the build. SPDX and CycloneDX, attached to every release	Third-Party Binaries
Sigstore / cosign / Rekor	Keyless signing through GitHub's OIDC identity, publicly logged. No long-lived private key exists	Release Process
Authenticode	Microsoft's executable signature, the one the UAC prompt names and SmartScreen reads. The installer carries one from 6.3.1 (Azure Artifact Signing, Progressive Robot Ltd, countersigned); releases before it do not and never will, because a published release is immutable	Security Policy
DCO	Developer Certificate of Origin — the Signed-off-by: trailer that replaces a CLA here	Contributing
CodeQL	GitHub's static analysis. C# on every push and pull request; C++ on pushes, weekly and on demand	Project Handbook
Fuzzing	Feeding a parser malformed input at high speed to find crashes	Fuzzing
Negative control	A new test built to fail against the pre-fix binary, proving it actually tests the fix	Release Process step 3
Regression gate	The full 2,127-test run on the exact binary being shipped. Any later change voids it	Regression Test Environment

---

hMailServer 6.2.28 — maintained by Christopher Holloway / Progressive Robot Ltd. Licensed under AGPL-3.0. Source and issue tracker: https://github.com/Progressiverobot/hmailserver