Pre-release: hMailServer 6.2.22 pre-release 1

Re-published on GitHub on 18 October 2026 from the GitLab release v6.2.22-pre1 of 2026-08-16. Each file below was checked against the SHA-256 that GitLab's package registry records for it before it was uploaded here.

Re-published on GitLab on 24 September 2026 from the GitHub release of 16 August 2026 (2026-08-16 22:33:58 UTC). Issue, pull request and discussion numbers below are GitHub's.

This is a pre-release. It carries everything merged since 6.2.21 — two database schema steps, a Sieve filtering wave, the Microsoft 365 OAuth switch-over, eleven IMAP extensions, and two reported bugs fixed, one of which broke certificate issuance entirely. The full 1,600-test regression suite passes on this exact build, but the changes are broad and recent; run it where you can afford to report a problem rather than where you cannot afford one.

Databases upgrade automatically (schema 6012 → 6014) via the bundled DBUpdater. Take a backup before installing a pre-release.

The built-in ACME client never worked against a real Let's Encrypt — fixed (GitHub issue 34)

GitHub issue 34 reported certificate issuance failing every time against Let's Encrypt production with "Authorization offers no http-01 challenge", while an independent client succeeded within seconds — an excellent report that had already ruled out DNS, CAA, firewalling and stale authorizations.

The cause was ours, and it was one line: boulder — the software behind Let's Encrypt staging and production — pretty-prints its JSON, "type": "http-01" with a space after the colon. The challenge locator searched for the compact form, "type":"http-01", which can never match a real Let's Encrypt response. Every issuance failed at the first authorization with a message that blamed the CA for a parse miss on our side. The rest of the client's JSON handling was already whitespace-tolerant; this one search was the only compact-form assumption — and the one an issuance cannot get past.

The locator now tolerates any whitespace and checks context (the string must actually be a "type" key's value), and the real CA's response shape is pinned by self-tests so it cannot regress. The two diagnosability gaps the reporter named are also fixed: every failure message now says which domain it is about — three CNAME'd hostnames were indistinguishable in the log — and the no-challenge refusal now includes the CA's actual response, the only evidence of what was really offered.

Log lines stopped going missing for forty minutes at a time (GitHub issue 33)

With Keep log files open enabled, each log line sat in a ~4 KB write buffer until enough later lines arrived to push it out — the close-per-line that the setting skips was the only flush. On a quiet server the tail of a session stayed invisible, cut off mid-line, for as long as nothing else happened; GitHub issue 33's reporter measured forty minutes. The logger now hands every line to the operating system as it is written — a visibility flush, deliberately not a physical disk sync — so the file is complete up to the last event the moment it happened. The setting keeps its actual saving, which is the open/close per line. (Installations without the setting were never affected, which is also why 1,589 regression tests never noticed.)

Microsoft 365: ready for the Basic-auth shutdown, four months early

Microsoft shuts off Basic authentication for SMTP relay in December 2026. This build implements the XOAUTH2 bearer login Microsoft requires, in both directions:

• Outbound relay: when a route's destination is on the configured OAuth host list, AUTH presents a bearer token in Microsoft's exact one-round-trip XOAUTH2 shape instead of LOGIN with a password. Tokens are fetched with the client-credentials flow, cached to 80% of their lifetime, and invalidated on refusal. The host list is the safety: a token presented to the wrong relay is a leaked token, so unlisted relays keep their password login unchanged.
• POP3 collection: external accounts fetching from Microsoft 365 authenticate the same way. The password is deliberately not a fallback — a provider configured for OAuth has Basic auth off, and a quiet downgrade would send a password to a server that no longer wants one.
• The Control Panel's Relayer page carries the new settings with an explanation of each.

Sieve filtering grows up

The Sieve engine now implements and advertises, end to end, with delivery-side tests asserting where messages were actually filed: variables (RFC 5229), editheader (RFC 5293) with the protected-header rule, duplicate (RFC 7352), reject/ereject (RFC 5429) generating real DSNs, include (RFC 6609) with per-script variable scopes, enotify (RFC 5435, mailto), date/currentdate with :index and :zone (RFC 5260), spamtest (RFC 5235) reading the server's own verdict — never a header a sender could forge, ihave/environment (RFC 5463/5183), mailboxexists, and :regex — wearing the same runaway-pattern circuit breaker as the rules engine, because a hostile pattern should suspend itself, not the server.

ManageSieve refusals now carry machine-readable response codes alongside the prose, and RENAMESCRIPT — promised by the capability line all along — is implemented.

Eleven IMAP extensions, one theme: stop making clients guess

• APPENDLIMIT (RFC 7889): the upload size limit was always enforced but undiscoverable — clients learned it by uploading and failing. Now advertised exactly (per-account, in bytes), answered via STATUS, and oversize refusals carry TOOBIG.
• LITERAL- (RFC 7888): {n+} literals stop being answered with continuations the client never reads; a LOGIN or small APPEND now needs one round trip.
• LIST-STATUS (RFC 5819): a client syncing N mailboxes at startup issues one LIST instead of one STATUS per mailbox.
• UNAUTHENTICATE (RFC 8437): a session can hand the user back and be reused. The per-connection failed-login counter deliberately survives, so the command cannot reset the brute-force cap.
• QUOTA modernised (RFC 9208): QUOTA=RES-STORAGE advertised, quota refusals carry OVERQUOTA, SETQUOTA is recognised and refused with an explanation (quotas are administrative), and the reply for an account without a quota is now grammatically valid.
• PREVIEW (RFC 8970): the server hands clients a body snippet, so a message list renders without fetching bodies. HTML-only messages are stripped to text; the RFC's 256-octet ceiling is enforced on a UTF-8 boundary.
• MULTIAPPEND (RFC 3502): several messages in one APPEND, atomically — refusing any message means storing none, which is the entire difference from N separate APPENDs. Composes with LITERAL- into a single round trip; APPENDUID carries the whole uid-set.
• REPLACE (RFC 8508): saving a draft stops being APPEND + STORE \Deleted + EXPUNGE. The replacement is stored first, so a failed append leaves the original untouched.
• SAVEDATE (RFC 8514, schema 6013): when a message was saved into its mailbox, as its own column — INTERNALDATE must survive COPY, the save date must not, and one field cannot do both. FETCH item and all four search keys.
• METADATA (RFC 5464, schema 6014): annotations on mailboxes and the server, with DEPTH/MAXSIZE options, atomic SETMETADATA, and shared entries visible to every session with access to the folder.
• Outbound SIZE (RFC 1870) on the SMTP client: MAIL FROM declares the message size, and a message above the remote's advertised limit is refused locally before the upload — some servers only enforce their limit after DATA. Building this exposed that the client only spoke EHLO on routes needing TLS or authentication, so ordinary MX-to-MX deliveries never learned the remote's capabilities at all; EHLO is now the opener on every delivery, with the HELO fallback kept.

Also in this build

• Schema 6012: an auto-reply can be given a start date as well as an end date, and rule criteria accept patterns up to 2,000 characters. A COM interface that reported bare HRESULTs for every error it ever raised now reports the actual message.
• Vacation-message begin dates, the rule-criteria length limit and the M365 relay settings are all editable in the Control Panel.

Known issues and honest gaps

• BINARYMIME, IMAP BINARY, CATENATE/URLAUTH, COMPRESS=DEFLATE and OBJECTID remain unimplemented; the roadmap describes each honestly.
• Outbound PIPELINING/CHUNKING: the delivery client is strictly one-command-one-reply. Round-trip optimisations, not correctness gaps.
• Equal-preference MX records are still not randomised (RFC 5321 5.1).

---

Assets

File	Size	SHA-256
hMailServer-6.2.22-x64.exe	76,720,492	a9555de111cd77cd3c4f01a3abc80a3c1323da64355e4898995191d1f713dfff
hMailServer-6.2.22-x64.exe.cosign.bundle	10,763	e14041df0e840dbe777b8b61083a32b1369e92c071197625c2c30133d5419c48
hmailserver.cyclonedx.json	89,889	0c569011a43be4da3fb0466ca97035daaf3a2b75b64fd3c5efc8b015176e0037
hmailserver.cyclonedx.json.cosign.bundle	10,811	f4df7d98edbc9865bb5e53894ebedc725054e708346b0062d9a3137daffae44d
hmailserver.spdx.json	151,498	a944159e06be5833152855e7394e9ab6eaf5c381c35c925005be1ac9c4ecf82a
hmailserver.spdx.json.cosign.bundle	10,715	c56b724a1d3ed0be71a8b0b0bbce568ac6de011b9fd5225032c5b992d8235411

These are the files published with the GitHub release, byte for byte, re-hosted in this project's package registry. The hashes above were computed from them on 24 September 2026. Each .cosign.bundle / .sigstore.json is the Sigstore bundle GitHub Actions made when the release was signed; all of them were verified again before re-publishing, against the former GitHub repository's workflow identity (https://github.com/Progressiverobot/hmailserver/..., issuer https://token.actions.githubusercontent.com), which is the identity to give cosign verify-blob for these files. The Windows installer of this release was not Authenticode-signed (Authenticode signing began with 6.3.1).