History / Connecting a Mail Client

Your First Domain and Mailbox, Aliases Lists and Public Folders, Connecting a Mail Client, DNS for Your Domain, How Email Works, Rules and Sieve and Routes and Relays describe the screenshots retaken from 6.3.7, read from each image and from the Control Panel at master, where they described the 6.2.10-era captures and the notes beside them said the left rail predated the grouped navigation: the Domains page puts the Domain box and Add domain above the domain list and the Address and Password boxes above the accounts, and a domain, an account or a distribution list is opened with the pencil button on its row (Edit domain ..., Edit account ..., Edit distribution list ...) or a double-click, a list's members with the people button (Members of ...), where the text said Properties and Edit; the domain dialog has seventeen tabs, General carrying the domain name, and the account dialog sixteen, Identity holding the account's kind, a person, a room or a piece of equipment, so that the kind is no longer among what only the Control Deck sets, while a room's booking policy is; the distribution list editor shows Moderator, Bounce address and the membership query; the public folders, routes and incoming relays pages are described as they are, the routes page with Properties... and its empty-list text, the relays page with its Front-end proxies (PROXY protocol and XCLIENT) card; an account's Two-factor tab is embedded as cp-account-twofactor.png where the Control-Panel-only administrator dialog stood in for it, and Live logs is described streaming the sample domain's local delivery rather than an SMTP and IMAP session, with the Listening column of TCP/IP ports, not Server status, saying which listeners are up; Protocols has a tab each for SMTP, IMAP, POP3 and ManageSieve and one for Timeouts; IP ranges is under Sign-in & access, with Allow delivery and Only after SMTP authentication in its Permissions card; Generate key pair... asks where to save the DKIM key; DNS records and the Setup checklist, once External setup, are under Set up this server, and the ARC and TLS reporting settings of Transport security are on its Signing and Reports tabs; the Rules page is titled Rules, with Show rules for and the Match list of the IF card (Match all criteria (AND), Match any criterion (OR)); the ManageSieve card is on the ManageSieve tab of Protocols; and the smart host is on the Smart host tab of Delivery of e-mail, where it was the Relayer tab, its fields Smart host name (empty = direct delivery) and The smart host requires authentication, with Journaling & dual delivery under Compliance. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 19, 2026

Every page's header says whether 6.3.7 is reflected in it, and none calls 6.3.6 the latest release, where thirty-seven headers still said "6.3.6, the latest release (6 October 2026...". The guide and reference pages brought up on 5 October 2026 to 6.3.6 say so with its date and schema, and that 6.3.7, the latest release (17 October 2026, schema 6108), is not yet reflected on them: Aliases, Lists and Public Folders, the APIs Reference, Compliance and eDiscovery, Connecting a Mail Client, Control Panel Pages, the Control Panel Reference, DNS for Your Domain, Encryption and Certificates, Encryption for People, How Email Works, Mail In to a Webhook, Mailing Lists, Message Storage, Migration, Monitoring and Health, Outbound Shaping, the Ports Reference, Profiles and Environment, Rooms and Equipment, Routes and Relays, Rules and Sieve, the Runbooks Digest, Security Hardening, Settings Overview, Sign-in and Identity, Stopping Spam, Stopping Viruses, The Control Deck, The Control Panel, The REST API, The Webmail, Troubleshooting, What hMailServer Is and Is Not and Your First Domain and Mailbox. Backup and Restore says that 6.3.7 is reflected only in the release a failed full restore is made again on, Capabilities and Configuration only in the releases the release jobs have made, and the Settings Reference that its keys were last re-checked at v6.3.6, where its re-check of 5 October 2026 called v6.3.6 the latest release. The COM API and Scripting and the Glossary, whose headers said nothing of a release after 6.3.4, say that 6.3.7 is not yet reflected, the Glossary that its stamp names it; Version History to 6.2.10 that its history ends at 6.2.10 and what came after, up to 6.3.7, is in Changes Since 6.2.10; and the Project Handbook that its status note, and what sections 7, 8, 9 and 11 say of how a change lands, who can approve it, which runners run what and which releases the release jobs have made, are brought up to the tree at 6.3.7, the rest not yet, and that 6.3.7, published on 17 October 2026, was the first of the security releases that go on until 30 September 2027. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 18, 2026

The guide pages say what 6.3.6 changes in anti-spam, DANE and outbound TLS, backups and restores, calendars, sign-ins, the webmail, Sieve, the store commands and the auto-ban, and every page's header says whether 6.3.6 is reflected in it. Stopping Spam: the SURBL test as 6.3.6 runs it (every registrable domain up to 200, 256 names a list, sixteen lookups at a time, SurblTooManyDomainsScore, a list's error answers never a listing), the Sender MX test by the Public Suffix List, the two FQDN checks, the greylisting key of schema 6107, the sender lists' URL entries. Encryption and Certificates: What DANE actually does for 6.3.6 - DANE-TA, the indeterminate lookups, the validated MX RRset, a resolver that strips DNSSEC, the deferrals where mail bounced, and the log lines as the tag writes them. DNS for Your Domain: the indeterminate rule and the resolver requirement. Routes and Relays: the relayer's STARTTLS required refuses permanently, as it always did; a webhook route held to public addresses through HttpProxy. Mail In to a Webhook: the same. Backup and Restore: the Updates folder and a destination inside the data directory left out, the restore that copies in first and undoes a copy that fails, the full restore that failed on installations made new with 6.3.4 or 6.3.5, this installation's own self-signed pair kept, a message deleted while a backup copies. Rooms and Equipment: the organiser verified by the From address, and the send API believed for nobody. Encryption for People and The Webmail: the S/MIME certificates kept, the HTML view's images, OpenPGP's 32 MB, the attachments' types, the invitation card, days to keep. Connecting a Mail Client: a stored event changed only by a verified sender, the AUTH on port 25 that bans, FETCH's NO [LIMIT]. Sign-in and Identity: the pending sign-ins carried by the browser, sealed. Rules and Sieve: ManageSieve's deadlines and a session that ends. Message Storage: the store commands' link rule. Mailing Lists: every field of a posting removed. Security Hardening: the grant through a junction, who else on the computer may read the mail (/ProtectFolders), AutoBanMinutes for an AUTH on port 25, the checklist's row 12a. Migration: days to keep messages, as the repository's document gives it. Aliases, Lists and Public Folders, Compliance and eDiscovery, Control Panel Pages, Monitoring and Health, Outbound Shaping, Profiles and Environment, Stopping Viruses, What hMailServer Is and Is Not, Your First Domain and Mailbox and How Email Works: the header says that 6.3.5 and 6.3.6 are not yet reflected on the page. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 5, 2026

Every link to the project points at its address in the group, gitlab.com/hmailserver/hmailserver, where it has been since 29 September 2026; the identities 6.3.5 was signed with, and the setting row that lists both paths, keep the path the project began at. The project's path in all 63 pages that linked it (548 links), 6.3.6 being the first release made at the group's path. Left as they were: the seven signing identities https://gitlab.com/Progressiverobot/hmailserver//.gitlab-ci.yml@refs/tags/v... (Release Process, Security Policy, The Update Feed, and the UpdateSigningIdentity row of Settings Reference), which name what 6.3.5 was signed as; and the UpdateSourceRepository row of Settings Reference, which lists both paths on purpose. The container registry's name is corrected with the container page. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 5, 2026

The wiki is brought up to the published release: 6.3.4 is the signed tag v6.3.4 at 51e2dbda0, published on GitLab on 27 September 2026 (02:37:56 UTC), not 8adce850a of 26 September, where the tag was first made and whose release gate failed. Every page that named 8adce850a as the tag or the release names 51e2dbda0, and every page that dated the release 26 September dates it 27 September: the footer, the sidebar, the page headers, the landing page's Current release, the release timeline's row and picture, section 4e's heading. Each fact those pages took from 8adce850a was checked at 51e2dbda0: the commits between the two change 42 files, whose only documents are CHANGELOG.md, BrandLogos.md, OpenPGP.md and SecretsAtRest.md, none of which a page copies, and which include none of Constants.h, Version.h, formMain.cs, the create scripts, IniFileSettings.cpp, SettingsDefaults.h, the IDL, the Control Panel or .gitlab/allowed_signers, so every file and line cited at the tag holds. Where a page said it read the tag on 26 September, it says it read 8adce850a and that what it read is the same at the tag. The suite has 3,811 [Test] attributes at the tag, not 3,809 (the fixes add two tests); twelve places say so. Changes Since 6.2.10 gains, in batch 40, what the release gate found and the eleven fixes: three change tests alone; of the other eight, three fix what 6.3.3 did too - a relay that refused the OAuth2 login got the server's token into the bounce and the logs (open since 6.2.22-pre1), a rule's forward, copy, reply or notice and an account's forwarding could wait a minute in the queue, and IMAP LIST and LSUB took a literal's length for the pattern - and five fix code new in 6.3.4 (sealed mail and an unnamed part, a closed key's FETCH refusal logged as a critical error, the help desk's password reset read as bytes, the logo and key-directory holds, an alert's encoded Subject over 76 characters). The gate table and the timeline give the re-run on 51e2dbda0 as the logs have it: 2,349 on the first bench (2,252 passed, 0 failed, 97 skipped) and 1,462 on the second (1,446 passed, 0 failed, 16 skipped), the 71 live-update tests elevated, all passed, and the Linux suite on the packaged binary, 2,013 tests, 1,562 passed, 0 failed, 451 skipped (results/b40full3 on linix); the database upgrade gates, the security scans, the fuzzers and the installer smoke test, 65 of 65. The JScript flaw is CVE-2026-100741 (CVSS 3.1 9.8), and the project's issue #43 is public: Security Hardening 17.11, the scripting page, the changes, the capabilities and the API reference name them. The project's download links work (the site has served HTTPS since 26 September; on 27 September they led to 6.3.4's files), so Installing on Linux and Running in a Container no longer say they work once it does. The copies of SECURITY.md and CONTRIBUTING.md give the day GitLab published the release, and the security policy's copy counts the 455 findings .gitlab/security-exceptions.yml accepts at the tag - the 169 of the SAST triage and the 286 that held the release scan - where the repository document still says 169; each header says where the copy differs. Three places said no pipeline had run on the fixed tree; one has, the schedule of 27 September 2026 on master 6bc09509d, which ran the update feed's pages and package-repos jobs alone, and they say so.

Christopher Holloway committed Sep 27, 2026

The wiki is brought up to the release itself, the signed tag v6.3.4 at 8adce850a: what it said of 6.3.4 had been read from master 92b8f9f63, which the tag's last batch, batch40, follows. Schema 6104, not 6103: 6.3.4 is sixty-four steps from 6.3.3's 6040, the last, 6103 to 6104, adding hm_fetchaccounts.faorigin (Constants.h:1224, formMain.cs:314 and the three create scripts at the tag); every header, table, count and diagram that gave 6103 as 6.3.4's schema says 6104, the upgrade table's step counts are each one more, the step tables gain the 6104 row, and where 6103 means the secrets-at-rest step it stays. No page calls 92b8f9f63 the release or the tree 6.3.4 was cut from any more: a page checked against it says so and that the tag adds a last batch, and a page that copies a repository document the tag leaves as it was says the document is the same at the tag. The copies of repository documents batch40 changes are brought up to the tag, hunk by hunk from the version each copy had reached, their own additions kept: Security Policy (the SSH-signed sums of a release made by hand and the two commands that check a download, an SBOM for every compiled file, a release held by its security scans, secrets refused before they are pushed; its note no longer says the document calls 6.3.3 the latest), Release Process (A release made by hand, the security gate, the SBOM jobs), Upgrading Guide (the installer's HM_ADMIN_PASSWORD, the named lock on MySQL and MariaDB, the probe that stops an upgrade on too old a server at 6041 and the repair of a half-done one), Contributing, Governance (rebuilt on the tag's document, which gives the GitLab roles the owner set on 26 September 2026; the map and the note on code-signing material kept), Assurance Case, Regulatory Scope, Third-Party Binaries, Fuzzing, Migrating the Database Backend and Regression Test Environment. The installer's password handling as the tag has it: the password page is skipped for HM_ADMIN_PASSWORD as for /adminpassword, the database step hands the password (or the live update's token, as token:<hex>) to DBSetupQuick and DBSetup in HM_ADMIN_PASSWORD and DBSetupQuick to DBUpdater the same way, never on a command line, the switch table has the variable, and the unattended upgrade takes either (Installing hMailServer, Upgrading hMailServer 18.4a). How to verify a download: 6.3.4's hmailserver-6.3.4-SHA256SUMS.txt and its .sig, checked with ssh-keygen -Y verify against .gitlab/allowed_signers and sha256sum -c, as SECURITY.md at the tag gives them, and each installer's and package's own SBOM (Installing hMailServer 4.1, Installing on Linux, Upgrading hMailServer 18.4 and 18.4c, home, Release Process, Project Handbook, Troubleshooting, Glossary, Assurance Case, Regulatory Scope). The /download/ links no longer wait on issue #30: the feed's site has had its certificate since 26 September 2026. Changes Since 6.2.10 gains batch 40 in section 4e (the audit before the release, GitLab's SAST and the release gate, the installer's password, the SBOMs and signed sums, the stable download links, the release chain and landing through merge requests, what the first pipeline found, Windows on ARM compiled), items 47 to 51 in section 5 (reserved domain names, a one-time code taken once, the outbound relay's OAuth2 token over TLS only, the fetchers and schema 6104, a pre-6.3.4 hash of a password above U+00FF refused), SQLOLEDB in item 38, the 6041 probe in item 36, and the installer's own PBKDF2 in item 39. Also what the tag makes false elsewhere: the suite has 3,809 [Test] attributes, not 3,698; hmailserver/docs holds 105 documents; Windows on ARM compiles and has never run, where it was "not built"; IMAP offers STARTTLS only before sign-in and TLS and COMPRESS=DEFLATE only after sign-in (Capabilities and Configuration); a parent-domain passkey relying party needs passkey_allowed_origins (Sign-in and Identity); the Settings Reference counts 193 hm_settings rows with PasskeyAllowedOrigins and WebPushLoopbackHttpForTests; and the Linux suite's CI job first ran in the pipeline of 26 September 2026 rather than never.

Christopher Holloway committed Sep 26, 2026

The feature pages now describe 6.3.4, the latest release (26 September 2026, schema 6103), built from the tree at 92b8f9f63. What they labelled as in the tree after 6.3.3 and not yet released is in 6.3.4 and says "since 6.3.4"; dates inside the release become the version; the sidebar names 6.3.4 as the latest release. What landed after 540347500 is added where a reader meets it. Connecting a Mail Client gains what 6.3.4 changed in IMAP's answers after Dovecot's imaptest (NO where BAD was wrong, \Seen on every BODY[section] without PEEK, APPEND stored byte for byte, a command pipelined behind APPEND answered, SORT and THREAD as the RFCs say, \Recent counted), what a new installation asks of a password (STARTTLS offered, TLS required for authentication from the Internet range, a self-signed certificate), rooms in CalDAV's room finder, and that a mailbox encrypted at rest takes its own password only. The Webmail gains a folder of a hundred thousand messages - one page copied, Oldest, a bounded search that goes on, select-all handed to the server - labelled built and not yet measured. Migration gains PST import: the import directory that is empty as shipped, what comes in and what is refused, and the reader in a child process, which is crash containment and not a sandbox. The Control Panel pages gain the Discovery page (65 pages), the Message store tab, the Windows service account card and what the virtual account refuses; the Control Deck page gains the Discovery and Inbound webhooks views (40), the twelve checklist items, the census of 466, 458 and 586 routes, and the update feed as it stands: 6.3.4 carries no Sigstore bundle and is installed by hand. The remaining pages gain the webhook route that outranks aliases and lists, a legal hold beside rules and Sieve, the Run function name rule, the three new permissions and the administrator password rehashed at sign-in. Four new pages give features with no wiki home one: Compliance and eDiscovery (cases, searches, holds, exports, and the erasure a hold outranks), Message Storage (compression and attachments held once, mailbox encryption at rest, object storage on S3 and Azure Blob, each off by default), Rooms and Equipment, and Mail In to a Webhook. Each is in the sidebar in its natural place, and every sidebar entry resolves to a page.

Christopher Holloway committed Sep 26, 2026

What the adversarial check of the wiki's catch-up found, put right. The REST API's route counts left out the settings groups: RestApiSettings.cpp writes /api/v1/settings and its named groups into the OpenAPI document from its group tables, so no path literal shows them, and the document names 146 paths and 219 operations in 6.3.3 and 417 and 588 at master 540347500, not the 137 and 202 and 404 and 563 the literals alone give; the landing page, The REST API, the APIs Reference and Capabilities and Configuration now say so. The landing page counted 53 pages and listed none of the eight new ones: it counts 61, lists all eight where the sidebar has them, says fifteen pages carry a Source of truth note rather than eight, and names the eight among the guides. A documentation error was said to become an issue with the documentation label, which neither the Default template nor a visitor can set; the sidebar, the footer and the landing page ask for an issue naming the page. Regulatory Scope's table linked Changes Since 6.2.10 as [[Page|Page]], which GitLab splits at the pipe. Capabilities and Configuration placed the 6.3.3 version stamp at 3233b0cc4; it is still 6.3.3 build 42 at 540347500. The Webmail counted Greek, Korean and European Portuguese among what the tree adds, when 6.3.3's twenty already had them; Connecting a Mail Client listed S/MIME in the page as new, which it has been since 6.3.2, where the new thing is a domain's S/MIME authority; Changes Since 6.2.10's collection sweep read 87 calls, six fixed and 84 others, which is three loops and three members; the COM page said every class now carries ISupportErrorInfo, where the checker holds every class that raises an error. And the wiki's own pages stop saying that GitHub's CI runs: Encryption for People's GnuPG proof, the Linux builds on the ARM runner and with both compilers, the translation-unit census, the Compose file and the chart, the settings-index generator, the ini-coverage checker, the account-stores checker and the C++ CodeQL job ran there until 18 September 2026 and are run by hand, or not at all, since. The APIs Reference's server states gain 5, Draining.

Christopher Holloway committed Sep 24, 2026

Connecting a Mail Client said an account single sign-on or SCIM made could get a password through its recovery address; setting a recovery address asks for the account's own password as well, which such an account has never been told, so an administrator setting one is the only way, and the page says so.

Christopher Holloway committed Sep 24, 2026

Running in a Container and Connecting a Mail Client said the opposite of the tree after 6.3.3, and now say what it does. The container page called configuration from the environment a roadmap row and warned that a changed HM_REST_* variable is ignored after the first start; since 23 September every [Settings] key and every database setting has an environment name (HM_SETTING_<key>, HM_PROPERTY_<name>, and _FILE forms for a secret), the entrypoint stores them with --apply-environment at every start, the environment wins and an administrator's change to a setting it names is refused, and HM_PROFILE applies a setting profile once. The page says which generation 6.3.3's image is, that none of this has yet been run in a container, and that GHCR belongs to the GitHub organisation while GitLab's registry holds no image, with the steps to build the image from the release's .deb in the meantime. The mail-client page said CardDAV serves one address book, CalDAV one calendar per account, and that iMIP and free-busy are not there; the tree serves every book an account can see (its own, shared ones and the organisation's directory), several calendars shared with accounts, groups and delegates, invitations by mail filed on delivery, and free-busy within the domain. It also says that passkeys and single sign-on reach the webmail and the Deck and not a mail client.

Christopher Holloway committed Sep 24, 2026

The wiki's links move from GitHub to GitLab, where the project has lived since 22 September 2026. GitHub suspended the account on 18 September and every one of the project's GitHub addresses answers 404, so the download links, the source links, the security route, the support route and the "report an error" link all led nowhere. Every link to a file in the repository now opens it on GitLab, and the four community files that moved to the repository root on master 540347500 - CONTRIBUTING.md, SECURITY.md, SUPPORT.md and CODE_OF_CONDUCT.md - are linked there, which also mends the seven links to a root SECURITY.md that did not exist when they were written. The download links open the latest GitLab release, and the installer has a link that always fetches the latest one. A private report goes to a GitLab confidential issue or the project's Service Desk address, a question is an issue with the Question template because GitLab has no Discussions, and a reader who wants to hear of releases is told how to watch the project on GitLab. The Project Handbook, written against GitHub on 4 September, says that its GitHub process is the project as it was then. The GitHub facts that stay are facts about the product, and each now says what is true of it: the update feed the server reads by default, which answers 404, so a check fails with "The update feed answered HTTP 404." until UpdateFeedUrl names another feed; the Sigstore identity and issuer that signed every release up to 6.3.3, which verify those files wherever they are hosted and which the verifier's defaults still name, so a release signed anywhere else is refused unless the three settings are changed; and the two GitHub addresses compiled into the product, the Policy line of the security.txt the server serves and the Control Panel's About link. Every GitHub issue, discussion and pull-request number written with a hash is now written in words - "GitHub issue 114", "GitHub discussion 18", "upstream PR 602" - with the kind the repository's CHANGELOG gives each number, because GitLab turns a hash and a number into a link to its own issue of that number, which is something else. The one maintainer handle left in running text is in code, and the webmail's mentions no longer read as a GitLab user. Four things GitLab rendered wrongly are put right. The Stopping Spam link to Routes and Relays was split by a line break and led to a page that does not exist. The Fuzzing page's two repository-relative links resolved inside the wiki; they open the fuzz folder and its regression README on GitLab. Placeholders written outside code, such as <host:port>, <addr> and <culture>, were read as HTML and dropped or turned into links; they are in code now. And the Assurance Case's eight section headings began "1. " above a setext rule, which CommonMark reads as a list and a thematic break, so its contents links had nothing to land on; they are ATX headings with the ids those links name.

Christopher Holloway committed Sep 24, 2026

The client-connection page gains the delegated mailboxes the Autodiscover answer now carries, to whom they are answered, and what Outlook does and does not do with them.

chrisholloway5 committed Sep 22, 2026

Four pages catch up with what is in the tree since 6.3.3 and with what shipped in it. The client page gains a CalDAV section beside the CardDAV one, written the way the CardDAV section is: the same listener, the same discovery and the same credentials, one calendar per account at /dav/calendars/<address>/calendar/ made the first time it is asked for, VEVENT and VTODO in the one collection so a phone's calendar and its reminders are the same thing, a repeating event expanded by the server across daylight saving in any of the 592 zone names the new iCalendar module knows, and calendar-query, multiget and sync-collection with ETags. It says what is not there too, because a calendar that silently drops an invitation is worse than one that never offered: no iMIP, no free-busy, no per-calendar time zone, no partial calendar-data, and no time-range filter on an alarm. The webmail paragraph loses a label that went stale the moment 6.3.3 was published - it said "6.3.3, unreleased" of what is now the current release - and gains the twelve features that followed it, each in the reader's terms rather than the roadmap's: the page installed as an app with its unread badge, contacts in and out, saved searches as folders, the reader's own time zone, undo on three more actions, the tracker notice counting what it kept out, swipe actions and snooze presets, three stars that every IMAP client sees as keywords, rows coloured by a rule, @mentions that add the person to the recipients, a formatted signature, and Report phishing beside Junk. The container page gains the two files people expect and this repository now ships. The Compose section says that the file is in the tree, that a workflow resolves it with docker compose config on every change - so it is a file known to parse rather than an example in a document - and how it differs from the page's own shortest-thing-that-starts version: the two passwords are Compose secrets read from files, and the REST certificate is mounted in. Then a Kubernetes section: a StatefulSet of one, because a message store is not something two pods may share, the three volumes as claim templates, the database pointed at and never bundled with the chart refusing to render without a host, the two passwords as a Secret the chart makes or an existing one it is pointed at, the REST listener needing a kubernetes.io/tls Secret because off loopback the server requires TLS, a LoadBalancer with externalTrafficPolicy Local so the server sees the client's address, and probes on port 25 as the image's own health check is. It ends with how the chart is proven, since neither Helm nor Docker is on the bench that gates the code: linted, rendered with a real install's values, and checked for its two refusals, on every change. The REST page gains wave J's routes with the unreleased label: the account groups as a resource (a listing, a create, a read, a rename, a delete, and the members beneath a group as their own small collection, because a membership is a pair and not a property of either side), a message copied into another folder of its account, and the rule-criterion probe that answers what the delivery path would decide without reading or writing anything. And the fuzzing page is re-copied from the repository document it declares as its source of truth, which now carries the nightly job: the three harnesses every night on a hosted runner, the corpus kept in the Actions cache under a key that carries the run id so it grows, and the crash, hang or violated invariant that fails the job and lands the reproducer as an artifact.

chrisholloway5 committed Sep 15, 2026

The client page: bringing contacts in from Google Contacts and Outlook through the webmail's Contacts page, and taking them out as vCard or CSV - in the tree since 15 September 2026, unreleased.

chrisholloway5 committed Sep 15, 2026

6.3.3, published 15 September 2026: the changes page's section 4d is the release now, with the stamped binary's gate, the timeline row and the picture carry it, the schema section runs to 6040 with the two steps of the release, the landing page's current release and schema rows move, the footer names it, and the live-update and CardDAV paragraphs on the upgrading and client pages lose their unreleased labels.

chrisholloway5 committed Sep 15, 2026

What is on master since 6.3.2 and in no release yet: a section on the changes page with the gate numbers of the batches that landed it, the live-update note on the upgrading page, CardDAV on the client page.

chrisholloway5 committed Sep 14, 2026

Two pages still said the built-in page is self-service and not a mail client, and pointed readers at Roundcube - true until 6.3.0, wrong since 6.3.2. What hMailServer Is and Is Not, and Connecting a Mail Client, now say what the page is since 6.3.2 and what 6.3.3 brings, labelled unreleased.

chrisholloway5 committed Sep 14, 2026

The portal is a webmail since 6.3.0, so the two pages that tell a user what it is say what it gained The self-service portal was documented at its 6.2.28 scope - a page that signs in and reads mail. 6.3.0 gave it addresses on the fragment, so a folder, a message, a search and a half-written draft each survive a reload and can be linked to; a change probe it polls every six seconds and not at all while the tab is hidden; folder create, rename and delete under IMAP's own rules and refused in IMAP's own sentences; and inline images, which it fetches itself and hands to its sandboxed frame as data: URLs, because the frame's opaque origin is exactly what stops the session cookie travelling to a subresource request. Neither page was wrong. Both understated the thing a user is deciding whether to use.

chrisholloway5 committed Sep 10, 2026

The wiki rewritten in depth: 141 diagrams drawn from the code, every reference page made exhaustive, and twenty-one defaults corrected that no page had ever stated The wiki was accurate after this morning's sweep and thin. This is the depth pass the owner asked for: every page read against the code again, every reference page completed, and a diagram wherever a diagram says it better than a paragraph. 141 Mermaid diagrams across 49 pages, each drawn from the handler rather than from memory: the SMTP submission sequence with the checks in the order ProtocolMAIL_ and ProtocolRCPT_ actually run them, the IMAP session state machine from the per-command authentication guards, the DMARC evaluation, the delivery pipeline and its retry arithmetic, the ACME renewal state machine, the spam decision from connection to delivery, the schema chain, the component and threading models of the whole server, the CI workflows and what each one gates, the release draft-sign-publish flow, and a map of the journeys through the wiki itself on the landing page. The reference pages are now exhaustive rather than representative: every route with its method, authentication, request and response shape and its error codes; every [Settings] key with its default, its effect and whether it needs a restart; every port with the key that opens it; every rule criterion and action; every Sieve extension the server advertises; every metric the listener exposes. Twenty-one facts were wrong or absent, and each is corrected against the code rather than adjusted. The ones that will save somebody an afternoon: IMAP SASL PLAIN and SCRAM are not advertised on a default install, which looks exactly like a client bug; SMTP AUTH PLAIN is off by default too; DMARC checking is on while SPF and DKIM as scored tests are off, and the DMARC test evaluates both itself regardless; the seeded DNSBL and SURBL servers are inactive; a new mailbox contains INBOX and nothing else, which is the real cause of the classic missing Sent folder; MTA-STS hosting and autoconfiguration default on while both web-service ports default to 0, so the shipped default is features on with nothing listening; and TLS-RPT and DMARC report sending are inert until their From address is set, with each completed day discarded unsent. Eleven screenshots are named as wanted, with what each should show. The existing images are from a 6.2.10-era build and the pages say so where it matters.

chrisholloway5 committed Sep 8, 2026

Every page read against the tree on 8 September 2026: the release and schema stamps (6.2.27, schema 6031, 2,124 tests), the routes, keys and pages that were missing, the listener paragraphs that were false, and the unreleased work labelled as such An audit of all 51 pages against master produced about 360 findings on 43 of them, applied here. The largest: the APIs reference lacked 47 routes and described the listeners as single-threaded HTTP/1.0 (they run on the Boost.Asio HTTP/1.1 server); the settings reference lacked the fourteen Update* keys and IMAPCompressionEnabled and counted 195 keys instead of 236; every "current release" stamp said 6.2.24; Changes Since 6.2.10 ended three releases and one schema step early; Architecture said the optional listeners were deliberately not Boost.Asio and built their own SSL contexts (neither is true); the upgrading pages still warned of a silent-upgrade hang fixed in 6.2.23; the Control Panel pages knew nothing of the seventeen languages, the Updates card or the stalled-mail page; and two pages did not render (a header inside a code block, CR and TAB bytes in file names). Anything in the tree but not in v6.2.27 - the live update, the self-service portal and /api/v1/me, the HttpServer listeners, IMAP COMPRESS=DEFLATE, the seventeen-language Control Panel, the Control Deck views - is documented and marked "in the tree after 6.2.27, not yet released". The Control Panel screenshots are still from a 6.2.10 build and the pages now say so.

chrisholloway5 committed Sep 8, 2026

The hMailServer 6.2.24 wiki: the corrected manual, the runbooks, and the references generated from the code

chrisholloway5 committed Sep 4, 2026