Glossary

Glossary

This page began as a chapter of the 6.2.10 manual and has been corrected for 6.2.24, then completed on 8 September 2026 for 6.2.28: every entry now says where in hMailServer you meet the thing, and the acronyms the newer pages use are here too. The Control Panel's pages are grouped differently now, so the paths below use today's groups; the TLS ports 465, 993 and 995 exist only after you create them on the TCP/IP ports page (a fresh install seeds 25, 587, 110 and 143); and everything added since 6.2.10 is in Changes-Since-6210. Where a value here disagrees with the Settings Reference, which is generated from the code, the reference is right. 6.3.7, the latest release (17 October 2026, schema 6108), is not yet reflected in the entries; the stamp at the foot of the page names it.

A glossary is only useful if it tells you where the word lives. Each entry below has three parts: what the term means, what it means here, and the Control Panel page, setting name or wiki page where you would go next. Terms in bold in the right-hand column are settings in hMailServer.ini — see the Settings Reference.

How the words fit together

Most of the vocabulary below is one of four things: a role a machine plays, a protocol it speaks, a check it performs on somebody else's mail, or a record it publishes in DNS so that other people can check its mail. This is how they relate.

flowchart LR
    subgraph roles["Roles"]
        MUA["MUA<br/>the mail client"]
        MSA["MSA<br/>submission server"]
        MTAA["MTA<br/>mail transfer agent"]
        MDA["MDA<br/>delivery agent"]
    end
    subgraph proto["Protocols"]
        SMTPP["SMTP / ESMTP"]
        IMAPP["IMAP"]
        POP3P["POP3"]
        SIEVEP["Sieve + ManageSieve"]
    end
    subgraph pub["What you publish in DNS"]
        MXR["MX"]
        SPFR["SPF"]
        DKIMR["DKIM selector"]
        DMARCR["DMARC"]
        MTASTSR["MTA-STS"]
        TLSAR["TLSA - DANE"]
        TLSRPTR["TLS-RPT"]
        PTRR["PTR"]
    end
    subgraph checks["What the server checks on arrival"]
        SPFC["SPF result"]
        DKIMC["DKIM signature"]
        DMARCC["DMARC alignment + policy"]
        DNSBLC["DNSBL / SURBL"]
        GREYC["Greylisting"]
        SAC["SpamAssassin score"]
        AVC["Anti-virus"]
    end

    MUA -->|"submits on 587"| MSA
    MSA --> MTAA
    MTAA -->|"relays on 25"| MTAA
    MTAA --> MDA
    MDA --> IMAPP
    MDA --> POP3P
    MDA --> SIEVEP
    MUA --- IMAPP
    MUA --- POP3P
    MSA --- SMTPP
    MTAA --- SMTPP

    MXR -.->|"tells senders where"| MTAA
    SPFR -.-> SPFC
    DKIMR -.-> DKIMC
    DMARCR -.-> DMARCC
    MTASTSR -.->|"require TLS to me"| SMTPP
    TLSAR -.->|"this is my certificate"| SMTPP
    TLSRPTR -.->|"tell me when TLS fails"| SMTPP
    PTRR -.->|"who this IP claims to be"| DNSBLC

    SPFC --> SAC
    DKIMC --> DMARCC
    DMARCC --> SAC
    DNSBLC --> SAC
    GREYC --> SAC
    SAC --> AVC
    AVC --> MDA

Loading

Roles and the shape of an email system

Term	Meaning	Where you meet it here
MTA	Mail Transfer Agent — a mail server that accepts and forwards messages	hMailServer is one. Connections & protocols → Protocols
MSA	Message Submission Agent (RFC 6409) — the server your own users hand mail to, normally on port 587, normally with authentication	The same process; the distinction is made at RCPT TO, and it decides whether hMailServer supplies a missing Message-ID
MUA	Mail User Agent — the mail client: Outlook, Thunderbird, a phone	Connecting a Mail Client
MDA	Mail Delivery Agent — the part that puts a message into a mailbox	LocalDelivery; this is where rules, Sieve, quotas and auto-replies run
Relay	Accepting a message for a domain you do not host and passing it on	Access & abuse protection → IP ranges, four separate permissions
Open relay	A server that relays for anyone. Never be one	The shipped IP ranges refuse it; Monitoring → External setup checks
Smart host	Another server you send all your outbound mail through, often your ISP's	Mail flow & delivery → Delivery of e-mail, "SMTP Relayer"
Route	A per-destination-domain override of where mail goes	Mail flow & delivery → Routes — beats the smart host
Incoming relay	An upstream gateway in front of you whose IP must not be treated as the real client by anti-spam checks	Mail flow & delivery → Incoming relays
Backscatter	Bounces sent to a forged sender address; you are the innocent third party	Avoided by refusing at RCPT TO rather than accepting and bouncing

Protocols and their extensions

Term	Meaning	Where you meet it here
SMTP	The protocol for transferring mail between servers (RFC 5321)	Ports 25 and 587 by default
ESMTP	SMTP after EHLO, with extensions advertised as keywords	The keyword list is in Capabilities and Configuration
HELO / EHLO	The greeting a sending server gives. EHLO asks for the extension list	A legacy HELO session gets plain, non-enhanced replies
IMAP	Protocol for reading mail that stays on the server (RFC 3501 / RFC 9051)	Port 143; TLS on 993 once you add the port
IMAP4rev2	RFC 9051, the current IMAP. Opt-in per session via ENABLE IMAP4rev2	Removes \Recent, makes SEARCH return ESEARCH
POP3	Protocol for downloading mail to one device (RFC 1939)	Port 110; TLS on 995 once you add the port
STARTTLS	Upgrading a plaintext connection to an encrypted one, in-band	Connections & protocols → TCP/IP ports, "STARTTLS optional/required"
Implicit TLS	TLS from the first byte, no upgrade step — ports 465, 993, 995	The same page, "SSL/TLS" security setting
PIPELINING	The client may send several commands without waiting for each reply	Advertised unconditionally inbound; outbound since 6.2.25
CHUNKING / BDAT	RFC 3030: send the message as counted binary chunks instead of dot-stuffed DATA	Advertised inbound; outbound behind OutboundChunking, default on
BINARYMIME	RFC 3030: 8-bit binary content with no transfer encoding	Accepted for local delivery; relayed onward only for an authenticated submission to a server advertising both
8BITMIME	The message body may contain 8-bit octets	Advertised unconditionally
SMTPUTF8 / EAI	Internationalised addresses — non-ASCII in the local part and domain	Advertised unconditionally
ENHANCEDSTATUSCODES	The three-part codes (4.2.2, 5.7.1) that accompany a reply	Advertised unconditionally; RFC 3463
DSN	Delivery Status Notification (RFC 3461/3464) — the machine-readable half of a bounce	NOTIFY= and ORCPT= on RCPT TO; NOTIFY=NEVER is honoured
ORCPT	The DSN parameter carrying the address the sender originally wrote	Validated for syntax, deliberately not retained
NDR	Non-Delivery Report — the bounce message itself	Mail flow & delivery → Server messages holds its text
IDLE	The IMAP command that lets a client wait for new mail instead of polling	Gated by the enableimapidle setting, seeded on
UID / UIDVALIDITY	The stable per-message and per-folder identifiers IMAP clients cache against	Changing a folder's identity invalidates every client's cache
EXPUNGE	Permanently removing messages an IMAP client marked \Deleted	Expunge history is kept for QRESYNC and pruned by a scheduled task
COMPRESS=DEFLATE	RFC 4978 — compress the whole IMAP session. New in 6.2.28	IMAPCompressionEnabled, default on; both directions once started, and there is no way back to plain text
XCLIENT	A Postfix extension letting a trusted upstream declare the real client's address	SMTPXClientTrustedIPs; never advertised to an untrusted peer
PROXY protocol	HAProxy's v1/v2 header carrying the original client address	SMTPProxyProtocolEnabled + SMTPProxyProtocolTrustedIPs
ManageSieve	RFC 5804 — the protocol a client uses to upload and manage its Sieve scripts	ManageSieveServerPort, 0 (off) by default
Sieve	The standard mail-filtering language (RFC 5228), evaluated during delivery	Accounts & domains → the account's Sieve tab; Rules and Sieve

Authentication and credentials

Term	Meaning	Where you meet it here
SASL	The framework mail protocols use to carry an authentication exchange	Everything below is a SASL mechanism
AUTH LOGIN / PLAIN	The two mechanisms that send the password itself	PLAIN needs the SMTP "allow plain text" setting; both should only run under TLS
SCRAM	A challenge-response mechanism where the password never crosses the wire	SCRAM-SHA-256 is offered whenever AUTH is
Channel binding (-PLUS)	A SCRAM variant that ties the exchange to the exact TLS connection, defeating a man in the middle	SCRAM-SHA-256-PLUS, offered on TLS only
XOAUTH2 / OAUTHBEARER	Signing in with an OAuth 2.0 access token instead of a password — how Microsoft 365 and Google want it done	OAuth2Enabled; Access & abuse protection → Authentication
SASL EXTERNAL	Authenticating by the client TLS certificate alone	Offered when the certificate verified against the port's CA and names an address
App password	A long random secondary password for one client, revocable on its own	Per account; stored in hm_apppasswords
TOTP	Time-based one-time password — the six digits from an authenticator app	Per account, and server-enforced for administrators since 6.2.25
PBKDF2	The default password hashing scheme here (PBKDF2-HMAC-SHA256)	PreferredHashAlgorithm = 4, the shipped default
Argon2id	A memory-hard password hash, stronger against GPU attack	PreferredHashAlgorithm = 5
scrypt	The other memory-hard option, with a tunable work factor	Added in 6.2.25
Pepper	A server-wide secret mixed into every password hash, kept outside the database	PasswordPepper, empty by default
LDAP / Active Directory	Checking mailbox passwords against a directory rather than the local database	Access & abuse protection → Directory authentication (LDAP)
ACL	Access Control List — who may do what to a shared IMAP folder	Accounts & domains → Public folders; all decisions go through ACLManager
Role	A named set of administrator permissions, given to an account for named domains	6.3.4: serveradmin, domainadmin, helpdesk, auditor and custom roles over 27 permissions (RoleManager.cpp's PermissionTokens); Administrator roles page, /api/v1/roles
Passkey / WebAuthn	A credential kept by a phone, a laptop or a security key and proved by a signature, so no password is typed	6.3.4: sign-in to the webmail and the Control Deck, enrolled on the Security page; IMAP, POP3 and SMTP still take the password
OpenID Connect (OIDC)	Signing in at the organisation's identity provider, which vouches for the person with a signed token	6.3.4: the Oidc* settings; the webmail and the Deck only
SAML	The older, XML-based single sign-on that ADFS - and Entra ID or Okta set up that way - speak	6.3.4: the Saml* settings; the same one-use ticket as OIDC
SCIM	A standard API an identity provider uses to make, change and remove the accounts of the people it manages	6.3.4: /scim/v2 on the REST listener, for an API key holding provision
Recovery code	One of ten single-use codes a person keeps for the day their authenticator is lost	6.3.4: the webmail's Security page, beside a recovery address; sent in X-hMailServer-Recovery-Code

Anti-spam, anti-abuse and content

Term	Meaning	Where you meet it here
SPF	A DNS record listing which servers may send mail for your domain	Spam & virus filtering → Anti-spam settings; publish yours from Monitoring → DNS records
DKIM	A cryptographic signature proving a message came from your domain unaltered	Per domain, with the DNS record shown and copyable. RSA and Ed25519
DKIM selector	The label in selector._domainkey.example.com that names one key, so keys can be rotated	Chosen when you generate the key
DMARC	A policy saying what to do when SPF and DKIM both fail, and where to send reports	Evaluated on arrival; aggregate (rua) reports sent hourly when a from-address is set
ARC	Authenticated Received Chain — preserves authentication results across a forwarder that breaks SPF	TLS & certificates → Transport security
DNSBL	DNS blacklist — a list of IP addresses known to send spam	Spam & virus filtering → DNS blacklists
SURBL	A blocklist of domains appearing in message bodies, rather than sending IPs	Spam & virus filtering → SURBL servers
Greylisting	Temporarily refusing an unknown sender with a 4xx; real servers retry, most spambots do not	Anti-spam settings; QuickRetries exists so your own deferred mail retries quickly
Tarpit	Deliberately slowing a connection that is behaving like an attack, to make it expensive	Recipient tarpit on Anti-spam settings; logon tarpit on Auto-ban
Auto-ban	Blocking an IP address after repeated failed logons	Access & abuse protection → Auto-ban
Quarantine	Holding a suspected-spam message for review instead of delivering or destroying it	Spam & virus filtering → Quarantine; QuarantineEnabled
SpamAssassin	An external scoring engine hMailServer can consult over spamd	Anti-spam settings; the bench runs it as a service named SpamAssassinJAM
ClamAV	The open-source virus scanner, spoken to over clamd on 3310 or run as clamscan	Spam & virus filtering → Anti-virus settings
EICAR	The harmless standard test string every scanner is required to detect	Used to prove a scanner is really loaded and warmed up
Blocked attachment	A file-name wildcard (*.exe) whose attachments are stripped	Spam & virus filtering → Blocked attachments
BATV	Bounce Address Tag Validation — signs your envelope sender so forged bounces can be spotted	BATV settings
SRS	Sender Rewriting Scheme — rewrites the envelope sender when you forward, so SPF still passes	Used on forwarding paths
Mail flow rule	A rule run on the mail of the whole server or of one domain, with actions a transport rule has: add a disclaimer, reject with a text, require TLS, quarantine, warn the sender	6.3.4: a domain's own rules beside the server's and an account's (schema 6063)
DLP / sensitive content	Data loss prevention - catching card numbers, IBANs, account numbers or kinds of attachment on their way out	6.3.4: conditions of the mail flow rules, not a second engine
Impersonation protection	Flagging or quarantining mail from outside that borrows a colleague's name or a look-alike of the domain	6.3.4: per domain, off until turned on (schema 6087)
Compromised-account detection	Spotting the shape of a stolen password in what an account sends, against its own history	6.3.4: watch by default, enforce to hold and lock (schema 6071)
Restricted delivery	Accounts, or a whole domain, that may exchange mail only with named domains	6.3.4: on the domain and the account (schema 6084)
Sandbox	A machine that opens an attachment to see what it does, before the message is delivered	6.3.4: SandboxEnabled (an hm_settings row), and a sandbox service you name (schema 6091)

Transport security and DNS

Term	Meaning	Where you meet it here
MX record	The DNS record saying which server receives a domain's mail	Monitoring → MX query looks any domain's up from this server
PTR record	Reverse DNS — maps an IP back to a host name. Many receivers require one that matches	Monitoring → External setup
MTA-STS	A policy, fetched over HTTPS and announced in DNS, telling other servers that mail to you must be encrypted and to which host names	TLS & certificates → Transport security; hosting the policy needs a port on the web services listener
DANE	Publishing your TLS certificate (or its issuer) in DNS as a TLSA record, secured by DNSSEC	Enforced outbound by default; DaneEnforcementEnabled
TLSA	The DNS record type DANE uses	Monitoring → DNS records shows what to publish
DNSSEC	Cryptographic signing of DNS, so answers cannot be forged. DANE is worthless without it	DnssecValidationEnabled, on by default; the resolver validates in-process
TLS-RPT	RFC 8460 reports telling a sending domain that TLS to them failed — and receiving the same about you	Sent hourly once TlsRptFromAddress is set
ACME	The protocol Let's Encrypt uses to issue certificates automatically	TLS & certificates → Certificates (ACME); renewal is checked hourly
ARI	ACME Renewal Information — the server telling the client when to renew	Honoured by the renewal task
Certificate chain	The server certificate plus the intermediates a client needs to build a path to a trusted root	fullchain.pem from ACME; the REST listener falls back to it when given no certificate of its own

Storage, accounts and delivery

Term	Meaning	Where you meet it here
Domain	A mail domain this server is authoritative for	Accounts & domains → Domains
Domain alias	A second name for a domain — mail to either lands in the same mailboxes	The Domains page
Account	One mailbox, with a password and a quota	The Domains page
Alias	A second address that resolves to an account, a list, or an external address	Aliases Lists and Public Folders
Distribution list	An address that fans out to many recipients, optionally moderated	The same page
Catch-all	An address that receives anything otherwise undeliverable in the domain	Set on the domain
Plus addressing	user+anything@example.com delivering to user, with the tag usable by rules and Sieve	Enabled per domain
Public folder	A shared IMAP folder, with per-group permissions	Accounts & domains → Public folders
Group	A named set of accounts, used to grant public-folder permissions	Accounts & domains → Groups
Fetch account	An account on someone else's server that this server logs into and collects mail from, over POP3 or IMAP	On the account; MaxNumberOfExternalFetchThreads bounds them
Mirror folders	A fetch-account mode that copies whole remote IMAP folders, flags and dates included, rather than delivering into the inbox	FetchAccount.MirrorFolders, new in 6.2.27 — the migration route
Delivery queue	Mail this server has accepted and not yet delivered, held as a database row plus a file on disk	Monitoring → Delivery queue
Deferral	Holding a message for a later attempt after a temporary failure. Always preferable to bouncing	The retry schedule is on Delivery of e-mail
Envelope vs header	The MAIL FROM/RCPT TO addresses the servers use, versus the From:/To: a person reads. They need not match	Why DMARC alignment exists at all
Return-Path	The header hMailServer writes at delivery, recording the envelope sender	Added by the trace-header writer
Received header	The trace line each server adds as a message passes through	Read them bottom-up: the oldest hop is last
Message-ID	The globally unique identifier of a message	Supplied by this server only when it is the submission server for the message
Retention	Automatically deleting mail, logs or archives older than a set age	Maintenance pages; four scheduled tasks - logs, archives, mailboxes, IMAP expunge history
Archive	A separate, indexed copy of mail kept for compliance, with legal hold	Maintenance → Advanced; added in 6.2.25
eDiscovery	Finding and handing over mail for a legal or compliance matter: a case, searches across mailboxes, holds, and an export that proves what was handed over	6.3.4 (schema 6097): /api/v1/discovery/cases, the Control Deck's Discovery view, a read-only Control Panel page; permissions view_discovery (the auditor role) and manage_discovery. Discovery.md
Legal hold (eDiscovery hold)	A case's instruction that mail be kept whatever anyone asks: its owner's delete, retention, a purge, a move or a restore	6.3.4: placed on an account, a domain or the archived copies a search matched, and released only by the case; it outranks an address erasure, and a held mailbox's deleted items are kept until it is released. The older per-copy archive hold of 6.2.25 is POST /api/v1/archive/{id}/hold
Resource mailbox (room, equipment)	An account that is a meeting room or a piece of equipment and answers the invitations it is sent by itself	6.3.4 (schema 6101): kind on PUT /api/v1/accounts/{address}, COM Account.Kind; its booking policy at /api/v1/accounts/{address}/booking-policy; it cannot be signed into. RoomsAndEquipment.md
Journaling	Sending a copy of a domain's or an account's mail to an address elsewhere - as a journal report, or as the message itself (dual delivery)	6.3.4: Journaling and dual delivery page (schema 6075)
Masked address	An address made for one shop or sign-up, delivered to the account and switched off when it starts to bring spam	6.3.4: the webmail's Settings (schema 6067)
Send-as address	An address at another provider, proved with a mailed code, that an account may write from	6.3.4: the webmail's Settings (schema 6066)
Directory (GAL)	The organisation's address list: the accounts and lists of your own domain, with titles, departments and phones	6.3.4: the webmail's completion and a CardDAV collection, never across domains (schema 6078)
Message recall	Withdrawing an unread message from the accounts on this server it was sent to	6.3.4: POST /api/v1/me/recall; nothing that left the server is recalled (schema 6085)
List manager	Mailing-list handling inside a distribution list: joining and leaving by mail or page, an archive, a digest, a footer	6.3.4: switched on per list (schema 6092)
VERP	Variable Envelope Return Path - a return address per member, so a bounce names the member it came from	6.3.4: an option of the list manager
OpenPGP / WKD	The other end-to-end encryption standard, and the Web Key Directory that publishes a person's key at their own domain	6.3.4: a published-key store (schema 6050) and OpenPGP in the webmail (6080)
Protected message	A message encrypted to a password, read in the browser by a recipient who has no key	6.3.4: the webmail's compose (schema 6082)
Zero-access mailbox	A mailbox encrypted to its owner's own key, which the server holds and cannot read	6.3.4: opt-in per account where ZeroAccessAllowed (an hm_settings row) lets it (schema 6083)
S/MIME authority	A domain's own certificate authority, which certifies the keys its people make in the browser	6.3.4: per domain (schema 6095); it never makes or holds a person's key
Gateway encryption	Encrypting mail to a partner domain at the server, to the partner's own key, whatever the sender's client did	6.3.4: a remote domain policy (schema 6094)
Outbound shaping / throttling	Pausing delivery to a destination that asks this server to slow down, and keeping one tenant from holding every delivery thread	6.3.4: OutboundBackoffMinutes (an hm_settings row), on at 2; the per-destination and per-tenant ceilings, off
IP warm-up	Raising a new sending address's daily volume at each large provider a step at a time	6.3.4: a schedule per address (schema 6093)
Send API	An application sending mail through an API key that names its sender and its ceilings	6.3.4: POST /api/v1/send (schema 6089)
Inbound webhook (mail in to a webhook)	Mail that arrives for an address being posted to a web application's URL, parsed, instead of - or as well as - being put in a mailbox	6.3.4 (schema 6100): /api/v1/inbound-webhooks and the Deck's Inbound webhooks view, under manage_inbound_webhooks; SendGrid-style form fields or JSON, signed; nothing on until a route is made. InboundWebhooks.md
Message store	Where delivered messages live: files under the data directory, one per message, with the database as their index	Since 6.3.4 every read and write of a message's file goes through one unit, Common/Persistence/MessageStore, which is what lets it be compressed, encrypted or put in an object store. MessageStore.md
Storage compression and de-duplication	Storing a message deflated, and a large attachment once for every message that carries the same bytes	6.3.4 (schema 6098): MessageStoreCompression, off as shipped; MessageStoreDedupMinKB (256); GET /api/v1/store says what it saves
Object store	Storage reached over HTTPS by key rather than as files: S3 and its compatibles (MinIO, Wasabi, Backblaze B2, Ceph RGW), or Azure Blob Storage	6.3.4: the message store's messages there, the database the index, written to local disk first and moved by a background committer; MessageStoreBackend file and no service as shipped, so off until named. ObjectStorage.md
Encryption at rest (mailbox)	A mailbox whose stored messages are encrypted to a key of the account's own, opened by its password at sign-in	6.3.4 (schema 6099): per account, off on every account, after the domain's recovery key is made; REST and the Deck only. Distinct from a zero-access mailbox, whose key the server never holds. EncryptionAtRest.md
Recovery key (a domain's)	The key a domain's encrypted mailboxes are also sealed to, wrapped by a passphrase only an administrator knows	6.3.4: /api/v1/domains/{domain}/mailbox-recovery; lose the passphrase and a forgotten password cannot be recovered
PST import	Reading an Outlook data file into an account on the server itself	6.3.4: a migration of kind pst, read in a process of its own (--pst-read); no PST job until PstImportDirectory names a directory, empty as shipped. Migration.md

Administration, operations and the project

Term	Meaning	Where you meet it here
Control Panel	The .NET 10 WPF administration application (hMailCP) that replaced the old Administrator	The Control Panel
COM API	The scriptable object model every management surface goes through	The COM API and Scripting
REST API	The HTTP administration API at /api/v1, off until given a port	The REST API
Portal	The self-service page at /portal on the REST listener, where a user signs in with their mailbox password. New in 6.2.28	Monitoring → API & monitoring
Control Deck	The administration page in the browser at / on the REST listener, which reads and writes since 6.3.0	Fifteen views in 6.3.3, forty in 6.3.4; APIs Reference §5
Settings store	The database table that holds the [Settings] keys, with the file's section as its copy	6.3.4: schema 6042; an edit to the file is not used and is named once (HM5804), its line put back where the service may write the file - not under NT SERVICE\hMailServer, to which the file is read-only (The Service Account)
Applies mark	When a saved setting takes effect: now, after a reinitialise, or after a restart	6.3.4: on every [Settings] key; the Control Panel's pending bar and Apply now
Setting level	The server, a domain or an account - each able to hold its own value of the same setting	6.3.4: 27 settings; EffectiveSetting says what is in effect and where it came from (schema 6088)
Environment name	HM_SETTING_<key> or HM_PROPERTY_<name>: a setting set from the container's environment, which then wins	6.3.4: hmailserver --apply-environment at every start
Profile	A named set of settings for one kind of server - office, gateway, relay, sender - applied with a diff first and a way back	6.3.4: the checklist, the Setting profiles page, the container's HM_PROFILE
Drain / maintenance mode	Closing the doors - listeners closed, delivery paused - while the process stays up	6.3.4: /api/v1/server/drain; the live update drains first
Prometheus	The metrics format the metrics listener exposes	MetricsServerPort, 0 (off) by default
OpenTelemetry / OTLP	The vendor-neutral protocol for exporting traces, metrics and logs	OtelEndpoint; a no-op until set
Event script	A VBScript or JScript handler (Windows), or since 6.3.4 a JavaScript one (Linux, in the QuickJS engine), run at a named point in delivery (OnDeliveryStart, OnDeliverMessage, …)	Maintenance → Event scripts; The COM API and Scripting 23.6
QuickJS	Fabrice Bellard's small JavaScript engine, embedded in the server	6.3.4: release 2025-04-26, vendored as source under Server/quickjs, running event scripts on Linux with no file, process or network access; 6.3.6: release 2026-06-04, ES2025
Sealed secret	A secret stored in the database encrypted under a key that is not in the database, so a copy of the database does not give it away	6.3.4 (schema 6103): an account's TOTP secret and ten [Settings] secrets, as HMK1:<key id>:<base64> (AES-256-GCM); off after an upgrade until a stored-secrets key is made. SecretsAtRest.md
Stored-secrets key	The installation's key the sealed secrets are sealed under, held by every server that shares the database	6.3.4: [Security] StoredSecretsKey in each server's hMailServer.ini under DPAPI or the Linux key file, never in the database or a backup; --create-stored-secrets-key, --export-, --import-, --forget-sealed-secrets
Virtual service account	A Windows service identity made from the service's name, with no password and only the rights it is granted	6.3.4: a new installation runs as NT SERVICE\hMailServer, an upgrade keeps its account; hMailServer.exe /GrantServiceAccess. ServiceAccount.md
Secure defaults	What a new installation is given before anyone configures it	6.3.4: a self-signed certificate, STARTTLS on 25, 587, 110 and 143, and TLS required for authentication from the Internet range - for a database the installation created, never an upgraded one. SecureDefaults.md
SNMP	Simple Network Management Protocol, which older monitoring systems poll for a device's figures	6.3.4: a read-only SNMPv3 agent (UDP 161, authPriv) answering the mail MIB; off, and answering nobody until SnmpAllowedAddresses names a manager; Ports Reference 4.6
Database TLS mode	Whether and how the connection to the database server is encrypted and checked	6.3.4: [Database] TlsMode - empty for prefer, disable, require, verify-full - and TlsCaFile. DatabaseTls.md
Diagnostics	The built-in self-checks — DNS, ports, connectivity, data directory, backup directory	Monitoring → Diagnostics, and Diagnostics over COM
Schema version	The number in hm_dbversion that must equal REQUIRED_DB_VERSION in the binary. 6040 in 6.3.3, 6104 in 6.3.4	Mismatch is why a server "starts" and refuses its database
DBUpdater	The tool that walks the upgrade chain and moves a database forward one step at a time	Shipped with the installer; Upgrading hMailServer
SQL CE	SQL Server Compact 4.0, the embedded backend with no server to install	The default for small installations and the regression bench
DPAPI	The Windows API used to protect stored secrets with the machine or account key	Maintenance → Server limits & expert settings
SBOM	Software Bill of Materials — the machine-readable list of everything in the build. SPDX and CycloneDX, attached to every release from 6.2.3; the five earlier releases that carry an installer have a CycloneDX SBOM of it alone, made afterwards	Third-Party Binaries
Sigstore / cosign / Rekor	Keyless signing through a CI system's OIDC identity, publicly logged. No long-lived private key exists. The release assets from 6.2.19 to 6.3.3 - but for the two SBOMs of 6.2.22-pre3, which carry no bundle - were signed this way by GitHub Actions, the only signer a 6.2.28 to 6.3.3 server trusts; the releases before 6.2.19 carry no bundle. 6.3.4 carries no Sigstore bundle, so no server's live update installs it and it is installed by hand, its download checked against a SHA-256 sums file signed with the release tags' SSH key; it trusts the GitHub signer for releases up to 6.3.3 and the project's GitLab CI pipeline for a v* tag, which has signed every release after 6.3.4 - 6.3.5 at the path the project began at, and from 6.3.6 at the path of the group hmailserver, which the project moved to on 29 September 2026	Release Process, Upgrading hMailServer 18.4c
Authenticode	Microsoft's executable signature, the one the UAC prompt names and SmartScreen reads. The installer carries one from 6.3.1 (Azure Artifact Signing, Progressive Robot Ltd, countersigned), 6.3.4's included; releases before it do not and never will: the releases up to 6.3.3 are published with their original files, byte for byte, on GitLab and, since 18 October 2026, in its copy on GitHub - 6.2.0 and 6.0.0-B4 with none, which only the suspended account, or someone's old download, has	Security Policy
DCO	Developer Certificate of Origin — the Signed-off-by: trailer that replaces a CLA here	Contributing
CodeQL	GitHub's static analysis. It analysed the C# on every push and pull request, and the C++ on pushes, weekly and on demand, and from a change of 18 September 2026 on pull requests too. That was a GitHub Actions workflow of the project's, codeql.yml, which has not run since GitHub suspended the project's account that day. Since 18 October 2026 CodeQL analyses the code of the project's repository on GitHub, GitLab's mirror, on each push to master, on each pull request and weekly - GitHub's default setup at first, and then a workflow of the project's, .github/workflows/codeql.yml, with the same languages, queries and categories, which OpenSSF Scorecard's SAST check counts where it did not count the default setup; the maintainers read its findings, and it holds no change and no release. The project's own .gitlab-ci.yml defines cppcheck, clang-tidy, Semgrep, Trivy and OSV jobs in its place, and not CodeQL: since 6.3.6 static-analysis (cppcheck and clang-tidy) and semgrep fail the pipeline of master, a batch* branch or a release tag on a finding new to their baselines that master's exceptions file does not accept, while dependency-scan (Trivy with OSV) blocks no pipeline and the release job reads its report	Project Handbook
Fuzzing	Feeding a parser malformed input at high speed to find crashes	Fuzzing
Negative control	A new test built to fail against the pre-fix binary, proving it actually tests the fix	Release Process step 3
Regression gate	The full run on the exact binary being shipped - 2,302 tests in 6.3.3, 3,811 in 6.3.4 ([Test] in hmailserver/test/RegressionTests at the tag), run in two halves on two benches. Any later change voids it	Regression Test Environment

---

hMailServer 6.3.7, the latest release (17 October 2026) — maintained by Christopher Holloway / Progressive Robot Ltd. Licensed under AGPL-3.0-or-later. Source and issue tracker, the one place the project is worked on: https://gitlab.com/hmailserver/hmailserver; its mirror on GitHub since 18 October 2026, with no Issues: https://github.com/RainbowWizard-coder/hMailServer