History / The Control Deck

Six of this wiki's own pages name the feed a server from 6.2.28 to 6.3.3 reads by default as the suspended account's Releases API on GitHub, which has answered 404 since 18 September 2026, as UpdateFeed.md says from batch49 and Upgrading hMailServer and Troubleshooting already say, where they called it GitHub's feed or GitHub's API, answering 404, or said that such a server still reads GitHub, which reads as GitHub itself unavailable now that it serves the project's releases again; the Project Handbook and Changes Since 6.2.10 say that GitHub's own CodeQL default setup has analysed the copy on GitHub since 18 October 2026, where the Handbook said that nothing ran CodeQL; and Capabilities and Configuration calls the Scorecard workflow .github/ holds from batch49 a new one. Installing hMailServer, What a server's own update check trusts: a server from 6.2.28 to 6.3.3 reads by default the Releases API of the suspended account's repository, github.com/Progressiverobot/hmailserver, which has answered 404 since 18 September 2026 and still does, the releases copied to GitHub since 18 October 2026 being under another account, where such a server does not look, as Upgrading hMailServer says, where it said GitHub's release feed. Installing on Linux, the update checker: a server from 6.3.0 to 6.3.3 reads the suspended account's Releases API on GitHub, which has answered 404 since 18 September 2026 and still does, where it said GitHub's feed. Capabilities and Configuration, The feed and the signers, as of 6.3.4: up to 6.3.3 the default feed is the Releases API of the suspended account's repository on GitHub, where it said GitHub's Releases API. The Control Deck, the Update view: the default feed since 6.3.4 is in place of the suspended account's Releases API on GitHub, and a server from 6.2.28 to 6.3.3 still reads the suspended account's Releases API on GitHub until UpdateFeedUrl is set, where it said in place of GitHub's and still reads GitHub. Ports Reference, the update feed's row, and Settings Overview, the comment on UpdateFeedUrl: up to 6.3.3 the suspended account's Releases API on GitHub, which answers 404, where both said GitHub's API. On 19 October 2026 api.github.com answered 404 for the releases of Progressiverobot/hmailserver and 200 for the latest release of RainbowWizard-coder/hMailServer, v6.3.7. The Project Handbook, section 13, Static analysis: codeql.yml, a GitHub Actions workflow of the project's, has not run since 18 September 2026, and nothing runs it on GitLab; since 18 October 2026 GitHub's own CodeQL default setup, no workflow of the project's, analyses the code of the copy on GitHub on each push to master, on each pull request and weekly, and holds no change and no release (SECURITY.md, What ran on GitHub, from batch49; the default setup read as configured, weekly, on 19 October 2026), where it said that CodeQL had not run since 18 September 2026 and nothing ran it on GitLab yet, as the Glossary's row on CodeQL now says too. Changes Since 6.2.10, batch 14: after nothing runs it on GitLab yet, that the default setup analyses the code of the copy on GitHub since 18 October 2026. Capabilities and Configuration, the quality-gates line: from batch49 .github/ holds the pull-request template and a new workflows/scorecard.yml, not the workflow of that name the line lists - the tag v6.3.3's, run on a push to master, weekly on Sundays and on demand, where the new one, for the copy on GitHub, runs on a push to master, weekly on Mondays and on a change to branch protection - where it named workflows/scorecard.yml with nothing to tell the two apart. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 19, 2026

Installing hMailServer gives 6.3.7's check, as its header says it does, and it and seven more pages say that the project's GitLab CI has signed every release since 6.3.5 - 6.3.5 at the path the project began at, and from 6.3.6 at the group's, which the project moved to on 29 September 2026 - where they said, as 6.3.4 was made, that the pipeline was to sign the releases after it, had signed none yet and would follow the project to the path it was to move to. Installing hMailServer, section 4.1: a paragraph on checking 6.3.7 - made by its tag's GitLab pipeline, each of its sixty-two files signed with Sigstore and its bundle beside it, hmailserver-6.3.7.intoto.sigstore.json its SLSA provenance, no .sig; the installer checked against the SHA-256 the Download table of the release's notes gives it, dcae96bd75d6cae8e5a910d15940567067539ed99db5aeed40a815added4d85f for hMailServer-6.3.7-x64.exe, or against its bundle with cosign, the identity https://gitlab.com/hmailserver/hmailserver//.gitlab-ci.yml@refs/tags/v6.3.7 and the issuer https://gitlab.com, the project's id 86730559 read as Security Policy's Verifying a release says, then its Authenticode signature - where the page checked releases up to 6.3.3 and 6.3.4 alone; the releases after 6.3.4 are signed by the project's GitLab CI, a signer every server from 6.3.4 on has compiled in, and Upgrading hMailServer 18.4f says which servers install 6.3.7 by their live update, where they were to be signed and a 6.3.4 server's live update was to install them; and what a 6.3.4 server trusts is that pipeline at the path the project began at, where it signed 6.3.5, and at the group's, where it has signed every release from 6.3.6, there only with the project's id. The same stale sentence, swept: Settings Overview (the update feed's two signers), Release Process (Verifying what was published, this wiki's own section: the identities the releases from 6.3.5 carry), the Glossary (Sigstore), the Control Panel Reference (the Updates card), The Control Deck (the Update view: a 6.3.4 server's live update trusts the releases after it, where the signing job was written and had not yet run), the Project Handbook's section 10 and the Settings Reference's UpdateSourceRepository row (the three settings at the path the project began at keep a server to it, so that it refuses every release from 6.3.6, and since the move a server from 6.2.28 to 6.3.3 is upgraded by hand; the row's link to UpdateFeed.md now at the group's path). Home: the Atom feed's entries' ids are made from each release's tag alone, so that they do not change when a release is edited or the project moves, as UpdateFeed.md's The Atom feed says, where they were to keep their ids when the project moved into the group. The sections for one release - Changes Since 6.2.10's 4e and Upgrading hMailServer's 18.4c, written for 6.3.4 - and Capabilities and Configuration's paragraph marked as of 6.3.4 say it as 6.3.4 stood, and stay as written. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 18, 2026

Every page's header says whether 6.3.7 is reflected in it, and none calls 6.3.6 the latest release, where thirty-seven headers still said "6.3.6, the latest release (6 October 2026...". The guide and reference pages brought up on 5 October 2026 to 6.3.6 say so with its date and schema, and that 6.3.7, the latest release (17 October 2026, schema 6108), is not yet reflected on them: Aliases, Lists and Public Folders, the APIs Reference, Compliance and eDiscovery, Connecting a Mail Client, Control Panel Pages, the Control Panel Reference, DNS for Your Domain, Encryption and Certificates, Encryption for People, How Email Works, Mail In to a Webhook, Mailing Lists, Message Storage, Migration, Monitoring and Health, Outbound Shaping, the Ports Reference, Profiles and Environment, Rooms and Equipment, Routes and Relays, Rules and Sieve, the Runbooks Digest, Security Hardening, Settings Overview, Sign-in and Identity, Stopping Spam, Stopping Viruses, The Control Deck, The Control Panel, The REST API, The Webmail, Troubleshooting, What hMailServer Is and Is Not and Your First Domain and Mailbox. Backup and Restore says that 6.3.7 is reflected only in the release a failed full restore is made again on, Capabilities and Configuration only in the releases the release jobs have made, and the Settings Reference that its keys were last re-checked at v6.3.6, where its re-check of 5 October 2026 called v6.3.6 the latest release. The COM API and Scripting and the Glossary, whose headers said nothing of a release after 6.3.4, say that 6.3.7 is not yet reflected, the Glossary that its stamp names it; Version History to 6.2.10 that its history ends at 6.2.10 and what came after, up to 6.3.7, is in Changes Since 6.2.10; and the Project Handbook that its status note, and what sections 7, 8, 9 and 11 say of how a change lands, who can approve it, which runners run what and which releases the release jobs have made, are brought up to the tree at 6.3.7, the rest not yet, and that 6.3.7, published on 17 October 2026, was the first of the security releases that go on until 30 September 2027. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 18, 2026

The reference pages carry what 6.3.6 adds and changes: the live update's trust read from hMailServer.ini alone, the never-ban list by reverse name, each SMTP listener's AUTH, the FQDN checks, the SURBL score, the sessions' bounds, the folders made private, and the COM members, routes, states and figures that go with them. APIs Reference: days to keep with one meaning and the 409 for a page left open; Utilities' helpers answering a signed-in caller; the members added in 6.3.6 with their dispids; UpdateState 6 and 7 and GET /api/v1/update's new fields; the never-ban routes; smtp_authentication on /api/v1/ports; the three anti-spam keys and auto_ban_widen_by_reverse_name; the breach-check test, the audit put-back and the trust keys refused on /settings/ini; the invitation reply's occurrences; the administrator password's delay, the Host the loopback port answers, the IPv6 /64, fifty sessions a holder, API keys' source restrictions, the audit trail's new records. The REST API: the same on its own tables. Settings Reference: the five trust keys file-only, the UpdateSourceRepository row, the four hm_settings rows 6.3.6 adds with hm_neverbannames and portsmtpauth, HelpWikiBaseUrl at the group's path, the [Settings] baseline unchanged, DNSServer and the IP forms refused, DnssecValidationEnabled's IPv6 servers, DaneEnforcementEnabled's resolver, AutoBanCommand's ledger, AutoBanNeverBan's older forms, HttpProxy's callers, the XOAUTH2 token request through it, the Updates folder left out of backups, HM4401. Settings Overview: the five cannot be set over COM, REST, the Control Panel or the Deck. Control Panel Reference: the external account's wording, the update settings shown and not edited, the status card's states 6 and 7 and Install update under NT SERVICE\hMailServer, the thirteenth checklist item, the search phrase, the live logs' message, the Deck's script policy. The Control Panel and The Control Deck: thirteen items, the live logs' message, the Deck's 6.3.6 behaviour. Capabilities and Configuration: the version and schema stamps, the trust keys, the update states, HttpProxy's callers, the never-ban names and the widening, OpenSSL 4.0.3, libpq 18.6, QuickJS 2026-06-04. Ports Reference: portsmtpauth, each listener's AUTH, ManageSieve's deadlines, the bind addresses in older forms, SO_EXCLUSIVEADDRUSE, the forward proxy's callers. The COM API and Scripting: Send a message from a script through Application.CreateMessage, OnExternalAccountDownload's answers for IMAP, QuickJS 2026-06-04 and ES2025, scripting off, the Service Desk address at the group's path. Project Handbook: the libraries and the address. Runbooks Digest: days to keep -1. Architecture: HttpsClient's callers, and the flowchart of an error report that no longer recurses on a missing UseScriptServer. Troubleshooting: the by-hand install and Install update, HM7465 to HM7469 and HM5480, port 25's Honeypot, a disk that fills as a message's last bytes are written. Each page's header says it was brought up on 5 October 2026 to 6.3.6 for what 6.3.6 changes on it; where 6.3.5 changed the page too (the sidebar's order, the quarantine review, its fields and members), the header says that is not yet written in. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 5, 2026

Every link to the project points at its address in the group, gitlab.com/hmailserver/hmailserver, where it has been since 29 September 2026; the identities 6.3.5 was signed with, and the setting row that lists both paths, keep the path the project began at. The project's path in all 63 pages that linked it (548 links), 6.3.6 being the first release made at the group's path. Left as they were: the seven signing identities https://gitlab.com/Progressiverobot/hmailserver//.gitlab-ci.yml@refs/tags/v... (Release Process, Security Policy, The Update Feed, and the UpdateSigningIdentity row of Settings Reference), which name what 6.3.5 was signed as; and the UpdateSourceRepository row of Settings Reference, which lists both paths on purpose. The container registry's name is corrected with the container page. Signed-off-by: Christopher Holloway <chris.holloway@progressiverobot.com>

Christopher Holloway committed Oct 5, 2026

The wiki is brought up to the published release: 6.3.4 is the signed tag v6.3.4 at 51e2dbda0, published on GitLab on 27 September 2026 (02:37:56 UTC), not 8adce850a of 26 September, where the tag was first made and whose release gate failed. Every page that named 8adce850a as the tag or the release names 51e2dbda0, and every page that dated the release 26 September dates it 27 September: the footer, the sidebar, the page headers, the landing page's Current release, the release timeline's row and picture, section 4e's heading. Each fact those pages took from 8adce850a was checked at 51e2dbda0: the commits between the two change 42 files, whose only documents are CHANGELOG.md, BrandLogos.md, OpenPGP.md and SecretsAtRest.md, none of which a page copies, and which include none of Constants.h, Version.h, formMain.cs, the create scripts, IniFileSettings.cpp, SettingsDefaults.h, the IDL, the Control Panel or .gitlab/allowed_signers, so every file and line cited at the tag holds. Where a page said it read the tag on 26 September, it says it read 8adce850a and that what it read is the same at the tag. The suite has 3,811 [Test] attributes at the tag, not 3,809 (the fixes add two tests); twelve places say so. Changes Since 6.2.10 gains, in batch 40, what the release gate found and the eleven fixes: three change tests alone; of the other eight, three fix what 6.3.3 did too - a relay that refused the OAuth2 login got the server's token into the bounce and the logs (open since 6.2.22-pre1), a rule's forward, copy, reply or notice and an account's forwarding could wait a minute in the queue, and IMAP LIST and LSUB took a literal's length for the pattern - and five fix code new in 6.3.4 (sealed mail and an unnamed part, a closed key's FETCH refusal logged as a critical error, the help desk's password reset read as bytes, the logo and key-directory holds, an alert's encoded Subject over 76 characters). The gate table and the timeline give the re-run on 51e2dbda0 as the logs have it: 2,349 on the first bench (2,252 passed, 0 failed, 97 skipped) and 1,462 on the second (1,446 passed, 0 failed, 16 skipped), the 71 live-update tests elevated, all passed, and the Linux suite on the packaged binary, 2,013 tests, 1,562 passed, 0 failed, 451 skipped (results/b40full3 on linix); the database upgrade gates, the security scans, the fuzzers and the installer smoke test, 65 of 65. The JScript flaw is CVE-2026-100741 (CVSS 3.1 9.8), and the project's issue #43 is public: Security Hardening 17.11, the scripting page, the changes, the capabilities and the API reference name them. The project's download links work (the site has served HTTPS since 26 September; on 27 September they led to 6.3.4's files), so Installing on Linux and Running in a Container no longer say they work once it does. The copies of SECURITY.md and CONTRIBUTING.md give the day GitLab published the release, and the security policy's copy counts the 455 findings .gitlab/security-exceptions.yml accepts at the tag - the 169 of the SAST triage and the 286 that held the release scan - where the repository document still says 169; each header says where the copy differs. Three places said no pipeline had run on the fixed tree; one has, the schedule of 27 September 2026 on master 6bc09509d, which ran the update feed's pages and package-repos jobs alone, and they say so.

Christopher Holloway committed Sep 27, 2026

The wiki is brought up to the release itself, the signed tag v6.3.4 at 8adce850a: what it said of 6.3.4 had been read from master 92b8f9f63, which the tag's last batch, batch40, follows. Schema 6104, not 6103: 6.3.4 is sixty-four steps from 6.3.3's 6040, the last, 6103 to 6104, adding hm_fetchaccounts.faorigin (Constants.h:1224, formMain.cs:314 and the three create scripts at the tag); every header, table, count and diagram that gave 6103 as 6.3.4's schema says 6104, the upgrade table's step counts are each one more, the step tables gain the 6104 row, and where 6103 means the secrets-at-rest step it stays. No page calls 92b8f9f63 the release or the tree 6.3.4 was cut from any more: a page checked against it says so and that the tag adds a last batch, and a page that copies a repository document the tag leaves as it was says the document is the same at the tag. The copies of repository documents batch40 changes are brought up to the tag, hunk by hunk from the version each copy had reached, their own additions kept: Security Policy (the SSH-signed sums of a release made by hand and the two commands that check a download, an SBOM for every compiled file, a release held by its security scans, secrets refused before they are pushed; its note no longer says the document calls 6.3.3 the latest), Release Process (A release made by hand, the security gate, the SBOM jobs), Upgrading Guide (the installer's HM_ADMIN_PASSWORD, the named lock on MySQL and MariaDB, the probe that stops an upgrade on too old a server at 6041 and the repair of a half-done one), Contributing, Governance (rebuilt on the tag's document, which gives the GitLab roles the owner set on 26 September 2026; the map and the note on code-signing material kept), Assurance Case, Regulatory Scope, Third-Party Binaries, Fuzzing, Migrating the Database Backend and Regression Test Environment. The installer's password handling as the tag has it: the password page is skipped for HM_ADMIN_PASSWORD as for /adminpassword, the database step hands the password (or the live update's token, as token:<hex>) to DBSetupQuick and DBSetup in HM_ADMIN_PASSWORD and DBSetupQuick to DBUpdater the same way, never on a command line, the switch table has the variable, and the unattended upgrade takes either (Installing hMailServer, Upgrading hMailServer 18.4a). How to verify a download: 6.3.4's hmailserver-6.3.4-SHA256SUMS.txt and its .sig, checked with ssh-keygen -Y verify against .gitlab/allowed_signers and sha256sum -c, as SECURITY.md at the tag gives them, and each installer's and package's own SBOM (Installing hMailServer 4.1, Installing on Linux, Upgrading hMailServer 18.4 and 18.4c, home, Release Process, Project Handbook, Troubleshooting, Glossary, Assurance Case, Regulatory Scope). The /download/ links no longer wait on issue #30: the feed's site has had its certificate since 26 September 2026. Changes Since 6.2.10 gains batch 40 in section 4e (the audit before the release, GitLab's SAST and the release gate, the installer's password, the SBOMs and signed sums, the stable download links, the release chain and landing through merge requests, what the first pipeline found, Windows on ARM compiled), items 47 to 51 in section 5 (reserved domain names, a one-time code taken once, the outbound relay's OAuth2 token over TLS only, the fetchers and schema 6104, a pre-6.3.4 hash of a password above U+00FF refused), SQLOLEDB in item 38, the 6041 probe in item 36, and the installer's own PBKDF2 in item 39. Also what the tag makes false elsewhere: the suite has 3,809 [Test] attributes, not 3,698; hmailserver/docs holds 105 documents; Windows on ARM compiles and has never run, where it was "not built"; IMAP offers STARTTLS only before sign-in and TLS and COMPRESS=DEFLATE only after sign-in (Capabilities and Configuration); a parent-domain passkey relying party needs passkey_allowed_origins (Sign-in and Identity); the Settings Reference counts 193 hm_settings rows with PasskeyAllowedOrigins and WebPushLoopbackHttpForTests; and the Linux suite's CI job first ran in the pipeline of 26 September 2026 rather than never.

Christopher Holloway committed Sep 26, 2026

The wiki is brought up to the tree batch40 will contain: the branches ns-verifier, gl-project, gov, ci-hyg and tf, read from the repository on 26 September 2026. The copies of repository documents take the changes batch40 makes to them - CONTRIBUTING, SECURITY, RELEASE, GOVERNANCE, ASSURANCE-CASE, Fuzzing, RegulatoryScope, ThirdPartyBinaries and RegressionEnvironment - each header saying so. The seven links into /-/blob/master/.github/ point at .gitlab/allowed_signers, .gitlab/hmailserver.openvex.json, or name the GitHub workflow as being in the git history at v6.3.3, since .github/ is gone from the tree; the verify-tag commands read .gitlab/allowed_signers. What the sweep made false is put right: the PKGBUILD builds from the tag on GitLab; the Compose file and the chart name registry.gitlab.com/progressiverobot/hmailserver, a registry that is switched on and holds no image yet; OpenSSL's release archive comes from Debian's archive against its pinned hash; linuxdeploy is no longer downloaded; the build-inputs-1 files come from the package registry; the manifests name the installer's file there. The live update's third signer, the group hmailserver the project is to move to, with the project's id required, is on the update and security pages, the Settings Reference and the changes for 6.3.4, with the three GitLab settings that keep a server to the present path. Governance names Zain Ul Abidin as zainulabidin1990 on GitLab and gives the owner's rule that release tags are created by the Progressiverobot account alone. The /download/ links at updates.progressiverobot.com are given beside the permalinks, labelled as working once that site serves HTTPS (issue #30; it still failed at 05:16). Contributing gains a section of its own on the issue and merge-request templates, the Service Desk, the two boards and the labels as they are on GitLab.

Christopher Holloway committed Sep 26, 2026

What the check of the wiki's 6.3.4 pages found: the Control Deck's Update row named the next release by number, and now says the releases after 6.3.4 are to be signed by the project's GitLab CI once its signing job exists; the Control Panel reference said GitLab CI signs the releases after 6.3.3, which 6.3.4, unsigned, is not; the restart row counted 26 bootstrap keys where build/ini-settings-baseline.txt now has 29, [Database] TlsMode and TlsCaFile and [Security] StoredSecretsKey added; the stored-secrets key is made by the Windows installer alone, and the Linux packages need the verb as an upgrade does; the sandbox's shipped types include shortcuts, disk images and PDFs; the object store's fixture needs a lab store and skips without one, rather than running against the lab as a matter of course; PasswordPepper is the one setting the virtual service account refuses to save; a shaping wait spares a message's retries only until it outlives its retry schedule; and the database connection's new TLS is MySQL's, MariaDB's and SQL Server's, unverified unless TlsMode asks, PostgreSQL's being unchanged.

Christopher Holloway committed Sep 26, 2026

The feature pages now describe 6.3.4, the latest release (26 September 2026, schema 6103), built from the tree at 92b8f9f63. What they labelled as in the tree after 6.3.3 and not yet released is in 6.3.4 and says "since 6.3.4"; dates inside the release become the version; the sidebar names 6.3.4 as the latest release. What landed after 540347500 is added where a reader meets it. Connecting a Mail Client gains what 6.3.4 changed in IMAP's answers after Dovecot's imaptest (NO where BAD was wrong, \Seen on every BODY[section] without PEEK, APPEND stored byte for byte, a command pipelined behind APPEND answered, SORT and THREAD as the RFCs say, \Recent counted), what a new installation asks of a password (STARTTLS offered, TLS required for authentication from the Internet range, a self-signed certificate), rooms in CalDAV's room finder, and that a mailbox encrypted at rest takes its own password only. The Webmail gains a folder of a hundred thousand messages - one page copied, Oldest, a bounded search that goes on, select-all handed to the server - labelled built and not yet measured. Migration gains PST import: the import directory that is empty as shipped, what comes in and what is refused, and the reader in a child process, which is crash containment and not a sandbox. The Control Panel pages gain the Discovery page (65 pages), the Message store tab, the Windows service account card and what the virtual account refuses; the Control Deck page gains the Discovery and Inbound webhooks views (40), the twelve checklist items, the census of 466, 458 and 586 routes, and the update feed as it stands: 6.3.4 carries no Sigstore bundle and is installed by hand. The remaining pages gain the webhook route that outranks aliases and lists, a legal hold beside rules and Sieve, the Run function name rule, the three new permissions and the administrator password rehashed at sign-in. Four new pages give features with no wiki home one: Compliance and eDiscovery (cases, searches, holds, exports, and the erasure a hold outranks), Message Storage (compression and attachments held once, mailbox encryption at rest, object storage on S3 and Azure Blob, each off by default), Rooms and Equipment, and Mail In to a Webhook. Each is in the sidebar in its natural place, and every sidebar entry resolves to a page.

Christopher Holloway committed Sep 26, 2026

The operator pages that name GitHub because the code or the packaging still does now say, beside each such fact, that moving it off GitHub is planned roadmap work and not yet done, as the reference pages already do. Installing hMailServer says that only GitHub Actions can issue the signing identity the update verifier pins, so no later release can carry it, and that the package-manager manifests and their workflow are to move; Installing on Linux says it of the PKGBUILD, whose source is git+ its url and whose url is still github.com/Progressiverobot/hmailserver at master 540347500, of the default release feed, and of the image on ghcr.io; Running in a Container of the image and of the ghcr.io names in the Compose file and the chart (docker-compose.yml and values.yaml at master); the Control Panel Reference of the default feed and the About view's compiled-in GitHub link (AboutView.cs); and Troubleshooting, Upgrading hMailServer and the Control Deck's Update view of the default feed (UpdateChecker.cpp's STABLE_FEED and PRERELEASE_FEED).

Christopher Holloway committed Sep 24, 2026

The Control Deck's Update view is where a reader meets the release feed, and the page did not say that the default feed is GitHub's API, which has answered 404 since 18 September 2026; the row now says so, and that the check fails until UpdateFeedUrl names another feed, pointing to Upgrading hMailServer 18.7.

Christopher Holloway committed Sep 24, 2026

Eight new pages for the ground the wiki had no page for, each written for the wiki's reader from its repository documents at master 540347500 - what it is, how to turn it on, what it does not do - with a link to the full document, and each saying which parts are in 6.3.3 and which are in the tree after it and not yet released. The Webmail: turning it on, what 6.3.3 has, and what the tree adds - Important and inbox sections, subscriptions, brand logos, recover deleted, offline days, a second account, emoji and tables, send-as and masked addresses, other accounts, expiring messages, recall, calendars, sharing and invitations, shared address books, the directory, the Security page - and the administrator's bounds. The Control Deck: signing in, the fifteen views of 6.3.3 and the thirty-eight of the tree, the parity census (456 of 464), the first-hour checklist and who may use it. Sign-in and Identity: what 6.3.3 has, passkeys, OpenID Connect and SAML side by side, SCIM, account recovery, devices and the session policies, administrator roles. Encryption for People: S/MIME in the page, a domain's S/MIME authority, OpenPGP and the Web Key Directory, password-protected messages, zero-access mailboxes, gateway encryption and sealed mail, and that a message that expires is not encryption. Mailing Lists: the membership query and the list manager - joining and leaving, the copies, one-click unsubscribe, digest, archive, bounces, and no From rewriting. Outbound Shaping: the back-off that is on by default, the connection and tenant ceilings, uncounted deferrals, IP warm-up, and bounces, complaints and the reputation watch. Profiles and Environment: apply-on-save, the three setting levels, every setting from the environment, and the four profiles. Migration: which route for which move, the webmail's Other accounts with Gmail and Outlook.com sign-in, and the migration jobs.

Christopher Holloway committed Sep 24, 2026