Version History to 6210

Version History to 6.2.10

This page began as a chapter of the 6.2.10 manual and has been corrected for 6.2.24, then checked and extended against the 6.2.28 source on 8 September 2026. The Control Panel's pages are grouped differently now, so the paths below use today's groups; the TLS ports 465, 993 and 995 exist only after you create them on the TCP/IP ports page (a fresh install seeds 25, 587, 110 and 143); and everything added since 6.2.10 is in Changes-Since-6210. Where a value here disagrees with the Settings Reference, which is generated from the code, the reference is right. The history it gives ends at 6.2.10; what came after, up to 6.3.7, the latest release (17 October 2026, schema 6108), is in Changes-Since-6210.

The lineage

This fork does not start at 6.0.0 from nothing: it starts from the original hMailServer by Martin Knafve, which has since resumed development separately, and brings the toolchain, the crypto and the administration tool forward. Everything below 6.0.0 is upstream's history, not this project's.

flowchart LR
    UP["Original hMailServer<br/>32-bit"] --> V600["6.0.0<br/>the toolchain and crypto rebuild:<br/>VS 2026, OpenSSL 4.0, Boost 1.91,<br/>PostgreSQL 18, 64-bit only"]
    V600 --> V610["6.1.0<br/>the first web Control Deck;<br/>themes and Ctrl+K in the<br/>classic Administrator"]
    V610 --> V620["6.2.0 - 6.2.4<br/>the administration rebuild:<br/>Control Panel replaces the<br/>classic Administrator"]
    V620 --> V625["6.2.5 - 6.2.9<br/>fixing what the rebuild broke,<br/>plus IMAP4rev2 and the first<br/>Control Panel tests"]
    V625 --> V6210["6.2.10<br/>the first security-audit release:<br/>C++ CodeQL run by hand,<br/>WebAdmin removed"]
    V6210 --> LATER["6.2.11 onwards -<br/>see Changes Since 6.2.10"]

Loading

At a glance

Version	Theme	The thing worth remembering
6.2.10	Security and housekeeping	Fifteen COM methods returned false from HRESULT functions — and false is S_OK. Found by running CodeQL's C++ suite by hand, because the workflow had only ever analysed C#
6.2.9	Charts	LiveCharts upgraded; the dashboard stopped rendering as a white block on the dark theme. First automated Control Panel tests
6.2.8	Control Panel defects	List editors rendered every row blank; the panel became unusable after a service restart
6.2.7	Control Panel usability	DKIM generation showing a copyable DNS record, password reveal and generation, date pickers, Enter/Esc, remembered window state
6.2.6	Protocol and looks	IMAP4rev2 (RFC 9051) as an opt-in session mode; visual redesign; a real QR code for 2FA
6.2.5	Fresh-install fixes	DPAPI database-password truncation, and create-table scripts stamping the wrong schema version — both broke default fresh installs
6.2.0 – 6.2.4	The administration rebuild	Control Panel replaces the classic Administrator; SCRAM-SHA-256(-PLUS), Argon2id, OAuth2 bearer; Sieve and ManageSieve; SMTPUTF8, PIPELINING, ENHANCEDSTATUSCODES, DSN, SRS, CHUNKING/BDAT, BATV; Prometheus metrics, JSON logging, slow-query log; AD account pickers
6.1.0	UI and UX	The first Web Control Deck on the REST listener - a dashboard, domains and accounts, queue retry and delete, TLSA records - and light and dark themes and a Ctrl+K palette in the classic Administrator. Server core unchanged from 6.0.0 build 4; schema 6001
6.0.0	The toolchain and crypto rebuild	VS 2026, OpenSSL 4.0, Boost 1.91, PostgreSQL 18, 64-bit only; PBKDF2-HMAC-SHA256; TLS 1.2/1.3 defaults; MTA-STS, DANE with in-process DNSSEC validation, TLS-RPT; DMARC, ARC, Ed25519 DKIM; ACME v2; REST API; web services; IMAP MOVE, ID, SPECIAL-USE; SMTP 8BITMIME

Two patterns run through that table and are still true of the releases after it:

• The defects that hurt most were in the paths nobody exercises twice — a fresh install (6.2.5), a service restart (6.2.8), a COM return value nobody checks (6.2.10). Every one of those now has a check that runs on every release: build/check-db-scripts.ps1 builds a database from the create script, build/check-schema-versions.ps1 reconciles the chain, and the C++ CodeQL job ran on every push to master rather than by hand, until GitHub became unavailable on 18 September 2026.
• A capability that exists but is inert by default is not a capability. The 6.2.10 audit is where that lesson was learned, and it is why Capabilities and Configuration records what is advertised rather than what is compiled in.

6.2.10 — security and housekeeping

• Fifteen COM methods reported success on calls they had refused. They returned false from HRESULT functions, and false is S_OK. Five InterfaceCache getters returned before writing *pVal, handing an unauthorized caller success plus uninitialized memory; SetAdministratorPassword and five siblings reported a password change that never happened. Found by running CodeQL's C++ suite by hand — the workflow had only ever analysed C#, leaving the entire protocol surface unscanned.
• The PHP WebAdmin is removed. It stored the administrator password in plaintext in a PHP session and required DCOM to be opened up for the web server account.
• The retired Administrator is removed from the repository. Interop.hMailServer.dll now comes from Shared, so the packaged output is unchanged.
• Code-quality findings on shipped, hand-written code taken to zero.

6.2.9

• LiveCharts upgraded; dashboard charts no longer render as a white block on the dark theme.
• First automated tests for the Control Panel.

6.2.8

• Fixed list editors rendering every row blank.
• Fixed the Control Panel becoming unusable after an hMailServer service restart.

6.2.7

• Control Panel usability: DKIM key generation with the DNS record shown and copyable, password reveal toggles and a strong-password generator, date pickers, Enter/Esc in dialogs, window state remembered.

6.2.6

• IMAP4rev2 (RFC 9051) as an opt-in session mode.
• Control Panel visual redesign; complete settings coverage; real QR code for 2FA.

6.2.5

• Fixed two defects that broke default fresh installs: DPAPI database-password truncation, and the create-table scripts stamping the wrong schema version.

6.2.0 – 6.2.4

• The Control Panel replaces the classic Administrator.
• SCRAM-SHA-256 and SCRAM-SHA-256-PLUS, Argon2id, OAuth2 bearer authentication.
• Sieve (RFC 5228) and ManageSieve (RFC 5804).
• SMTPUTF8/EAI, PIPELINING, ENHANCEDSTATUSCODES, DSN, SRS, CHUNKING/BDAT, BATV.
• Prometheus metrics and health probes; JSON logging; slow-query log.
• Active Directory account pickers.

6.1.0

• The Web Control Deck, served by the REST API listener (RestApiPort): a live dashboard, domain and account management, queue retry and delete, and the DANE TLSA records to publish.
• The classic Administrator gains light and dark themes, a Ctrl+K command palette and a modernised dashboard.
• The installer's wizard is rebranded and ships the web page.
• The server core is 6.0.0 build 4's, apart from the endpoint that serves the page; schema 6001.

6.0.0

• The v6.0.0 tag points at build 2, while the published release carried the build 4 installer (hMailServer-6.0.0-B4-x64.exe); build 3 fixed database creation on MySQL and MariaDB, and build 4 the service crash at startup that build 3's bundled runtime DLLs caused on fresh installations.

• Visual Studio 2026 toolchain, OpenSSL 4.0, Boost 1.91, PostgreSQL 18, 64-bit only.

• PBKDF2-HMAC-SHA256 password hashing; TLS 1.2/1.3 defaults.

• MTA-STS, DANE with in-process DNSSEC validation, TLS-RPT.

• DMARC evaluation, ARC sealing, Ed25519 DKIM.

• ACME v2 (Let's Encrypt) built in; REST API; Prometheus metrics; web services server.

• IMAP MOVE, ID and SPECIAL-USE; SMTP 8BITMIME.

---