Hermes Mail Suite v0.1.21

Release notes for v0.1.10 → v0.1.21. Newest first.

v0.1.21 - 2026-08-06 · Reliability

Fixed: a TLS port could stop completing handshakes after long uptime. Seen in the wild on IMAPS :993: after ~2 weeks of uptime, clients got a fatal alert or abrupt EOF, while every other TLS port on the same daemon (including :465, the identical handshake) stayed fine - and a restart cleared it with no file changed. Root cause: the TLS layer consulted OpenSSL's per-thread error queue without clearing it first, so a single malformed ClientHello from a bot could poison the next valid handshake. The pollution accumulated, so only the busiest port crossed the threshold. The queue is now cleared before every SSL operation, as OpenSSL requires.

Added: a DEBUG log line on TLS handshake failure (netconn: TLS handshake failed from <ip>) - visible with log-level debug, so these are no longer completely silent.

v0.1.20 - 2026-07-23 · Anti-spam

Changed: bayes-learn-sent now defaults to on. Its guards are unchanged - SPAMMY mail is skipped, contributions stay capped per mailbox per day, and it still requires outbound-spam-scanning and control-socket (and stays off without them). Set bayes-learn-sent off to opt out.

Upgrade note: installs already running both prerequisites will begin learning ham from authenticated submission automatically. Multi-tenant operators sharing one Bayes corpus across unrelated customers may prefer off.

v0.1.19 - 2026-07-23 · Anti-spam & tooling

Fixed: umail-learn is now shipped in the container image. The offline Bayes trainer was built but never copied into the runtime image, so there was no way to bulk-seed the corpus - and since Junk-folder moves only grow the spam side, many installs sat at zero ham with Bayes silently doing nothing.

Added: bayes-learn-sent - train the ham corpus from mail your authenticated users send (a safe ham source: it can't be injected without credentials). Guarded: SPAMMY mail is skipped; contributions are capped per mailbox per UTC day (bayes-learn-sent-daily-contribution, default 4); requires outbound-spam-scanning and control-socket.

Note: Unicorn Mail keeps one global Bayes corpus - at multi-tenant scale, prefer the tenant-neutral signals (RBL, URIBL, FCrDNS, SPF/DKIM/DMARC, heuristics, hash-AV) and treat Bayes as a single-tenant feature.

v0.1.18 - 2026-07-18 · Anti-spam

Fixed: URIBL evasion via slash-padded URLs. A link like https://////////evil.example/path - obfuscation that mail clients still resolve - defeated host extraction entirely, so the domain was never blocklist-checked. Redundant slashes after the scheme are now skipped.

Added: NO_DKIM scoring rule (default 1.0, tunable). A mild penalty for mail that was DKIM-checked and carries no valid signature. Fires only when DKIM was actually evaluated.

Added: Bayes corpus reported at startup - bayes corpus spam=N ham=M … so it's obvious whether the classifier is scoring yet. (The corpus persists across restarts.)

v0.1.17 - 2026-07-14 · Submission

Fixed: "send as" now honors inline mailbox aliases. An authenticated user couldn't send with a From: set to an alias declared inline in their own mailbox stanza - it was rejected 554 send-as denied, even though inbound delivery to that alias worked. It now checks the authenticated mailbox's own inline aliases (that mailbox specifically, so no spoofing).

Changed: the send-as denied log line now includes a reason= field, so the cause (wrong domain vs. unowned alias) is obvious at a glance.

v0.1.16 - 2026-07-12 · Metrics

Added: per-mailbox breakdown in metrics.json. Each domain now carries a mailboxes array with sent/received per individual mailbox. Domain totals remain the sum of their mailboxes, so anything reading only the domain level is unaffected. received is credited to the mailbox that actually took delivery (after alias/catch-all rewriting); +detail subaddresses fold into the base mailbox.

v0.1.15 - 2026-06-30 · Logging

Fixed: imap auth ok / smtp auth ok lines are now actually suppressed by default. They were demoted to DEBUG earlier, but verbose logging was hardcoded on, so they still appeared on every client poll. After upgrading they're gone with no config change (auth failures still log at WARN).

Added: log-level config key (info default, or debug).

v0.1.14 - 2026-06-30 · Outbound delivery

Added: outbound smarthost relay. Route all remote mail through an upstream MTA: smarthost on, smarthost-hostname (hostname or IP), smarthost-port (default 587), smarthost-username, smarthost-password / smarthost-password-file. Local delivery is unaffected.

Added: outbound SMTP AUTH (AUTH PLAIN, with AUTH LOGIN fallback). Credentials are sent only over a certificate-verified TLS session - an authenticated relay delivery requires STARTTLS and verifies the relay's certificate; otherwise the message is deferred rather than risk leaking the password.

v0.1.13 - 2026-06-20 · Metrics

Fixed: metrics.json now works for domains hosted via the mailbox tree (the common setup) - previously the filter only recognised the explicit domains list, so nothing was counted. The file is also written at startup, so it always exists after a restart.

v0.1.12 - 2026-06-20 · Metrics

Added: per-domain mail metrics → <maildir>/metrics.json. A 7-day rolling count of messages sent and received per hosted domain, written atomically and updated continuously - meant for a control panel to read directly (no API, no DB).

v0.1.11 - 2026-06-17 · Anti-spam

Added: per-mailbox spam allowlist. New mailbox-stanza keys allow-sender and allow-domain - mail from a matching sender bypasses spam checks (greylist / RBL / URIBL / scoring / tagging) and goes straight to the inbox. Matches both the envelope sender and the From: header; virus scanning still applies. The same keys work at the domain level (inherited by every mailbox).

v0.1.10 - 2026-06-17 · Logging

Changed: successful logins (imap auth ok / smtp auth ok) are no longer logged at INFO - clients re-authenticate on every poll, which flooded auth.log. (Superseded by the proper fix in v0.1.15.)

One privilege-separated daemon - the only dependency is OpenSSL. 🪶