Hermes Mail Suite v0.1.27

Unicorn Mail: changes from v0.1.22 to v0.1.28

These are the releases since v0.1.21, newest first.

You can now point one hosted domain at another, so mail for the first domain is delivered to the same local part at the second. Add one line to the alias domain's _root.conf:

• domain old.com { alias-of new.com } delivers anyone@old.com to anyone@new.com, using the primary domain's quota, Sieve, catch-all and aliases.
• The alias domain doesn't need any per-user files, only its directory and that line. Chains of aliases are followed, and loops are rejected.
• For now this only works for receiving mail. Users can't send as the alias domain yet, because that needs the alias domain's own DKIM key and DNS records.
• Each alias domain still needs its own MX record pointing to this mail host, plus SPF and DMARC records. umail check <domain> checks that the target resolves.

This release fixes three related bugs that could lose mail without any error. We found them while looking into a send that reported zero bounces. Upgrading is strongly recommended.

• Mail rejected partway through sending was logged as delivered. If the receiving server accepted the recipient but then rejected the message body, or closed the connection before its final 250, umail recorded the message as delivered and discarded it. Now a permanent rejection produces a bounce, a temporary one is deferred and retried, and a message only counts as delivered after the final 250.
• Bounces to local senders could get lost. They were sent back out through the server's own MX, where they were greylisted (empty sender, no SPF or DKIM) and then lost because of the bug above. Local mail, bounces included, is now delivered locally instead of going out through the MX.
• Stalled connections no longer hold a delivery slot. If a remote server opened a connection and then stopped responding, the slot stayed in use until umail was restarted. A delivery that makes no progress for 5 minutes is now deferred and retried.

Setting a listener's address to :: now serves both IPv4 and IPv6, with IPv4 set up first:

• umail opens one IPv4 socket and a separate IPv6 socket. If the host has no IPv6, the IPv6 socket is skipped, a note is logged, and the port carries on working over IPv4.
• 0.0.0.0 is still IPv4 only and a specific IPv6 address is still IPv6 only, so existing configs behave the same. Changing an address to :: needs a restart.

Abandoned connections, such as port scans or bots whose connection dropped without closing cleanly, were never cleaned up. Over time they filled the listener's connection limit. After that, every new connection, from real clients and uptime monitors alike, was accepted and immediately dropped. The port looked down, but nothing crashed and nothing was logged. All ports were affected because they share the same connection handling.

• Idle connections are now closed. A connection that sends nothing within about 60 seconds is closed. Once a client has sent something, the idle limit is 35 minutes. That's longer than the 30-minute IMAP IDLE window on purpose, so active IDLE sessions are never closed.
• IMAP and ManageSieve now have a per-IP connection limit (default 20, the same as SMTP), so a single host can't use up all of a listener's connections.

Adding or changing an alias used to need a full restart. Mail sent to a new alias before a restart was accepted but delivered to a stray folder named after the alias. SIGHUP now reloads the alias map and the global default Sieve script. TLS and SNI certificates already reloaded on SIGHUP.

What needs what:

• Applies immediately: adding or removing a mailbox, passwords, forward, quotas, suspending an account, per-domain settings, per-user Sieve.
• Needs SIGHUP: aliases, the global default Sieve, TLS and SNI certificates.
• Needs a restart: anything in umail.conf.

umail can now serve a different certificate depending on which hostname the client connects to. This lets tenants or resellers use their own mail hostnames on one shared server.

• Put a <host>.cert.pem and <host>.key.pem pair in the same folder as the default certificate and it will be used for that hostname. There's no setting to turn on.
• tls-cert and tls-key are still the default. A broken or incomplete pair is skipped with a warning and doesn't affect the others. New pairs are picked up on SIGHUP.
• umail doesn't issue certificates itself. Getting and renewing them is still handled by the control panel (ACME).

• One-click unsubscribe headers are now signed. Gmail and Yahoo only show the unsubscribe button if List-Unsubscribe and List-Unsubscribe-Post are covered by the DKIM signature (RFC 8058). Reply-To, MIME-Version and Content-Type are now signed too, when they're present.
• From and the unsubscribe headers are oversigned, so a second, forged copy can't be added after the message is signed.
• The Received: header now says ESMTPS for inbound connections over TLS. It used to always say ESMTP, which made encrypted hops look like plaintext.