s/qmail
s/qmail (pronounced skew-mail) is a Mail Transfer Agent (MTA) based on Qmail suited for high-speed and confidential email transport over IPv4 and IPv6 networks.
s/qmail preserves the Qmail ecosystem (my mirror)
and ought to be a drop-in replacement for most sites.
s/qmail's mascot is the phoenix (SQRP).
Scope and History
While Qmail provides the framework for a distributed MTA, my own developments for Qmail (e.g. SMTP Authentication, Spamcontrol) are considered necessary protocol extensions. s/qmail is a complete refactoring of the source code according to current demands for 64-bit systems and including IPv6 capabilities.
The new start: s/qmail 3.x
After now more then 20 years of Qmail's superior and uncompromised email delivery (since Qmail 1.01 launch in April 1997), s/qmail posses most of the 'future' Qmail features Dan Bernstein was heading for (see also: Qmail TODO).
- s/qmail is available in Dan Bernstein's /package format, usually invoked by Daemontools.
- s/qmail provides TLS support based on the ucspi-ssl package.
- SMTP Authentication, Anti-Spam, and Anti-Virus features are supported out-of-the-box.
- Recipient and MAV capabilities in addition with powerful filters for SMTP envelope addresses.
- Scalable and reliable mail delivery is guaranteed by means of QMQ.
- Native IPv6 support for all communication modules.
The s/qmail 'universe' is illustrated here:
A new foundation: s/qmail 4.x & fehQlibs
Now, s/qmail 4.x is available based on my fehQlibs providing a common foundation for all my djbware. Apart from a complete refactoring of the s/qmail modules, DNS BIND'ish remnants have been removed and replaced by the modern fehQlibs DNS stub resolver which was on DJB's todo list.
Communication and security features
- s/qmail uses D. J. Bernstein's 'C' coding principles entirely.
- Full IPv6 compliance: Allow specific IPv6 bindings to any IPv6 address (even LLU) for all servers and clients (qmail-smtpd, qmail-qmqtpd; qmail-remote, qmail-smtpam, qmail-qmqpc).
- Unlike the original version, qmail-remote works multi-tenant, thus supporting different domains and senders with particular sending attributes (e.g. IP addresses, authentication, certificates) as well as providing particular bounce delivery, together with QMTP and QMTPS client capabilities.
- Distributed queueing: n:1, 1:n n:m with qualified authentication and authorization (enhanced 'QMQ').
- TLS enabling of most servers and particular clients for SMTP and QMTP as well as POP3.
- Together with ucspi-ssl (0.12.x) s/qmail is TLS 1.3 [RFC 8446] capable, provided OpenSSL/LibreSSL is installed and the respective ucspissl.a lib is build on top of it.
- LibreSSL (up to 3.7) and OpenSSL (1.1/3.0) are already considered within ucspi-ssl.
- s/qmail allows 'opportunistic' as well as mandatory TLS encryption together with easy X.509 certificate pinning.
- qmail-remote is TLSA/DANE and finally RFC 1870 enabled.
- Compliance with John Levin's RFC 7505.
- SPF capabilities have been added for qmail-smtpd using Jana Saout's development (used by permission); of course with full IPv6 support.
- Reversely, SRS is natively supported with the modules srsforward and srsreverse used in a dot-qmail file.
- SMPTUTF8 [RFC 6532] together with International Domain Names (aka E-mail Address Internationalisation - EAI ) is now supported by s/qmail provided the libidn2 is available.
- Conformance with the recent RFC 8314 ('Cleartext Considered Obsolete: Use of Transport Layer Security (TLS) for Email Submission and Access') even if former RFCs violated those principles.
- RFC 8314 'Implicit TLS' configurable for qmail-remote and qmail-smtpam.
- qmail-smtpd is now immune against ESMTP pipelining command injection and finally against Guninski's large alloc bug (report).
- Greylisting can be achieved using qmail-postgrey.
- DKIM signing with qmail-dksign and verification with qmail-dkverify for RSA or Ed25519 signatures, thus supporting RFC 6376 and RFC 8463.
- Hybrid DKIM signing and verification with both RSA SHA-256 and Ed25519 private and public keys are working now.
Protocol extension: QMTPS
The Quick Mail Transport Protocol QMTP is an invention of Dan Bernstein and is a simple but fast host-to-host transparent email transport protocol, with very little protocol overhead. It has been adopted by Postfix as well. Also a Net-QMTP Perl module is available.
s/qmail provides additionally the TLS-secured protocol QMTPS
to couple several s/qmail instances and distributed queues among different nodes.
IANA has now assigned port 6209 for
QMTPS.
s/qmail's implementation of QMTPS supports together with sslserver X.509 client certificates enables qmail-qmtpd to relay email based on valid certificates used by qmail-remote.
Distributed Queueing
Based on SMTP but rather preferably QMTP(S) or QMQP, s/qmail can be instructed to work in a distributed queue environment, typically given in case of a Cloud service. Authentication among the nodes and encryption on the links can be guaranteed using QMTPS. This feature is called enhanced 'Qmail Multiple Queues' (QMQ).
Its light-weight design allows to deploy s/qmail nodes rapidly in a Cloud based service domain.
Included packages
The basic s/qmail installation includes the following packages (adapted mostly from Dan Bernstein):
- A versatile, CRAM enabled checkpassword compatible authentication PAM called qmail-authuser.
- The fastforward package is part of s/qmail.
- Including the qmailanalog package suited for s/qmail together with tai64nfrac.
- Additional qmail-mrtg frontend evaluating TAI64N timestamps in s/qmail's logs
(and replacing my previous version of qmail-mrtg)
for Tobias Oetiker's MRTG.
A working sample can be found for this site. - If you miss something like qmail-queuefix or qmHandle here it is: qmail-qmaint.
Supported Qmail packages
s/qmail provides full support for the following vanilla Qmail add-ons unaltered:
- Inter7's vpopmail
- Bruce Guenter's VMailMgr
- Dan Bernstein's ezmlm
- Fred Lindbergs' and Bruce Guenter's's ezmlm-idx
- procmail
- Andreas Aardal Hanssen's IMAP server BINC (Note: An up-to-date version is under development)
- Timo Sirainen's Dovecot (LDA)
Note 1: For those packages TLS encryption and
IPv6 capabilities for any data-in-flight is possible with s/qmail.
Note 2: s/qmail Recipients extension is capable to understand
ezmlm's VERP addresses.
Note 3: Authentication and recipient verification for virtual users is provided
out-of-the-box for vpopmail
and VMailMgr as well.
Note 4: Dovecot can be used as Identity Provider proxy even for
qmail-smtpd by means of the enhanced
qmail-authuser calling
doveadm to test
a specific socket connection.
My s/qmail extensions will work natively with Qmail:
- Newanalyse 2.x is tailored for s/qmail
- QMVC -- is working but the latetest release (in particular recognizing IPv6 addresses) is under way.
Dependencies and installation of s/qmail
The installation of s/qmail tries to conform to existing Qmail systems as well as to provide a pre-configured and working MTA together with an easy update scheme:
- Easy installation and maintenance by means of slashpackage.
- Compliance with 64-bit architecture and current 'C' standards.
- Drop-in replacement for Qmail (same interface; same API), same user accounts; same module names.
- Ready-to-use integration into daemontools.
- systemd support is provided as well.
Dependencies
For installation, s/qmail requires a development environment and additionally the OpenSSL development libraries (in particular on Linux) starting with version 1.1.1 or a compatile LibreSSL implementation.
In particular, the following packages are recommended:
- Mandatory: fehQlibs: The common foundation.
- Mandatory: ucspi-ssl: Additional TLS libraries.
- Optional: ucspi-tcp6: cdb generation, module rblsmtpd.
- Optional: daemontools: providing supervise and TAI64N timestamps by multilog.
- Attention: In order to include EIA/UTF8 support, you need to install the libidn2 together with the header file <idn2.h>.
Quick installation of s/qmail
s/qmail uses D.J.B's slashpackage convention for installing while trying to keep the standard Qmail installation essentially unaltered:
- Daemontools is installed and /service is working.
- ucspi-ssl is installed in default location.
- ucspi-tcp6 is installed.
- Untar the s/qmail tar file under '/package'
- Move to /package/mail/sqmail/sqmail-V.R.F and
- do an initial: package/install.
Note: The package/install step respects your current Qmail settings.
Upgrade to s/qmail from qmail (+ perhaps Spamcontrol)
s/qmail will preserve your current qmail installation entirely under the following circumstances:
- Install ucspi-ssl-XX and ucspi-tcp6-XX under /package.
- Untar s/qmail under /package and change to the install directory.
- Check and adjust the following conf-XX files (see below) to your
existing qmail installation:
conf-break, conf-cc, conf-ld, conf-home, and conf-split (the rest may stay unaltered). - Execute:
- package/ucspissl
- package/compile
- package/legacy
- package/man
- Verify your setting:
- ./compile/qmail-showctl
- ./compile/ipmeprint (you see the additional IPv6 addresses)
- You need to take care about the new IPv6 addresses and your SSL environment+settings, change your run scripts and adjust control files.
Configuration
The basic s/qmail configuration is done by means of conf-XX files (in alphabetic order):
- conf-break -- the character for VERP addresses [-]
- conf-cc -- compiler (no change required)
- conf-delivery -- qmail-start default-delivery
- conf-groups*) -- s/qmail groups
- conf-home -- home dir of s/qmail [/var/qmail]
- conf-idn2 -- customization path for IDN2 libraries
- conf-ids*) -- Unix ids for s/qmail
- conf-instances -- QMQ instances to be raised
- conf-ld -- loader options to be adjusted (for i386; AMD64 default)
- conf-log -- target dir of s/qmail logs [/var/log]
- conf-man -- target dir of man pages, usually automatically recognized
- conf-patrn -- s/qmail paternalism [002]
- conf-qmq -- QMQ environment settings
- conf-spawn -- silent concurrency limit [120]
- conf-split -- depth of s/qmail dirs [23]
- conf-svcdir -- supervise's directory [/service]
- conf-ucspissl -- path to UCSPI-SSL dirs
- conf-users*) -- user names
*) These files are coupled and need to be adjusted as one entity!
The basic s/qmail configuration is done by means of conf-XX
Step-by-step installation
For an individual step-by-step installation the following commands can be executed:
- package/dir -- sets up the directories
- package/ids -- sets up the s/qmail users
- package/ucspissl -- hooks up the required sources and libs with package ucspi-ssl
- package/compile -- compiles the sources
- package/upgrade -- potentially does the upgrade
- package/legacy -- installs the binaries in the qmail directory
- package/man -- installes the man pages
- package/control -- populates the mininmal required control files for running
- package/sslenv -- sets up the SSL/TLS environments together with X.509 certs and key files (from ucspi-ssl)
- package/service -- sets up the run script for daemontools' /service and additionally the logging
- package/scripts setup optional, undocumented and unmaintained scripts
- package/run -- touches qmail/alias/ files, sets default-delivery, and enables s/qmail's sendmail module
Documentation
A concise documentation for s/qmail is close to be final:
- A 's/qmail Big Picture' is available providing the default settings (run scripts) for most services.
- You may want to check the README and brief INSTALL documentation first.
- The 'official' s/qmail documentation is (however) still in progress.
- The set of man-pages coming along with s/qmail have been converted into HTML and are accessible here.
- The standard LWQ documentation for Qmail is mostly still valid; except for the installation procedure of s/qmail (and its extensions of course).
s/qmail current release and download
Once you've checked the s/qmail requirements and complied to those, you are ready to go for download and installation.
Download
The current release(s) of s/qmail can be downloaded here:
Version & Download | Description | fehQlibs | Verification |
sqmail-4.2.29a | The tenth 4.2 release allows now the usage of DKIM RSA and Ed25519 keys
in parallel for signing and verification. While it uses refactored
ALT-NT's libdkim C++ modules, it is deeply incorporated
into s/qmail and provides multi-tenant signing. Ed25519 signatures
are supported given the recent OpenSSL as well LibreSSL versions. Its RECIPIENTS mechanism is enhanced to semi-automatically consider qmail-newu's cdb, which is now available as assign.cdb. Backported fixes for [20230922#1/4.3.01], [20230920#1/4.3.01], and [20230823#1/4.3.00] included. Includes fix for the potential qmail-smtpd AUTH misbehavior and upddates the mkdkimkey.sh script. Includes small fix for misspelled prototype in smtpdlog.h. Additional fix included for control/domainips which erroneously adds a '\0' to the helohost greeting. Backported improved TLSA (TA) evaluation for qmail-remote from s/qmail 4.3. Improved robustness of DKIM signing considering erroneous keys and an unclean DKIM stage area. Included backported fixes for EHLO X-* announcements, assign.cdb evaluation by the Recipients extension, and a correct treatment of file ids in case of wrong DKIM keys. |
fehQlibs-22/23 (a must for SPF!) |
MD5: dcef0e6d9b1faadb3e913f0ed75b7188 Build: 20240226150615 |
sqmail-4.1.18e | The eleventh 4.1 release providing
Greylisting capabilities by means of qmail-postgrey.
This version is a backport from s/qmail-4.2. Additional trimming for
qmail-remote's cafile and ciphers handling. qmail-remote is enhanced to support TLSA lookups and (PKIX-EE) automatic X.509 cert validation and (now with an additional CNAME lookup and finally) supporting RFC 1870 SIZE announcements for the remote MTA while correctly provide the parameters in the MAIL FROM command. qmail-remote is now enhanced to comply with RFC 8314 for 'implicit TLS' MTAs. Added module qmail-qmaint to check the queue sanity and to remove mails from here. TLSA evaluation is now complete and working seamlessly after further adjustments coping with various DNS server settings. Malfunctioning OpenSSL X509_pubkey_digest() calculation replaced. Backported fixes for [20230922#1/4.3.01], [20230920#1/4.3.01], and [20230823#1/4.3.00] included. |
fehQlibs-20/ fehQlibs-21 |
MD5 c6a802a93d7854e2e8b305912e0f8063 Build: 20230924113858 |
sqmail-4.0.10a | The eighth 4.0 release now demanding fehQlibs while supporting natively SPF together now with SRS (srsforward and srsreverse). SMTPUTF8 can now be enabled for qmail-smtpd by means of the environment variable 'UTF8'. Based on fehQlibs-15 even some outstanding old CVE's are now fixed completely. This release *is* the last one in the 4.0 cycle. | fehQlibs-15 | MD5: a266b85355b48b58a2656273cf4af67d Build: 20230311180733 |
sqmail-3.3.25 | The fourteenth 3.3 (and backported from 3.4) release including A. Oppermann's EXTTODO extension together with (optional) SMTPUTF8/EAI/IDN2 support while featuring the new qmail-vmailuser and the enhanced qmail-authuser PAM; providing better compatibility with current versions of OpenSSL 1.1 and finally fixing problems with qmail-remote and some eventual SPF-related problems in qmail-smtpd. | None. | MD5: 1182e3860f49a09595e61117ab3a8250 Build: 20200729153744 |
sqmail-3.2.19 | The sixth (official) 'SPF' release; covering OpenBSD (6.0) and Debian 9 (Stretch) while providing additional Recipient PAMs for VMailMgr and vpopmail (together with ucspi-ssl-0.99). | None. | MD5: 8a4fd942c1a1271619b0696d934c401a Build: 220170408184513 |
sqmail-3.1.9 | This is the fourth update. This 'π5+' release enhances the qmail-authuser capabilities for virtual domain handlers. | None. | MD5: cb4da2ca52a05fda6668850c1d41359f Build: 20160724111506 |
sqmail-3.0.2 | The third fully integrated release; don't use it/just for reference. | None. | MD5: 4045d0a85fe4857fcf9c118fcfa13d1f |
The code of the current release can be viewed in a doxygen archive.
Addendum
Two patches are currently available for s/qmail 4.1 and 4.2 which are incorporated into the last builds, but also can be applied to previous builds:
- mkdkimkey.sh version 0.46 script. You need to redfine the HOME variable.
- Fix for EXIST clause evaluating SPF records: spfdnsip.c.patch - prevents wrong SPF results for this case (only).
- Fix for BADMIMETYPE evaluation: qmail-smtpd.c.patch - for convenience ony; otherwise simply use BADMIMETYPE=" " instead.
Additional packages
I also recommend to use
- Newanalyse 2.x which allows long-haul logging and easy finding of delivered mails from the logs.
- Tobias Oetiker's MRTG to visualize s/qmail's logs together with qmail-mrtg.
Release Management & Defects
Naming conventions:
- Error: Implementation does not conform to reqs, e.g. something is missing.
- Bug: Coding mistake in source file(s).
- Flaw: Wrong/missing description in man-file or any attached documentation.
- RfC: Request for Change: Feature request.
Open defects:
Reference | Type | Description | State |
[20170630#1] | Rfc | Add flexible uid configuration. | Confirmed, pending |
[20200509#1] | Rfc | Add qmail-ldapam for authentication. | Confirmed; an external package is required swallowing the code from s/qmail-4.3 (work in progress) |
[20200715#1] | Rfc | VERP address should be automatically accepted by qmail-smtpd's recipient extension | Rejected; better to include those with an additional entry here. |
[20220324#1] | Rfc | The RECIPIENTS mechanism does not support qmail-users's cdb | Done; starting with version 4.2 the cdb generated by qmail-newu will be consulted for valid recipients semi-automatically; however, the resulting cdb is renamed assign.cdb. |
[20240118#1] | Error | qmail-remote may falsely recognize a MTA's ESMTP EHELO message with X-* extension. | Fix has beed posted to the list; complete solution will be given in s/qmail 4.3. Very rare condition. |
Mitre CVEs:
- [CVE-2020-15955] StartTLS command injection (closed in 4.0.08)
- [CVE-2005-1513] Integer overflow on 64 bit platforms (closed in 4.0.08)
Closed defects (version 4 only):
- [20231110#1/4.2.29] qmail-dksign deferres mail, in case the sign-key is not available.
- [20231203#1/4.2.29] qmail-smtpd may crash while logging SPF bounces.
- [20230931#1/4.3.02] qmail-smtpd may segfault in case of invalid AUTH method input. Backported to s/qmail-4.2.27.
- [20230922#1/4.3.01] spfquery's returns wrong results for the SPF EXIST clause due a to wrong DNS lookup.
- [20230920#1/4.3.01] qmail-remote's announces SIZE=0 if invoked from a pipe and not from a file interface; ie. if called from an umbrella script. Workaround: SIZE announcement disabled for SMTP, deferral message given for QMTP delivery. Need to change API in qmail-rspawn in the forthcoming release.
- [20230823#1/4.3.00] qmail-smtpd's badmimetype does not work setting the environment variable to "BADMINETYPE=''". Rather use "BADMINETYPE='!'" (workaround).
- [20231109#1/4.2.29] qmail-dksign does not evaluate DKIM in lowercase only.
- [20231003#1/4.2.27b] While using control/domainips with a tailored 'helohost'
qmail-remote adds a '\0' to the naked hostname given here in violation of RFC 2821.
Workaround: Simply add some welcome text to the hostname. - [20231003#1/4.2.27a] qmail-smtpd returns incomplete Auth failure message.
- [20230718#1/4.2.25] qmail-dkim considers DKIM verification as 'failed/key revoked' if in the DNS TXT records 'k=' (key type) is missing.
- [20230503#1/4.2.24] qmail-smtpd does not correctly evaluate 'SPF PTR:' settings (ie. for yahoo.com).
- [20230316#1/4.2.23] qmail-remote does not fall-back to none-StartTLS connections (fix backported to 4.1).
- [20230303#1/4.2.22] qmail-remote abends connecting to a MTA that does not provide a SMTP dialogue (fix backported to 4.1 and 4.0).
- [20221223#2/4.1.18] qmail-local does not detect mail loops in some cases (if address includes a dash).
- [20221223#1/4.1.18] fastforward does not inject the mail, if the alias is given in the cdb.
- [20221220#1/4.1.18] qmail-remote verification failure for X.509 certs according to tlsdestinations settings.
- [20222213#1/4.1.18] qmail-smtpd given its SPF evaluation does not understand the 'exists' pattern.
- [20220315#1/4.1.16] qmail-remote fails to bind IPv4 address in case it is given in localip.
- [20220329#1/4.1.16] qmail-remote erratic logging of 'greylisting'.
- [20220225#1/4.1.14] qmail-remote shows up wrong 'Greylisting' infomation in log.
- [20211218#1/4.1.13] qmail-remote conforms to RFC 6698 PKIX-EE certificate verification for TLSA. [20211021#1/4.1.12] qmail-remote TLSA checking working again correctly.
- [20210824#1/4.1.11] Fixed qmail-smtpam segfaults on call.
- [20210818#1/4.1.11] qmail-vmailuser is unable to validate vpopmail's Mailboxes.
- [20210801#1/4.1.10] Fixed wrong SIZE evaluation for QMTP sending within qmail-remote.
- [20210622#1/4.1.09] Fixed wrong SIZE and UTF8 announcement for qmail-remote together with an incomplete TLSA record checking.
- [Flaw:20210212#1/4.1.08] Removed hardcoded domain name 'spf.pobox.com' in SPF default expansion.
- [20120312#1/4.1.08] Using both qmail-smtpd's badmailfrom and badrcptto may interfere and reject mails erroneously.
- [Flaw:20201112#1/4.1.08] qmail-remote's smtproutes allows now binding to specific local IP address.
- [Flaw:20210213#1/4.1.08] qmail-remote's smtproutes are not authenticating.
- [20201123#1/4.1.08] Binding problem to IPv4 addresses for qmail-remote resolved.
- [20200724#1/4.0.10] Compatibility with GCC 10 is finally provided now.
- [20200724#1/4.0.08] Fixes for qmail-smtpd to cope with CVE-2011-0411 (ESMTP pipelining command injection).
- [20200713#1/4.0.08] Fixes for qmail-vmailuser not respecting vpopmail's home directory.
- [20200509#1/4.0.08] Fixes for qmail-smtpd to cope with CVE 2005-1513 (Guninski alloc bug report) and solved via fehQlibs-15.
- [20200514#1/4.0.07] Fixes for qmail-smtpd considering other DNS TXT as none-existing SPF records (and potentially rejecting connections).
- [20200423#1/4.0.06] qmail-smtpd may segfault while evalutating SPF records from Google.
- [20200410#1/4.0.05] qmail-remote and qmail-smtpam is not SMTP-UTF8 enabled by default (and now without compiler flag).
- [20200408#1/4.0.05] qmail-remote has wrong mangling of RCPT TO: addresses in case of a CNAME.
- [20200303#1/4.0.04] qmail-smtpd may segfault for mails with more than one RCPT TO:.
- [20200227#1/4.0.02] Added SRS capabilities with the modules srsforward and srsreverse.
- [20190116#1/4.0.00] qmail-remote fails to authenticate to some servers fixed.
Note: The given release number following the defect number tells, in which version of s/qmail this change was applied. The given date, when the defect was reported.
Release plan
s/qmail will be maintained and my release plan includes the following topics:
-
Version 3.0 is the first complete release(done). - Version 3.1 will be used for additional enhancements (done).
- Version 3.2 includes SPF capabilities and LibreSSL as well OpenSSL 1.1 hooks have been added within ucspi-ssl 0.99 (done).
- Version 3.3 is scheduled for performance enhancements (EXTTODO; done).
- Version 3.4 is forseen for integrating
DJBDNSCurve6fehQlibs and adding SRS capabilities (done as 4.0). -
Version 3.5 ... let's see: TLSA support? ... and probably DKIM as well. - Version 4.0 uses fehQlibs and thus its DNS stub resolver routines (done).
- Version 4.1 shall provide
a DKIM API(posponed to furthcoming version) and perhaps TLSA support (done). - Version 4.2 supports DKIM (both sending and receiving - done)
- Version 4.3 will include a versatile LDAP PAM for authentication.
- Version 4.4 is supposed to allow SMTP pipeling for qmail-rspawn (desperately missing).
- Version 5.0 UUID identifier for files in the queue?
Tickets, Change Requests, communication
An EZMLM mailing list working together with s/qmail keeps you updated with current developments, bug fixes, and features discussed. This list also can be used to file
- Defects (bug reports) and
- Change Requests (enhancements).
To inscribe use: s/qmail mailing list
I can't guarantee a certain response level; but reasonable issues will be answered.