Qmail and Vpomail licence and commit attribution history violation

November 15, 2026 by Roberto Puzzanghera 0 comments

I regret having to clutter this space with a rant prompted by a negative incident that has caused me considerable annoyance.

If you are -or have been- a contributor to this project, a supporter, a user, or simply someone who values ​​the philosophy of free software, please be aware that Brian O'Reilly ("fade") has cloned my qmail and vpopmail repositories and distributed our collective work while taking full credit for it himself. Look here:

• https://github.com/fade/dsmr-qmail 
• https://github.com/fade/dsmr-vpopmail 
• https://github.com/fade/netqmail/tree/debian/latest

You can see that, across the various branches of his repositories, every single commit appears as his own personal work; furthermore, his qmail and vpopmail repositories are not even identified as forks of my original ones.

If you navigate in my vpopmail and qmailadmin repos, you can find all commit's attribution history intact since the software was shipped by the Inter7's programmers. Brian O'Reilly has instead attributed to himself other people work and, by doing so, he has violated the licences.

This is not just a lack of respect; it is, quite frankly, dishonest behavior.

I ask Debian users to let me know if you come across any qmail/vpopmail packages distributed by this individual. In the meantime, I have filed a DMCA takedown notice with GitHub.

Upgrading qmail

November 11, 2026 by Roberto Puzzanghera 607 comments

• Latest version 2026.11.11 (github)
• Changelog
• Readme

Changelog

• Nov 11, 2026
  - Fix null reverse-path handling in sendmail -f option in #49
  - Fix stray \ before # in qmailctl causing warning af18e5b
• Sep 29, 2026
  More info in the changelog
  - Modernization for compatibility with C23 and recent GCC/clang releases in #44
  - srs: do not rewrite qmail's internal envelope addresses ("#@[]" and VERP) by @yohgaki in #46
  - Improve general portability across linux and *BSD platforms in #47
• Apr 7, 2026
  - (security) Remote Code Execution via Shell Injection in qmail-remote TLS Error Handler in #42 (tx Diep Pham)
• Apr 2, 2026
  - qmail-remote auth improvements by pierluigi in #39
  - Fixed DKIM ed25519-sha256 signing and verification to conform to RFC8463 by @agerstla in #40
  - Updated qmail-qfilter to support filters defined in control/qfilters by @agerstla in #41
• Feb 25, 2026
  - Improved DKIM status handling by @agerstla in #35
  - Ported over DKIM_BAD_IDENTITY support from Indimail (tx Manvendra Bhangui and Andreas Gerstlauer 1299b55)
  - SNI support for qmail-smtpd by @agerstla in #37
  - Added qmail-qfilter by @agerstla in #38
• Feb 3, 2026
  - Bug fix for verifying multiple DKIM signatures (second one always failed due to a DNS lookup bug). tx Andreas Gerstlaurer #31
  - config-all.sh upgrade #33
  * config-all.sh: moreipme is now populated with IPs in separate lines
  * config-all.sh: rsa dh keys can be created even if the certificate creation is skipped
  * config-all requires to accept overwriting with y/N/a=all options
• Apr 25, 2025
  - added a configuration script config-all, which configure and installs the control files (as per the original config-fast script), aliases, SRS (uses control/me as the srs_domain), log dirs in /var/log/qmail, tcprules (basic, just to make initial tests), supervise scripts, qmailctl script, DKIM control/filterargs and control/domainkeys dir, SURBL, smtpplugins, helodnscheck spp plugin, svtools, qmHandle, queue-repair, SSL key file (optional). 

Installing and configuring simscan

November 15, 2026 by Roberto Puzzanghera 101 comments

• github
• Changelog
• John Simpson's simscan page (patch and a lot of info)
• README
• Old combined patch used (Sep 13, 2023)
• Version: simscan-1.4.7

Simscan is a simple program that enables the qmail smtpd service to reject viruses, spam, and block attachments during the SMTP conversation so the processing load on the email system is kept to a minimum.

Changelog

• Nov 15, 2026
  - Fix legacy C declarations and POSIX function prototypes for modern compilers in #7
  - Changed gcc to cc to make freebsd/clang compilers happy in e45eeb9
  - Message with found viri is now put in quarantine by Shah Imran in 459d557

read more

Roundcube webmail

November 9, 2026 by Roberto Puzzanghera 17 comments

• Info: https://roundcube.net
• Version: 1.7.6

Roundcube is a full featured webmail with a nice interface.

Changelog

• Nov 9, 2026
  - version 1.7.6 (security release)
• Mar 9, 2025
  added $config['quota_zero_as_unlimited'] = true; to show quota unlimited instead of unknown for accounts with unlimited quota

Read the release note at https://github.com/roundcube/roundcubemail/blob/master/CHANGELOG.md for more info.

Installing ClamAV

November 4, 2026 by Roberto Puzzanghera 24 comments

• Info: http://www.clamav.net
• Latest version: 1.5.4

Clam AntiVirus is an open source (GPL) anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways.

Changelog

• Nov 4, 2026
  - clamav upgraded to v 1.5.4
• Oct 11, 2025
  - clamav upgraded to v 1.5.0. A recent version of rust is needed (successfully using 1.88 here). Just reinstall as explained below. No particular change is needed in the config files.

Installing a Let's Encrypt certificate for your qmail, dovecot and apache servers

October 20, 2026 by Roberto Puzzanghera 29 comments

Changelog

• Oct 20, 2024 (v. 4.0.4)
  - bug fix: $CERT_CHANGED_FLAG was touched badly in hook.sh deploy_cert() function (8409252)
• Oct 7, 2026 (v. 4.0.3)
  - sendmail bin determined by 'command -v', instead of using the sendmail shipped by qmail by default a20904b
• Jul 25, 2026 (v. 4.0) hook scripts and below documentation completeley reviewed.
  - Added a new dehydrated-renew wrapper script to execute certificate renewal and perform service synchronization for SNI only when one or more certificates have actually changed.
  - Introduced a change flag mechanism (dehydrated.changed) to avoid unnecessary service reloads and restarts if any certificate has been actually deployed.
  - Consolidated post-renew operations into the new cert_sync() function, providing a single entry point for synchronizing qmail, Dovecot, and Apache certificate configuration after successful renewals. The same cert_sync() can be called via stand-alone script, which doesn't involve the dehydrated run.
  - Reduced unnecessary service interruptions by performing synchronization once per renewal run instead of once per renewed certificate.
  - qmail certificate is built only if MAKE_MAIL_CERTS=1 is set. If MAKE_MAIL_CERTS=0 the hook script only deploys the certificates (use for webserver).
  - Server Server Name Indication (SNI) stuff for qmail and dovecot can be disabled by setting ENABLE_SNI=0 (default).
  - ServerName and ServerAlias entries for Apache and SNI domains can be optionally set with ENABLE_APACHE_SNI_CONF=1.

Installing and configuring VPopMail

September 16, 2026 by Roberto Puzzanghera 228 comments

• VPopMail version: 5.6.14
• github: sagredo-dev/vpopmail
• Download
• Changelog
• README.vdelivermail
• Inter7's original page

Vpopmail provides an easy way to manage virtual email domains and non /etc/passwd email accounts on your mail servers.

Changelog

• Sep 16, 2026 (version 5.6.14)
  - Refactoring 64-bit endian conversion handling in #11
  - Purge vlog in #12 #13 853be6c 012e58d b4bafad d7fce5d
  - escape SQL through the client library, not by hand. by @yohgaki in #14
  - bug fix in vpalias.c: valias_select_next() was called with a 'alias' variable, while it is defined with no arguments (tx Ulrich) in #15
  - backfill.c: fix const qualifier warnings in strrstr() 8f77b5d
  - vusaged: rename internal list functions to vlist_* to avoid symbol collisions with MariaDB client library 1bb31ca
• Feb 11, 2026
  - vlimits.c: avoids no file found exit when .qmailadmin-limits is not existent because no limits are defined yet (a565779)
  - added sql files to be imported on upgrade to v. 5.6.x (8136480)
• Feb 8, 2026 (v. 5.6.12)
- vmysql.c changes (#10)
  * valias_create_table now checks if table is already created in order to avoid warnings in dotqmail2valias
  * solved quotes issue in query in valias_insert function
  - improved the upgrade section
• Nov 20, 2025 (v. 5.6.11)
  - vutil: 'isSomething' functions reviewed to satisfy qmailadmin calls in #9
  - Added definition of 'call_onchange' function and cured its calls to avoid break 97ffe38
• Oct 30, 2025 (v. 5.6.10)
  - Added specific usage informations for s/qmail users (look here)
  - Dropped -std=gnu17 from compilation options and solved (probably) all breaks and warnings on gcc 15.2 2d8526d
  - configure.ac now looks for mariadb include and lib dir in addition to mysql dab36e8
  - configure.ac automatically looks for vanilla qmail's users/cdb and s/qmail's users/assign.cdb file 723efb3
  - Updated the usage() funcion message in vadduser.c to clarify the use of pre-hashed passwords with -e 5b5ccdb
  - control/defaultdelivery is now installed by vpopmail if --enable-defaultdelivery 77f54eb
  - vrcptcheck plugin for s/qmail: it now checks all kind of address (users, forwards, valiases) #7
  - Dropped unused functions in vpopmail.c #8
• Sep 1, 2025 (v. 5.6.9)
  - added -std=gnu17 to gain compatibility with gcc-15 (PR #6)
  - pw_clear_passwd field enlarged to varchar(128) to create room for long passwords (tx Ricardo Brisighelli) c54688d
• Mar 29, 2025 (v5.6.8)
  defaultdelivery feature (--enable-defaultdelivery) changes (more info here, commit):
  • vdelivermail is installed by default in .qmail-default of newly created domains with option 'delete' as in the previous version.
  • if no user's valiases and no .qmail are found, then the message is sent to the control/defaultdelivery file, so that dovecot-lda (or whatelse) can execute the sieve rules and finally store the message into inbox.
  • if vdelivermail is found in control/defaultdelivery, then it is ignored to avoid loops. The delivery is done by vdelivermail
  • v. 5.6.8 is backward compatible. The users having .qmail from previous versions of the defaultdelivery feature are not affected by this change.

qmail - basic setup

August 31, 2026 by Roberto Puzzanghera 48 comments

Changelog

• Aug 31, 2026
  - fixed a qmail-queue issue on OpenBSD
• Jun 25, 2026
  - netqmail branch for OpenBSD users available
• Aug 19, 2025
  - netqmail-1.07.1: now compiles with gcc 15.3
• Feb 10, 2025
  - the original netqmail sources are now compatible with latest gcc and clang compilers
  - renamed as netqmail-1.07 the original netqmail sources after the update

QmailAdmin

August 29, 2026 by Roberto Puzzanghera 206 comments

• Version: 1.2.28
• github
• Changelog
• Original Inter7 page

qmailAdmin is a free software package that provides a web interface for managing a qmail system with virtual domains. It provides admin for adding/deleting users, Aliases, Forwards, Mailing lists and Autoresponders.

Changelog

• Aug 29, 2026
  - Bug fix: avoided to add translations from 400 to 450, as they are reserved strings for autoresponder's headers in #9. Thanks to ueli for spotting the bug.
• Nov 28, 2025 (v1.2.27)
  - Solved a compilation break on mailinglist.c when onchange is enabled in vpopmail a6395a9
  - Configure option --with-auth-log becomes --with-auth-logdir e6bdd48
  - Dropped VPOPMAIL_DEFS_H def in template.c 658eaa9
  - Revised the definition of PACKAGE and VERSION macros in several .c files 18abb99 bff23be
  - Functions file_exists() and str_replace() renamed to file_exists2() and str_replace2() on util.c because they are already defined in vpopmail bff23be
  - Fixed quick search button functionality (wasn't working well) bff23be
  - qmailadmin now requires vpopmail-5.6.11 a640c59
  - Solved undefined EZMLDIR and changing --enable-auth-log to --enable-auth-logdir in #5
  - Dropped a lot of br tags in lang files, fixed accents in italian language in #6
  - Dropped unusued --enable-help feature in configure in #7
  - mailinglist.c: if MySQL support is enabled mysql:localhost is the default host in #8
• Nov 8, 2025 (v1.2.26)
  - Improved the handling of program exit because of wrong configuration. This should avoid the unpleasant "blank screen" situation in some cases.
  - Configure program is now able to require a minimum vpopmail version 3846a52
  - Upgrade in auth-logging feature: added configurable auth log path via --with-auth-log=DIR (default ~vpopmail/log). Log file now written under vpopmail privileges instead of apache. 59e234d 04e2bf9 0c75b47 5f768b1
  - Added verbosity to the "File error" event #4

Installing Dovecot and sieve on a VpopMail + qmail server

August 28, 2026 by Roberto Puzzanghera 157 comments

Changelog

• Aug 28, 2026
  - dovecot upgraded to v2.4.5
  - the new version has lua as a dependency. Added --without-lua at configure command
• Feb 25, 2026
  - Added Server Name Indication (SNI) settings in sni.conf.template, imported from local.conf commit
  - userdb iterate query now orders by domain and username commit
  - 15-mailboxes.conf: fts_autoindex = no added to Trash and Junk folders commit
  - 10-auth.conf: + character added to auth_username_chars commit
• Nov 24, 2025
  - dropped 'enforce = no' from 90-quota.conf to enforce quota limits (commit)
• Nov 22, 2025
  - quota driver switched to 'count' (commit). 'count' is  the recommended way of calculating quota on recent Dovecot installations.
• Mar 15, 2025 (config version 2.4.0.1 diff) 
  - Added quota warnings feature. Improved quota configuration in 90-quota.conf (more info here)
  - Configured auth-master.conf.ext and auth-deny.conf.ext. To be included in local.conf
• Mar 9, 2025
  - fixed quota calculation in sql queries (tx Hakan Cakiroglu) (commit)
• Feb 22, 2025 (version 2025.02.25b)
  - Bug fix in 90-sieve.conf: global script to move spam into Junk now working
  - Bug fix in move-spam.sieve: it was erroneously matching "YES" in the header if "BAYES" was present (Feb 15, 2025 config version not affected, no need to recompile the sieve script)
• Jan 29, 2025
  - dovecot upgraded to v. 2.4.0. Old configuration files are not valid anymore and you have to install dovecot from scratch.
• Nov 15, 2024
  - added a postlogin script to update the vpopmail.lastauth SQL table on login (see 10-master.conf, thanks kengheng)
• Dec 29, 2023
  default_pass_scheme = SHA512-CRYPT (was MD5-CRYPT) in dovecot-sql.conf.ext, as vpopmail-5.6.x has now SHA512-CRYPT password by default