hMailServer October updates fix DKIM forgery and delivery flaws

DKIM signing fix released on 17 October

Progressive Robot’s hMailServer fork released version 6.3.7 on 17 October 2026. It restricts DKIM signing to authorized senders, correcting a forgery risk in versions 6.0.0 through 6.3.6. The CVE-2026-107567 record was published on 19 October.

With DKIM enabled for a hosted domain, the server could sign incoming mail whose From address impersonated that domain. An external forward, alias, list or rule could then carry the signed forgery to another receiver, where it could pass DKIM and DMARC. Authenticated users could also obtain signatures for another hosted domain without permission to send as its addresses.

Operators should review 6.3.7’s full upgrade notes and send-as permissions, back up the database and mail data, and upgrade. Test legitimate submissions and forwarding, and confirm unauthorized messages cannot acquire the hosted domain’s signature. Version 6.3.7 adds no database schema step over 6.3.6; upgrading from 6.3.5 or earlier still runs one-way schema changes.

Earlier fixes in 6.3.6

Progressive Robot’s hMailServer fork released version 6.3.6 on 6 October 2026. It fixes security problems in message authentication checks and outbound delivery. The related CVE records were published on 8 October.

In versions 6.0.0 through 6.3.5, costly DKIM and ARC header processing could let a remote sender exhaust mail-processing workers. CVE-2026-107576 describes this denial-of-service issue; the fix makes header processing more efficient.

Linux builds from 6.3.0 through 6.3.5 also lacked working timeouts for some network operations. A stalled MTA-STS policy fetch could hold delivery threads indefinitely. CVE-2026-103649 also lists DANE lookups and other affected operations. Windows builds are unaffected by that timeout flaw.

What operators should check

Confirm whether you run the Progressive Robot fork and review the release notes for the version you are installing. The newer 6.3.7 release also addresses the DKIM signing flaw described above; stopping at 6.3.6 leaves that issue unfixed.

After upgrading, test incoming authentication checks and outbound delivery, and check queue progress. These are implementation defects in this fork, rather than flaws in the DKIM, ARC or MTA-STS standards.