Security
A missing DS is proved missing, not assumed (RFC 4035 §5.2, RFC 5155 §8). The DNSSEC validator that guards DANE and the SPF, DKIM and DMARC lookups treated a DS query answered with nothing as an unsigned delegation - which is exactly what an attacker who strips the DS from the answer on the way shows a resolver, and a signed zone quietly became an unsigned one, DANE and validated TXT gone with it. The resolver now keeps the authority section of a negative answer and requires the parent's proof there: an NSEC at the delegation name with NS set and DS clear, an NSEC3 whose hashed owner matches with the same bits, or an Opt-Out NSEC3 covering the hash, each signed by the parent's key. A proof that fails to verify, has expired, claims a DS exists, or belongs to another name is no proof, and a delegation without one under a signed parent is Bogus - blocked, as a forged chain is - rather than Insecure. An unsigned parent still makes everything below it Insecure, as it should, and a resolver that cannot be reached still degrades to Insecure rather than lying. Twelve tests run the resolver against a chain the suite signs itself, through the new Diagnostics.DnssecChainStatus.
Mail flow
An external IMAP account can mirror every folder (FetchAccount.MirrorFolders, schema 6031; in the Control Panel, Mirror every folder on an IMAP external account). With it on, the server lists the remote mailboxes and collects each into the local folder of the same name: every message byte for byte, its \Seen \Flagged \Answered \Draft \Deleted flags, its internal date, the remote hierarchy delimiter mapped to the local one. Nothing is delivered - no header, rule, anti-spam or anti-virus touches a copy - because it is mail the other server had already accepted. Each folder keeps its own record of what has been collected, so a second poll takes only what is new, and days to keep messages 0 makes it a move, folder by folder. This is the imapsync shape: the way to bring a mailbox from another IMAP server, or from a hosted service that is switching Basic authentication off, into this one.
The Import Tool reads a Maildir. A second button takes a Maildir - the directory with cur, new and tmp - and imports the INBOX and every Maildir++ folder beside it, with the flags the file names carry (;2, and !2, accepted as well as :2,, since a colon cannot be in a Windows file name) and line endings made CRLF.
Migration.md is the guide the roadmap asked for: from another IMAP server, from mbox, from a Maildir, from Outlook (through IMAP - PST is deliberately not parsed, and the page says why), from the upstream hMailServer in place, and accounts in bulk; what each route keeps and what it does not.
A message imported into a folder a client has open appears at once. The Import Tool's import told nobody that the folder had changed, so a session with the folder's message list cached saw the copy only after a restart. The folder is now refreshed, as it is after a delivery.
Also in it
- Four roadmap rows brought up to date after 6.2.26, and the create-script check and the DBUpdater's message record what #114 taught.
Upgrading
Schema 6030 → 6031: one column on hm_fetchaccounts, added by the installer's database upgrade on every backend; the SQL Server Compact verification that 6.2.25 got wrong was fixed in 6.2.26 and is proved on a fresh database before every release. From 6.2.25 or 6.2.26: run the installer. From earlier: the 6.2.25 and 6.2.24 notes describe what changes on the way.
Verification
Three clean Release builds of the stamped source produced a byte-identical hMailServer.exe 6.2.27.37 (SHA-256 8CD745C49657A2E02989A8A86E9290C0AA49D317466B860C3749C757C129410F). The full regression suite ran on the assertion-enabled build of this source and again on the shipping binary: 2024 tests, 2017 passed, 0 failed, the 7 explicit skips, both times. The Control Panel's tests passed. hMailServer-6.2.27-x64.exe is 77,237,885 bytes, SHA-256 F60D3C30F27AF9EDC18BEE295DA231C666E826C1436E2214593B33499227C1A6; its Sigstore bundle and the two SBOMs are attached below, signed by this repository's sign-release workflow.
