hMailServer 6.2.6

Built 15 June 2026 6.2 series

This is not the current release. hMailServer 6.3.3 is the one to install unless you need this exact version.

Downloads for 6.2.6

Windows

Windows 10 (version 1607 or later) and Windows 11, or Windows Server 2016 and newer; 64-bit only. Run the installer as an administrator: it upgrades an installation older than this version in place, and it cannot go backwards — an older server refuses a database a newer one has upgraded, so back up the database and the data directory first. It is not Authenticode-signed, so Windows names an unknown publisher and SmartScreen warns before it will run it.

  • hMailServer-6.2.6-x64.exex64 · 79.0 MB
    Download
    SHA-2560f92dd7be639…4bd3ded2

What’s new in 6.2.6

A Control Panel and installer polish release, with one new opt-in server protocol mode. Download hMailServer-6.2.6-x64.exe below.

Full release notes for 6.2.6 3 sections

Highlights

  • IMAP4rev2 (RFC 9051) as an opt-in session mode. The server advertises IMAP4rev2; ENABLE IMAP4rev2 switches the connection to RFC 9051 semantics (ESEARCH by default, \Recent/RECENT dropped from SELECT/EXAMINE/STATUS, the obsolete [UNSEEN] response code suppressed, UTF-8 acceptance). IMAP4rev1 behaviour is unchanged until a client opts in.
  • Control Panel visual redesign. A central, theme-aware colour-token system replaces scattered hardcoded colours (success/warning/danger/info and the log palette now adapt to light/dark/high-contrast); a proper Fluent nav selection style plus a brand keyboard-focus ring; legible live-log colours on light theme; readable data grids and balanced columns; settings forms capped to a readable column with right-sized inputs; state-encoding KPI colours; softened destructive buttons; "no activity" chart placeholders; and a Welcome page of clickable quick-action tiles.
  • Complete settings coverage. Every configurable server setting now has a GUI control: OAuth2 / external-token auth, SRS & BATV, submission/outbound rate limits, OpenTelemetry + slow-query log, connection timeouts, delivery/queue tuning, search indexing, message archiving and other INI knobs, Logging.Device/LogFormat, cache size caps, the domain Active Directory link, and a write-only secret editor. See settings.md.
  • Two-factor authentication setup now renders a real scannable QR code (plus a grouped manual key with a copy button) and a larger, clearer verification field.
  • Installer. DPI-scaled custom database-type page, removal of the dead legacy dependency installers (MSI/IE6/MDAC/JET/.NET 2.0), modernised copy, and refreshed brand imagery.

Validation

Server core validated by the full regression suite: 898 of 898 tests passing, including live SpamAssassin, ClamAV (EICAR), DMARC against live DNS, and TLS 1.2/1.3 handshakes end to end.

Assets

  • hMailServer-6.2.6-x64.exe - the installer
  • hmailserver.spdx.json - SPDX SBOM
  • hmailserver.cyclonedx.json - CycloneDX SBOM

Release facts

Version
6.2.6
Packages
1Windows, x86-64
Installer SHA-256
0f92dd7be639…4bd3ded2hMailServer-6.2.6-x64.exe

Every file in 6.2.6

Full SHA-256 of each file as recomputed on this server. The SBOM is not needed to install; it lists every component in the build. Nothing in this release is signed — the signing workflow came later — so the hash above is this server’s own recomputation rather than a check against something the project signed.

FileWhat it isSizeSHA-256Signature
hMailServer-6.2.6-x64.exeWindows installer · x6479.0 MB0f92dd7be639ace0549c6309ed192346ca2b88b6533eabe44a27f8a24bd3ded2—
hmailserver.spdx.jsonSBOM (SPDX)Every component in the build, in SPDX JSON.500 KB3f333fd3d88bc3990d210f6282d5d74ed84766f142242bc8c3ca1039a340ae75—
hmailserver.cyclonedx.jsonSBOM (CycloneDX)The same inventory in CycloneDX JSON.200 KBeab64c374cdc48ada9ec17be065f474d4b502a9c4c078beac577de68a8a9faf9—