hMailServer 6.2.5 is a critical fix release. The default fresh install — an internal SQL Server Compact database with DPAPI secret protection (both shipped defaults) — could not connect to its own database. Anyone running a default install should upgrade.
Critical fixes

    DPAPI database-password truncation (SQL CE error 25028). IniFileSettings::ReadIniSettingString_ used a fixed 255-character buffer, so GetPrivateProfileString truncated the ~356-character DPAPI-protected database-password envelope. The truncated blob failed to decrypt, yielding an empty password and SQL CE error 25028 (Authentication failed) on a default install. The buffer is now 4096 characters (also protects long OAuth2 HMAC secrets and the password pepper).
    Fresh-install database version (6004 → 6005). The CreateTables scripts (MSSQL / MySQL / PostgreSQL — SQL CE uses the MSSQL script) still stamped hm_dbversion = 6004 while the server required 6005, so a brand-new install reported "database too old" (6004 vs 6005). Bumped to 6005. (The recipientdsnnotify column was already present; only the version row was stale.)

Validation

Validated end-to-end on a real Windows Server 2025 Active Directory domain controller:

    Default internal-DB install now connects successfully.
    AD authentication passes via COM ValidatePassword (both DNS domain.tld and NetBIOS DOMAIN\user forms) and a real IMAP LOGIN (correct password → OK, wrong → NO).

Control Panel

The modern .NET 8 WPF Control Panel (hMailCP.exe) reaches full settings parity with the classic Administrator. The Server Status page (version, server state, database details, statistics, session counts, uptime, configuration-warnings panel including open-relay detection) and the per-account rule criteria/action editor are validated and wired into navigation.
Downloads

    hMailServer-6.2.5-x64.exe — Windows x64 installer (bundles the server, the Control Panel, and the .NET 8 Desktop Runtime bootstrapper).
    hmailserver.spdx.json / hmailserver.cyclonedx.json — Software Bill of Materials (SPDX + CycloneDX).

Copyright © 2026 Christopher Holloway / Progressive Robot Ltd.