Progressiverobot
diff --git a/‎README.md‎
Lines changed: 59 additions & 1 deletion b/‎README.md‎
Lines changed: 59 additions & 1 deletion
diff --git a/‎build/generate-settings-index.ps1‎
Lines changed: 94 additions & 0 deletions b/‎build/generate-settings-index.ps1‎
Lines changed: 94 additions & 0 deletions
diff --git a/‎hmailserver/installation/section_setup_64.iss‎
Lines changed: 4 additions & 4 deletions b/‎hmailserver/installation/section_setup_64.iss‎
Lines changed: 4 additions & 4 deletions
diff --git a/‎hmailserver/source/Server/Common/AntiSpam/DKIM/DKIM.cpp‎
Lines changed: 35 additions & 6 deletions b/‎hmailserver/source/Server/Common/AntiSpam/DKIM/DKIM.cpp‎
Lines changed: 35 additions & 6 deletions
diff --git a/‎hmailserver/source/Server/Common/Application/Application.cpp‎
Lines changed: 23 additions & 1 deletion b/‎hmailserver/source/Server/Common/Application/Application.cpp‎
Lines changed: 23 additions & 1 deletion
@@ -5,7 +5,7 @@ hMailServer is an open source email server for Microsoft Windows, implementing S
 
 This repository is a modernized fork of the original project (which is no longer maintained upstream). It has been brought up to date with a current toolchain, current cryptography, and the transport-security standards expected of a mail server in 2026. It is maintained by Christopher Holloway / [Progressive Robot Ltd](https://www.progressiverobot.com).
 
-**Production status:** version **6.2.13** is released - [download the installer](https://github.com/Progressiverobot/hmailserver/releases/latest) (`hMailServer-6.2.13-x64.exe`). **6.2.13 is a community-feedback bug-fix release**: it fixes the issues testers reported on the forum against 6.2.11/6.2.12 - a SMTP DATA stall when relaying from Postfix/Proxmox Mail Gateway (a reverse-DNS lookup that blocked the network thread mid-message), the DBUpdater version labels, the Control Panel Diagnostics and service-restart, in-place upgrade settings/EventHandlers preservation, and a consistent Windows 10/2016 build target - and hardens the SMTP, IMAP FETCH and SpamAssassin paths against malformed input found while investigating. See *6.2.13* below. It is validated by the full regression suite: **1026 of 1026 tests passing, zero failures, zero inconclusive** - the complete suite, with live SpamAssassin and ClamAV (real EICAR detection), DMARC evaluation against live DNS, and TLS 1.2/1.3 handshakes end to end. Every test runs; nothing is skipped. The bundled administration GUI is the modern .NET 8 **Control Panel**.
+**Production status:** version **6.2.14** is released - [download the installer](https://github.com/Progressiverobot/hmailserver/releases/latest) (`hMailServer-6.2.14-x64.exe`). **6.2.14 is a correctness and usability release**: an adversarial audit of the server found and fixed **21 defects** - including failed message copies crashing delivery, IMAP APPEND reporting success for messages that were never written, string SQL parameters bound from freed memory on the default backend, a DKIM test-mode flag that turned a failed signature into a DMARC-aligned pass, and IMAP SASL passwords written to the log - plus the two issues reported by the community. The Control Panel's Ctrl+K palette now searches all 227 settings by label and INI key, and settings that were filed by how they are stored moved to the pages where they are used. See *6.2.14* below. It is validated by the full regression suite: **1026 of 1026 tests passing, zero failures, zero inconclusive** - the complete suite, with live SpamAssassin and ClamAV (real EICAR detection), DMARC evaluation against live DNS, and TLS 1.2/1.3 handshakes end to end. Every test runs; nothing is skipped. The bundled administration GUI is the modern .NET 8 **Control Panel**.
 
 What's new in 6.0
 =================
@@ -83,6 +83,64 @@ change until the new settings are turned on.
 
    * SPDX + CycloneDX SBOMs (Syft) attached to every release, Dependabot CVE alerts + grouped update PRs, and a dependency-review PR gate.
 
+6.2.14
+======
+
+A correctness and usability release. Two community reports are fixed, an adversarial audit of the server found and fixed **21 defects** — several of which could lose or corrupt mail — and the Control Panel now lets you search for a setting instead of guessing which page it is on. No database change (schema version 6005).
+
+Validated by the full regression suite: **1026 of 1026 passing, zero failures**, against the rebuilt 6.2.14 service.
+
+## Reported by the community
+
+- **Backup would not start** (#19). The Control Panel called a method that does not exist on the backup settings interface, so *Save settings* and *Start backup now* both failed with `'System.__ComObject' does not contain a definition for 'Save'`. The settings were in fact being saved; only the start was blocked. Every other late-bound call in the Control Panel was audited against the server's interface definitions at the same time.
+- **"Setting for days to keep logs"** (#16) already existed but was effectively unfindable. It — and the rest of the logging settings — now live together on the **Logging** page (see *Finding settings* below).
+
+## Mail loss, corruption and crashes
+
+- **Failed message copies crashed delivery.** When a message file could not be copied (full volume, file locked by antivirus or backup), local delivery, forwarding, Sieve redirect and mirroring dereferenced a null handle. The delivery task died and left the message locked in the queue, where it failed again on every restart.
+- **IMAP APPEND reported success for messages that were never written.** A full disk or a locked file produced `OK [APPENDUID …]`, so Sent Items copies, drafts and migration uploads were lost while the client showed them as saved. APPEND now fails cleanly and removes the partial file.
+- **Every string SQL parameter on MS SQL and SQL CE was bound from freed memory.** The value was built from a temporary that was destroyed before the parameter was used — undefined behaviour on the default database backend, on every query carrying a string.
+- **A failed database transaction start leaked its pooled connection.** After a few occurrences the pool was exhausted and every SMTP, IMAP and POP3 operation blocked until the service was restarted.
+- **A failed IMAP folder insert was reported as success**, caching a folder with no database row; messages filed into it were written to disk with nothing to find them by.
+- **IMAP CLOSE expunged without telling other sessions**, so a phone and a desktop on the same mailbox drifted out of step and the second client could act on the wrong message.
+- **A POP3 session that was refused the mailbox lock still released it on disconnect**, handing away the owning session's lock and letting two clients download concurrently.
+- **POP3 RETR and TOP ignored the result of opening the message file**, so an unreadable message dropped the connection with no response and wrote a minidump. Both now answer `-ERR`, and TOP recreates a missing file the way RETR already did.
+- **The message cache size accounting was inverted**, so the 512 MB cap never applied as intended; the accumulated size is also reset when the cache is cleared.
+
+## Security
+
+- **DKIM test mode (`t=y`) turned a failed signature into a pass**, which then satisfied DMARC alignment — so mail forging a domain whose key record still carried the rollout flag was accepted rather than rejected. A failure in test mode is now reported as *neutral*, per RFC 6376.
+- **IMAP SASL credentials were written to the log.** With IMAP logging enabled, `AUTHENTICATE PLAIN` passwords and XOAUTH2/OAUTHBEARER tokens were recorded verbatim; POP3 and SMTP already masked them.
+- **Only the first DKIM key record at a selector was examined**, so while a sender rotated its key roughly half of its mail failed verification and lost DMARC alignment — rejecting legitimate mail.
+- **MTA-STS enforcement and MX failover were lost for large recipient sets.** Recipients past the first batch reused mutated delivery state, so the policy of an MX host was looked up instead of the recipient domain's, and a STARTTLS fallback on one host could carry to the next.
+- The REST administration API now bounds how long one request may take to arrive, so a slow client cannot occupy the worker thread (or delay shutdown), and a rejected administrator credential is logged.
+- `ES256` OAuth2 tokens are now rejected with a clear message. The implementation fed a raw JWS signature to a verifier expecting DER, so it could never succeed; saying so beats a phantom "signature verification failed". `RS256` and `HS256` are unaffected.
+
+## Protocol correctness
+
+- IMAP `RENAME` no longer lets a folder become its own parent when the hierarchy delimiter is not `.` — which made the folder and its mail disappear from `LIST`.
+- `SELECT`/`EXAMINE` report a message sequence number in `[UNSEEN]`, as RFC 3501 requires, instead of a UID; clients that jump to the first unseen message no longer land on nothing.
+- Expunged and moved messages are removed from the session's `\Recent` set, so `RECENT` no longer claims new mail that no longer exists.
+- A `BODY.PEEK` item no longer cancels the `\Seen` update requested by another item in the same `FETCH`.
+- POP3 answers `-ERR` (not the invalid `+ERR`) when the mailbox cannot be opened, which some clients read as success.
+- Reverse-DNS lookups for the `Received` header now run on their own thread pool, so a burst of connections from addresses with unresponsive reverse DNS cannot delay message acknowledgements. This completes the fix that landed in 6.2.13.
+
+## Finding settings
+
+Settings had accumulated on whichever page matched how they were *stored* rather than what they *do*, so several real features looked missing. That is fixed in two ways.
+
+- **The command palette (Ctrl+K) now searches settings, not just pages.** Type `delete logs`, `log level` or an INI key such as `LogDeleteDays` and you get the setting and the page that owns it. All 227 settings are indexed by label and key; the index is generated from the pages themselves and a test fails the build if it ever falls behind.
+- **Settings moved to where they are used.** Log level, maximum line length, per-service log files and JSON logging joined retention on **Logging**. SpamAssassin and ClamAV timeouts moved onto their own scanner tabs. Search-indexer cadence moved to **Performance → Indexing**. Retry cadence, queue jitter and the per-destination outbound throttle moved to **Delivery of e-mail** — the quick-retry setting silently overrides the retry interval shown there, so the two now sit together.
+- **"Advanced hardening" is now "Advanced INI settings"** and sits under Maintenance. Only four of its cards were security-related; the rest were operational settings that admins were not opening a page marked "change these only with a specific reason" to find.
+- Signposts were added where a setting correctly stays put but is easy to miss: ManageSieve and OAuth2 from the Protocols page, MTA-STS *publishing* from the MTA-STS card, SRS/BATV from Delivery, and the message-store consistency scan from Diagnostics.
+
+## Also
+
+- Multiple smart hosts are documented at last: put several hosts in the relayer field separated by `|` and delivery fails over to the next when one cannot be reached. This has always worked; nothing said so.
+- A domain's size was calculated from the wrong column on MS SQL, SQL CE and PostgreSQL.
+- The account cache is now cleared when the server stops, so edits made to the database while it is stopped are no longer ignored.
+- `TCP_NODELAY` is set on every connection, and an SNI failure now reports the SNI error rather than a stale success code.
+
 6.2.13
 ======
 
 
@@ -0,0 +1,94 @@
+# Regenerates the Control Panel's settings search index.
+#
+# The Ctrl+K palette searches page names AND individual settings, so an
+# administrator can type "log level" or "LogDeleteDays" and be taken to the page
+# that owns it, wherever that page happens to live. The index is generated from
+# the page definitions themselves so it cannot drift; ControlPanel.Tests fails
+# if the checked-in file no longer matches the sources.
+#
+# Usage:  ./build/generate-settings-index.ps1
+#
+# Run it after adding, removing or relabelling any setting.
+
+$ErrorActionPreference = 'Stop'
+
+$repoRoot = (Get-Item $PSScriptRoot).Parent.FullName
+$cpRoot = Join-Path $repoRoot 'hmailserver\source\Tools\ControlPanel'
+$featurePath = Join-Path $cpRoot 'Views\FeatureSettingsView.xaml.cs'
+$serverPath = Join-Path $cpRoot 'Views\ServerSettingsView.xaml.cs'
+$outputPath = Join-Path $cpRoot 'Services\SettingsSearchIndex.g.cs'
+
+# Section -> nav page key, matching MainWindow's page factories.
+$featurePages = @{ 'Security' = 'security'; 'Automation' = 'acme'; 'Integration' = 'api'; 'Hardening' = 'hardening' }
+$serverPages = @{ 'Protocols' = 'protocols'; 'Delivery' = 'delivery'; 'AntiSpam' = 'antispam'; 'AntiVirus' = 'antivirus';
+                  'Tls' = 'tls'; 'Logging' = 'logging'; 'Performance' = 'performance'; 'Advanced' = 'advanced' }
+
+function Add-Entry($list, $label, $key, $page) {
+   $label = $label.Trim()
+   if ([string]::IsNullOrWhiteSpace($label)) { return }
+   $list.Add([PSCustomObject]@{ Label = $label; Key = $key; Page = $page }) | Out-Null
+}
+
+$entries = New-Object System.Collections.ArrayList
+
+# --- INI-backed pages (FeatureSettingsView): "case Section.X:" blocks ---
+$featureText = Get-Content $featurePath -Raw
+$featureParts = [regex]::Split($featureText, 'case Section\.(\w+):')
+for ($i = 1; $i -lt $featureParts.Count; $i += 2) {
+   $section = $featureParts[$i]
+   $body = $featureParts[$i + 1]
+   $page = $featurePages[$section]
+   if (-not $page) { continue }
+
+   foreach ($m in [regex]::Matches($body, 'Key = "([^"]+)"[^}]*?Label = "([^"]*)"')) {
+      Add-Entry $entries $m.Groups[2].Value $m.Groups[1].Value $page
+   }
+}
+
+# --- COM-backed pages (ServerSettingsView): "private void Build<Section>()" ---
+$serverText = Get-Content $serverPath -Raw
+foreach ($m in [regex]::Matches($serverText, '(?s)private void Build(\w+)\(\)\s*\{(.*?)\n      \}')) {
+   $section = $m.Groups[1].Value
+   $body = $m.Groups[2].Value
+   $page = $serverPages[$section]
+   if (-not $page) { continue }
+
+   foreach ($s in [regex]::Matches($body, 'Path = "([^"]+)",\s*Label = "([^"]*)"')) {
+      Add-Entry $entries $s.Groups[2].Value $s.Groups[1].Value $page
+   }
+   foreach ($s in [regex]::Matches($body, 'Label = "([^"]*)",\s*Path = "([^"]+)"')) {
+      Add-Entry $entries $s.Groups[1].Value $s.Groups[2].Value $page
+   }
+}
+
+# Stable order so regeneration produces no spurious diffs.
+$sorted = $entries | Sort-Object Page, Label, Key -Unique
+
+$sb = New-Object System.Text.StringBuilder
+[void]$sb.AppendLine('// <auto-generated>')
+[void]$sb.AppendLine('//     Generated by build/generate-settings-index.ps1 from the settings page')
+[void]$sb.AppendLine('//     definitions. Do not edit by hand - re-run the script instead.')
+[void]$sb.AppendLine('// </auto-generated>')
+[void]$sb.AppendLine()
+[void]$sb.AppendLine('namespace hMailServer.ControlPanel.Services')
+[void]$sb.AppendLine('{')
+[void]$sb.AppendLine('   public static partial class SettingsSearchIndex')
+[void]$sb.AppendLine('   {')
+[void]$sb.AppendLine('      /// <summary>Every setting on the settings pages: label, INI key or COM path, and the nav page that owns it.</summary>')
+[void]$sb.AppendLine('      public static readonly SettingEntry[] Entries =')
+[void]$sb.AppendLine('      {')
+
+foreach ($e in $sorted) {
+   # The captured text comes straight out of a C# string literal, so it is
+   # already escaped; re-escaping it here would double the backslashes.
+   [void]$sb.AppendLine("         new SettingEntry(`"$($e.Label)`", `"$($e.Key)`", `"$($e.Page)`"),")
+}
+
+[void]$sb.AppendLine('      };')
+[void]$sb.AppendLine('   }')
+[void]$sb.AppendLine('}')
+
+New-Item -ItemType Directory -Force -Path (Split-Path $outputPath) | Out-Null
+Set-Content -Path $outputPath -Value $sb.ToString() -Encoding UTF8 -NoNewline
+
+Write-Host "Wrote $($sorted.Count) settings to $outputPath"
@@ -1,7 +1,7 @@
 [Setup]
-OutputBaseFilename=hMailServer-6.2.13-x64
-AppVerName=hMailServer 6.2.13-x64
+OutputBaseFilename=hMailServer-6.2.14-x64
+AppVerName=hMailServer 6.2.14-x64
 ArchitecturesInstallIn64BitMode=x64
 ArchitecturesAllowed=x64
-AppVersion=6.2.13
-VersionInfoVersion=6.2.13.0
+AppVersion=6.2.14
+VersionInfoVersion=6.2.14.0
@@ -427,7 +427,12 @@ namespace HM
       if (!ValidateBodyHash_(fileName, signatureParams, bodyCanonicalization))
       {
          LOG_DEBUG("DKIM: Validation of body hash failed.");
-         return testMode ? Pass : PermFail;
+
+         // RFC 6376 3.6.1: t=y means the verifier must not treat a failure as a
+         // failure - it does NOT mean the signature verified. Returning Pass here
+         // granted DMARC alignment to mail whose signature was invalid, so a
+         // domain that left the test flag in its key record could be spoofed.
+         return testMode ? Neutral : PermFail;
       }
 
       AnsiString tagH = signatureParams.GetValue("h");
@@ -452,7 +457,12 @@ namespace HM
 
       Result result = VerifyHeaderHash_(canonicalizedHeader, tagA, tagB, publicKeyString);
 
-      return testMode ? Pass : result;
+      // In test mode a failure is downgraded to "no assertion" rather than being
+      // reported as a successful verification (see the body-hash case above).
+      if (testMode && result != Pass)
+         return Neutral;
+
+      return result;
    }
 
    DKIM::Result
@@ -717,12 +727,31 @@ namespace HM
                        JyM2IRZ8qSOCeQscnre5iVjwIDAQAB;
       */
 
-      AnsiString result = results[0];
-
+      // A selector can legitimately hold more than one TXT record - most often
+      // while a sender rotates its key. Inspecting only the first meant roughly
+      // half of that sender's mail failed verification (and lost DMARC
+      // alignment) until the rotation completed, so try each record and use the
+      // first one that is usable for this signature.
       DKIMParameters dnsKeyParams;
-      dnsKeyParams.Load(result);
+      bool foundUsableKey = false;
+
+      for (const AnsiString &result : results)
+      {
+         // A fresh instance per record: Load merges into the existing values
+         // rather than replacing them, so reusing one object would blend the
+         // tags of several records together.
+         DKIMParameters candidateParams;
+         candidateParams.Load(result);
+
+         if (!ValidateDNSEntry_(candidateParams, signatureParams))
+            continue;
+
+         dnsKeyParams = candidateParams;
+         foundUsableKey = true;
+         break;
+      }
 
-      if (!ValidateDNSEntry_(dnsKeyParams, signatureParams))
+      if (!foundUsableKey)
       {
          LOG_DEBUG("DKIM: Error when retrieving public key. Validation of DNS entry failed.");
          return PermFail;
 
@@ -74,6 +74,7 @@ namespace HM
       server_work_queue_("Server queue"),
       maintenance_queue_("Maintenance queue"),
       asynchronous_tasks_queue_("Asynchronous task queue"),
+      name_lookup_queue_("Name lookup queue"),
       unique_id_(0)
    {
       version_ = Formatter::Format("{0}-B{1}", HMAILSERVER_VERSION, HMAILSERVER_BUILD);
@@ -154,9 +155,17 @@ namespace HM
       LOG_DEBUG("Application::InitInstance - Configuration loaded.");
 
       // Start an asynch workqueue which processes asynchronous tasks from clients.
-      WorkQueueManager::Instance()->CreateWorkQueue(Configuration::Instance()->GetAsynchronousThreads(), 
+      WorkQueueManager::Instance()->CreateWorkQueue(Configuration::Instance()->GetAsynchronousThreads(),
                                                     asynchronous_tasks_queue_);
 
+      // Separate queue for blocking name lookups made on behalf of a live
+      // session. These can stall for seconds on an address whose reverse zone
+      // is unreachable, so they are kept off the asynchronous task queue that
+      // finalizes (and acknowledges) received messages. Saturating this queue
+      // only delays the lookups themselves, which degrade to "Unknown".
+      WorkQueueManager::Instance()->CreateWorkQueue(Configuration::Instance()->GetAsynchronousThreads(),
+                                                    name_lookup_queue_);
+
       return true;
    }
 
@@ -241,6 +250,8 @@ namespace HM
 
       WorkQueueManager::Instance()->RemoveQueue(asynchronous_tasks_queue_);
 
+      WorkQueueManager::Instance()->RemoveQueue(name_lookup_queue_);
+
       // Backup manager is created by initinstance so should be destroyed here.
       if (backup_manager_) 
          backup_manager_.reset();
@@ -666,6 +677,17 @@ namespace HM
       return pAsynchQueue;
    }
 
+   std::shared_ptr<WorkQueue>
+   Application::GetNameLookupWorkQueue()
+   {
+      std::shared_ptr<WorkQueue> pQueue = WorkQueueManager::Instance()->GetQueue(name_lookup_queue_);
+
+      if (!pQueue)
+         ErrorManager::Instance()->ReportError(ErrorManager::Medium, 5118, "Application::GetNameLookupWorkQueue()", "Name lookup work queue not available.");
+
+      return pQueue;
+   }
+
    int 
    Application::GetUniqueID()
    {