qmail

qmail is a

Features

This section does not cite any sources. Please help improve this section by adding citations to reliable sources. Unsourced material may be challenged and removed. (March 2015) (Learn how and when to remove this template message)

Security

When first published, qmail was the first security-aware mail transport agent; since then, other security-aware

qmail also introduces the Quick Mail Transport Protocol (QMTP), an e-mail transmission protocol that is designed to have better performance than Simple Mail Transfer Protocol (SMTP), the de facto standard;[4] and Quick Mail Queuing Protocol (QMQP), a network protocol designed to share e-mail queues between several hosts.^[5]

Modularity

qmail is nearly a completely modular system in which each major function is separated from the other major functions. It is easy to replace any part of the qmail system with a different module as long as the new module retains the same interface as the original.

Controversy

Security reward and Georgi Guninski's vulnerability

In 1997, Bernstein offered a US$500 reward for the first person to publish a verifiable

In 2005, security researcher Georgi Guninski found an integer overflow in qmail. On 64-bit platforms, in default configurations with sufficient virtual memory, the delivery of huge amounts of data to certain qmail components may allow remote code execution. Bernstein disputes that this is a practical attack, arguing that no real-world deployment of qmail would be susceptible. Configuration of resource limits for qmail components mitigates the vulnerability.^[7]

On November 1, 2007, Bernstein raised the reward to US$1000.^[1] At a slide presentation the following day, Bernstein stated that there were 4 "known bugs" in the ten-year-old qmail-1.03, none of which were "security holes". He characterized the bug found by Guninski as a "potential overflow of an unchecked counter". "Fortunately, counter growth was limited by memory and thus by configuration, but this was pure luck."^[8]

On May 19, 2020, a working exploit for Guninski's vulnerability was published by Qualys^[9] but exploit authors' state they were denied the reward because it contains additional environmental restrictions.

Frequency of updates

The core qmail package has not been updated for many years.^[10] New features were initially provided by third-party patches, from which the most important at the time were brought together in a single meta-patch called netqmail.^[11]

Standards compliance

qmail was not designed as a drop-in replacement for

Furthermore, some qmail features have been criticized for introducing mail forwarding complications; for instance, qmail's "wildcard" delivery mechanism and security design prevents it from rejecting messages from forged or nonexistent senders during SMTP transactions.[14] In the past, these differences may have made qmail behave differently when abused as a spam relay, though modern spam delivery techniques are less influenced by bounce behavior.

Copyright status

qmail was released to the

qmail is the only broadly deployed

• qpsmtpd
• djbdns
• List of mail servers
• Comparison of mail servers

References