s/qmail (pronounced skew-mail) is a Mail Transfer Agent (MTA) based on Qmail suited for high-speed and confidential email transport over IPv4 and IPv6 networks.
s/qmail preserves the Qmail ecosystem
and ought to be a drop-in replacement for most sites.
s/qmail's mascot is the phoenix (SQRP).
Looking for ...
- my old qmail support page,
- Spamcontrol's page,
- my Newanalyse page,
- my QMVC page,
- my Qmail book page?
While Qmail provides the framework for a distributed MTA, my own developments and extensions for Qmail (e.g. SMTP Authentication, Spamcontrol) are considered necessary protocol extensions. s/qmail is a complete refactoring of the source code according to current demands for 64-bit systems and including IPv6 capabilities.
After now 20 years of Qmail's superior and uncompromised email delivery (since Qmail 1.01 launch in April 1997), s/qmail posses most of the 'future' Qmail features Dan Bernstein was heading for (see also: Qmail TODO).
- s/qmail is available in Dan Bernstein's /package format, usually invoked by Daemontools.
- s/qmail provides TLS support based on the ucspi-ssl package.
- SMTP Authentication, Anti-Spam, and Anti-Virus features are supported out-of-the-box.
- Recipient and MAV capabilities in addition with powerful filters for SMTP envelope addresses.
- Scalable and reliable mail delivery is guaranteed by means of QMQ.
- Native IPv6 support for all communication modules.
The s/qmail 'universe' can be depict from here:
- s/qmail uses D. J. Bernstein's 'C' coding principles entirely.
- Full IPv6 compliance: Allow specific IPv6 bindings to any IPv6 address (even LLU) for all servers and clients (qmail-smtpd, qmail-qmqtpd; qmail-remote, qmail-smtpam, qmail-qmqpc).
- Unlike the original version, qmail-remote works multi-tenant, thus supporting different domains and senders with particular sending attributes (e.g. IP addresses, authentication, certificates) as well as providing particular bounce delivery, together with QMTP and QMTPS client capabilities.
- Distributed queueing: n:1, 1:n n:m with qualified authentication and authorization (enhanced 'QMQ').
- TLS enabling of most servers and particular clients for SMTP and QMTP as well as POP3.
- LibreSSL and OpenSSL (1.1) and comes with ucspi-ssl (0.99) .
- s/qmail allows 'opportunistic' as well as mandatory TLS encryption together with easy X.509 certificate pinning.
- Compliance with John Levin's RFC 7505.
- SPF capabilities have been added for qmail-smtpd based on Jana Saout's development (used by permission); of course with full IPv6 support.
- SMPTUTF8 [RFC 6532] together with International Domain Names (aka E-mail Address Internationalisation -- EAI ) is now supported by s/qmail provided the libidn2 is available.
Note: DKIM is still under investigation.
The Quick Mail Transport Protocol QMTP is an invention of Dan Bernstein and is a simple but fast host-to-host transparent email transport protocol, with very little protocol overhead. It has been adopted by Postfix as well. Also a Net-QMTP Perl module is available.
s/qmail provides additionally the TLS-secured protocol QMTPS
to couple several s/qmail instances and distributed queues among different nodes.
IANA has now assigned port 6209 for QMTPS.
Based on SMTP but rather preferably QMTP(S) or QMQP, s/qmail can be instructed to work in a distributed queue environment, typically given in case of a Cloud service. Authentication among the nodes and encryption on the links can be guaranteed using QMTPS. This feature is called enhanced 'Qmail Multiple Queues' (QMQ).
It's light-weight design allows to deploy s/qmail nodes rapidly in a Cloud based service domain.
The basic s/qmail installation includes the following packages (adapted mostly from Dan Bernstein):
- A versatile, CRAM enabled checkpassword compatible authentication PAM called qmail-authuser.
- The fastforward package is part of s/qmail.
- Including the qmailanalog package suited for s/qmail together with tai64nfrac.
- Additional qmail-mrtg frontend evaluating TAI64N timestamps in s/qmail's logs (and replacing my previous version of qmail-mrtg) for Tobias Oetiker's MRTG. A working sample can be found for this site.
s/qmail provides full support for the following vanilla Qmail add-ons unaltered:
- Inter7's vpopmail
- Bruce Guenter's VMailMgr
- Dan Bernstein's ezmlm
- Fred Lindbergs' and Bruce Guenter's's ezmlm-idx
- Andreas Aardal Hanssen's IMAP server BINC
- Timo Sirainen's Dovecot (LDA)
Note 1: For those packages TLS encryption and
IPv6 capabilities for any data-in-flight is possible with s/qmail.
Note 2: s/qmail Recipients extension is capable to understand
ezmlm's VERP addresses.
Note 3: Authentication and recipient verification for virtual users is provided
out-of-the-box for vpopmail
and VMailMgr as well.
Note 4: Dovecot can be used as Identity Provider proxy even for qmail-smtpd by means of the enhanced qmail-authuser calling doveadm to test a specific socket connection.
My s/qmail extensions will work natively with Qmail:
- Newanalyse 2.x ist tailored for s/qmail
- QMVC -- is working but the latetest release (in particular recognizing IPv6 addresses) is under way.
The installation of s/qmail tries to conform to existing Qmail systems as well as to provide a pre-configured and working MTA together with an easy update scheme:
- Easy installation and maintenance by means of slashpackage.
- Compliance with AMD64 architecture and current 'C' standards.
- Drop-in replacement for Qmail (same interface; same API), same user accounts; same module names.
- Ready-to-use integration into Daemontools.
- systemd support should be possible without headache (except for logging).
For installation, s/qmail requires a development environment and additionally the OpenSSL development libraries (in particular on Linux).
In particular, the following packages are recommended:
- Mandatory: ucspi-ssl: Additional TLS libraries.
- Optional: ucspi-tcp6: cdb generation, module rblsmtpd.
- Optional: daemontools: providing supervise and TAI64N timestamps by multilog.
- Attention: In order to include EIA/UTF8 support, you need to install the libidn2 together with the header file <idn2.h>.
s/qmail uses D.J.B's slashpackage convention for installing while trying to keep the standard Qmail installation essentially unaltered:
- Daemontools is installed and /service is working.
- ucspi-ssl is installed in default location.
- ucspi-tcp6 is installed.
- Untar the s/qmail tar file under '/package'
- Move to /package/mail/sqmail/sqmail-V.R.F and
- do an initial: package/install.
Note: The package/install step respects your current Qmail settings.
s/qmail will preserve your current qmail installation entirely under the following circumstances:
- Install ucspi-ssl-XX and ucspi-tcp6-XX under /package.
- Untar s/qmail under /package and change to the install directory.
- Check and adjust the following conf-XX files (see below) to your
existing qmail installation:
conf-break, conf-cc, conf-ld, conf-home, and conf-split (the rest may stay unaltered).
- ./compile/ipmeprint (you see the additional IPv6 addresses)
The basic s/qmail configuration is done by means of conf-XX files (in alphabetic order):
- conf-break -- the character for VERP addresses [-]
- conf-cc -- compiler (no change required)
- conf-delivery -- qmail-start default-delivery
- conf-djbdns -- DJBNDS libs (not supported yet)
- conf-groups*) -- s/qmail groups
- conf-home -- home dir of s/qmail [/var/qmail]
- conf-idn2 -- customization path for IDN2 libraries
- conf-ids*) -- Unix ids for s/qmail
- conf-instances -- QMQ instances to be raised
- conf-ld -- loader options to be adjusted (for i386; AMD64 default)
- conf-log -- target dir of s/qmail logs [/var/log]
- conf-man -- target dir of man pages, usually automatically recognized
- conf-patrn -- s/qmail paternalism 
- conf-qmq -- QMQ environment settings
- conf-spawn -- silent concurrency limit 
- conf-split -- depth of s/qmail dirs 
- conf-svcdir -- supervise's directory [/service]
- conf-ucspissl -- path to UCSPI-SSL dirs
- conf-users*) -- user names
*) These files are coupled and need to be adjusted as one entity!
For an individual step-by-step installation the following commands can be executed:
- package/dir -- sets up the directories
- package/ids -- sets up the s/qmail users
- package/ucspissl -- hooks up the required sources and libs with package ucspi-ssl
- package/compile -- compiles the sources
- package/upgrade -- potentially does the upgrade
- package/legacy -- installs the binaries in the qmail directory
- package/man -- installes the man pages
- package/control -- populates the mininmal required control files for running
- package/sslenv -- sets up the SSL/TLS environments together with X.509 certs and key files (from ucspi-ssl)
- package/service -- sets up the run script for daemontools' /service and additionally the logging
- package/scripts setup optional, undocumented and unmaintained scripts
- package/run -- touches qmail/alias/ files, sets default-delivery, and enables s/qmail's sendmail module
A concise documentation for s/qmail is under construction. However, some survival information can be found here:
- A 's/qmail Big Picture' is now available providing the default settings (run scripts) for most services.
- You may want to check the README and brief INSTALL documentation first.
- The 'official' s/qmail documentation is in progress.
- The set of man-pages coming along with s/qmail have been converted into HTML and are accessible here.
- The standard LWQ documentation for Qmail is mostly still valid; except for the installation procedure of s/qmail (and it's extensions of course).
Once you checked the s/qmail requirements and complied to those, you are ready to go for download and installation.
The current release(s) of s/qmail can be downloaded here:
|Version & Download||Description||Verification|
|sqmail-3.3.13||The fifth 3.3 release including A. Oppermann's EXTTODO extension together with (optional) SMTPUTF8/EAI/IDN2 support while featuring the new qmail-vmailuser and enhanced qmail-authuser PAM.|| MD5: fd219b1337cedf1d2c20775f3d253b13
|sqmail-3.2.19||The sixth (official) 'SPF' release; covering OpenBSD (6.0) and Debian 9 (Stretch) while providing additional Recipient PAMs for VMailMgr and vpopmail (together with ucspi-ssl-0.99).||MD5: 8a4fd942c1a1271619b0696d934c401a
|sqmail-3.1.9||This is the fourth update. This 'π5+' release enhances the qmail-authuser capabilities for virtual domain handlers.|| MD5: cb4da2ca52a05fda6668850c1d41359f
|sqmail-3.0.2||The third fully integrated release; don't use it/just for reference.||MD5: 4045d0a85fe4857fcf9c118fcfa13d1f|
Note: The code of the current release can be viewed in a doxygen archive.
Hotfix: Please apply the fix [20170626#1/3.3.6] to versions prior of 3.3.
I also recommend to use
- Michel Bertram's qmHandle.
- Newanalyse 2.x which allows long-haul logging and easy finding of delivered mails from the logs.
- Tobias Oetiker's MRTG to visualize s/qmail's logs together with qmail-mrtg.
- Error: Implementation does not conform to reqs, e.g. something is missing.
- Bug: Coding mistake in source file(s).
- Flaw: Wrong/missing description in man-file or any attached documentation.
- RfC: Request for Change: Feature request.
- [20170427#1] Rfc: Add SRS capability to cope with certain SPF deficiencies for qmail-smtpd.
- [20170630#1] Rfc: Add flexible uid configuration.
- [20170817#1/3.3.13] Two small bugs (fixed) related to SMTPTUF8 in qmail-remote and a tiny one in qmail-smtpd, where the firsts may impact sending SMTPUTF8 mails.
- [20170813#1/3.3.12] Bug: qmail-remote does not evaluate control/tlsdestinations correctly for a given FQDN.
- [20170812#1/3.3.11] Error: qmail-smtpd rejects bounces, Out-of-office Replies, and Caller Verification with 'Mail From: <>' in case MFDNSCHECK is enabled (introduced in version s/qmail 3.2.19).
- [20170714#1/3.3.10] Error: Wrong call of qmail-authuser for Dovecot Auth.
- [20170630#1/3.3.6] Bug: Wrong parsing and display of (some) compactified IPv6 addresses.
- [20170626#1/3.3.6] Bug: qmail-remote TLS bug
and potential abend if tlsdestinations or domaincerts
includes a line like -: or *:.
Fix: Download and install tls_remote.c as replacement for all versions s/qmail < 3.3.
- [20170405#1/3.3.6] Rfc: Using Dovecot-auth as backend for qmail-smtpd authentication.
- [20170625#1/3.3.5] Bug: Wrong IP addresss display in qmail-remote log if lowest MX is IPv6 and connection is IPv4.
- [20170307#1/3.2.19] Bug: Wrong behavior of qmail-smtpd's badmailfrom due to wrong nesting.
- [20170224#1/3.2.18] (Error) Badmailfrom check in qmail-smtpd fails for 'extended' addresses.
- [20170109#1/any] OpenSSL 1.1 compatibility added with ucspi-ssl-0.99.
- [20161004#1/3.2.16] Recipient PAMs for vpopmail and vmailmgr included.
- [20161001#1/3.2.15] (OpenBSD) qmail-remote TLS abend resolved.
- [20161001#1/3.2.13] (OpenBSD) Segfault in fastforward solved.
- [20160712#1/3.1.9] Bug in qmail-send not releasing FDs for bounces, in case bouncemaxbytes is undefined/0.
- [20160615#1/3.1.8] Bug in qmail-smtpd not to return exceeding 'databyte' limits.
Client (eg. qmail-remote) might hang; thus never ending SMTP transaction.
- [20160527#1/3.1.7] RfC to cope with OpenBSD's missing 'pw' within package/ids.
- [20160514#2/3.1.7] Bug in qmail-smtpd's badmailfrom '?' evaluation (wrong RC).
- [20160514#1/3.1.7] Bug in qmail-smtpd's address parser; abending if 'Mail From: <.. @[...]>' (in particular double bounces).
- [20160414#1/3.1.6] RfC hook for File Descriptor > 1024.
- [20160428#1/3.0.4] Strict Auth error in qmail-smtpd.
- [20160131#1/3.0.1] Error in qmail-smtpd's RSET behaviour (RFC 5321).
- [20160110#1/3.0.0] Bug in some package/XX scripts due to missing 'eval' statement (i.e. sslenv).
- [20160108#1/3.0.0] Error in qmail-remote not recognizing 'fast' 5xy rejection issued upon SMTP greeting.
- [20160106#1/3.0.0] Bug in skeleton script run_qmqpd. Wrong binary referenced.
- [Since last public beta/2.6.06] Bug in qmail-tcpto displaying wrong information.
Bug in qmail-mrtg -2 shows only one output value (while MRTG expects two).
Note: The given release number following the defect number tells, in which version of s/qmail this change was applied.
s/qmail will be maintained and my release plan includes the following topics:
Version 3.0 is the first complete release(done).
- Version 3.1 will be used for additional enhancements (done).
- Version 3.2 includes SPF capabilities and LibreSSL as well OpenSSL 1.1 hooks have been added within ucspi-ssl 0.99 (done).
- Version 3.3 is scheduled for performance enhancements (EXTTODO; done).
- Version 3.4 is forseen for integrating DJBDNSCurve6 libs.
- Version 3.5 ... let's see: DANE support?
- Version 4.0 UUID identifier for files in the queue.
An EZMLM mailing list working together with s/qmail keeps you updated with current developments, bug fixes, and features discussed. This list also can be used to file
- Defects (bug reports) and
- Change Requests (enhancements).
To inscribe use: s/qmail mailing list
I can't guarantee a certain response level; but reasonable issues will be answered.