qmail is a mail transfer agent (MTA) that runs on Unix. It was written, starting December 1995, by Daniel J. Bernstein as a more secure replacement for the popular Sendmail program. qmail's source code is in the public domain, making qmail free software.^[2]

Features[link]

Security[link]

When first published, qmail was the first security-aware mail transport agent; since then, other security-aware MTAs have been published. The most popular predecessor to qmail, Sendmail, was not designed with security as a goal, and as a result has been a perennial target for attackers. In contrast to sendmail, qmail has a modular architecture composed of mutually untrusting components; for instance, the SMTP listener component of qmail runs with different credentials than the queue manager, or the SMTP sender. qmail was also implemented with a security-aware replacement to the C standard library, and as a result has not been vulnerable to stack and heap overflows, format string attacks, or temporary file race conditions.

Performance[link]

When it was released, qmail was significantly faster than Sendmail, particularly for bulk mail tasks such as mailing list servers. qmail was originally designed as a way for managing large mailing lists

Simplicity[link]

Sendmail configuration is complex. For common configurations, qmail is significantly easier to configure and deploy.

Innovations[link]

qmail encourages the use of several innovations in mail (some originated by Bernstein, others not):

Maildir

Bernstein invented the Maildir format for qmail, which splits individual email messages into separate files. Unlike the de facto standard Mbox format, which stored all messages in a single file, Maildir avoids many locking and concurrency problems, and can safely be provisioned over NFS. qmail also delivers to Mbox mailboxes.

Wildcard mailboxes

qmail introduced the concept of user-controlled wildcards. Out of the box, mail addressed to "user-wildcard" on qmail hosts is delivered to separate mailboxes, allowing users to publish multiple mail addresses for mailing lists and spam management.

qmail also introduces the Quick Mail Transport Protocol (QMTP) and Quick Mail Queuing Protocol (QMQP) protocols.

Modularity[link]

Controversy[link]

qmail was designed as a pointed response to Sendmail, an extremely popular and somewhat beloved^{[citation needed]} piece of Unix software. Author Bernstein was not shy about pointing out the deficiencies in Sendmail's design and the superior characteristics of qmail, nor did he take pains to replicate Sendmail's behavior, which at the time was the de facto standard for Internet mail delivery. As a result, qmail came under unusually intense scrutiny.^{[citation needed]}

Security reward and Georgi Guninski's vulnerability[link]

Bernstein offered a US$500 reward for the first person to publish a verifiable security hole in the latest version of the software.^[3]

In 2005, security researcher Georgi Guninski found an integer overflow in qmail. On 64-bit platforms, in default configurations with sufficient virtual memory, the delivery of huge amounts of data to certain qmail components may allow remote code execution. Bernstein disputes that this is a practical attack, arguing that no real-world deployment of qmail would be susceptible. Configuration of resource limits for qmail components mitigates the vulnerability.^[4]

On November 1, 2007, Bernstein raised the reward to US$1000.^[1] At a slide presentation the following day, Bernstein stated that there were 4 "known bugs" in the ten year old qmail-1.03, none of which were "security holes." He characterized the bug found by Guninski as a "potential overflow of an unchecked counter." "Fortunately, counter growth was limited by memory and thus by configuration, but this was pure luck."^[5]

Frequency of updates[link]

The core qmail package has not been updated for many years.^[6] New features are provided by third party patches, such as net-qmail. This is a benefit for some users, from not needing to apply patches continuously, and a liability for other users, particularly those who rely on authentication mechanisms that post-date qmail.

Standards compliance[link]

qmail was not designed to replace Sendmail, and does not behave exactly as Sendmail did in all situations. In some cases, these differences in behavior have become grounds for criticism. For instance, qmail's approach to bounce messages (a format called QSBMF) differs from the standard format of delivery status notifications specified by the IETF in RFC 1894, meanwhile advanced to draft standard as RFC 3464, and recommended in the SMTP specification.

Furthermore, some qmail features have been criticized for introducing mail forwarding complications; for instance, qmail's "wildcard" delivery mechanism and security design prevents it from rejecting messages to nonexistent senders during SMTP transactions. In the past, these differences may have made qmail behave differently when abused as a spam relay, though modern spam delivery techniques are less influenced by bounce behavior.

Copyright status[link]

Prior to 1994, Qmail was the outbound message processor for PCBoard BBS systems. Versions 1 through 3 were written by Mark (Sparky) Herring, and version 4 was written by Michael Leavitt. Neither Herring or Leavitt claim a trademark on the name and only wish that there be no confusion between their Qmail software and this product which came later.

qmail was released to the public domain in November 2007.^[7] Until November 2007, qmail was license-free software, with permission granted for distribution in source form or in pre-compiled form (a "var-qmail package") only if certain restrictions (primarily involving compatibility) were met. This unusual licencing arrangement made qmail non-free according to some guidelines (such as the DFSG), and was a cause of controversy.

qmail is the only broadly deployed MTA in the public domain.

See also[link]

Free software portal

• qpsmtpd
• djbdns
• List of mail servers
• Comparison of mail servers

References[link]

1. ^ ^{a b} "Some thoughts on security after ten years of qmail 1.0". http://cr.yp.to/qmail/qmailsec-20071101.pdf. Retrieved 2007-12-01. 
2. ^ "Information for distributors". http://cr.yp.to/qmail/dist.html. "I hereby place the qmail package (in particular, qmail-1.03.tar.gz, with MD5 checksum 622f65f982e380dbe86e6574f3abcb7c) into the public domain. You are free to modify the package, distribute modified versions, etc." 
3. ^ "The qmail security guarantee". http://cr.yp.to/qmail/guarantee.html. Retrieved 2007-10-05. 
4. ^ Georgi Guninski. "Georgi Guninski security advisory #74, 2005". http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html. Retrieved 2007-10-05. 
5. ^ "Some thoughts on security after ten years of qmail 1.0 [Slide presentation"]. http://cr.yp.to/talks/2007.11.02/slides.pdf. Retrieved 2008-01-17. 
6. ^ "Life with qmail; History". http://www.lifewithqmail.org/lwq.html#history. Retrieved 2007-12-01. 
7. ^ "Bernstein releases code into the public domain". http://video.google.com/videoplay?docid=-3147768955127254412&q=%22Bernstein+releases+code+to+public+domain%22&total=1&start=0&num=10&so=0&type=search&plindex=0. Retrieved 2007-11-30. 

External links[link]

• Official qmail website, maintained by the author.
• qmail.org A reference site for qmail users, including patches and addons, maintained by Russ Nelson
• qmail-LDAP-UI - qmail-LDAP-UI is a Web based User Administration tool
• Qmailtoaster - Distributes RPM files for appropriate distros to install Qmail quickly and easily. Has a wiki and mailing list.
• pkgsrc qmail and qmail-run, a pair of easy-to-install cross-platform qmail source packages included in pkgsrc
• The qmail section of FAQTS, an extensive knowledgebase built by qmail users
• qmailWiki is a relatively new wiki about qmail, hosted by Inter7
• J.M.Simpson qmail site Useful Information about qmail, including explanations and patches, by John M. Simpson (Updated regularly)
• Unofficial qmail Bug and Wishlist
• Qmail queue messages deliver (PHP)
• qmail-distributions - qmail patches combined into easy to use distributions
• IndiMail - A Modern, Modular Mailserver using qmail as MTA. Provides multiple missing features not found in qmail
• Roberto's qmail notes - An English/Italian howto on qmail and related software. A big patch is included. Updated regularly.