5 ms·

For anyone considering QMail today, don't. When QMail was initially conceived, Sendmail was king, and Sendmail was awful (from a security perspective). Today t

For anyone considering QMail today, don't. When QMail was initially conceived, Sendmail was king, and Sendmail was awful (from a security perspective). Today there are multiple very good alternatives to Sendmail (I've used Postfix for many years with no complaints), and QMail has seen very sparse development. While Postfix has a moderately less stellar security record, it's still pretty darned good, and still under active maintenance. Many modern mail security features are either hacked onto QMail via patches from third parties (none of whom are as famous for their security chops as djb) or completely non-existent in QMail. The number of people running it today is extremely small, so you're going to find relatively few resources about it when you run into problems (and what resources you find will be very, very, very old, in most cases). If you're wanting a similarly limited SMTP server that is under active maintenance, opensmtpd from the OpenBSD folks might be an option (though I've never used it). It, at least, has people looking at it regularly and supports basic features lacking in QMail, like encryption, without patches. QMail has a tiny but rabid following (kinda like djb himself) who settled into their beliefs about the MTA landscape in 1998 and have ignored everything that's happened since. (Funny, or maybe just odd, story: When we removed qmail-ldap, an unmaintained patched version of QMail that adds LDAP authentication, from Virtualmin, I literally had someone bringing up companies that have been out of business for more than a decade as proof that it was still in active use and we should keep maintaining support for it, even though no one has asked a question about it in our forums in eight years. It was the most bizarre technical conversation I've had in a while. I was like, "But, umm...they have no website and every mention I can find of that company is from 2006. What makes you think they're still using qmail-ldap or would care that we're removing support for it?" Then again, they also wanted to rant for a couple dozen paragraphs about gay people oppressing them in our issue tracker and for an hour or so in our IRC channel, so he may not have been entirely connected to our reality.)

KillerDiller 9y ago
As a hardcore qmail (and qmail-ldap) user back in the days, I can confirm that this is all accurate and correct.
- JdeBP 9y ago
  ... and yet writes netqmail entirely out of history. * http://netqmail.org http://netqmail.org.
  - SwellJoe 9y ago
    From the page you've linked: "Last modified: Wed Feb 2 23:37:31 EST 2005" What aspect of the existence of netqmail disputes what I wrote?
    - JdeBP 9y ago
      The onus is upon you to explain where you have accounted for the existence of netqmail in your narrative, from which it is otherwise conspicuous by its entire absence. You clearly went to its WWW site, but didn't even look at its changelog. Instead, you took the last modification date of the opening page of the WWW site itself and bizarrely tried to base some sort of argument, it is unclear what, upon that. When it comes to discussion of qmail and patches, netqmail is a fairly important part of the history. Hint: One of its co-authors literally wrote the book on qmail. (And indeed updated that book to describe netqmail.)
      - SwellJoe 9y ago
        20071130 version: netqmail 1.06 2007.
jlgaddis 9y ago
Yep, qmail was awesome back in the day -- especially all the virtual hosting stuff. It was used extensively at Yahoo! for quite a while with great success. I imagine they've probably long since moved on, though. WRT OpenSMTPD: I have used it and do use it on several machines, although just for locally generated mail (e.g. system e-mails to root) that I want delivered elsewhere. It's lightweight, easy as hell to configure, and just works(TM). Unless you're running a large mail environment or need lots of integrations with other software (e.g. SpamAssassin, OpenDKIM, etc.) it'll probably serve your needs quite well.
Rjevski 9y ago
+1 for OpenSMTPD.
lathiat 9y ago
I'm surprise how long qmail lasted but it definitely has issues (some of them with patches, the patches definitely have much more flimsy security and realistically you can't run it without many feature patches these days) I actually wrote a replacement for vpopmail called 'rmail' that stored the virtual user databases in cdb. I never liked requiring a central DB like MySQL for your mail receipt to work in real time in an otherwise relatively decentralised server protocol (despite literally working at MySQL for 9 years) and liked the idea of a file better. Powered 1000+ users for many many years. Now replaced with postfix for about 5 years :) Still, it definitely has a surprisingly solid place in my historic heart.
- SwellJoe 9y ago
  Postfix has always (or, at least, as long as I can remember) used something very similar to that idea for all of its various user, alias, virtual, etc. tables. It's mostly transparent to the user, but when you run postmap, you're creating a key/value database (for those who don't know, cdb was djb's efficient key/value database implementation way back when) of the things in the map file. It can even use cdb as a backend, but realistically for the kinds of map tables one works with in a mail server, any of them are Good Enough(tm) because the entire data set will always fit in memory (even if you have an absurdly large mail server with 100,000 mail users on a single system, it'll still fit in RAM). We used to get a lot of people wanting MySQL support in our mail stack, which I actively have always discouraged. It's (orders of magnitude) slower, harder to maintain, and provides no benefit for the vast majority of deployments. For whatever reason (maybe just that fewer people want to host their own mail beyond sending mail from apps and notifications from the system itself), we get a lot fewer requests for it lately. Maybe I finally convinced everyone it was a bad idea.
  - jlgaddis 9y ago
    I'm responsible for several mail servers and all are them are running postfix with the user data stored in SQL (including my own personal mail server). The primary reason is to simplify administration (management of user accounts and such, using various scripts and webapps).
js2 9y ago
I recently received via email an update for a patch I wrote for qmail over a decade ago. I'd forgotten I'd even written the patch and was shocked anyone was even still using qmail.
cperciva 9y ago
FWIW, I still use qmail. I wouldn't recommend it to someone who is setting up a new mail server -- then again, I generally wouldn't recommend that people set up mail servers -- but I've copied my setup from one system to another over the years and it's still working just fine.
- SwellJoe 9y ago
  I really hate that the general wisdom is, "don't run your own mail". Email is such a beautiful thing; anybody can talk directly to (almost) anybody else anywhere in the world, and it's been consistent and (mostly) compatible practically forever (much of what we call email was defined before it was even called "the internet"). And, that negative general wisdom is all because of abuse. Even if you figure out how to solve incoming spam, you might still have trouble sending mail to others because of their abuse prevention practices. But, it's really not as bad as the general wisdom would indicate. Even with the particularly severe challenges we deal with on behalf of our customers (we mostly interact with them while they're initially setting up a new server on an IP of indeterminate history), we almost always get things to a state where delivery is reliable. DKIM and SPF, while a little complicated, seem to be helping a lot...the big providers are seemingly relying less and less on IP address in determining spamminess and more on history of the sender. Anyway, I really hate that email is heavily consolidated into the hands of a very few very large corporations who have little respect for privacy. We still have some old-timers using QMail, and we keep supporting it in a sort of "we won't break it" way because we like our old-timers and they mostly take care of themselves and sometimes even submit patches. There's nothing really wrong with QMail. It's just quite dated in a number of areas. So, I don't mind supporting it. It's not bad software, it's just old software.
  - ktRolster 9y ago
    How do you deal with the spam issue?
    - gardnr 9y ago
      For sending or receiving?

KillerDiller 9y ago

As a hardcore qmail (and qmail-ldap) user back in the days, I can confirm that this is all accurate and correct.

JdeBP 9y ago
... and yet writes netqmail entirely out of history. * http://netqmail.org http://netqmail.org.
- SwellJoe 9y ago
  From the page you've linked: "Last modified: Wed Feb 2 23:37:31 EST 2005" What aspect of the existence of netqmail disputes what I wrote?
  - JdeBP 9y ago
    The onus is upon you to explain where you have accounted for the existence of netqmail in your narrative, from which it is otherwise conspicuous by its entire absence. You clearly went to its WWW site, but didn't even look at its changelog. Instead, you took the last modification date of the opening page of the WWW site itself and bizarrely tried to base some sort of argument, it is unclear what, upon that. When it comes to discussion of qmail and patches, netqmail is a fairly important part of the history. Hint: One of its co-authors literally wrote the book on qmail. (And indeed updated that book to describe netqmail.)
    - SwellJoe 9y ago
      20071130 version: netqmail 1.06 2007.

jlgaddis 9y ago

Yep, qmail was awesome back in the day -- especially all the virtual hosting stuff. It was used extensively at Yahoo! for quite a while with great success. I imagine they've probably long since moved on, though. WRT OpenSMTPD: I have used it and do use it on several machines, although just for locally generated mail (e.g. system e-mails to root) that I want delivered elsewhere. It's lightweight, easy as hell to configure, and just works(TM). Unless you're running a large mail environment or need lots of integrations with other software (e.g. SpamAssassin, OpenDKIM, etc.) it'll probably serve your needs quite well.

Rjevski 9y ago

+1 for OpenSMTPD.

lathiat 9y ago

I'm surprise how long qmail lasted but it definitely has issues (some of them with patches, the patches definitely have much more flimsy security and realistically you can't run it without many feature patches these days) I actually wrote a replacement for vpopmail called 'rmail' that stored the virtual user databases in cdb. I never liked requiring a central DB like MySQL for your mail receipt to work in real time in an otherwise relatively decentralised server protocol (despite literally working at MySQL for 9 years) and liked the idea of a file better. Powered 1000+ users for many many years. Now replaced with postfix for about 5 years :) Still, it definitely has a surprisingly solid place in my historic heart.

SwellJoe 9y ago
Postfix has always (or, at least, as long as I can remember) used something very similar to that idea for all of its various user, alias, virtual, etc. tables. It's mostly transparent to the user, but when you run postmap, you're creating a key/value database (for those who don't know, cdb was djb's efficient key/value database implementation way back when) of the things in the map file. It can even use cdb as a backend, but realistically for the kinds of map tables one works with in a mail server, any of them are Good Enough(tm) because the entire data set will always fit in memory (even if you have an absurdly large mail server with 100,000 mail users on a single system, it'll still fit in RAM). We used to get a lot of people wanting MySQL support in our mail stack, which I actively have always discouraged. It's (orders of magnitude) slower, harder to maintain, and provides no benefit for the vast majority of deployments. For whatever reason (maybe just that fewer people want to host their own mail beyond sending mail from apps and notifications from the system itself), we get a lot fewer requests for it lately. Maybe I finally convinced everyone it was a bad idea.
- jlgaddis 9y ago
  I'm responsible for several mail servers and all are them are running postfix with the user data stored in SQL (including my own personal mail server). The primary reason is to simplify administration (management of user accounts and such, using various scripts and webapps).

js2 9y ago

I recently received via email an update for a patch I wrote for qmail over a decade ago. I'd forgotten I'd even written the patch and was shocked anyone was even still using qmail.

cperciva 9y ago

FWIW, I still use qmail. I wouldn't recommend it to someone who is setting up a new mail server -- then again, I generally wouldn't recommend that people set up mail servers -- but I've copied my setup from one system to another over the years and it's still working just fine.

SwellJoe 9y ago
I really hate that the general wisdom is, "don't run your own mail". Email is such a beautiful thing; anybody can talk directly to (almost) anybody else anywhere in the world, and it's been consistent and (mostly) compatible practically forever (much of what we call email was defined before it was even called "the internet"). And, that negative general wisdom is all because of abuse. Even if you figure out how to solve incoming spam, you might still have trouble sending mail to others because of their abuse prevention practices. But, it's really not as bad as the general wisdom would indicate. Even with the particularly severe challenges we deal with on behalf of our customers (we mostly interact with them while they're initially setting up a new server on an IP of indeterminate history), we almost always get things to a state where delivery is reliable. DKIM and SPF, while a little complicated, seem to be helping a lot...the big providers are seemingly relying less and less on IP address in determining spamminess and more on history of the sender. Anyway, I really hate that email is heavily consolidated into the hands of a very few very large corporations who have little respect for privacy. We still have some old-timers using QMail, and we keep supporting it in a sort of "we won't break it" way because we like our old-timers and they mostly take care of themselves and sometimes even submit patches. There's nothing really wrong with QMail. It's just quite dated in a number of areas. So, I don't mind supporting it. It's not bad software, it's just old software.
- ktRolster 9y ago
  How do you deal with the spam issue?
  - gardnr 9y ago
    For sending or receiving?