6 ms·

I recently had the pleasure of migrating a legacy server 2008 app to a brand new server 2022 box. One of the requirements is a local smtp server for sending mai

I recently had the pleasure of migrating a legacy server 2008 app to a brand new server 2022 box. One of the requirements is a local smtp server for sending mail so I looked up how to do this in windows. To my shock and horror, smtp service has been deprecated since server 2012, you can still install it but it comes with an extremely old version of IIS as a dependency and it’s broken out of the box. To get it working you have to dig into some xml files and add parameters. I really wonder how anyone can take a server OS seriously that doesn’t have out of the box first class functionality for smtp, one of the most ubiquitous protocols on the internet.

nextaccountic 3y ago
why do you need a smtp server developed by microsoft? isn't windows compatible with a multitude of open source smtp servers?
- SteveNuts 3y ago
  You don’t, but why ship broken features at all? If I can install something from the OS it shouldn’t come broken and insecure. It just feels like such a strange platform to build a server on to me.
  - mixmastamyk 3y ago
    I’m as disappointed with Windows as anyone, but didn’t you just write it was deprecated? Email use itself is waning and has never had privacy as a guaranteed feature.
  - jimmaswell 3y ago
    They shipped it marked as deprecated to support people already using it, but to discourage new use. You can't really complain after ignoring that warning.
    - SteveNuts 3y ago
      There's no indication it's deprecated, it'll let you install it in its broken state with no warning.
      - jeroenhd 3y ago
        > There's no indication it's deprecated The "Features Removed or Deprecated in Windows Server 2012" page has mentioned SMTP since the OS was still called "Windows 8 server": https://web.archive.org/web/20120517025232/http://technet.microsoft.com/en-us/library/hh831568 https://web.archive.org/web/20120517025232/http://technet.mi... I suppose you could've missed this if you moved directly from WS2008 to WS2022, but I don't know any OS that publishes "things we have removed or deprecated in the last three versions", it's usually just "what changed from the previous version to the current one".
GSGBen 3y ago
hmailserver is the replacement you want for this.
- SteveNuts 3y ago
  This is the way I ended up going and it worked great.
- mycall 3y ago
  It is no longer under development.
  - wruza 3y ago
    That happens when you finish your roadmap and call it done. It’s frustrating that the modern sense of it became automatically negative. This is an actual claim if someone is interested: https://www.hmailserver.com/state https://www.hmailserver.com/state On SHA-1: https://en.wikipedia.org/wiki/SHA-1 https://en.wikipedia.org/wiki/SHA-1 As of 2020, chosen-prefix attacks against SHA-1 are practical.[6][8] As such, it is recommended to remove SHA-1 from products as soon as possible and instead use SHA-2 or SHA-3. Replacing SHA-1 is urgent where it is used for digital signatures. Digging further: https://www.hmailserver.com/forum/viewtopic.php?t=40568 https://www.hmailserver.com/forum/viewtopic.php?t=40568 Tl;dr: it uses sha256 by default and only has sha1 for backwards compatibility, which is considered insecure today. Critical updates are still there.
    - mycall 3y ago
      hmailserver needs openssl version bumps from time to time.
liquidpele 3y ago
why the hell do you think that Microsoft would want you to use your basic SMTP server when they want you to use an exchange server? Of course they deprecated that. If you’re using windows then use their ecosystem.

nextaccountic 3y ago

why do you need a smtp server developed by microsoft? isn't windows compatible with a multitude of open source smtp servers?

SteveNuts 3y ago
You don’t, but why ship broken features at all? If I can install something from the OS it shouldn’t come broken and insecure. It just feels like such a strange platform to build a server on to me.
- mixmastamyk 3y ago
  I’m as disappointed with Windows as anyone, but didn’t you just write it was deprecated? Email use itself is waning and has never had privacy as a guaranteed feature.
- jimmaswell 3y ago
  They shipped it marked as deprecated to support people already using it, but to discourage new use. You can't really complain after ignoring that warning.
  - SteveNuts 3y ago
    There's no indication it's deprecated, it'll let you install it in its broken state with no warning.
    - jeroenhd 3y ago
      > There's no indication it's deprecated The "Features Removed or Deprecated in Windows Server 2012" page has mentioned SMTP since the OS was still called "Windows 8 server": https://web.archive.org/web/20120517025232/http://technet.microsoft.com/en-us/library/hh831568 https://web.archive.org/web/20120517025232/http://technet.mi... I suppose you could've missed this if you moved directly from WS2008 to WS2022, but I don't know any OS that publishes "things we have removed or deprecated in the last three versions", it's usually just "what changed from the previous version to the current one".

GSGBen 3y ago

hmailserver is the replacement you want for this.

SteveNuts 3y ago
This is the way I ended up going and it worked great.
mycall 3y ago
It is no longer under development.
- wruza 3y ago
  That happens when you finish your roadmap and call it done. It’s frustrating that the modern sense of it became automatically negative. This is an actual claim if someone is interested: https://www.hmailserver.com/state https://www.hmailserver.com/state On SHA-1: https://en.wikipedia.org/wiki/SHA-1 https://en.wikipedia.org/wiki/SHA-1 As of 2020, chosen-prefix attacks against SHA-1 are practical.[6][8] As such, it is recommended to remove SHA-1 from products as soon as possible and instead use SHA-2 or SHA-3. Replacing SHA-1 is urgent where it is used for digital signatures. Digging further: https://www.hmailserver.com/forum/viewtopic.php?t=40568 https://www.hmailserver.com/forum/viewtopic.php?t=40568 Tl;dr: it uses sha256 by default and only has sha1 for backwards compatibility, which is considered insecure today. Critical updates are still there.
  - mycall 3y ago
    hmailserver needs openssl version bumps from time to time.

liquidpele 3y ago

why the hell do you think that Microsoft would want you to use your basic SMTP server when they want you to use an exchange server? Of course they deprecated that. If you’re using windows then use their ecosystem.