{"slug": "qmail", "name": "qmail", "category": "communication", "category_name": "Email and chat", "description": "", "recommenders": 4, "commenters": 10, "warners": 1, "score": 4.239, "rising": 1.35, "first": "2025-11-07", "latest": "2026-10-30", "why": "A simple design, it had security baked in from the start, and remains one of the most secure software packages in history.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 5, "compare": 0, "warn": 1}, "spark": [0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 1], "listed": true, "loved": [], "caveat": "", "short_quote": "A simple design, it had security baked in from the start, and remains one of the most secure software packages in history.", "kind": "", "icon": false, "domain": "yp.to", "github_repo": null, "official_url": "https://cr.yp.to/qmail.html", "pricing": "", "aliases": ["qmail", "Qmail"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 804985456, "item_id": 50311591, "url": "https://news.ycombinator.com/item?id=50311591", "by": "ForHackernews", "date": "2026-10-30", "stance": "recommend", "quote": "It is possible to write more secure software[0]", "excerpt": "I assume that \"defensive AI\" means finding and patching vulnerabilities before attackers do, not some kind of live LLM packet-inspection. It is possible to write more secure software[0], companies just choose not to prioritize security. [0] https://cr.yp.to/qmail/qmailsec-20071101.pdf", "context": "", "use_case": "Mail transfer agent", "switched_from": "", "story": "Linode Security Incident"}, {"id": 797108081, "item_id": 49819255, "url": "https://news.ycombinator.com/item?id=49819255", "by": "0xbadcafebee", "date": "2026-09-23", "stance": "recommend", "quote": "A simple design, it had security baked in from the start, and remains one of the most secure software packages in history.", "excerpt": "Most attacked, sure. Most exploited? You get out of it what you put into it. If you work to make it more secure, it will stay more secure, popular or not. WordPress is a software design from the early 2000's - and not a particularly good example. Even back then there were more secure designs. Take QMail for example. A simple design, it had security baked in from the start, and remains one of the most secure software ", "context": "", "use_case": "", "switched_from": "", "story": "WordPress: Unauthenticated path traversal leading to conditional RCE"}, {"id": 779087073, "item_id": 48692942, "url": "https://news.ycombinator.com/item?id=48692942", "by": "knuckleheads", "date": "2026-06-26", "stance": "recommend", "quote": "because it was running qmail, it didn't even slow down", "excerpt": "Something that I have started doing lately is asking ChatGPT et al to check usenet for reactions from users about events (if it is the right 80's/90's time period). Sure enough, aol.sucks on usenet had some choice words about the outage: >What does Cisco stand for?? Case's Internet System Crapped Out. That's right, Steve Case and his AOL pig fell victim to some mickey mouse networking equipment. Unfortunatly for AOL,", "context": "", "use_case": "", "switched_from": "", "story": "A human postmortem of the 1996 AOL outage"}, {"id": 769900337, "item_id": 48118771, "url": "https://news.ycombinator.com/item?id=48118771", "by": "strenholme", "date": "2026-05-13", "stance": "recommend", "quote": "perfect for admins who valued security over features", "excerpt": "The point of djbdns and qmail was this: It allowed administrators to run a local DNS server securely without needing to constantly patch the code. They were limited in scope, but were perfect for admins who valued security over features. In an era when DNS was otherwise a monoculture, djbdns was a welcome breath of fresh air. https://lwn.net/2001/0208/", "context": "", "use_case": "", "switched_from": "", "story": "CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq"}, {"id": 769839072, "item_id": 48114942, "url": "https://news.ycombinator.com/item?id=48114942", "by": "strenholme", "date": "2026-05-12", "stance": "recommend", "quote": "showed that one could have (mostly) security bug free software", "excerpt": "DJB, with Qmail and DjbDNS (as well as Publicfile, which didn\u2019t catch on in an era of CGI scripts), showed that one could have (mostly) security bug free software without the scope being \u201cextremely narrow\u201d, and without the claim being \u201cdubious\u201d. It\u2019s not normal for software to be so poorly written, one doubts the claim that a security bug hasn\u2019t been found in over three years. If one thinks the claim of no security b", "context": "", "use_case": "", "switched_from": "", "story": "CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 741247856, "item_id": 46327991, "url": "https://news.ycombinator.com/item?id=46327991", "by": "AlotOfReading", "date": "2025-12-19", "stance": "warn", "quote": "qmail has seen RCEs [0, 1] because DJB didn't consider integer and buffer overflows in-scope for the application.", "excerpt": "What about qmail? No one runs qmail and no one is writing new C with that kind of insanely hyperconservative style using only world-class security experts. And it still wasn't enough. qmail has seen RCEs [0, 1] because DJB didn't consider integer and buffer overflows in-scope for the application. [0] https://www.guninski.com/where_do_you_want_billg_to_go_today_4.html [1] https://lwn.net/Articles/820969/", "context": "", "use_case": "", "switched_from": "", "story": null}]}], "who": [{"by": "vinay_ys", "context": "former student sysadmin", "url": "https://news.ycombinator.com/item?id=49044200", "date": "2026-07-24"}], "tags": [], "use_cases": ["mail transfer agent", "school mail server", "mail server", "catch-all email on vps", "personal mail server"], "compared": [{"slug": "freebsd", "name": "FreeBSD", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "djbdns", "name": "djbdns", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "postfix", "name": "Postfix", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=48112042", "title": "CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=45839901", "title": "Two billion email addresses were exposed", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50310687", "title": "Linode Security Incident", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49803959", "title": "WordPress: Unauthenticated path traversal leading to conditional RCE", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49020751", "title": "Self-host your mail server", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48660522", "title": "A human postmortem of the 1996 AOL outage", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 3}, "2025-12": {"warn": 1}, "2026-01": {}, "2026-02": {}, "2026-03": {"neutral": 1}, "2026-04": {}, "2026-05": {"recommend": 1}, "2026-06": {"recommend": 1}, "2026-07": {"neutral": 1}, "2026-08": {}, "2026-09": {"recommend": 1}, "2026-10": {"recommend": 1}}, "quotes": [{"id": 804985456, "item_id": 50311591, "url": "https://news.ycombinator.com/item?id=50311591", "by": "ForHackernews", "date": "2026-10-30", "stance": "recommend", "quote": "It is possible to write more secure software[0]", "excerpt": "I assume that \"defensive AI\" means finding and patching vulnerabilities before attackers do, not some kind of live LLM packet-inspection. It is possible to write more secure software[0], companies just choose not to prioritize security. [0] https://cr.yp.to/qmail/qmailsec-20071101.pdf", "context": "", "use_case": "Mail transfer agent", "switched_from": "", "story": "Linode Security Incident"}, {"id": 797108081, "item_id": 49819255, "url": "https://news.ycombinator.com/item?id=49819255", "by": "0xbadcafebee", "date": "2026-09-23", "stance": "recommend", "quote": "A simple design, it had security baked in from the start, and remains one of the most secure software packages in history.", "excerpt": "Most attacked, sure. Most exploited? You get out of it what you put into it. If you work to make it more secure, it will stay more secure, popular or not. WordPress is a software design from the early 2000's - and not a particularly good example. Even back then there were more secure designs. Take QMail for example. A simple design, it had security baked in from the start, and remains one of the most secure software ", "context": "", "use_case": "", "switched_from": "", "story": "WordPress: Unauthenticated path traversal leading to conditional RCE"}, {"id": 784707200, "item_id": 49044200, "url": "https://news.ycombinator.com/item?id=49044200", "by": "vinay_ys", "date": "2026-07-24", "stance": "neutral", "quote": "Long time ago I used to run qmail for my school (about 2000 users). It was a lot of fun to do", "excerpt": "Long time ago I used to run qmail for my school (about 2000 users). It was a lot of fun to do as a student sysadmin. Today, I'm tempted to build a minimal mail system for 1-10 users using agentic coding and use it for less critical use-cases like email for shopping/restaurants etc account registration. I wonder if I can get a safe and secure minimal build done completely agnatically without having to directly look at", "context": "former student sysadmin", "use_case": "school mail server", "switched_from": "", "story": "Self-host your mail server"}, {"id": 779087073, "item_id": 48692942, "url": "https://news.ycombinator.com/item?id=48692942", "by": "knuckleheads", "date": "2026-06-26", "stance": "recommend", "quote": "because it was running qmail, it didn't even slow down", "excerpt": "Something that I have started doing lately is asking ChatGPT et al to check usenet for reactions from users about events (if it is the right 80's/90's time period). Sure enough, aol.sucks on usenet had some choice words about the outage: >What does Cisco stand for?? Case's Internet System Crapped Out. That's right, Steve Case and his AOL pig fell victim to some mickey mouse networking equipment. Unfortunatly for AOL,", "context": "", "use_case": "", "switched_from": "", "story": "A human postmortem of the 1996 AOL outage"}, {"id": 769900337, "item_id": 48118771, "url": "https://news.ycombinator.com/item?id=48118771", "by": "strenholme", "date": "2026-05-13", "stance": "recommend", "quote": "perfect for admins who valued security over features", "excerpt": "The point of djbdns and qmail was this: It allowed administrators to run a local DNS server securely without needing to constantly patch the code. They were limited in scope, but were perfect for admins who valued security over features. In an era when DNS was otherwise a monoculture, djbdns was a welcome breath of fresh air. https://lwn.net/2001/0208/", "context": "", "use_case": "", "switched_from": "", "story": "CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq"}, {"id": 769839072, "item_id": 48114942, "url": "https://news.ycombinator.com/item?id=48114942", "by": "strenholme", "date": "2026-05-12", "stance": "recommend", "quote": "showed that one could have (mostly) security bug free software", "excerpt": "DJB, with Qmail and DjbDNS (as well as Publicfile, which didn\u2019t catch on in an era of CGI scripts), showed that one could have (mostly) security bug free software without the scope being \u201cextremely narrow\u201d, and without the claim being \u201cdubious\u201d. It\u2019s not normal for software to be so poorly written, one doubts the claim that a security bug hasn\u2019t been found in over three years. If one thinks the claim of no security b", "context": "", "use_case": "", "switched_from": "", "story": "CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq"}, {"id": 758504193, "item_id": 47406512, "url": "https://news.ycombinator.com/item?id=47406512", "by": "gerdesj", "date": "2026-03-16", "stance": "neutral", "quote": "", "excerpt": "\"with no downtime and no rebooting\" So, no patching. I used to boast about my NetWare server uptimes but that is so noughties 8)", "context": "", "use_case": "Mail server", "switched_from": "", "story": "I Love FreeBSD"}, {"id": 741247856, "item_id": 46327991, "url": "https://news.ycombinator.com/item?id=46327991", "by": "AlotOfReading", "date": "2025-12-19", "stance": "warn", "quote": "qmail has seen RCEs [0, 1] because DJB didn't consider integer and buffer overflows in-scope for the application.", "excerpt": "What about qmail? No one runs qmail and no one is writing new C with that kind of insanely hyperconservative style using only world-class security experts. And it still wasn't enough. qmail has seen RCEs [0, 1] because DJB didn't consider integer and buffer overflows in-scope for the application. [0] https://www.guninski.com/where_do_you_want_billg_to_go_today_4.html [1] https://lwn.net/Articles/820969/", "context": "", "use_case": "", "switched_from": "", "story": null}, {"id": 736559286, "item_id": 46034955, "url": "https://news.ycombinator.com/item?id=46034955", "by": "randallsquared", "date": "2025-11-24", "stance": "neutral", "quote": "I used Sendmail, Exim, Postfix, and qmail at various times.", "excerpt": "I ran my own mail server from 1998 through 2019, and set up a FreeBSD mail server as one of my first contract jobs in 1998 or 1999. I used Sendmail, Exim, Postfix, and qmail at various times. I switched to mail-in-a-box in 2014, and contributed a few minor fixes, then (which I'd forgotten about until I idly looked to see, just now). Throughout 20 years of running my own mail server for companies, friends, and myself,", "context": "", "use_case": "Mail transfer agent", "switched_from": "", "story": "The Cloudflare outage might be a good thing"}, {"id": 733584992, "item_id": 45849062, "url": "https://news.ycombinator.com/item?id=45849062", "by": "tguvot", "date": "2025-11-07", "stance": "neutral", "quote": "", "excerpt": "did exactly same. the only difference is that i use compromised emails to train spam filter", "context": "", "use_case": "Catch-all email on VPS", "switched_from": "", "story": "Two billion email addresses were exposed"}, {"id": 733582128, "item_id": 45848883, "url": "https://news.ycombinator.com/item?id=45848883", "by": "6c696e7578", "date": "2025-11-07", "stance": "neutral", "quote": "I setup qmail in my VPS", "excerpt": "> I used per-account email with alias services and password managers. 20-something-ish years ago I setup qmail in my VPS and a .qmail-default file captures all my me-sitename@vps emails. If they send me junk I echo '#' > .qmail-sitename and that's the end of it. Other things that get a mixture like someone annoying who harvested my ebay/paypal addresses or something, I'll sift out the good (stuff I need) via maildrop", "context": "", "use_case": "Personal mail server", "switched_from": "", "story": "Two billion email addresses were exposed"}]}