CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
Port details

mail/qmail 1.06_7

Secure, reliable, efficient, simple, and fast MTA

Port info

Maintainer
erdgeist@erdgeist.org
Packages
latest: 1.06_7
Upstream
up to date
Last update
to 1.06_7 · fff227115a
Quarterly
2026Q4: 1.06_7
WWW
https://cr.yp.to/qmail.html
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install netqmail
installs 1.06_7 from latest; from quarterly (2026Q4) 1.06_7
Port
# cd /usr/ports/mail/qmail && make install clean
# make -C /usr/ports/mail/qmail config  # change options first
Size
258 KiB download · 1.0 MiB installed
Depends on
nothing
Creates
user alias, qmaild, qmaill, qmailp, qmailq, qmailr, qmails, group qmail, qnofiles
Options
3 of 16 on in the package: DNS_CNAME DOCS RCDLINK
Show the 13 options that are off
BIG_CONCURRENCY_PATCH BIG_TODO_PATCH BLOCKEXEC_PATCH DISCBOUNCES_PATCH EXTTODO_PATCH LOCALTIME_PATCH MAILDIRQUOTA_PATCH OUTGOINGIP_PATCH QEXTRA QMTPC_PATCH SMTP_AUTH_PATCH SPF_PATCH TARPIT_PATCH
pkg-message
Shown after installing
ATTENTION:

You can enable qmail as your default mailer executing:
> /var/qmail/scripts/enable-qmail

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.06_71.06_7–
FreeBSD 151.06_71.06_7–
FreeBSD 141.06_71.06_71.06_7

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.06_71.06_7–
FreeBSD 141.06_71.06_71.06_7

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (2)

The CVE record lists the packaged version 1.06_7 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2020-38117.52020-05-26qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability.
CVE-2020-38125.52020-05-26qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test for the existence of files and directories anywhere …

VuXML only (0)

Listed in VuXML, the packaged version 1.06_7 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (1)

Show 1 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (287)

Renato Botelho (garga) · 1.03_5
Add ext_todo patch, and external high performance todo manager.
1438e33cae
Renato Botelho (garga) · 1.03_5
Back out last commit and remove DomainKeys support. I'm going to add it as a separate port.
804ff75f0a
Renato Botelho (garga) · 1.03_5
Add DomainKeys implementation to qmail-spamcontrol and qmail-mysql
9ec3aa980a
Renato Botelho (garga) · 1.03_5
Add dns patch to read answers > 512 bytes to qmail-spamcontrol
5595186206
Renato Botelho (garga) · 1.03_5
Add maildirquota++.patch support for qmail-spamcontrol
fe512af95c
Renato Botelho (garga) · 1.03_5
Add big-concurrency patch to qmail-spamcontrol
6f8f2b2946
Renato Botelho (garga) · 1.03_5
Make localtime-date-patch available for qmail-spamcontrol and qmail-ldap
3406239dfa
Renato Botelho (garga) · 1.03_5
- Update to spamcontrol 2.4.15:

2.4.15  FIXED missing IP information in Received header.
        ADDED ucspi-ssl-0.70_ucspitls-0.4.patch_.
        CHNGD order of qmail-smtpd reject conditions.
195dc22fa1
Renato Botelho (garga) · 1.03_5
Adapt qmail-smtpd to work fine with new rblsmtpd functionality, checking envvar set by rblsmtpd when IP matched on a RBL list and deny email is user is not authenticated.
32447622f7
Renato Botelho (garga) · 1.03_5
Add qmail-mfrules.8, forgotten when i updated qmail-spamcontrol to 2414
ba930d27f0
Renato Botelho (garga) · 1.03_5
- Update qmail-spamcontrol to 2.4.14, finally with STARTTLS support

Full ChangeLog at:
	http://www.fehcom.de/qmail/spamcontrol.html
5e5767703e
Renato Botelho (garga) · 1.03_5
Fix MASTER_SITES for spf patch

Reported by:	Giovanni <jumpyboy at infinito.it>
f0129b9366
Renato Botelho (garga) · 1.03_5
Update qmail-mysql to 1.1.15
3f55114899
Renato Botelho (garga) · 1.03_5
More cleanups on Makefile, mostly related with DOCS install
cb9bef090a
Renato Botelho (garga) · 1.03_5
- Use PORTDOCS facility and clean a bit Makefile and pkg-plist
3b84c52d01
Renato Botelho (garga) · 1.03_5
Update qmail-ldap to 20060201

Approved by:	portmgr (linimon)
dc9662370a
Renato Botelho (garga) · 1.03_5
- Add qmail-smtpd-auth-0.31.tar.gz to my area on MASTER_SITE_LOCAL, file   seems to be unfetchable.

Noticed by:	Vyacheslav Sotnikov <bsdforfree@rambler.ru>
2918168aa1
Renato Botelho (garga) · 1.03_5
Add TARPIT patch by Chris Johnson <dcj-qmaildoc@palomine.net>

What's tarpitting? It's the practice of inserting a small sleep in an SMTP
session for each RCPT TO after some set number of RCPT TOs. The idea is to
thwart spammers who would hand your SMTP server a single message with a long
list of RCPT TOs. If a spammer were to attempt to use your server to relay a
message with, say, 10,000 recipients, and you inserted a five-second delay for
each recipient after the fiftieth, the spammer would be "tarpitted" and would
likely assume that his connection had stalled and give up.

Asked by:	Joao Ricardo Mendes Pecanha <joao@redepegasus.com.br>
18e84bed8b
Renato Botelho (garga) · 1.03_5
- Add SPF patch on qmail-tls slaveport [1] - Indent if's and for's on qmail's Makefils

Thanks to:	Manuel Mausz <manuel@mausz.at> [1]
9532564178
Renato Botelho (garga) · 1.03_5
Add qmail-smtpd-auth-close3.patch when SMTP_AUTH_PATCH is selected. This is useful to fix a minor bug that occours after a failed authentication if you have morercpthosts configured.
227a16c31a
Renato Botelho (garga) · 1.03_5
- One more fix for tls+auth patches, now I hope all are working fine.

Submitted by:	Manuel Mausz <manuel@mausz.at>
9c37005da8
Renato Botelho (garga) · 1.03_5
- qmail-tls is not working fine with auth, fix it printing STATTLS alone in   one line on EHLO command [1] - Add ECHO_CMD to SUB_LIST, it's necessary to boot files

PR:		ports/92574 [1]
Submitted by:	Cristiano Deana <cris@gufi.org> [1]
f0ccca2ea5
Renato Botelho (garga) · 1.03_5
- Revert last commit and back to use alias user, that is the default. - Fix mkaliasdir accordingly
e1ed2e8e9c
Renato Botelho (garga) · 1.03_5
- Fix username creation on pkg-install - s/alias/qalias/g

Reported by:	B. Cook <bcook@bsdwebsolutions.com>
effbdad4cb
Kirill Ponomarev (krion) · 1.03_5
- Fix 'all-depends-list' target in cases if dependencies list is   very long and if some dependencies can't be added into the list.   [1]

- Fix FAM support.  Make gamin the default FAM system. [2]

- Introduce new 'quicksearch' target to show only port, path and
  info section of the matching ports. [3]

- Introduce new category - rubygems. [4]

- Fix stale dependencies while installing qmail slaveport and
  another port that depends on qmail. [5]

- Add commentary for describes target in bsd.port.mk. [6]

- Fix warning issued during make index on archs !368. [7]

- Add USE_DOS2UNIX variable.  If set to "YES", remove the ^M from
  all files under ${WRKSRC}. If set to a string, remove in all files
  under ${WRKSRC} with one of these names the ^Ms. [8]

- Add new variables PERL_RUN_DEPENDS and PERL_BUILD_DEPENDS by
  checking the existance of the Perl modules with the "perl -e 'use
  module;'" command. [9]

- Fix bsd.port.mk variable quoting issues.  No quoting is necessary
  anymore either in the Makefile or on the command line.  Affected
  variables include:

  BROKEN
  FORBIDDEN
  IGNORE
  MANUAL_PACKAGE_BUILD
  NO_CDROM
  NO_PACKAGE
  RESTRICTED

  [10]

- Add NOFETCHFILES variable.  If set, don't download these files
  from the ${MASTER_SITES} or ${MASTER_SITE_BACKUP} (but do from
  ${MASTER_SITE_OVERRIDE}). [11]

- Improve 'search' target output. [12]

- Add a new virtual category for Amateur Radio - hamradio. [13]

- Cleanup some old/unused pathes in bsd.port.mk. [14]

- Add @dirrmtry for plists which does the same as:
  "@unexec rmdir %D/foo 2>/dev/null || true" [15]

- Remove virtual category - offix. [16]

- Use portsnap instead of cvsup or cvs on "make update" in
  /usr/ports. [17]

- Move location of bsd.autotools.mk within bsd.port.mk [18]

- Add bsd.linux-rpm.mk, fix INSTALLS_SHLIB for Linux ports [19]

- Use new USE_RC_SUBR format for FreeBSD version >= 700007 [20]

- Replace the string "FreeBSD" by "The FreeBSD Project" in the
  security warning [21]

- Add bsd.local.mk for local modification to ports framework. [22]

- Replace rcNG spelling by rc.d [23]

- Remove superfluous USE_REINPLACE. [24]

Special thanks to:      linimon for spending hours with all these patches
                        clement for fixes
                        kris for help with pointyhat
PR:     ports/86310 [1], ports/89498 [2], ports/83530 [3],
        ports/83789 [4], ports/84053 [5], ports/86281 [6],
        ports/87214 [7], ports/87234 [8], ports/87318 [9],
        ports/87396 [10], ports/87605 [11], ports/87840 [12],
        ports/88230 [13], ports/88493 [14], ports/88711 [15],
        ports/88751 [16], ports/89281 [17], ports/89999 [18],
        ports/90031 [19], ports/90150 [20], ports/90668 [21],
        ports/91433 [23], ports/88754 [24]
Submitted by:   mi [1], marcus [2], Lars Engels <lars.engels@0x20.net> [3],
                pav [4, 16, 20, 24], garga [5], cperciva [6], vd [7],
                edwin [8, 9, 11, 15, 21],
                fenner [10], Arseny Nasokin <tarc.po.cs.msu.su@tarc.po.cs.msu.su> [12],
                Carl Makin <carl@stagecraft.cx> [13], arved [14],
                NIIMI Satoshi <sa2c@sa2c.net> [17], thierry [18],
                jylefort [19], linimon [22], dougb [23]
01c588a635
Renato Botelho (garga) · 1.03_4
- s/cram-md5/cram_md5/ to fix the spamcontrol option WITH_AUTHCRAM

Noticed by:	Jan-Erik Moon <jan@1kdigital.com>
1c36a87df5
Renato Botelho (garga) · 1.03_4
- Permit DISTFILES var be overwritted by slave ports

Noticed by:	Wendell Martins Borges <wendell@ramenzoni.com.br>
abe3fc08c9
Renato Botelho (garga) · 1.03_4
- Use last version of qmail-tls patch that fix build problem - Remove smtp_auth+tls lines forgotten on distinfo
348c16341b
Renato Botelho (garga) · 1.03_4
- Remove mail/qmail-smtp_auth+tls since you can choose SMTP_AUTH_PATCH on   qmail-tls port.
1f0edbb3c7
Renato Botelho (garga) · 1.03_4
- Add SMTP Authentication on qmail-tls slave port, after that, i'll remove   port mail/qmail-smtp_auth+tls, since it won't be necessary anymore
6aa04113c2
Renato Botelho (garga) · 1.03_4
- Add patch to provide SMTP Authentication on main qmail port.
1887dc5e18
Renato Botelho (garga) · 1.03_4
- Fix patch-install.c, like qmail-ldap
dadc7493ee
Renato Botelho (garga) · 1.03_4
- Use correct patch when try to compile qmail-smtp_auth+tls with outgoingip   patch selected

Noticed by:	oliver
f5f149a034
Renato Botelho (garga) · 1.03_4
- Add SHA256
46e7d42e8a
Renato Botelho (garga) · 1.03_4
- Author of qmail-tls patch fixes last problem and create a new tarball, so,   use it and remove the REINPLACE_CMD that was used to fix the problem.
c2525d2ea6
Renato Botelho (garga) · 1.03_4
- Remove redeclaration of strerror(), that was breaking the port.

Reported by:	oliver
72958c0541
Renato Botelho (garga) · 1.03_4
- Update to spamcontrol-2317

Changes:
 o Removes multiple-Nullsender check;
 o fixes a bug in LOCALMFCHECK.
3d1bc825a6
Renato Botelho (garga) · 1.03_4
Rodrigo Graeff <delphus@delphus.org> merged qmtpc and outgoingip patches, so, remove BROKEN when both is selected.

Thanks Rodrigo!!
01510677a8
Renato Botelho (garga) · 1.03_4
- Add one more OPTION to qmail-smtp_auth+tls slave port, to apply a custom version of maxrcpt patch made by Ederson Chimbida <chimbida@gmail.com>
e4b249f53d
Renato Botelho (garga) · 1.03_4
Add qmail-vida to CONFLICTS
05f8beb009
Renato Botelho (garga) · 1.03_4
- Add a changed version of starttls-smtp-auth patch that applies cleanly if outgoing-ip patch is applied.

Submitted by:	Wouter de Geus <benv@junerules.com>
a56d6fef21
Renato Botelho (garga) · 1.03_4
- Change PATCH_SITES var using correct labels, I forgot it on last commit.

Approved by:	portmgr (marcus)
96acf7e735
Renato Botelho (garga) · 1.03_4
- Make smtp_auth_tls fetchable again - Transfer patches backups from lioux to my local-distfiles dir

Approved by:	portmgr (linimon)
62c1036b5a
Renato Botelho (garga) · 1.03_4
Update spamcontrol patch to 2316

Approved by:	flz (mentor)
1541d04673
Renato Botelho (garga) · 1.03_4
Change MAINTAINER to my @FreeBSD.org account

Approved by:	flz (mentor)
d5a8ad9d47
Roman Bogorodskiy (novel) · 1.03_4
- Fix RCDLINK option - Fix qmail-ldap plist - Fix checking WITH(OUT)_ vars before include bsd.port.pre.mk

PR:		82983
Submitted by:	Renato Botelho (maintainer)
ca15d525a2
Roman Bogorodskiy (novel) · 1.03_4
Fix qmail-tls and qmail-smtp_auth+tls pkg-message.

PR:		82970
Submitted by:	Renato Botelho (maintainer)
8ce28cb5ea
Florent Thoumie (flz) · 1.03_4
- Add lots of OPTIONS. - Fix USE_OPENSSL.

PR:		ports/82698
Submitted by:	maintainer
a269d3e9e3
Roman Bogorodskiy (novel) · 1.03_4
Fix qmail-tls patch name to create TLS.readme.

PR:		82343
Submitted by:	Renato Botelho (maintainer)
6f10850be7
Pav Lucistnik (pav) · 1.03_4
- Update ldap patch to 20050401a - Add sysutils/daemontools to RUN_DEPENDS because the new patch works   just with it - Change pkg-message to reflect qmail.schema file installation - Change pkg-descr to reflect new features

PR:		ports/81966
Submitted by:	Renato Botelho <freebsd@galle.com.br> (maintainer)
fab158e1f3