No setting or chapter matched your filter query. Clear the search box to view all 12 chapters again.
Chapter 01
System Architecture, Zero-Restart Hot-Reload & Port Matrix
SharpMailserver unifies ESMTP, IMAP4rev2, JMAP, CalDAV/CardDAV, WBXML Mobile Push, ManageSieve, Webmail PWA, and GoBD WORM archiving in a single native process (~40 MB idle RSS). Nearly all Admin Cockpit (/admin/) settings apply with zero service restart and propagate across cluster nodes automatically.
Operational Tip & Architecture Note:
Expose only required ports at your perimeter firewall. Modern TLS-only deployments need just the 5 core ports (25, 443, 465, 587, 993). Keep port 143 disabled unless legacy internal appliances cannot use implicit TLS on port 993.
| Setting / Location |
What does it do? |
Default Value |
Production Best Practice |
ServerHostName (#pNetwork) |
Public FQDN advertised in ESMTP 220 greetings, outbound EHLO/HELO, Autodiscover responses, and TLS diagnostics. Applies in 0 ms without restart. |
mail.<DefaultDomain> |
Always use a dedicated host FQDN such as mail.company.com that matches your public IPv4/IPv6 Reverse-DNS (PTR) record 1:1. |
TCP 25 (ESMTP MX Inbound & Outbound) |
Server-to-server inbound MX reception and outbound MX delivery with opportunistic/enforced STARTTLS and RFC 3030 CHUNKING/BDAT. |
Aktiv (Pflicht) / Enabled |
Allow both inbound and outbound TCP 25 (verify ISP port 25 unblock). Plaintext AUTH on port 25 is disabled by default; keep it disabled. |
TCP 443 (HTTPS: Webmail, Admin, Push, DAV) |
Serves Webmail PWA (/mail/), Admin Cockpit (/admin/), JMAP, CalDAV/CardDAV (/dav/), Mobile Push (/Microsoft-Server-ActiveSync), and Send API. |
Aktiv (Pflicht) / Enabled |
Serve directly via Kestrel with built-in Let's Encrypt or behind HAProxy/Nginx/pfSense SSL gateway with X-Forwarded-For / PROXY protocol. |
TCP 465 (SMTPS) & TCP 587 (Submission) |
Authenticated client mail submission for desktop/mobile MUAs, scanners, and MFPs (465 implicit TLS per RFC 8314, 587 STARTTLS). |
Beide aktiv / Both enabled |
Prefer port 465 (implicit TLS from byte 0 per RFC 8314) for modern clients while keeping port 587 open for STARTTLS scanners and ERP systems. |
TCP 993 (IMAPS) & TCP 143 (IMAP) |
IMAP4rev2 mailbox access with sub-5 ms IDLE push and bidirectional Apple Notes sync (993 implicit TLS, 143 explicit STARTTLS). |
993 aktiv, 143 optional |
Keep port 993 open; close port 143 on public interfaces whenever possible so clients never attempt unencrypted connections. |
TCP 80 (ACME HTTP-01) & TCP 4190 (Sieve) |
Port 80 answers automated Let's Encrypt HTTP-01 challenges; port 4190 provides authenticated ManageSieve filter editing (Thunderbird/Roundcube). |
Optional / Optional |
Open port 80 if SharpMailserver handles Let's Encrypt HTTP-01 directly; expose port 4190 only if users manage Sieve scripts from desktop clients. |
Chapter 02
10/10 DNS Deliverability, Reverse DNS (FCrDNS) & Wildcard DNS Pitfalls
Major receivers such as Gmail, Microsoft 365, and Deutsche Telekom evaluate sender reputation heavily on DNS alignment. Under TLS & DNS Advisor (#pTls), SharpMailserver generates copy-ready records for every hosted domain and validates them live against public DNS.
Operational Tip & Architecture Note:
Beware of Wildcard DNS (*.company.com -> web server IP): a wildcard record silently routes unconfigured subdomains like autodiscover.company.com to your web host instead of your mail server! Always create explicit CNAME or A/AAAA records for mail, autodiscover, and autoconfig.
| Setting / Location |
What does it do? |
Default Value |
Production Best Practice |
Reverse-DNS (PTR) & FCrDNS |
Maps your server's public IPv4 (and IPv6) address back to ServerHostName at your ISP/hosting provider (Forward-Confirmed Reverse DNS). |
Beim Hoster zu setzen / ISP panel |
Set PTR at Hetzner/IONOS/Netcup/AWS to match ServerHostName 1:1. Missing or generic PTR records cause immediate 550 rejections at strict ISPs. |
SPF TXT (v=spf1) |
Declares which IPv4/IPv6 addresses and MX hosts are authorized to send mail on behalf of your domain (RFC 7208). |
v=spf1 mx a -all |
Include explicit sending IPs (v=spf1 mx ip4:... ip6:... -all), stay well below the 10-lookup RFC limit, and enforce -all once all senders are listed. |
Dual-DKIM (RSA-2048 + Ed25519) |
Cryptographically signs outbound headers and body hashes so receivers verify domain authenticity and message integrity. |
RSA-2048 (s1) aktiv |
Generate keys with 1 click in the Domain Inspector: always publish RSA-2048 for universal compatibility, optionally dual-signing with Ed25519. |
DMARC (_dmarc.<domain>) |
Binds SPF/DKIM alignment to the visible From header and instructs receivers how to handle spoofing, feeding aggregate XML reports back into /admin/. |
v=DMARC1; p=quarantine; ... |
Start with p=quarantine and rua=mailto:dmarc@company.com for 2 weeks, inspect the built-in DMARC analyzer, then graduate to p=reject. |
Autodiscover, Autoconfig & DNS-SRV |
Enables zero-touch server discovery across Outlook, Apple Mail, Thunderbird, and mobile clients using only the user's email address. |
Auf Port 443 integriert |
Create explicit CNAMEs for autodiscover & autoconfig pointing to mail.<domain> plus SRV records (_imaps, _submission, _caldavs, _carddavs). |
Chapter 03
True Dual-Stack IPv6 ([::]) & Happy-Eyeballs Outbound MX
Starting in v1.2.4, all protocol listeners (ESMTP 25/465/587, IMAP 143/993, ManageSieve 4190) and Kestrel bind in native Dual-Stack mode ([::] with DualMode = true). A single kernel socket accepts both native IPv6 and IPv4 traffic while normalizing IPv4-mapped addresses (::ffff:x.x.x.x) cleanly across SPF, greylisting, and logs.
Operational Tip & Architecture Note:
Golden rule of IPv6 mail: publish an AAAA record for mail.company.com ONLY after setting the matching IPv6 PTR record at your hosting provider and adding ip6:... to your SPF record! Gmail strictly rejects IPv6 senders lacking valid IPv6 PTR.
| Setting / Location |
What does it do? |
Default Value |
Production Best Practice |
BindAddress (Smtp / Imap / ManageSieve) |
Controls local socket binding. Wildcards (::, [::], 0.0.0.0, *) automatically enable Dual-Stack IPv6 + IPv4 with graceful IPv4 fallback if OS IPv6 is disabled. |
:: (Dual-Stack IPv6 + IPv4) |
Leave at default :: so both IPv6 and IPv4 peers connect seamlessly; bind a specific IP only on multi-homed hosts with separate MTAs. |
Ausgehendes Happy-Eyeballs MX |
Interleaves resolved MX AAAA and A targets and falls back immediately to IPv4 if an IPv6 route is unreachable or blocked. |
Automatisch aktiv / Auto |
When native IPv6 routing is active on the OS, ensure your IPv6 PTR matches ServerHostName and outbound IPv6 TCP 25 is permitted. |
IPv6 /64 Subnetz-Greylisting & Rate-Limit |
Groups ephemeral IPv6 addresses within the same /64 prefix together (matching /24 grouping on IPv4) for greylisting and abuse throttling. |
/64 Präfix (IPv6) · /24 (IPv4) |
Keep default /64 grouping so legitimate IPv6 MTAs rotating host addresses inside their /64 block pass greylisting cleanly on first retry. |
Chapter 04
Running Behind pfSense, OPNsense, HAProxy & SSL Gateways
Many enterprise deployments run their web server and SharpMailserver in internal VLANs behind a shared perimeter firewall (pfSense, OPNsense, Sophos) or an SSL/HAProxy gateway. Without Hairpin NAT (NAT Reflection), packets sent from inside the network to your own public WAN IP time out at the gateway.
Operational Tip & Architecture Note:
Why did port checks previously report 'Timeout' behind shared gateways? When the probe originated behind the same pfSense firewall without NAT reflection, WAN loopback packets dropped even though external internet clients connected fine. SharpMailserver v1.2.4 detects and compensates for this topology automatically.
| Setting / Location |
What does it do? |
Default Value |
Production Best Practice |
pfSense / OPNsense: Split-DNS (DNS Resolver) |
Resolves mail.company.com directly to the internal LAN/DMZ IP (e.g. 172.16.0.55) for internal clients and sibling servers instead of hairpining via WAN. |
Im Gateway konfigurieren |
Recommended #1 best practice! Add a Host Override in Unbound/DNS Resolver mapping mail.company.com to the internal LAN IP for zero-hop speed and real client IPs. |
pfSense: NAT Reflection (Pure NAT) |
Allows internal hosts to reach port-forwarded WAN services via the public WAN IP when Split-DNS is not used. |
Deaktiviert in pfSense |
If internal hosts must hit the public WAN IP, enable Pure NAT + Automatic Outbound NAT for Reflection under System -> Advanced -> Firewall & NAT. |
SSL-Gateway / Reverse-Proxy für Port 443 |
Terminates HTTPS on an edge gateway (HAProxy / Nginx) and forwards Webmail, Admin, CalDAV/CardDAV, and ActiveSync to SharpMailserver. |
Direkt oder Reverse-Proxy |
Increase gateway read/idle timeouts to >= 900s for ActiveSync Ping long-polling and forward X-Forwarded-For + X-Forwarded-Proto headers. |
Smtp/Imap:EnableProxyProtocol (HAProxy v2) |
Extracts the true remote client IP from HAProxy PROXY Protocol v1/v2 headers on TCP ports 25, 465, 587, and 993. |
false (Direktes NAT) |
Keep FALSE for standard pfSense/iptables DNAT port forwards (which already preserve source IPs)! Enable ONLY when HAProxy explicitly sends send-proxy-v2. |
Chapter 05
Smartphone & iPhone Onboarding via QR, WhatsApp & 1-Click Admin Invite
Users should be able to provision Mail, Calendar, Contacts, and Notes on iOS and macOS in under 30 seconds without typing ports or exposing their master password. SharpMailserver generates PKCS#7/CMS-signed .mobileconfig profiles paired with an isolated per-device App Password.
Operational Tip & Architecture Note:
Why Messenger-safe Setup Links (/onboarding/setup/{token}) matter: WhatsApp, Teams, Slack, and Signal pre-fetch links to build preview cards, which destroys naive single-use download tokens before the human taps! SharpMailserver ignores HEAD/crawler previews, masks credentials from bots, and guides in-app WebViews smoothly into Safari.
| Setting / Location |
What does it do? |
Default Value |
Production Best Practice |
Admin: Smartphone einrichten (#pUsers) |
Generates a 24-hour mobile setup page link directly from the Accounts table, Account Editor, or right after creating a new mailbox. |
24 Stunden gültig / 24h TTL |
Fastest way to onboard new hires: click 'Device Setup' on any user row to share via WhatsApp, copy the setup URL, or send an automated welcome email. |
Profil-Modus: Exchange Push vs. IMAP + DAV |
Lets the recipient install either the unified Push profile (EAS-compatible Mail/Calendar/Contacts/Notes/Tasks) or standard IMAPS + CalDAV/CardDAV. |
Push-Kombi-Profil empfohlen |
Recommend the unified Push profile on iPhone/iPad (provisions Mail, Calendar, Contacts, Notes & Reminders in one native iOS toggle); use Standard for macOS. |
Isoliertes Geräte-App-Passwort |
Every provisioned profile embeds a unique random per-device App Password rather than the user's primary Webmail/2FA password. |
Automatisch pro Gerät |
If a phone is lost or retired, revoke just that single App Password in the Account Editor without resetting the user's password or breaking other devices. |
Download-Toleranz & Safari-Handoff |
Permits up to 6 profile downloads within the 24h window so switching from WhatsApp's embedded WebView into Safari never invalidates the link. |
Max. 6 Abrufe / 24h TTL |
On iOS, open the link in Safari and confirm installation under Settings -> General -> VPN & Device Management -> Profile Downloaded. |
Chapter 06
SMTP Queue, Retry Schedule, ISP Throttling, Smart-Host & Live MX Tester
The outbound delivery engine resolves MX records, enforces MTA-STS and DANE TLSA policies, applies Dual-DKIM signatures, and manages 4xx deferral retries automatically. Under SMTP Queue & Routing (#pSmtpQueue), you can inspect queued messages and run live MX delivery diagnostics.
Operational Tip & Architecture Note:
Use the built-in Outbound MX, STARTTLS & DANE Live Tester (#pSmtpQueue) whenever a partner domain reports issues: it runs a real non-destructive TCP, EHLO, STARTTLS, and DANE TLSA handshake against their MX servers without sending an email.
| Setting / Location |
What does it do? |
Default Value |
Production Best Practice |
RetryScheduleMinutes |
Comma-separated backoff intervals in minutes when a remote MX returns a transient 4xx deferral (such as greylisting or temporary throttling). |
5, 15, 60, 240, 720, 1440 |
Keep default (5m first retry clears remote greylisting quickly; progressive steps span ~41 hours before generating a final DSN bounce). |
OutboundWorkerConcurrency |
Maximum number of concurrent outbound SMTP delivery workers across all destination domains. |
4 Worker |
4 to 8 workers suit typical SMB traffic; scale to 12-24 for high-volume transactional billing bursts. |
MaxConnectionsPerMxIp & RatePerMinute |
Caps simultaneous TCP sessions and messages/minute per destination MX IP/domain to prevent 421 rate-limit deferrals at major ISPs. |
2 Verbindungen · 60/Min. |
Keep conservative caps (2 concurrent connections, 30-60 msgs/min) especially when warming up a fresh IP address. |
Globaler Smart-Host & Domain-Routen |
Routes either all outbound mail through an upstream relay (when ISP blocks TCP 25) or specific domains to internal ERP/DMS/partner gateways. |
Direkter MX-Versand (leer) |
Prefer direct MX delivery whenever TCP 25 is open and PTR is aligned; use a Smart-Host on cloud VMs where outbound port 25 is blocked. |
Chapter 07
SpamGuard, Smart Greylisting, DNSBL, FTRL-ML & ClamAV Antivirus
SharpMailserver's inbound defense combines protocol-level checks (SPF, DKIM, DMARC, FCrDNS, DNSBL, Smart Greylisting) with MIME heuristics, an online FTRL machine-learning model (trained automatically when users move mail into or out of Junk), and optional streaming ClamAV antivirus.
Operational Tip & Architecture Note:
Zero silent mail loss: messages scoring between JunkThreshold (4.5) and RejectThreshold (9.0) are never dropped silently; they land safely in the user's Junk folder with detailed X-Spam-Status headers. Test any sample live in the Spam Analyzer (#pSpam).
| Setting / Location |
What does it do? |
Default Value |
Production Best Practice |
JunkThreshold & RejectThreshold (#pSpam) |
Scores >= JunkThreshold route to the Junk folder; scores >= RejectThreshold trigger an immediate SMTP 550 5.7.1 rejection. |
Junk: 4.5 · Reject: 9.0 |
4.5 / 9.0 provides optimal balance. Avoid lowering RejectThreshold below 7.5 so poorly formatted legitimate newsletters go to Junk rather than bouncing. |
SubjectPrefix ([SPAM]) |
Optionally prepends a visible tag such as [SPAM] to the Subject header of messages classified as Junk. |
Deaktiviert (Ordner-Routing) |
Leave off when using Webmail, IMAP, or Mobile Push since Junk folder routing is cleaner and keeps the original subject intact if unmarked. |
Smart Greylisting (GreylistingEnabled) |
Issues a polite one-time 451 temporary deferral for unseen (IP /24 or /64 prefix, MAIL FROM, RCPT TO) triplets; skips SPF/DKIM-aligned senders. |
Aktiv · 240 s Wartezeit |
Keep enabled! Blocks >85% of fire-and-forget botnets before DATA transfer while SPF/DKIM-verified senders bypass the delay automatically. |
DNSBL-Zonen & DnsblScore |
Queries real-time IP blocklists and adds DnsblScore to the composite spam score rather than blindly dropping on a single list hit. |
zen.spamhaus.org, bl.spamcop.net (3.5) |
Important for Spamhaus: ensure your OS uses a local recursive DNS resolver (Unbound / Windows DNS / pfSense), NOT public resolvers like 8.8.8.8 or 1.1.1.1! |
ClamAV Antivirus (TCP INSTREAM) |
Streams inbound MIME payloads over TCP INSTREAM to a local or LAN clamd daemon and rejects malware at SMTP time with 554 5.7.0. |
Deaktiviert · 127.0.0.1:3310 |
When running clamd (Docker sidecar or Linux/Windows daemon), verify connectivity using the 1-click PING + EICAR stream self-test in #pSpam. |
Chapter 08
OutboundGuard, ESMTP Limits, Tarpit & Fail2Ban / Auto-Ban
Two threats face every internet-facing mail server: external credential-stuffing bots and a single compromised internal workstation attempting to blast phishing mail (which ruins IP reputation within minutes). SharpMailserver guards both vectors out of the box.
Operational Tip & Architecture Note:
Under Firewall & Auto-Ban (#pRules), inspect active attacker bans in real time and whitelist your static office/VPN egress IPs so a forgotten password behind shared office NAT never locks out coworkers.
| Setting / Location |
What does it do? |
Default Value |
Production Best Practice |
Auto-Ban / Fail2Ban (8 Versuche / 10 Min.) |
Tracks failed authentication attempts across SMTP, IMAP, Webmail, ActiveSync, and DAV per remote IP and blocks brute-force sources automatically. |
8 Fehlversuche -> 30 Min. Sperre |
Leave active and add static office/VPN IPs as Allow rules in #pRules. Individual accidental blocks can be cleared with 1 click. |
TarpitDelayMs (SMTP-Verzögerung) |
Applies a controlled artificial delay on invalid SMTP commands, unknown RCPT probes, and failed AUTH attempts. |
1500 ms (1,5 Sekunden) |
1500-2000 ms stalls automated dictionary scanners to a crawl while remaining completely invisible to legitimate mail clients. |
MaxMessageSizeMb |
Maximum total RFC 5322 message size including ~33% Base64 MIME encoding overhead. |
50 MB (~36 MB Netto-Anhang) |
50 MB (~36 MB raw attachment) aligns cleanly with Gmail and Exchange Online limits; larger values often bounce at external recipients anyway. |
OutboundGuard (Konto-Ratenlimit) |
Enforces per-account hourly/daily outbound sending ceilings and halts compromised accounts before IP reputation suffers. |
Aktiv (pro Konto steuerbar) |
Keep standard user accounts on reasonable hourly limits and route bulk invoices/notifications through dedicated scoped API keys. |
Chapter 09
Let's Encrypt ACME v2 (0 ms SNI), MTA-STS, DANE & BIMI
SharpMailserver automates X.509 certificate issuance and renewal via Let's Encrypt ACME v2, hot-swapping renewed certificates in 0 ms across HTTPS, SMTPS, STARTTLS, IMAPS, and ManageSieve with zero dropped connections.
Operational Tip & Architecture Note:
Crucial DANE (TLSA) detail: always publish DANE records using Usage 3, Selector 1 (SPKI public key), MatchingType 1 (SHA-256), i.e. '3 1 1'. Never use '3 0 1' (full cert hash) with automated 60-day Let's Encrypt renewals unless automating DNS updates!
| Setting / Location |
What does it do? |
Default Value |
Production Best Practice |
ACME SAN-Domains (#pTls) |
Subject Alternative Names included in the Let's Encrypt certificate, renewed automatically 30 days prior to expiry. |
ServerHostName vorausgewählt |
Include ONLY hostnames whose public A/AAAA records point to this server! Including a root domain hosted elsewhere will fail HTTP-01 validation. |
MTA-STS & TLS-RPT (RFC 8461 / 8460) |
Instructs sending MTAs via HTTPS policy to deliver mail to your domain strictly over authenticated TLS. |
Integrierter Policy-Endpunkt |
Start in testing mode while monitoring TLS-RPT reports in /admin/, then switch policy mode to enforce. |
DANE TLSA (_25._tcp.<ServerHostName>) |
Pins your server's SubjectPublicKeyInfo SHA-256 digest in DNSSEC-signed DNS (_25._tcp.mail.company.com). |
3 1 1 <SPKI-SHA256-Hash> |
Publish ONLY on DNSSEC-signed zones using the exact '3 1 1' SPKI SHA-256 record generated in #pTls. |
BIMI Markenlogo (default._bimi) |
Displays your verified brand mark (SVG Tiny 1.2 PS) next to your messages in supporting mail clients. |
Integrierter SVG-Sanitizer |
Requires DMARC p=quarantine or p=reject. Upload your SVG in #pTls to sanitize and host it automatically with proper CORS headers. |
Chapter 10
Transactional Send API, API Keys, SCIM 2.0, OIDC & Global Disclaimers
Web apps, ticketing tools, and ERP software should never share human mailbox passwords. Under API, SSO & Transport (#pApiAuth), issue scoped API keys, configure company-wide legal disclaimers and Master Sieve rules, and inspect OIDC/SCIM integrations.
Operational Tip & Architecture Note:
Smart anti-stacking disclaimers: before appending your company legal footer to HTML and plaintext parts, SharpMailserver checks whether the marker phrase is already present in the thread, preventing ugly stacked footers on back-and-forth replies!
| Setting / Location |
What does it do? |
Default Value |
Production Best Practice |
API-Schlüssel (POST /api/v1/send & SMTP) |
Tenant-scoped keys (smk_live_...) hashed with Argon2id on disk for high-speed JSON transactional email delivery with full DKIM & GoBD archiving. |
Pro Anwendung getrennt |
Create one distinct API key per application (Shop, CRM, Monitoring) so keys can be rotated or revoked independently without downtime. |
Globale Pflicht-Signatur / Disclaimer |
Automatically appends mandatory corporate/legal footers to both text/html and text/plain parts of outbound messages. |
Optional aktivierbar |
Provide concise HTML and Plaintext variants and keep duplicate suppression enabled so reply chains stay clean. |
Globales System-Sieve-Skript |
Master RFC 5228 Sieve script executed on every inbound delivery prior to individual user Sieve filters. |
Deaktiviert (leer) |
Ideal for tenant-wide compliance routing or tagging; syntax is validated automatically before saving. |
OIDC Single Sign-On & SCIM 2.0 |
Connects Entra ID, Keycloak, Authentik, or Okta for OIDC Single Sign-On plus automated SCIM 2.0 user lifecycle provisioning (/scim/v2). |
Lokale Auth + Passkeys aktiv |
Encourage FIDO2 Passkeys for admins and users; pair OIDC SSO with SCIM 2.0 provisioning when managing identities centrally. |
Chapter 11
Persistent Message Trace & Immutable GoBD WORM Compliance Archive
When a customer asks 'Where is our invoice?', you need an instant factual answer. Message Trace (#pMessageTrace) records exact timestamps, remote IPs, TLS ciphers, spam scores, and remote SMTP responses across Inbound, Outbound, Deferred, Bounced, and Rejected mail, alongside the immutable GoBD WORM journal.
Operational Tip & Architecture Note:
Audit & privacy best practice: never hand full ServerAdmin credentials to external tax auditors. Assign the dedicated read-only ComplianceAuditor role, which grants GoBD journal search, ZUGFeRD inspection, and procedural documentation export without write access.
| Setting / Location |
What does it do? |
Default Value |
Production Best Practice |
Nachrichtenverfolgung (#pMessageTrace) |
Searchable history of inbound and outbound SMTP/API transactions with direction/status filters and 1-click CSV export. |
Aktiv (Echtzeit-SignalR) |
Filter by sender, recipient, or Message-ID to prove remote MX acceptance (250 2.0.0 OK) in seconds. |
Domain GoBD-Aufbewahrung (RetentionDays) |
Configures immutable WORM retention duration per domain backed by cryptographic SHA-256 hash chaining. |
3650 Tage (10 Jahre GoBD) |
Keep at 3650 days (10 years under German AO/HGB tax retention rules) for commercial domains and run periodic 1-click hash-chain verification. |
ZUGFeRD / XRechnung & Scan-OCR |
Indexes structured EN 16931 ZUGFeRD/Factur-X invoice XML metadata alongside PDF text and scan OCR in < 8 ms p95 search queries. |
Automatisch aktiv |
Allows accounting and auditors to locate e-invoices instantaneously by invoice ID, VAT ID, or vendor name. |
S3 Object Lock & Verfahrensdokumentation |
Optionally replicates deduplicated Zstd blobs to S3 Object Lock (COMPLIANCE mode) and exports pre-filled GoBD procedural documentation. |
Lokaler Blob-Store (+ S3 optional) |
Export an updated GoBD procedural documentation snapshot from #pArchive after major topology changes and file it with your audit records. |
Chapter 12
Storage Engines (SQLite, MS SQL Server, PostgreSQL 18), Clustering & Updater
SharpMailserver cleanly separates structured metadata and full-text indexes from SHA-256 deduplicated, Zstandard-compressed MIME blobs (-62% disk footprint). Choose freely among three first-class SQL engines with zero Redis, Elasticsearch, or Kafka dependencies.
Operational Tip & Architecture Note:
Before applying any in-place update, the built-in 1-Click Updater (#pSystem) cryptographically verifies the SHA-256 digest against SHA256SUMS.txt while strictly preserving appsettings.Production.json, TLS certificates, and mailbox data.
| Setting / Location |
What does it do? |
Default Value |
Production Best Practice |
SQLite WAL (Storage:Provider = Sqlite) |
Zero-config embedded database running in Write-Ahead-Logging (WAL) mode with built-in FTS5 search and zero external daemons. |
Standard für Einzelserver |
Ideal for single-node deployments up to ~250 active mailboxes on local SSD/NVMe storage (never place SQLite WAL files on network SMB/NFS shares!). |
Microsoft SQL Server (SqlServer) |
First-class Microsoft.Data.SqlClient engine for SQL Server 2019-2025, Express, Docker, and Azure SQL with sp_getapplock clustering and zero-addon search. |
READ_COMMITTED_SNAPSHOT auto |
Top choice for Windows Server infrastructure: works out of the box even on SQL Server Express without requiring OS Full-Text Search add-ons. |
PostgreSQL 18 (Postgres) |
High-throughput active-active cluster engine leveraging LISTEN/NOTIFY (< 2 ms push), UNLOGGED tables, and pg_try_advisory_lock. |
Empfohlen für Linux-Cluster |
Reference engine for 500 to 100,000+ mailboxes and multi-node Active-Active Linux/Kubernetes clusters. |
1-Klick-System-Updater (#pSystem) |
Checks /api/releases/latest, verifies SHA-256 checksums, stages binaries, and restarts the Windows Service or systemd unit seamlessly. |
SHA-256-geprüft |
Trigger 1-click updates directly from #pSystem (or via install.sh --update / MSI wizard) with automatic reconnect once the new version boots. |
