The qmail security guarantee
For anyone considering QMail today, don&#x27;t.<p>When QMail was initially conceived, Sendmail was king, and Sendmail was awful (from a security perspective). Today there are multiple very good alternatives to Sendmail (I&#x27;ve used Postfix for many years with no complaints), and QMail has seen very sparse development. While Postfix has a moderately less stellar security record, it&#x27;s still pretty darned good, and still under active maintenance.<p>Many modern mail security features are either hacked onto QMail via patches from third parties (none of whom are as famous for their security chops as djb) or completely non-existent in QMail. The number of people running it today is extremely small, so you&#x27;re going to find relatively few resources about it when you run into problems (and what resources you find will be very, very, very old, in most cases).<p>If you&#x27;re wanting a similarly limited SMTP server that is under active maintenance, opensmtpd from the OpenBSD folks might be an option (though I&#x27;ve never used it). It, at least, has people looking at it regularly and supports basic features lacking in QMail, like encryption, without patches.<p>QMail has a tiny but rabid following (kinda like djb himself) who settled into their beliefs about the MTA landscape in 1998 and have ignored everything that&#x27;s happened since. (Funny, or maybe just odd, story: When we removed qmail-ldap, an unmaintained patched version of QMail that adds LDAP authentication, from Virtualmin, I literally had someone bringing up companies that have been out of business for more than a decade as proof that it was still in active use and we should keep maintaining support for it, even though no one has asked a question about it in our forums in eight years. It was the most bizarre technical conversation I&#x27;ve had in a while. I was like, &quot;But, umm...they have no website and every mention I can find of that company is from 2006. What makes you think they&#x27;re still using qmail-ldap or would care that we&#x27;re removing support for it?&quot; Then again, they also wanted to rant for a couple dozen paragraphs about gay people oppressing them in our issue tracker and for an hour or so in our IRC channel, so he may not have been entirely connected to our reality.)