qmail
Hacker ApprovedShares rank 4 of 9 mail servers by recommenders
Admired for simple design, security built in from the start, and very few bugs. Common caveat: no forks allowed, so it fell behind modern needs like spam filtering.
Admired for simple design, security built in from the start, and very few bugs. Common caveat: no forks allowed, so it fell behind modern needs like spam filtering.
20 people gave an opinion
- recommend it
- 15
- criticize it
- 5
- approval share
- 75%
Recommended in 10 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: recommended
- August 2026: not recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 15 people recommend itNeeds 10 or more, met.
- 3 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 10 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Security designed in from the start
“A simple design, it had security baked in from the start, and remains one of the most secure software packages in history.”
Comment from 23 Sep 2026 in “WordPress: Unauthenticated path traversal leading to conditional RCE” “DJB, with Qmail and DjbDNS ... showed that one could have (mostly) security bug free software”
Comment from 12 May 2026 in “CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq” “its security withstood scrutiny for quite a lot of years”
Comment from 3 Jan 2026 in “The rsync algorithm (1996) [pdf]” - Comment from 13 May 2026 in “CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq”
Very few bugs, little patching
“DJB, with Qmail and DjbDNS ... showed that one could have (mostly) security bug free software”
Comment from 12 May 2026 in “CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq” “the best example of software with very few bugs is something like qmail”
Comment from 14 Apr 2026 in “Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them” “those didn't need a ton of patching over time”
Comment from 24 Oct 2026 in “Sam Altman: 'I No Longer Think We're Gonna Be Able to Just Patch All the Bugs'” Rewarding to learn and run
“Honestly one of the best, but annoying, things I've done, well worth the time invested”
Comment from 7 Nov 2025 in “Two billion email addresses were exposed” “I relied heavily on qmail for about a decade, and learned a lot from the experience”
Comment from 19 Mar 2026 in “Astral to Join OpenAI” “It was a lot of fun to do as a student sysadmin.”
Comment from 25 Jul 2026 in “Self-host your mail server” Simple, compartmentalized design
“A simple design, it had security baked in from the start, and remains one of the most secure software packages in history.”
Comment from 23 Sep 2026 in “WordPress: Unauthenticated path traversal leading to conditional RCE” “where he took a very different and compartmentalized approach to the more common monolithic tooling”
Comment from 21 Feb 2026 in “DJB's Cryptographic Odyssey: From Code Hero to Standards Gadfly”
What people warn about
Each mark is one comment
Fell behind modern needs
“Djb didn’t allow forking and repackaging so quail did not keep up with an increasingly hostile environment”
Comment from 14 Apr 2026 in “Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them” “it failed to keep up and DJBs attitude didn't help”
Comment from 14 Apr 2026 in “Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them” “The official release is not standard compliance. It does not support anything modern spam filter need.”
Comment from 13 May 2026 in “Dead.letter (CVE-2026-45185) Humans vs. LLM for Unauthenticated RCE Race on Exim” Author's attitude and maintenance criticized
“I feel he didn't responsibly maintain Qmail/DJBdns/Publicfile”
Comment from 13 May 2026 in “CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq” “it failed to keep up and DJBs attitude didn't help”
Comment from 14 Apr 2026 in “Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them” Too locked down to function
“it was a case of security being so tight that users had to break it in order to make the system functional”
Comment from 4 Jul 2026 in “NSA tries to weaken mlkem standardisation” “that does mean it's essentially unusable”
Comment from 12 May 2026 in “Dead.letter (CVE-2026-45185) Humans vs. LLM for Unauthenticated RCE Race on Exim” Memory-unsafe; advised against running
“there is no reason to run a memory-unsafe MTA”
Comment from 12 May 2026 in “Dead.letter (CVE-2026-45185) Humans vs. LLM for Unauthenticated RCE Race on Exim” “I don't think anyone should run qmail.”
Comment from 12 May 2026 in “Dead.letter (CVE-2026-45185) Humans vs. LLM for Unauthenticated RCE Race on Exim”
Other mail servers people recommend
The four most recommended other mail servers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Stalwart Mail Server | 27 | 4 | 87% | 10 | 3 mo3 owners | Approved |
| Postfix | 21 | 5 | 81% | 9 | 22 yrs4 owners | Approved |
| Dovecot | 18 | 1 | 95% | 11 | 15 yrs4 owners | Approved |
| qmailThis page | 15 | 5 | 75% | 10 | — | Approved |
| mailcow | 15 | 1 | 94% | 7 | 2 yrs5 owners | Approved |
What people said
23 of the 24 comments that mention it, newest first. Each links to the original comment.
“those didn't need a ton of patching over time”
“A simple design, it had security baked in from the start, and remains one of the most secure software packages in history.”
“Email as a messaging bus works very well”
“It was a lot of fun to do as a student sysadmin.”
“it was a case of security being so tight that users had to break it in order to make the system functional”
“perfect for admins who valued security over features”
“The official release is not standard compliance. It does not support anything modern spam filter need.”
“I feel he didn't responsibly maintain Qmail/DJBdns/Publicfile”
“that does mean it's essentially unusable”
“DJB, with Qmail and DjbDNS ... showed that one could have (mostly) security bug free software”
“I don't think anyone should run qmail.”
“there is no reason to run a memory-unsafe MTA”
“because it really has no public source-available equal, except maybe djbdns”
“it failed to keep up and DJBs attitude didn't help”
“Djb didn’t allow forking and repackaging so quail did not keep up with an increasingly hostile environment”
“the best example of software with very few bugs is something like qmail”
“I relied heavily on qmail for about a decade, and learned a lot from the experience”
“it ended up killing qmail, djbdns, etc stone dead”
“where he took a very different and compartmentalized approach to the more common monolithic tooling”
“its security withstood scrutiny for quite a lot of years”
“DJB didn't consider integer and buffer overflows in-scope for the application”
“Look at djb's decades-long policy of offering rewards to people who find holes in qmail or djbdns.”
“Honestly one of the best, but annoying, things I've done, well worth the time invested”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.