Sendmail Open Source

Sendmail 8.18.1 is available from ftp.sendmail.org. The release has a gzipped tar file and a PGP signature file. The compressed/gzipped tar files are signed by the 2024 signing key. See the Security and PGP Signing Keys section for more information about how releases are signed.

Security advisories are issued by The Computer Emergency Response Team CERT. Sendmail server related security problems should be sent to:

sendmail-security-YYYY@support.sendmail.org

Replace YYYY with the current year, e.g., 2015. This address is only for reporting security problems in sendmail. When reporting security problems, please use PGP-the public key is available in the file PGPKEYS of the sendmail distribution.

Please do not use this address to report problems that are not related to the security of the sendmail server. Questions about avoiding spam risk, how to set up your own certificate authorities, etc. should be posted in comp.mail.sendmail, and Unix-related security in the comp.security.unix newsgroup.

All sendmail distributions are signed with a PGP key named "Sendmail Signing Key/YYYY" where YYYY is the year of release.

Signing Keys

If the signature does not match any of these keys, you may have a forgery.

Older Releases

These addresses are for contributing patches or reporting problems about V8 sendmail. The members of these lists do not have the resources to support vendor versions. Before sending to any of these addresses, please check the FAQ and the files README, sendmail/README (on this web-site as Compiling Sendmail) and cf/README (on this web-site as the Configuration README pages) to see if they are already answered; about half of the questions received can be answered in this way.

Notes

• Do not send us mail in HTML format, use plain text only (even multipart/alternative with an HTML part will be classified as spam by some of our members and hence an answer will most likely be delayed).
• Do not use 8bit characters in the Subject: nor use some encoding, e.g., =?GB2312?B?, but only plain 7bit ASCII without any charset encoding.
• If you send e-mail to sendmail.org, the answer will most likely not come from a system in the sendmail.org domain. If you use some anti-spam techniques (e.g., challenge-response systems) or you block hosts that are connected via DSL then please do not expect an answer. More and more often replies are blocked which is very annoying. Do not block this address or make sure that your system accepts at least STARTTLS secured mail. A list of IPs is available in the sendmail.org SPF record.
• If you use a challenge/response system, make sure that it does NOT send us a challenge when we reply to your question or when you receive mail from the announce list. We will not reply to those annoying mails.
• If you are using the blacklist from spamlist.org then please do not send us e-mail, the reply of the sendmail maintainer will not reach you.
• Do not send us mail in proprietary formats.
• The mailservers for support.sendmail.org now (2004-11-24) use the following DNSBLs:
  • sbl-xbl.spamhaus.org
  • dnsbl.sorbs.net
  • list.dsbl.org
  • bl.spamcop.net
• The mailserver for support.sendmail.org performs strict RFC checks, for example, it does not accept mail if the domain part has an MX record that points to an IP address (instead of hostname as required).

If you have a question about sendmail, then please post it to the Usenet group comp.mail.sendmail. This newsgroup is dedicated to sendmail. Please make sure you check the usual resources before posting and follow the netiquette.

E-mail addresses to contact sendmail.org are (do not send questions about sendmail to these addresses, see above instead; replace YYYY with the current year, e.g., 2006, in all of these addresses):

• sendmail-YYYY@support.sendmail.org for contributing patches, feature requests, and general comments but not questions how to use, install, or configure sendmail;
• sendmail-bugs-YYYY@support.sendmail.org to report implementation bugs;
• sendmail-faq-YYYY@support.sendmail.org only for comments / questions about the FAQ. Please mark your mail clearly with "FAQ: item" where item is the entry in the faq to which you are referring. If it is a general comment about the FAQ, use "FAQ: general", if it is an addition, use "FAQ: new".
• sendmail-security-YYYY@support.sendmail.org (use this only to report related bugs or problems in sendmail). Please do not use this to ask about problems with your configuration, including how to stop spam, how to set up your own certificate authority, how to make sendmail work with S/MIME, etc. All such questions should be asked in comp.mail.sendmail. Also, please do not tell us that you were able to forge mail by using telnet to connect to port 25; this is fundamental to the Internet design for SMTP, and not a sendmail bug. Please use encryption to send mail to this address.
• sendmail-mirror-YYYY@support.sendmail.org for updates about a mirror (e.g., a new mirror or an address change).
• webmaster-YYYY@support.sendmail.org for comments about the website.

These are not open lists, meaning that subscription is by invitation only.

The Domain Keys Identified Mail (DKIM) Internet standard enables email senders to digitally sign their messages so that receivers can verify that those messages have not been forged. The DKIM sender authentication scheme allows the recipient of a message to confirm a message originated with the sender’s domain and that the message content has not been altered. A cryptography-based solution, DKIM provides businesses an industry-standard method for mitigating email fraud and protecting an organization’s brand and reputation at a relatively low implementation cost.

DKIM has been approved by the IETF as a draft standard (RFC 4871). The protocol was developed through the cooperation of Sendmail, Cisco Systems and Yahoo!

Since being approved by the IETF, a new open source project was started. The OpenDKIM Project is a community effort to develop and maintain a C library for producing DKIM-aware applications and an open source milter for providing DKIM service.

The project started from a code fork of version 2.8.3 of the open source dkim-milter package developed and maintained by Sendmail, Inc.

The Sendmail Sentrion Message Processing Engine comes standard with OpenDKIM. More information is available at opendkim.org and dkim.org