msmtp 1.8.26 is released


This release adds support for SCRAM-SHA-*-PLUS authentication, and prefers to use the SCRAM methods if they are available.
A Resent-From header, if present, is now taken into consideration when --read-envelope-from is used.
Translations were updated, thanks again to everyone at!

msmtp 1.8.25 is released


This is a bug fix release:

20 years of msmtp


On this day 20 years ago msmtp version 0.2.5 was released. This was the first public version.

It's been a long time, and I'm happy msmtp is still in use: there's a lot of msmtp packages out there, the Debian popcon numbers and Arch Linux relative usage numbers still suggest relevance, and msmtp copyright notices have popped up in many embedded system manuals and integrated software packages.

Most importantly: there is still regular feedback from users. This was always one of my main motivations for working on msmtp. Without your suggestions, bug reports and patches, msmtp would still be at version 0.2.5, and I would have learned nothing new, so I'd like to thank you all for the last 20 years, and I look forward to the coming years :)

msmtp 1.8.24 is released


This release fixes the allow_from_override command, adds the from_full_name command, fixes a few minor bugs and updates the translations (thanks again to everyone at

msmtp 1.8.23 is released


This release fixes XOAUTH2 authentication with some servers, updates the msmtpq scripts, and updates the translations (including a new Swedish translation).

msmtp 1.8.22 is released


This is a hotfix release that fixes building with libgsasl, which was accidentally broken in version 1.8.21 (released earlier today).
It also updates the msmtpq script.

msmtp 1.8.21 is released


Changes in this release:

Furthermore, a few minor problems were corrected and the documentation and translations were updated.

msmtp 1.8.20 is released


This release adds the configuration command allow_from_override.
Setting this to off prevents the -f command line option from overriding the envelope-from address set via the from configuration command.
This is useful for system-wide installations of msmtp that need to enforce the correct envelope-from address and potentially also the From header (via set_from_header on).

msmtp 1.8.19 is released


This release fixes a security problem in the minimal SMTP server msmtpd: mail addresses starting with a hyphen could be interpreted as command line options by the pipe command. This could be used to make the pipe command run arbitrary executables with the user id of the msmtpd process.

Note that msmtp itself is not affected. You are only affected if you run msmtpd without authentication and with a pipe command that does not end with -- (to separate options from arguments). Since msmtpd only accepts connections on the local interface by default, this bug can only be triggered by untrusted processes on your machine; it cannot be triggered over the network.

As a workaround, you can configure the msmtpd pipe command to end with --.
If you want to patch an older version instead of updating to 1.8.19, the relevant git commit is 2679609f72e27760f9785c3905f9943451b47a12 and this patch applies to all versions starting with 1.8.0 when used with patch -F3.

msmtp 1.8.18 is released


This release fixes a few minor problems related to translations and the documentation.

msmtp 1.8.17 is released


This release adds new options to the minimal SMTP server msmtpd to enable a new use case: now you can use it as a gateway between msmtp and mail software such as Thunderbird that cannot use msmtp directly and insists on using an SMTP server.
Similarly, the new minimal POP3 server mpopd (part of mpop) can now be used as a gateway between a local mail box on your disk and mail software that insists on using a POP3 server.
So now you can have full control over incoming and outgoing mail, including all the processing and filtering with any tools you want, while still using a mail client that does not give you these options itself.
See the msmtpd and mpopd documentation for examples.

msmtp 1.8.16 is released


With this release, the from command now accepts patterns (as in shell file name matching) so that many different envelope from addresses given on the command line can match the same account. The domain command now supports expansion of %H, %C and %M. The msmtpd daemon now supports sysexits.h error codes from the pipe command. For configurations using libtls instead of GnuTLS, the tls_fingerprint and tls_certcheck commands were fixed.

msmtp and starttls security


A recent security analysis of STARTTLS revealed many problems of STARTTLS (as opposed to immediate TLS) in mail clients and servers. The researchers published their fake mail server software that can be used for testing client software such as msmtp.
I used this software to test msmtp and found no problems, but I would be grateful if someone could double check this in case I missed something. Please let me know your results, I will update this news item accordingly!

Simon Josefsson on SCRAM authentication


Simon Josefsson wrote an article about the current state of authentication mechanisms. It highlights problems with the SCRAM family of methods, but also points out that SCRAM addresses some shortcomings of simpler mechanisms such as PLAIN. This is worth reading!

msmtp 1.8.15 is released


This release adds support for SCRAM-SHA-256 authentication via libgsasl thanks to Simon Josefsson. It also fixes a bug with %M in the envelope from address and updates translations.

About authentication methods: Update


A month ago, I questioned the value of newer authentication methods, in particular SCRAM-SHA-*, compared to simple PLAIN authentication over TLS, and concluded with "I really hope I'm wrong". Well, the good news is: I was wrong!

Here are the main points that convinced me:

These two points are enough to actually reverse my point of view completely: ideally every service should offer only SCRAM-SHA-* authentication and drop support for PLAIN and others, to enforce that these benefits become ubiquitous.

My thanks to everyone who sent me comments and helped to convince me!

Also, to clarify: with GNU SASL, msmtp and mpop support SCRAM-SHA-1 and in the next version will also support SCRAM-SHA-256.

Update 2021-01-30: This does not mean that SCRAM-SHA-* is without flaws. See this comment by Simon Josefsson, who is an expert in these matters.

Update 2021-06-15: Simon Josefsson wrote an article about authentication mechanisms. It highlights problems with SCRAM, but also points out that SCRAM addresses some shortcomings of simpler mechanisms such as PLAIN.

About authentication methods


This article asks why there are so many authentication methods when the simplest one works just fine.

There are several methods for password-based authentication with SMTP, POP3, IMAP and other protocols. The simplest one is PLAIN. It just sends user name and password, and that's it. The server side only needs to store a hash of the password, not the password itself, so it cannot be stolen from the server. The client side can store the password encrypted, so it cannot be stolen from the client either (in msmtp and mpop: use a keyring or use gpg with passwordeval). The transmission of the password is inside a TLS-secured session, so the client knows it is really talking to the right service and not to an attacker, and eavesdropping is prevented.

So, all problems are solved, right? But why then are there so many authentication methods? I have not found a convincing answer to this question yet. In the following, I will argue that even the relatively new SCRAM-SHA-256 method does not provide any practical benefit over PLAIN and is far more complex than it should be. If I am wrong, please send me a mail and correct me. I promise I will update this article with all the convincing arguments I receive.

My premise is that everyone is using TLS for every SMTP, POP3 or IMAP session nowadays, since there is no such thing as a trustworthy network.
So what benefits does SCRAM-SHA-256 promise? According to RFC 5802:

So what's left? Nothing. I really hope I'm wrong.

Update 2021-01-27: Here's the update I promised. The good news: I was wrong.

Update 2021-06-15: Simon Josefsson wrote an article about authentication mechanisms. It highlights problems with SCRAM, but also points out that SCRAM addresses some shortcomings of simpler mechanisms such as PLAIN.

msmtp 1.8.14 is released


This release adds support for the libtls library (provided by the LibreSSL project), thanks to Nihal Jere.
This is the third TLS library supported by msmtp. Use the --with-tls= option of the configure script to choose one. Here's an overview:

Furthermore, translations were updated. Thanks again to the translators at!

msmtp 1.8.13 is released


This release add support for XOAUTH2 authentication, the predecessor of OAUTHBEARER that is still in use. The passwordeval command can now handle long inputs for these methods. Furthermore, translations were updated. Thanks again to the translators at!

msmtp 1.8.12 is released


With this release, msmtpd supports session reuse and improves standard compliance, and automatic account matching in msmtp supports subaddresses. For example, will match account
Furthermore, translations were updated. Thanks again to the translators at!

msmtp permission denied errors: disable apparmor!


If you see "permission denied" errors with msmtp, please disable AppArmor to see if this fixes the problem: sudo aa-disable /etc/apparmor.d/usr.bin.msmtp
More information: unfortunately Debian and Ubuntu provide an AppArmor profile for msmtp that frequently breaks functionality, and in ways that are very hard to debug. Until they fix that profile, I can only recommend disabling it whenever you see a "permission denied" error that has no apparent reason.
The latest example affects OAUTH2 authentication. Thanks to Github user marcelolaia for figuring this out!

Update 2021-09-13:The Debian package for msmtp 1.8.15 now disables the AppArmor profile by default. The profile has received many improvements in the mean time, so it might make sense to enable it depending on your use case. Many thanks to the Debian contributors for their work!

msmtp 1.8.11 is released


This release adds the undisclosed_recipients command that replaces all To, Cc, and Bcc headers with a single "To: undisclosed-recipients:;" header. This is useful for example if you forward system mails and your mail provider does not accept headers like "To: root" or similar.
Furthermore, portability was improved. There should be no "permission denied" errors for temporary files on Windows systems anymore.
Translations were updated. Thanks again to the translators at!

msmtp with oauth2 for gmail


Christian Tenllado documented how to use msmtp with OAuth2 authentication for Gmail. Thanks!

msmtp 1.8.10 is released


This release fixes the msmtpq script that was accidentally broken in 1.8.8.
Furthermore, internationalization files are updated and a new serbian translation is included. Thanks to the translators at!
Note that version 1.8.9 only partially fixed the msmtpq problem and was quickly replaced by 1.8.10.

msmtp 1.8.8 is released


This version includes the folowing changes:

Furthermore, the translations were updated. Thanks to all translators at!

msmtp 1.8.7 is released


This version extends the from command that sets the envelope from address: the patterns %U, %H, %C, %M are now replaced with user name, host name, canonicalized host name, and the contents of /etc/mailname. This is useful for system-wide installations and is more powerful than the old auto_from and maildomain commands, which are now deprecated (but still supported, of course).

msmtp 1.8.6 is released


This version adds support for recursive alias expansion. Additionally, a few minor bugs were fixed.

msmtp 1.8.5 is released


This version fixes OAUTHBEARER authentication, adds support for TLS client certificates via PKCS11 devices such as smart cards, and fixes a few minor bugs.

msmtp 1.8.4 is released


This version adds support for the OAUTHBEARER authentication method and fixes a few minor bugs.



The git repository contains new support for the OAUTHBEARER authentication method, formerly known as XOAUTH2, a method pushed mainly by Google.
This means msmtp can now use an OAuth2 token for authentication by setting auth oauthbearer in the configuration file. The token is typically passed to msmtp via the passwordeval command since it changes regularly.
However, msmtp does not provide a way to generate such a token. This depends on your mail provider.
Since I do not use this method myself, it would be great if you could test this feature and maybe document how to generate the necessary token for your mail provider, so that I can add examples to the documentation.
Looking forward to your feedback!

Source code moved


The source code moved to, see the updated download instructions.
The reason is that gitlab vanished from Debian stable and there is no working upgrade path to the version in Debian backports. Sorry for the inconvenience.

msmtp 1.8.3 is released


This version fixes a security problem that affects version 1.8.2 (older versions are not affected): when the new default value system for tls_trust_file is used, the result of certificate verification was not properly checked.

Update 2019-02-14: This problem has been assigned CVE-2019-8337. This is the patch that fixes it (included in version 1.8.3).

msmtp 1.8.2 is released


This version simplifies configuration:

Additionally, there are several code cleanups and updates, and translations are now handled by the Translation Project. Many thanks to the translators!

msmtp 1.8.1 is released


This version fixes a bug that broke TLS 1.3 support.

If you do not want to upgrade to the 1.8 series yet but you need TLS 1.3 support, you can apply this patch to msmtp version 1.6.8 or 1.4.32.

msmtp 1.8.0 is released


This is the first release of the new stable release series. Noteworthy changes since 1.6.8:

msmtp 1.8.0rc1 is released


This is a release candidate for the upcoming 1.8.x stable release series. The following changes were made:

Using msmtp with OpenSSL is discouraged, please use GnuTLS


It is recommended to use msmtp with GnuTLS instead of OpenSSL. The upcoming version of msmtp will not use OpenSSL automatically anymore, and if you choose it manually, you will get a warning.

The reason for this is that the OpenSSL-related code in msmtp is essentially unmaintained. I don't work on it myself anymore, and the last time somebody sent a patch was 8 years ago. As a result, if you use msmtp with OpenSSL today, you don't get support for TLS SNI, --tls-priorities, --tls-crl-file, or --tls-min-dh-prime-bits.

The code is hard to read, maintain, and improve due to severe limitations in the usability and documentation of the OpenSSL API. A few examples:

Complexity is the enemy of security. I have given up on OpenSSL years ago and will not work to improve and update the OpenSSL-related code in msmtp. If someone wants to do that work, I will accept patches, but I will continue to recommend using GnuTLS instead. If the OpenSSL support in msmtp remains in its current state, it will eventually be removed.

New experimental feature: msmtpd, a minimal SMTP server


There is an experimental new feature in the git repository: msmtpd, a minimal SMTP server that listens on a local interface and pipes each incoming mail to msmtp (or a different program).
It is intended to be used with system services that expect an SMTP server on the local host and cannot be configured to use the sendmail interface that msmtp provides.
If you are interested, use configure --with-msmtpd to enable it, and let us know what you think.

msmtp 1.6.8 is released


New in this release:

msmtp 1.6.7 is released


New in this release:

Repository mirror


The main git repository at is now mirrored at

Project moved


After many years, this project moved from Sourceforge to a self-hosted gitlab instance:

Older news are stored in the news archive.