Haraka

Communication & Email

A highly scalable Node.js SMTP server with a modular plugin architecture for handling thousands of concurrent connections and delivering high‑throughput mail.

Track releases GitHub Website

JavaScript Latest v3.2.1 · 9d ago Security brief →

Features

Modular plugin system enabling custom behavior via JavaScript hooks
Highly scalable, supports thousands of concurrent SMTP connections
Built‑in spam protection plugins (DNSBLs, DKIM, SpamAssassin, rspamd, etc.)

Recent releases

View all 8 releases →

Review required

v3.2.0 Breaking risk 10d

Dependencies Breaking upgrade

address-rfc282 replacement

Open

Review required

v3.1.6 Breaking risk 19d

Dependencies Auth

Dependency removals

Open

v3.1.5 Bug fix 2mo

Fixed SMTP forward queue hook to call next() after delivery.

Full changelog

fix(smtp_forward): update AUTH to match WHATWG URL API #3546
fix(smtp_forward): queue hook now calls next() after delivery
— see haraka/message-stream#17
deps(all): bump versions to latest
test: refactor server, use smtp_client for all tests #3548
test runner is now node --test #3547
test(smtp_client, tls_socket, smtp_forward): 95% coverage #3546
ci: added explicit minimal permissions

View release on GitHub

v3.1.4 Breaking risk 2mo

Fixed crash on duplicate QUIT commands in outbound connections.

Full changelog

Fixed

fix: add ensure_body for late parse_body=true #3539
fix(outbound): prevent ERR_UNHANDLED_ERROR crash #3538
fix(txn): more robust handling of body filter additions #3537
fix(conn): avoid connection fault when 2x QUIT sent #3536
fix(txn): more robust handling of broken messages #3535
fix(connection): pause after odd SMTP command sequence #3525

Changed

chore(plugins): deleted deprecated core_require
dep(rabbitmq): repackaged as NPM module #3526
deps(all): bump versions
doc(Plugins): add sections filter, enrichment, and logging #3534
- added dropbox-plugin #3543
es2024: #3527, #3528
- outbound replace fs callback with promises and async/await #3528
- dep(async): remove dep by replacing async.map with Queue
- use startsWith instead of indexOf === 0
- use spread syntax instead of [].concat and {}.assign
- use implicit arrow function returns
- replace deprecated substr with slice or substring
test(outbound/queue): added tests #3531
test: fixes for test-fixtures 1.4 & local plugins that do require('./')
- TL;DR: bundled plugins don't need a special require any more
- fixtures/plugin behaves more like real one, test accordingly
- refactored connection, transaction, and outbound to node --test #3541
  - transaction.js (48 → 62 tests)
  - connection.js (24 → 51 tests)
  - moved ./test/outbound_* to ./test/outbound/, and fixed race conditions
- move TLS tests to haraka-tls #3542
- improve coverage for transaction, rfc1869, xclient, and record_envelope_addresses #3524