IOC Mail Server 0.1.0 — release verification, 8 October 2026

Build:
  Windows x64, .NET SDK 10.0.401, runtime 10.0.12.
  Server, tray and GUI installer compile and publish.
  The EXE is self-contained and embeds a SHA-256-checked ZIP payload.
  No Authenticode publisher signature has been applied.

Protocol/security integration:
  See TEST-RESULTS.json for exact names and results.
  Real loopback SMTP/STARTTLS/SMTPS, IMAP, POP3 and HTTPS, with MailKit clients.
  Actual DKIM signing and cryptographic verification.
  Actual ClamAV engine tested with a harmless custom signature.
  Authentication, quota, relay denial, sender binding, CSRF, API keys,
  cross-tenant and cross-mailbox access, backup, FTS, flags and attachments.
  TLS trust in the test harness is pinned to the generated test certificate.

Published product browser testing:
  See BROWSER-RESULTS.json.
  Chromium 151, fresh isolated profile. The self-contained server executable
  was launched directly, with its bundled ClamAV supervisor.
  Official ClamAV main/daily/bytecode signatures loaded; Ready observed.
  Browser: login, compose/send with attachment, download, draft save/reload,
  measured dashboard, domain creation/DNS view, mailbox creation, every admin
  page, mobile width 390 px, dark theme, no JavaScript errors.
  Self-signed certificate errors were ignored only in the isolated browser
  test profile; no machine trust or browser security settings were changed.

Windows GUI:
  Actual generated Setup.exe launched, license page and data-directory page
  inspected through Windows accessibility and screenshots.
  Preview was closed before installation. No IOC production service, registry
  installation or firewall rule was installed on the development computer.

Dependency check:
  dotnet list server/IOC.Server.csproj package --vulnerable --include-transitive
  reported no vulnerable packages in the current NuGet advisory source.
  This is not a security audit.

Not verified:
  Clean install / service identity / ACL / uninstall / reboot in clean VMs;
  Windows 10/11 and Server 2019/2022/2025 compatibility matrix;
  external SMTP delivery to Gmail/Yandex/Mail.ru; public DNS and certificates;
  full IMAP RFC conformance; concurrent load, 100/1000/10000 mailbox capacity;
  penetration testing, fault injection or business continuity certification.

The product remains a pre-release MVP. Tests do not establish commercial
readiness or completeness against the supplied 55-section specification.
