StreamSec Tools 4.x includes a complete mail protocol suite for Embarcadero Delphi ^TM: SMTP, POP3 and IMAP — each as both client and server — plus on-disk mailbox storage, account management, S/MIME, and the message authentication standards SPF, DKIM, DMARC and MTA-STS. Like the HTTPS layer, it is built directly on the library's own TLS stack, so transport security is part of the design rather than an afterthought.

Historically, Delphi applications sent mail through third-party SMTP components, with StreamSec supplying the TLS underneath. As of 4.1.2 the library covers the whole task itself — from composing a MIME message to running a standards-conforming mail server.

CLIENTS

• TsmSMTPClient — message submission with implicit TLS (465) or STARTTLS (587); SMTP AUTH on a cleartext connection is refused unconditionally, so credentials cannot leak by misconfiguration
• TsmPOP3Client and TsmIMAPClient — retrieval over implicit TLS or an upgraded connection; the IMAP client addresses messages by UID throughout, so another session expunging messages cannot renumber them underneath it

SERVERS

• TsmSMTPServer — a receiving MTA: inbound mail on port 25 with STARTTLS, authenticated submission on 587, and implicit-TLS SMTPS on 465. Local maildir delivery, or a disk-based spool with a retry schedule, delivery status notifications (RFC 3464 bounces), and onward delivery to a smarthost or directly to the destination's MX hosts
• TsmPOP3Server — POP3 with STLS on 110 and implicit TLS on 995
• TsmIMAPServer — IMAP4rev1 with IDLE and UIDPLUS, STARTTLS on 143 and implicit TLS on 993; ENVELOPE and BODYSTRUCTURE are answered by the same MIME parser that handles the messages, so the structure a client sees is the structure that is there
• No open relay by construction: relaying is denied by default and granted per listener role, per authenticated sender or per client certificate — and password mechanisms are never offered on cleartext connections

STORAGE AND ACCOUNTS

• TsmMailStore — Maildir++ mailboxes on disk with a crash-safe commit protocol (write, sync, rename); the same on-disk format Dovecot and Courier use, so an existing maildir tree can be imported as it stands
• TsmMailUsers — file-backed accounts with Argon2id password verifiers (RFC 9106), per-account lockout and timing-equalized verification; passwords are never stored, and the cost parameters can be raised on a live system without invalidating existing accounts
• One model throughout: an account, its mailbox and its client certificate are the same identity

MESSAGES AND S/MIME

• TsmEmail — RFC 5322 / MIME composer and parser that retains the exact octets of every parsed part until you change it — which is what makes multipart/signed verification work reliably where re-serializing parsers break the signature
• TstSMIMEBroker — S/MIME signing and encryption, both multipart/signed and opaque, on top of the library's CMS and certificate management

MESSAGE AUTHENTICATION AND DELIVERY POLICY

• DKIM signing and verification (RFC 6376), including ed25519-sha256 (RFC 8463)
• SPF evaluation (RFC 7208) and DMARC evaluation with strict identifier alignment
• MTA-STS (RFC 8461) policy discovery and enforcement for outbound delivery — the defence that makes a STARTTLS downgrade attack on the way to a destination detectable and refusable
• A built-in DNS resolver (DNS over TCP, RFC 7766), so none of the above depends on platform DNS APIs