fix: Fail receive_imf to not tombstone self-MDN if original message isn't found

feat: Apply self-MDN before tombstoning it
This way if the self-MDN isn't applied successfully, it can be received again and retried.
2026-05-09 09:56:31 +03:00 · 2026-05-01 07:15:03 -03:00 · 2026-05-01 07:15:03 -03:00 · 2026-05-01 07:15:03 -03:00 · 2026-05-01 07:15:03 -03:00 · 2026-05-01 07:15:03 -03:00
28 changed files with 604 additions and 327 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,8 +41,6 @@ jobs:
        shell: bash
      - name: Cache rust cargo artifacts
        uses: swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
-        with:
-          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Run rustfmt
        run: cargo fmt --all -- --check
      - name: Run clippy
@@ -94,8 +92,6 @@ jobs:
          persist-credentials: false
      - name: Cache rust cargo artifacts
        uses: swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
-        with:
-          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Rustdoc
        run: cargo doc --document-private-items --no-deps

@@ -139,8 +135,6 @@ jobs:

      - name: Cache rust cargo artifacts
        uses: swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
-        with:
-          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Install nextest
        uses: taiki-e/install-action@5f57d6cb7cd20b14a8a27f522884c4bc8a187458
@@ -175,8 +169,6 @@ jobs:

      - name: Cache rust cargo artifacts
        uses: swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
-        with:
-          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Build C library
        run: cargo build -p deltachat_ffi
@@ -203,8 +195,6 @@ jobs:

      - name: Cache rust cargo artifacts
        uses: swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
-        with:
-          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Build deltachat-rpc-server
        run: cargo build -p deltachat-rpc-server
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -36,7 +36,7 @@ checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
 "cfg-if",
 "cipher",
- "cpufeatures 0.2.17",
+ "cpufeatures",
 ]

 [[package]]
@@ -136,7 +136,7 @@ checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
 dependencies = [
 "base64ct",
 "blake2",
- "cpufeatures 0.2.17",
+ "cpufeatures",
 "password-hash",
 "zeroize",
 ]
@@ -497,16 +497,16 @@ dependencies = [

 [[package]]
 name = "blake3"
-version = "1.8.5"
+version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0aa83c34e62843d924f905e0f5c866eb1dd6545fc4d719e803d9ba6030371fce"
+checksum = "2468ef7d57b3fb7e16b576e8377cdbde2320c60e1491e961d11da40fc4f02a2d"
 dependencies = [
 "arrayref",
 "arrayvec",
 "cc",
 "cfg-if",
 "constant_time_eq 0.4.2",
- "cpufeatures 0.3.0",
+ "cpufeatures",
 ]

 [[package]]
@@ -799,7 +799,7 @@ checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
 dependencies = [
 "cfg-if",
 "cipher",
- "cpufeatures 0.2.17",
+ "cpufeatures",
 ]

 [[package]]
@@ -934,9 +934,9 @@ checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"

 [[package]]
 name = "colorutils-rs"
-version = "0.8.0"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69abc9a8ed011e2b7946769f460b9e76e8b659ece9ef4001b9d8bba3489f796d"
+checksum = "6e2fc25857fa523662de5cae84225b0e7bfb24a2a3f9ed8802fecf03df7252b1"
 dependencies = [
 "erydanos",
 "half",
@@ -1011,15 +1011,6 @@ dependencies = [
 "libc",
 ]

-[[package]]
-name = "cpufeatures"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "crc"
 version = "3.2.1"
@@ -1225,7 +1216,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
 dependencies = [
 "cfg-if",
- "cpufeatures 0.2.17",
+ "cpufeatures",
 "curve25519-dalek-derive",
 "digest",
 "fiat-crypto",
@@ -1301,9 +1292,9 @@ dependencies = [

 [[package]]
 name = "data-encoding"
-version = "2.11.0"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
+checksum = "d7a1e2f27636f116493b8b860f5546edb47c8d8f8ea73e1d2a20be88e28d1fea"

 [[package]]
 name = "dbl"
@@ -2610,9 +2601,9 @@ dependencies = [

 [[package]]
 name = "hyper"
-version = "1.9.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6299f016b246a94207e63da54dbe807655bf9e00044f73ded42c3ac5305fbcca"
+checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
 dependencies = [
 "atomic-waker",
 "bytes",
@@ -2625,6 +2616,7 @@ dependencies = [
 "httpdate",
 "itoa",
 "pin-project-lite",
+ "pin-utils",
 "smallvec",
 "tokio",
 "want",
@@ -2662,7 +2654,7 @@ dependencies = [
 "hyper",
 "libc",
 "pin-project-lite",
- "socket2 0.6.3",
+ "socket2 0.6.0",
 "tokio",
 "tower-service",
 "tracing",
@@ -3254,7 +3246,7 @@ version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
 dependencies = [
- "cpufeatures 0.2.17",
+ "cpufeatures",
 ]

 [[package]]
@@ -3268,9 +3260,9 @@ dependencies = [

 [[package]]
 name = "libc"
-version = "0.2.186"
+version = "0.2.184"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+checksum = "48f5d2a454e16a5ea0f4ced81bd44e4cfc7bd3a507b61887c99fd3538b28e4af"

 [[package]]
 name = "libm"
@@ -3461,13 +3453,13 @@ dependencies = [

 [[package]]
 name = "mio"
-version = "1.2.0"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
+checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
 dependencies = [
 "libc",
 "wasi 0.11.0+wasi-snapshot-preview1",
- "windows-sys 0.61.1",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -4420,7 +4412,7 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
 dependencies = [
- "cpufeatures 0.2.17",
+ "cpufeatures",
 "opaque-debug",
 "universal-hash",
 ]
@@ -4432,7 +4424,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
 dependencies = [
 "cfg-if",
- "cpufeatures 0.2.17",
+ "cpufeatures",
 "opaque-debug",
 "universal-hash",
 ]
@@ -5516,7 +5508,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f5058ada175748e33390e40e872bd0fe59a19f265d0158daa551c5a88a76009c"
 dependencies = [
 "cfg-if",
- "cpufeatures 0.2.17",
+ "cpufeatures",
 "digest",
 ]

@@ -5527,7 +5519,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
 "cfg-if",
- "cpufeatures 0.2.17",
+ "cpufeatures",
 "digest",
 ]

@@ -5555,7 +5547,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
 "cfg-if",
- "cpufeatures 0.2.17",
+ "cpufeatures",
 "digest",
 ]

@@ -5733,12 +5725,12 @@ dependencies = [

 [[package]]
 name = "socket2"
-version = "0.6.3"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
+checksum = "233504af464074f9d066d7b5416c5f9b894a5862a6506e306f7b816cdd6f1807"
 dependencies = [
 "libc",
- "windows-sys 0.61.1",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@@ -6152,9 +6144,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"

 [[package]]
 name = "tokio"
-version = "1.52.1"
+version = "1.50.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b67dee974fe86fd92cc45b7a95fdd2f99a36a6d7b0d431a231178d3d670bbcc6"
+checksum = "27ad5e34374e03cfffefc301becb44e9dc3c17584f414349ebe29ed26661822d"
 dependencies = [
 "bytes",
 "libc",
@@ -6162,7 +6154,7 @@ dependencies = [
 "parking_lot",
 "pin-project-lite",
 "signal-hook-registry",
- "socket2 0.6.3",
+ "socket2 0.6.0",
 "tokio-macros",
 "windows-sys 0.61.1",
 ]
@@ -6179,9 +6171,9 @@ dependencies = [

 [[package]]
 name = "tokio-macros"
-version = "2.7.0"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
 dependencies = [
 "proc-macro2",
 "quote",
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -53,7 +53,7 @@ blake3 = "1.8.2"
 brotli = { version = "8", default-features=false, features = ["std"] }
 bytes = "1"
 chrono = { workspace = true, features = ["alloc", "clock", "std"] }
-colorutils-rs = { version = "0.8.0", default-features = false }
+colorutils-rs = { version = "0.7.5", default-features = false }
 data-encoding = "2.9.0"
 escaper = "0.1"
 fast-socks5 = "1"
--- a/deltachat-ffi/deltachat.h
+++ b/deltachat-ffi/deltachat.h
@@ -413,6 +413,11 @@ char*           dc_get_blobdir               (const dc_context_t* context);
 *                    Messages in the "saved messages" chat (see dc_chat_is_self_talk()) are skipped.
 *                    Messages are deleted whether they were seen or not, the UI should clearly point that out.
 *                    See also dc_estimate_deletion_cnt().
+ * - `delete_server_after` = 0=do not delete messages from server automatically (default),
+ *                    1=delete messages directly after receiving from server, mvbox is skipped.
+ *                    >1=seconds, after which messages are deleted automatically from the server, mvbox is used as defined.
+ *                    "Saved messages" are deleted from the server as well as emails, the UI should clearly point that out.
+ *                    See also dc_estimate_deletion_cnt().
 * - `media_quality` = DC_MEDIA_QUALITY_BALANCED (0) =
 *                    good outgoing images/videos/voice quality at reasonable sizes (default)
 *                    DC_MEDIA_QUALITY_WORSE (1)
@@ -1456,16 +1461,16 @@ dc_chatlist_t*     dc_get_similar_chatlist   (dc_context_t* context, uint32_t ch

 /**
 * Estimate the number of messages that will be deleted
- * by the dc_set_config()-option `delete_device_after`.
+ * by the dc_set_config()-options `delete_device_after` or `delete_server_after`.
 * This is typically used to show the estimated impact to the user
 * before actually enabling deletion of old messages.
 *
 * @memberof dc_context_t
 * @param context The context object as returned from dc_context_new().
- * @param from_server Deprecated, pass 0 here
+ * @param from_server 1=Estimate deletion count for server, 0=Estimate deletion count for device
 * @param seconds Count messages older than the given number of seconds.
 * @return Number of messages that are older than the given number of seconds.
- *     Messages in the "Saved Messages" chat are not counted as they will not be deleted automatically.
+ *     Messages in the "saved messages" folder are not counted as they will not be deleted automatically.
 */
 int             dc_estimate_deletion_cnt    (dc_context_t* context, int from_server, int64_t seconds);

--- a/deltachat-jsonrpc/src/api.rs
+++ b/deltachat-jsonrpc/src/api.rs
@@ -735,19 +735,10 @@ impl CommandApi {
        Ok(msg_ids)
    }

-    /// Estimates the number of messages that will be deleted
-    /// by the `set_config()`-option `delete_device_after`.
-    ///
+    /// Estimate the number of messages that will be deleted
+    /// by the set_config()-options `delete_device_after` or `delete_server_after`.
    /// This is typically used to show the estimated impact to the user
    /// before actually enabling deletion of old messages.
-    ///
-    /// Messages in the "Saved Messages" chat are not counted as they will not be deleted automatically.
-    ///
-    /// Parameters:
-    /// - `from_server`: Deprecated, pass `false` here
-    /// - `seconds`: Count messages older than the given number of seconds.
-    ///
-    /// Returns the number of messages that are older than the given number of seconds.
    async fn estimate_auto_deletion_count(
        &self,
        account_id: u32,
--- a/deltachat-rpc-client/tests/test_folders.py
+++ b/deltachat-rpc-client/tests/test_folders.py
@@ -14,13 +14,10 @@ def test_moved_markseen(acfactory, direct_imap, log):
    ac2.add_or_update_transport({"addr": addr, "password": password})
    ac2.bring_online()

-    # Make sure that messages are not immediately auto-deleted on the server:
-    ac1.set_config("bcc_self", "1")
-    ac2.set_config("bcc_self", "1")
-
    log.section("ac2: creating DeltaChat folder")
    ac2_direct_imap = direct_imap(ac2)
    ac2_direct_imap.create_folder("DeltaChat")
+    ac2.set_config("delete_server_after", "0")
    ac2.set_config("sync_msgs", "0")  # Do not send a sync message when accepting a contact request.

    ac2.add_or_update_transport({"addr": addr, "password": password, "imapFolder": "DeltaChat"})
@@ -60,9 +57,11 @@ def test_moved_markseen(acfactory, direct_imap, log):
 def test_markseen_message_and_mdn(acfactory, direct_imap):
    ac1, ac2 = acfactory.get_online_accounts(2)

-    # Make sure that messages are not immediately auto-deleted on the server:
-    ac1.set_config("bcc_self", "1")
-    ac2.set_config("bcc_self", "1")
+    for ac in ac1, ac2:
+        ac.set_config("delete_server_after", "0")
+
+    # Do not send BCC to self, we only want to test MDN on ac1.
+    ac1.set_config("bcc_self", "0")

    acfactory.get_accepted_chat(ac1, ac2).send_text("hi")
    msg = ac2.wait_for_incoming_msg()
@@ -82,18 +81,17 @@ def test_markseen_message_and_mdn(acfactory, direct_imap):
    ac1_direct_imap.select_folder("INBOX")
    ac2_direct_imap.select_folder("INBOX")

-    # Check that the mdn and original message is marked as seen
-    assert len(list(ac1_direct_imap.conn.fetch(AND(seen=True), mark_seen=False))) == 2
-    assert len(list(ac2_direct_imap.conn.fetch(AND(seen=True), mark_seen=False))) == 2
+    # Check that the mdn is marked as seen
+    assert len(list(ac1_direct_imap.conn.fetch(AND(seen=True), mark_seen=False))) == 1
+    # Check original message is marked as seen
+    assert len(list(ac2_direct_imap.conn.fetch(AND(seen=True), mark_seen=False))) == 1


 def test_trash_multiple_messages(acfactory, direct_imap, log):
    ac1, ac2 = acfactory.get_online_accounts(2)
    ac2.stop_io()

-    # Make sure that messages are not immediately auto-deleted on the server:
-    ac2.set_config("bcc_self", "1")
-
+    ac2.set_config("delete_server_after", "0")
    ac2.set_config("sync_msgs", "0")

    ac2.start_io()
--- a/deltachat-rpc-client/tests/test_multidevice.py
+++ b/deltachat-rpc-client/tests/test_multidevice.py
@@ -4,29 +4,39 @@ from deltachat_rpc_client import EventType
 from deltachat_rpc_client.const import MessageState


-def test_bcc_self_is_enabled_when_setting_up_second_device(acfactory):
+def test_bcc_self_delete_server_after_defaults(acfactory):
+    """Test default values for bcc_self and delete_server_after."""
    ac = acfactory.get_online_account()

    # Initially after getting online
    # the setting bcc_self is set to 0 because there is only one device
+    # and delete_server_after is "1", meaning immediate deletion.
    assert ac.get_config("bcc_self") == "0"
+    assert ac.get_config("delete_server_after") == "1"

    # Setup a second device.
    ac_clone = ac.clone()
    ac_clone.bring_online()

-    # Second device setup enables bcc_self.
+    # Second device setup
+    # enables bcc_self and changes default delete_server_after.
    assert ac.get_config("bcc_self") == "1"
-    assert ac_clone.get_config("bcc_self") == "1"
+    assert ac.get_config("delete_server_after") == "0"

-    # Test manually disabling bcc_self
+    assert ac_clone.get_config("bcc_self") == "1"
+    assert ac_clone.get_config("delete_server_after") == "0"
+
+    # Manually disabling bcc_self
+    # also restores the default for delete_server_after.
    ac.set_config("bcc_self", "0")
    assert ac.get_config("bcc_self") == "0"
+    assert ac.get_config("delete_server_after") == "1"

-    # Cloning the account again enables bcc_self again
+    # Cloning the account again enables bcc_self
    # even though it was manually disabled.
    ac_clone = ac.clone()
    assert ac.get_config("bcc_self") == "1"
+    assert ac.get_config("delete_server_after") == "0"


 def test_one_account_send_bcc_setting(acfactory, log, direct_imap):
--- a/deltachat-rpc-client/tests/test_something.py
+++ b/deltachat-rpc-client/tests/test_something.py
@@ -348,7 +348,7 @@ def test_receive_imf_failure(acfactory) -> None:
        snapshot.text == "❌ Failed to receive a message:"
        " Condition failed: `!context.get_config_bool(Config::SimulateReceiveImfError).await?`."
        f" Core version {version}."
-        " Please report this bug to delta@merlinux.eu or https://support.delta.chat/."
+        " Please report this bug to delta@merlinux.eu or https://support.delta.chat/"
    )

    # The failed message doesn't break the IMAP loop.
@@ -1232,12 +1232,11 @@ def test_leave_and_delete_group(acfactory, log):


 def test_immediate_autodelete(acfactory, direct_imap, log):
-    """
-    `bcc_self` is off by default,
-    so that messages are supposed to be immediately autodeleted
-    """
    ac1, ac2 = acfactory.get_online_accounts(2)

+    # "1" means delete immediately, while "0" means do not delete
+    ac2.set_config("delete_server_after", "1")
+
    log.section("ac1: create chat with ac2")
    chat1 = ac1.create_chat(ac2)
    ac2.create_chat(ac1)
--- a/deny.toml
+++ b/deny.toml
@@ -33,17 +33,7 @@ ignore = [
    # We do not check CRL and cannot update rustls-webpki 0.102.8 
    # which is a dependency of iroh 0.35.0.
    # <https://rustsec.org/advisories/RUSTSEC-2026-0104>
-    "RUSTSEC-2026-0104",
-
-    # hickory-proto 0.25.2 unbounded loop in DNSSEC code.
-    # Dependency of iroh 0.35.0, cannot be updated as of 2026-05-02.
-    # <https://rustsec.org/advisories/RUSTSEC-2026-0118>
-    "RUSTSEC-2026-0118",
-
-    # hickory-proto 0.25.2 quadratic complexity issue.
-    # Dependency of iroh 0.35.0, cannot be updated as of 2026-05-02.
-    # <https://rustsec.org/advisories/RUSTSEC-2026-0119>
-    "RUSTSEC-2026-0119"
+    "RUSTSEC-2026-0104"
 ]

 [bans]
@@ -55,7 +45,6 @@ skip = [
     { name = "async-channel", version = "1.9.0" },
     { name = "bitflags", version = "1.3.2" },
     { name = "constant_time_eq", version = "0.3.1" },
-     { name = "cpufeatures", version = "0.2.17" },
     { name = "derive_more-impl", version = "1.0.0" },
     { name = "derive_more", version = "1.0.0" },
     { name = "event-listener", version = "2.5.3" },
--- a/python/src/deltachat/testplugin.py
+++ b/python/src/deltachat/testplugin.py
@@ -521,6 +521,7 @@ class ACFactory:
        assert "addr" in configdict and "mail_pw" in configdict, configdict
        configdict.setdefault("bcc_self", False)
        configdict.setdefault("sync_msgs", False)
+        configdict.setdefault("delete_server_after", 0)
        ac.update_config(configdict)
        self._acsetup._account2config[ac] = configdict
        self._preconfigure_key(ac)
--- a/python/tests/test_0_complex_or_slow.py
+++ b/python/tests/test_0_complex_or_slow.py
@@ -298,6 +298,73 @@ def test_use_new_verified_group_after_going_online(acfactory, data, tmp_path, lp
    assert msg_in.text == msg_out.text


+def test_verified_group_vs_delete_server_after(acfactory, tmp_path, lp):
+    """Test for the issue #4346:
+    - User is added to a verified group.
+    - First device of the user downloads "member added" from the group.
+    - First device removes "member added" from the server.
+    - Some new messages are sent to the group.
+    - Second device comes online, receives these new messages.
+      The result is an unverified group with unverified members.
+    - First device re-gossips Autocrypt keys to the group.
+    - Now the second device has all members and group verified.
+    """
+    ac1, ac2 = acfactory.get_online_accounts(2)
+    acfactory.remove_preconfigured_keys()
+    ac2_offl = acfactory.new_online_configuring_account(cloned_from=ac2)
+    for ac in [ac2, ac2_offl]:
+        ac.set_config("bcc_self", "1")
+    ac2.set_config("delete_server_after", "1")
+    ac2.set_config("gossip_period", "0")  # Re-gossip in every message
+    acfactory.bring_accounts_online()
+    dir = tmp_path / "exportdir"
+    dir.mkdir()
+    ac2.export_self_keys(str(dir))
+    ac2_offl.import_self_keys(str(dir))
+    ac2_offl.stop_io()
+
+    lp.sec("ac1: create verified-group QR, ac2 scans and joins")
+    chat1 = ac1.create_group_chat("hello")
+    qr = chat1.get_join_qr()
+    lp.sec("ac2: start QR-code based join-group protocol")
+    chat2 = ac2.qr_join_chat(qr)
+    ac1._evtracker.wait_securejoin_inviter_progress(1000)
+    # Wait for "Member Me (<addr>) added by <addr>." message.
+    msg_in = ac2._evtracker.wait_next_incoming_message()
+    assert msg_in.is_system_message()
+
+    lp.sec("ac2: waiting for 'member added' to be deleted on the server")
+    ac2._evtracker.get_matching("DC_EVENT_IMAP_MESSAGE_DELETED")
+
+    lp.sec("ac1: sending 'hi' to the group")
+    ac2.set_config("delete_server_after", "0")
+    chat1.send_text("hi")
+
+    lp.sec("ac2_offl: going online, checking the 'hi' message")
+    ac2_offl.start_io()
+    msg_in = ac2_offl._evtracker.wait_next_incoming_message()
+    assert not msg_in.is_system_message()
+    assert msg_in.text == "hi"
+    ac2_offl_ac1_contact = msg_in.get_sender_contact()
+    assert ac2_offl_ac1_contact.addr == ac1.get_config("addr")
+    assert not ac2_offl_ac1_contact.is_verified()
+    chat2_offl = msg_in.chat
+
+    lp.sec("ac2: sending message re-gossiping Autocrypt keys")
+    chat2.send_text("hi2")
+
+    lp.sec("ac2_offl: receiving message")
+    ev = ac2_offl._evtracker.get_matching("DC_EVENT_INCOMING_MSG|DC_EVENT_MSGS_CHANGED")
+    msg_in = ac2_offl.get_message_by_id(ev.data2)
+    assert not msg_in.is_system_message()
+    assert msg_in.text == "hi2"
+    assert msg_in.chat == chat2_offl
+    assert msg_in.get_sender_contact().addr == ac2.get_config("addr")
+    # Until we reset verifications and then send the _verified header,
+    # verification is not gossiped here:
+    assert not ac2_offl_ac1_contact.is_verified()
+
+
 def test_deleted_msgs_dont_reappear(acfactory):
    ac1 = acfactory.new_online_configuring_account()
    acfactory.bring_accounts_online()
--- a/python/tests/test_1_online.py
+++ b/python/tests/test_1_online.py
@@ -15,9 +15,6 @@ def test_basic_imap_api(acfactory, tmp_path):
    ac1, ac2 = acfactory.get_online_accounts(2)
    chat12 = acfactory.get_accepted_chat(ac1, ac2)

-    # Make sure that messages are not immediately auto-deleted on the server:
-    ac2.set_config("bcc_self", "1")
-
    imap2 = ac2.direct_imap

    with imap2.idle() as idle2:
@@ -165,9 +162,6 @@ def test_webxdc_message(acfactory, data, lp):
    ac1, ac2 = acfactory.get_online_accounts(2)
    chat = acfactory.get_accepted_chat(ac1, ac2)

-    # Make sure that messages are not immediately auto-deleted on the server:
-    ac2.set_config("bcc_self", "1")
-
    lp.sec("ac1: prepare and send text message to ac2")
    msg1 = chat.send_text("message0")
    assert not msg1.is_webxdc()
@@ -368,10 +362,6 @@ def test_send_and_receive_message_markseen(acfactory, lp):
    # make DC's life harder wrt to encodings
    ac1.set_config("displayname", "ä name")

-    # Make sure that messages are not immediately auto-deleted on the server:
-    ac1.set_config("bcc_self", "1")
-    ac2.set_config("bcc_self", "1")
-
    # clear any fresh device messages
    ac1.get_device_chat().mark_noticed()
    ac2.get_device_chat().mark_noticed()
@@ -516,15 +506,9 @@ def test_mdn_asymmetric(acfactory, lp):
    ac1.set_config("mdns_enabled", "1")
    ac2.set_config("mdns_enabled", "1")

-    # Make sure that the mdn is not immediately auto-deleted on the server:
-    ac1.set_config("bcc_self", "1")
-
    lp.sec("sending text message from ac1 to ac2")
    msg_out = chat.send_text("message1")

-    # Wait for the message to be marked as seen on IMAP.
-    ac1._evtracker.get_info_contains("Marked messages [0-9]+ in folder INBOX as seen.")
-
    assert len(chat.get_messages()) == 1 + E2EE_INFO_MSGS

    lp.sec("disable ac1 MDNs")
@@ -541,7 +525,7 @@ def test_mdn_asymmetric(acfactory, lp):
    lp.sec("ac1: waiting for incoming activity")
    assert len(chat.get_messages()) == 1 + E2EE_INFO_MSGS

-    # Wait for the mdn to be marked as seen on IMAP.
+    # Wait for the message to be marked as seen on IMAP.
    ac1._evtracker.get_info_contains("Marked messages [0-9]+ in folder INBOX as seen.")

    # MDN is received even though MDNs are already disabled
@@ -1089,8 +1073,6 @@ def test_send_receive_locations(acfactory, lp):

 def test_delete_multiple_messages(acfactory, lp):
    ac1, ac2 = acfactory.get_online_accounts(2)
-    # Make sure that messages are not immediately auto-deleted on the server:
-    ac2.set_config("bcc_self", "1")
    chat12 = acfactory.get_accepted_chat(ac1, ac2)

    lp.sec("ac1: sending seven messages")
--- a/scripts/update-provider-database.sh
+++ b/scripts/update-provider-database.sh
@@ -6,7 +6,7 @@ set -euo pipefail
 export TZ=UTC

 # Provider database revision.
-REV=2cba4b72f4c6e6417b83ba549aff7781be5f166c
+REV=ad097ee40579c884e7757de2d3bb0a51f481a32a

 CORE_ROOT="$PWD"
 TMP="$(mktemp -d)"
--- a/src/config.rs
+++ b/src/config.rs
@@ -194,6 +194,17 @@ pub enum Config {
    #[strum(props(default = "0"))] // also change MediaQuality.default() on changes
    MediaQuality,

+    /// Timer in seconds after which the message is deleted from the
+    /// server.
+    ///
+    /// 0 means messages are never deleted by Delta Chat.
+    ///
+    /// Value 1 is treated as "delete at once": messages are deleted
+    /// immediately, without moving to DeltaChat folder.
+    ///
+    /// Default is 1 for chatmail accounts without `BccSelf`, 0 otherwise.
+    DeleteServerAfter,
+
    /// Timer in seconds after which the message is deleted from the
    /// device.
    ///
@@ -543,6 +554,14 @@ impl Context {
        // Default values
        let val = match key {
            Config::ConfiguredInboxFolder => Some("INBOX".to_string()),
+            Config::DeleteServerAfter => {
+                match !Box::pin(self.get_config_bool(Config::BccSelf)).await?
+                    && Box::pin(self.is_chatmail()).await?
+                {
+                    true => Some("1".to_string()),
+                    false => Some("0".to_string()),
+                }
+            }
            Config::Addr => self.get_config_opt(Config::ConfiguredAddr).await?,
            _ => key.get_str("default").map(|s| s.to_string()),
        };
@@ -623,6 +642,23 @@ impl Context {
        self.get_config_bool(Config::MdnsEnabled).await
    }

+    /// Gets configured "delete_server_after" value.
+    ///
+    /// `None` means never delete the message, `Some(0)` means delete
+    /// at once, `Some(x)` means delete after `x` seconds.
+    pub async fn get_config_delete_server_after(&self) -> Result<Option<i64>> {
+        let val = match self
+            .get_config_parsed::<i64>(Config::DeleteServerAfter)
+            .await?
+            .unwrap_or(0)
+        {
+            0 => None,
+            1 => Some(0),
+            x => Some(x),
+        };
+        Ok(val)
+    }
+
    /// Gets the configured provider.
    ///
    /// The provider is determined by the current primary transport.
--- a/src/config/config_tests.rs
+++ b/src/config/config_tests.rs
@@ -142,6 +142,28 @@ async fn test_mdns_default_behaviour() -> Result<()> {
    Ok(())
 }

+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn test_delete_server_after_default() -> Result<()> {
+    let t = &TestContext::new_alice().await;
+
+    // Check that the settings are displayed correctly.
+    assert_eq!(t.get_config(Config::BccSelf).await?, Some("1".to_string()));
+    assert_eq!(
+        t.get_config(Config::DeleteServerAfter).await?,
+        Some("0".to_string())
+    );
+
+    // Leaving emails on the server even w/o `BccSelf` is a good default at least because other
+    // MUAs do so even if the server doesn't save sent messages to some sentbox (like Gmail
+    // does).
+    t.set_config_bool(Config::BccSelf, false).await?;
+    assert_eq!(
+        t.get_config(Config::DeleteServerAfter).await?,
+        Some("0".to_string())
+    );
+    Ok(())
+}
+
 const SAVED_MESSAGES_DEDUPLICATED_FILE: &str = "969142cb84015bc135767bc2370934a.png";

 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
--- a/src/context.rs
+++ b/src/context.rs
@@ -973,6 +973,12 @@ impl Context {
                .await?
                .to_string(),
        );
+        res.insert(
+            "delete_server_after",
+            self.get_config_int(Config::DeleteServerAfter)
+                .await?
+                .to_string(),
+        );
        res.insert(
            "last_housekeeping",
            self.get_config_int(Config::LastHousekeeping)
--- a/src/download.rs
+++ b/src/download.rs
@@ -15,6 +15,12 @@ use crate::{EventType, chatlist_events};
 pub(crate) mod post_msg_metadata;
 pub(crate) use post_msg_metadata::PostMsgMetadata;

+/// If a message is downloaded only partially
+/// and `delete_server_after` is set to small timeouts (eg. "at once"),
+/// the user might have no chance to actually download that message.
+/// `MIN_DELETE_SERVER_AFTER` increases the timeout in this case.
+pub(crate) const MIN_DELETE_SERVER_AFTER: i64 = 48 * 60 * 60;
+
 /// From this point onward outgoing messages are considered large
 /// and get a Pre-Message, which announces the Post-Message.
 /// This is only about sending so we can modify it any time.
--- a/src/ephemeral.rs
+++ b/src/ephemeral.rs
@@ -23,15 +23,16 @@
 //! ## Device settings
 //!
 //! In addition to per-chat ephemeral message setting, each device has
-//! a global user-configured setting that complements per-chat
-//! settings, `delete_device_after`.
-//! This setting is not synchronized among devices and applies to all
+//! two global user-configured settings that complement per-chat
+//! settings: `delete_device_after` and `delete_server_after`. These
+//! settings are not synchronized among devices and apply to all
 //! messages known to the device, including messages sent or received
 //! before configuring the setting.
 //!
 //! `delete_device_after` configures the maximum time device is
-//! storing the messages locally,
-//! but does not delete messages from the server.
+//! storing the messages locally. `delete_server_after` configures the
+//! time after which device will delete the messages it knows about
+//! from the server.
 //!
 //! ## How messages are deleted
 //!
@@ -59,8 +60,9 @@
 //!
 //! Server deletion happens by updating the `imap` table based on
 //! the database entries which are expired either according to their
-//! ephemeral message timers.
+//! ephemeral message timers or global `delete_server_after` setting.

+use std::cmp::max;
 use std::collections::BTreeSet;
 use std::fmt;
 use std::num::ParseIntError;
@@ -76,6 +78,7 @@ use crate::chat::{ChatId, ChatIdBlocked, send_msg};
 use crate::constants::{DC_CHAT_ID_LAST_SPECIAL, DC_CHAT_ID_TRASH};
 use crate::contact::ContactId;
 use crate::context::Context;
+use crate::download::MIN_DELETE_SERVER_AFTER;
 use crate::events::EventType;
 use crate::log::{LogExt, warn};
 use crate::message::{Message, MessageState, MsgId, Viewtype};
@@ -648,8 +651,23 @@ pub(crate) async fn ephemeral_loop(context: &Context, interrupt_receiver: Receiv
 }

 /// Schedules expired IMAP messages for deletion.
+#[expect(clippy::arithmetic_side_effects)]
 pub(crate) async fn delete_expired_imap_messages(context: &Context) -> Result<()> {
    let now = time();
+
+    let (threshold_timestamp, threshold_timestamp_extended) =
+        match context.get_config_delete_server_after().await? {
+            None => (0, 0),
+            Some(delete_server_after) => (
+                match delete_server_after {
+                    // Guarantee immediate deletion.
+                    0 => i64::MAX,
+                    _ => now - delete_server_after,
+                },
+                now - max(delete_server_after, MIN_DELETE_SERVER_AFTER),
+            ),
+        };
+
    context
        .sql
        .execute(
@@ -657,9 +675,11 @@ pub(crate) async fn delete_expired_imap_messages(context: &Context) -> Result<()
             SET target=''
             WHERE rfc724_mid IN (
               SELECT rfc724_mid FROM msgs
-               WHERE ephemeral_timestamp != 0 AND ephemeral_timestamp <= ?
+               WHERE ((download_state = 0 AND timestamp < ?) OR
+                      (download_state != 0 AND timestamp < ?) OR
+                      (ephemeral_timestamp != 0 AND ephemeral_timestamp <= ?))
             )",
-            (now,),
+            (threshold_timestamp, threshold_timestamp_extended, now),
        )
        .await?;

--- a/src/ephemeral/ephemeral_tests.rs
+++ b/src/ephemeral/ephemeral_tests.rs
@@ -455,6 +455,7 @@ async fn test_delete_expired_imap_messages() -> Result<()> {
    let uidvalidity = 12345;
    for (id, timestamp, ephemeral_timestamp) in &[
        (900, now - 2 * HOUR, 0),
+        (1000, now - 23 * HOUR - MIN_DELETE_SERVER_AFTER, 0),
        (1010, now - 23 * HOUR, 0),
        (1020, now - 21 * HOUR, 0),
        (1030, now - 19 * HOUR, 0),
@@ -511,6 +512,29 @@ async fn test_delete_expired_imap_messages() -> Result<()> {
        0
    );

+    t.set_config(Config::DeleteServerAfter, Some(&*(25 * HOUR).to_string()))
+        .await?;
+    delete_expired_imap_messages(&t).await?;
+    test_marked_for_deletion(&t, 1000).await?;
+
+    MsgId::new(1000)
+        .update_download_state(&t, DownloadState::Available)
+        .await?;
+    t.sql
+        .execute("UPDATE imap SET target=folder WHERE rfc724_mid='1000'", ())
+        .await?;
+    delete_expired_imap_messages(&t).await?;
+    test_marked_for_deletion(&t, 1000).await?; // Delete downloadable anyway.
+    remove_uid(&t, 1000).await?;
+
+    t.set_config(Config::DeleteServerAfter, Some(&*(22 * HOUR).to_string()))
+        .await?;
+    delete_expired_imap_messages(&t).await?;
+    test_marked_for_deletion(&t, 1010).await?;
+    t.sql
+        .execute("UPDATE imap SET target=folder WHERE rfc724_mid='1010'", ())
+        .await?;
+
    MsgId::new(1010)
        .update_download_state(&t, DownloadState::Available)
        .await?;
@@ -523,6 +547,10 @@ async fn test_delete_expired_imap_messages() -> Result<()> {
        0
    );

+    t.set_config(Config::DeleteServerAfter, Some("1")).await?;
+    delete_expired_imap_messages(&t).await?;
+    test_marked_for_deletion(&t, 3000).await?;
+
    Ok(())
 }

--- a/src/imap.rs
+++ b/src/imap.rs
@@ -1284,7 +1284,6 @@ impl Session {
        if request_uids.is_empty() {
            return Ok(());
        }
-        let is_chatmail = self.is_chatmail();

        for (request_uids, set) in build_sequence_sets(&request_uids)? {
            info!(context, "Starting UID FETCH of message set \"{}\".", set);
@@ -1382,29 +1381,17 @@ impl Session {
                    "Passing message UID {} to receive_imf().", request_uid
                );
                let res = receive_imf_inner(context, rfc724_mid, body, is_seen).await;
-
-                // If the message is not needed anymore on the server, mark it for deletion:
-                if !context.get_config_bool(Config::BccSelf).await? && is_chatmail {
-                    context
-                        .sql
-                        .execute(
-                            "UPDATE imap SET target='' WHERE rfc724_mid=?",
-                            (rfc724_mid,),
-                        )
-                        .await?;
-                    context.scheduler.interrupt_inbox().await;
-                }
-
-                // If there was an error receiving the message, show a device message:
                let received_msg = match res {
                    Err(err) => {
-                        warn!(context, "receive_imf error: {err:#}.");
-
-                        let text = format!(
-                            "❌ Failed to receive a message: {err:#}. Core version v{DC_VERSION_STR}. Please report this bug to delta@merlinux.eu or https://support.delta.chat/.",
-                        );
-                        let mut msg = Message::new_text(text);
-                        add_device_msg(context, None, Some(&mut msg)).await?;
+                        let err = format!("{err:#}");
+                        warn!(context, "receive_imf error: {err}.");
+                        if !err.contains("(SKIP_DEVICE_MSG)") {
+                            let text = format!(
+                                "❌ Failed to receive a message: {err}. Core version v{DC_VERSION_STR}. Please report this bug to delta@merlinux.eu or https://support.delta.chat/",
+                            );
+                            let mut msg = Message::new_text(text);
+                            add_device_msg(context, None, Some(&mut msg)).await?;
+                        }
                        None
                    }
                    Ok(msg) => msg,
--- a/src/imex.rs
+++ b/src/imex.rs
@@ -980,15 +980,20 @@ mod tests {

        // Check that the settings are displayed correctly.
        assert_eq!(
-            context1.get_config(Config::BccSelf).await?,
+            context1.get_config(Config::DeleteServerAfter).await?,
            Some("0".to_string())
        );
        context1.set_config_bool(Config::IsChatmail, true).await?;
+        assert_eq!(
+            context1.get_config(Config::BccSelf).await?,
+            Some("0".to_string())
+        );
+        assert_eq!(
+            context1.get_config(Config::DeleteServerAfter).await?,
+            Some("1".to_string())
+        );

-        assert_eq!(context1.get_config_bool(Config::IsMuted).await?, false);
-        context1.set_config_bool(Config::IsMuted, true).await?;
-        assert_eq!(context1.get_config_bool(Config::IsMuted).await?, true);
-
+        assert_eq!(context1.get_config_delete_server_after().await?, Some(0));
        imex(context1, ImexMode::ExportBackup, backup_dir.path(), None).await?;
        let _event = context1
            .evtracker
@@ -1005,9 +1010,15 @@ mod tests {
        assert!(context2.is_configured().await?);
        assert!(context2.is_chatmail().await?);
        for ctx in [context1, context2] {
-            // BccSelf should be enabled automatically when exporting a backup
-            assert_eq!(ctx.get_config_bool(Config::BccSelf).await?, true);
-            assert_eq!(ctx.get_config_bool(Config::IsMuted).await?, true);
+            assert_eq!(
+                ctx.get_config(Config::BccSelf).await?,
+                Some("1".to_string())
+            );
+            assert_eq!(
+                ctx.get_config(Config::DeleteServerAfter).await?,
+                Some("0".to_string())
+            );
+            assert_eq!(ctx.get_config_delete_server_after().await?, None);
        }
        Ok(())
    }
--- a/src/message.rs
+++ b/src/message.rs
@@ -2105,52 +2105,63 @@ pub async fn get_request_msg_cnt(context: &Context) -> usize {
 }

 /// Estimates the number of messages that will be deleted
-/// by the `set_config()`-option `delete_device_after`.
+/// by the options `delete_device_after` or `delete_server_after`.
 ///
 /// This is typically used to show the estimated impact to the user
 /// before actually enabling deletion of old messages.
 ///
-/// Messages in the "Saved Messages" chat are not counted as they will not be deleted automatically.
+/// If `from_server` is true,
+/// estimate deletion count for server,
+/// otherwise estimate deletion count for device.
 ///
-/// Parameters:
-/// - `from_server`: Deprecated, pass `false` here
-/// - `seconds`: Count messages older than the given number of seconds.
+/// Count messages older than the given number of `seconds`.
 ///
 /// Returns the number of messages that are older than the given number of seconds.
+/// Messages in the "saved messages" folder are not counted as they will not be deleted automatically.
 #[expect(clippy::arithmetic_side_effects)]
 pub async fn estimate_deletion_cnt(
    context: &Context,
    from_server: bool,
    seconds: i64,
 ) -> Result<usize> {
-    ensure!(
-        !from_server,
-        "The `delete_server_after` config option was removed. You need to pass `false` for `from_server`."
-    );
-
    let self_chat_id = ChatIdBlocked::lookup_by_contact(context, ContactId::SELF)
        .await?
        .map(|c| c.id)
        .unwrap_or_default();
    let threshold_timestamp = time() - seconds;

-    let cnt = context
-        .sql
-        .count(
-            "SELECT COUNT(*)
+    let cnt = if from_server {
+        context
+            .sql
+            .count(
+                "SELECT COUNT(*)
+             FROM msgs m
+             WHERE m.id > ?
+               AND timestamp < ?
+               AND chat_id != ?
+               AND EXISTS (SELECT * FROM imap WHERE rfc724_mid=m.rfc724_mid);",
+                (DC_MSG_ID_LAST_SPECIAL, threshold_timestamp, self_chat_id),
+            )
+            .await?
+    } else {
+        context
+            .sql
+            .count(
+                "SELECT COUNT(*)
             FROM msgs m
             WHERE m.id > ?
               AND timestamp < ?
               AND chat_id != ?
               AND chat_id != ? AND hidden = 0;",
-            (
-                DC_MSG_ID_LAST_SPECIAL,
-                threshold_timestamp,
-                self_chat_id,
-                DC_CHAT_ID_TRASH,
-            ),
-        )
-        .await?;
+                (
+                    DC_MSG_ID_LAST_SPECIAL,
+                    threshold_timestamp,
+                    self_chat_id,
+                    DC_CHAT_ID_TRASH,
+                ),
+            )
+            .await?
+    };
    Ok(cnt)
 }

--- a/src/mimeparser.rs
+++ b/src/mimeparser.rs
@@ -490,13 +490,11 @@ impl MimeMessage {
        let mail = mail.as_ref().map(|mail| {
            let (content, signatures_detached) = validate_detached_signature(mail, &public_keyring)
                .unwrap_or((mail, Default::default()));
-            if is_encrypted {
-                let signatures_detached = signatures_detached
-                    .into_iter()
-                    .map(|fp| (fp, Vec::new()))
-                    .collect::<HashMap<_, _>>();
-                signatures.extend(signatures_detached);
-            }
+            let signatures_detached = signatures_detached
+                .into_iter()
+                .map(|fp| (fp, Vec::new()))
+                .collect::<HashMap<_, _>>();
+            signatures.extend(signatures_detached);
            content
        });

--- a/src/provider/data.rs
+++ b/src/provider/data.rs
@@ -890,10 +890,16 @@ static P_NAUTA_CU: Provider = Provider {
        strict_tls: false,
        ..ProviderOptions::new()
    },
-    config_defaults: Some(&[ConfigDefault {
-        key: Config::MediaQuality,
-        value: "1",
-    }]),
+    config_defaults: Some(&[
+        ConfigDefault {
+            key: Config::DeleteServerAfter,
+            value: "1",
+        },
+        ConfigDefault {
+            key: Config::MediaQuality,
+            value: "1",
+        },
+    ]),
    oauth2_authorizer: None,
 };

@@ -2376,4 +2382,4 @@ pub(crate) static PROVIDER_IDS: LazyLock<HashMap<&'static str, &'static Provider
    });

 pub static _PROVIDER_UPDATED: LazyLock<chrono::NaiveDate> =
-    LazyLock::new(|| chrono::NaiveDate::from_ymd_opt(2026, 5, 6).unwrap());
+    LazyLock::new(|| chrono::NaiveDate::from_ymd_opt(2026, 4, 21).unwrap());
--- a/src/reaction.rs
+++ b/src/reaction.rs
@@ -18,7 +18,7 @@ use std::cmp::Ordering;
 use std::collections::BTreeMap;
 use std::fmt;

-use anyhow::Result;
+use anyhow::{Result, bail};
 use serde::{Deserialize, Serialize};

 use crate::chat::{Chat, ChatId, send_msg};
@@ -259,9 +259,8 @@ pub(crate) async fn set_msg_reaction(
            });
        }
    } else {
-        info!(
-            context,
-            "Can't assign reaction to unknown message with Message-ID {}", in_reply_to
+        bail!(
+            "Can't assign reaction to unknown message with Message-ID {in_reply_to} (SKIP_DEVICE_MSG)"
        );
    }
    Ok(())
@@ -519,6 +518,54 @@ Content-Disposition: reaction\n\
        Ok(())
    }

+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_reaction_and_multitransport() -> Result<()> {
+        let mut tcm = TestContextManager::new();
+        let alice = &tcm.alice().await;
+        let device_chat_id = ChatId::get_for_contact(alice, ContactId::DEVICE).await?;
+        let n_device_msgs = get_chat_msgs(alice, device_chat_id).await?.len();
+
+        let reaction_bytes = "To: alice@example.org, claire@example.org\n\
+From: bob@example.net\n\
+Date: Today, 29 February 2021 00:00:10 -800\n\
+Message-ID: 56789@example.net\n\
+In-Reply-To: 12345@example.org\n\
+Content-Type: text/plain; charset=utf-8\n\
+Content-Disposition: reaction\n\
+\n\
+\u{1F44D}"
+            .as_bytes();
+        // Alice receives a reaction to Claire's message from Bob earler than the message itself
+        // because Bob knows about Alice's new transport.
+        assert!(receive_imf(alice, reaction_bytes, false).await.is_err());
+
+        let msg_id = receive_imf(
+            alice,
+            "To: alice@example.org, bob@example.net\n\
+From: claire@example.org\n\
+Date: Today, 29 February 2021 00:00:00 -800\n\
+Message-ID: 12345@example.org\n\
+\n\
+Can we chat at 1pm pacific, today?"
+                .as_bytes(),
+            false,
+        )
+        .await?
+        .unwrap()
+        .msg_ids[0];
+
+        // Finally the reaction arrives on Alice's older transport.
+        receive_imf(alice, reaction_bytes, false).await?;
+        let reactions = get_msg_reactions(alice, msg_id).await?;
+        assert_eq!(reactions.to_string(), "👍1");
+
+        assert_eq!(
+            get_chat_msgs(alice, device_chat_id).await?.len(),
+            n_device_msgs
+        );
+        Ok(())
+    }
+
    async fn expect_reactions_changed_event(
        t: &TestContext,
        expected_chat_id: ChatId,
--- a/src/receive_imf.rs
+++ b/src/receive_imf.rs
@@ -6,7 +6,7 @@ use std::iter;
 use std::str::FromStr as _;
 use std::sync::LazyLock;

-use anyhow::{Context as _, Result, ensure};
+use anyhow::{Context as _, Result, bail, ensure};
 use deltachat_contact_tools::{
    ContactAddress, addr_cmp, addr_normalize, may_be_valid_addr, sanitize_bidi_characters,
    sanitize_single_line,
@@ -904,8 +904,10 @@ UPDATE config SET value=? WHERE keyname='configured_addr' AND value!=?1
    }

    // Get user-configured server deletion
+    let delete_server_after = context.get_config_delete_server_after().await?;
+
    if !received_msg.msg_ids.is_empty() {
-        let target = if received_msg.needs_delete_job {
+        let target = if received_msg.needs_delete_job || delete_server_after == Some(0) {
            Some("".to_string())
        } else {
            None
@@ -933,75 +935,6 @@ UPDATE config SET value=? WHERE keyname='configured_addr' AND value!=?1
            // This is a Delta Chat MDN. Mark as read.
            markseen_on_imap_table(context, rfc724_mid_orig).await?;
        }
-        if !mime_parser.incoming && !context.get_config_bool(Config::TeamProfile).await? {
-            let mut updated_chats = BTreeMap::new();
-            let mut archived_chats_maybe_noticed = false;
-            for report in &mime_parser.mdn_reports {
-                for msg_rfc724_mid in report
-                    .original_message_id
-                    .iter()
-                    .chain(&report.additional_message_ids)
-                {
-                    let Some(msg_id) = rfc724_mid_exists(context, msg_rfc724_mid).await? else {
-                        continue;
-                    };
-                    let Some(msg) = Message::load_from_db_optional(context, msg_id).await? else {
-                        continue;
-                    };
-                    if msg.state < MessageState::InFresh || msg.state >= MessageState::InSeen {
-                        continue;
-                    }
-                    if !mime_parser.was_encrypted() && msg.get_showpadlock() {
-                        warn!(context, "MDN: Not encrypted. Ignoring.");
-                        continue;
-                    }
-                    message::update_msg_state(context, msg_id, MessageState::InSeen).await?;
-                    if let Err(e) = msg_id.start_ephemeral_timer(context).await {
-                        error!(context, "start_ephemeral_timer for {msg_id}: {e:#}.");
-                    }
-                    if !mime_parser.has_chat_version() {
-                        continue;
-                    }
-                    archived_chats_maybe_noticed |= msg.state < MessageState::InNoticed
-                        && msg.chat_visibility == ChatVisibility::Archived;
-                    updated_chats
-                        .entry(msg.chat_id)
-                        .and_modify(|pos| *pos = cmp::max(*pos, (msg.timestamp_sort, msg.id)))
-                        .or_insert((msg.timestamp_sort, msg.id));
-                }
-            }
-            for (chat_id, (timestamp_sort, msg_id)) in updated_chats {
-                context
-                    .sql
-                    .execute(
-                        "
-UPDATE msgs SET state=? WHERE
-    state=? AND
-    hidden=0 AND
-    chat_id=? AND
-    (timestamp,id)<(?,?)",
-                        (
-                            MessageState::InNoticed,
-                            MessageState::InFresh,
-                            chat_id,
-                            timestamp_sort,
-                            msg_id,
-                        ),
-                    )
-                    .await
-                    .context("UPDATE msgs.state")?;
-                if chat_id.get_fresh_msg_cnt(context).await? == 0 {
-                    // Removes all notifications for the chat in UIs.
-                    context.emit_event(EventType::MsgsNoticed(chat_id));
-                } else {
-                    context.emit_msgs_changed_without_msg_id(chat_id);
-                }
-                chatlist_events::emit_chatlist_item_changed(context, chat_id);
-            }
-            if archived_chats_maybe_noticed {
-                context.on_archived_chats_maybe_noticed();
-            }
-        }
    }

    if mime_parser.is_call() {
@@ -2063,9 +1996,8 @@ async fn add_parts(
                    }
                }
                None => {
-                    warn!(
-                        context,
-                        "Cannot add iroh peer because WebXDC instance does not exist."
+                    bail!(
+                        "Cannot add iroh peer because WebXDC instance {in_reply_to} does not exist (SKIP_DEVICE_MSG)"
                    );
                }
            },
@@ -2098,6 +2030,82 @@ async fn add_parts(
            warn!(context, "Call: Not a reply.")
        }
    }
+    if !mime_parser.incoming && !context.get_config_bool(Config::TeamProfile).await? {
+        let mut missing_rfc724_mid = None;
+        let mut updated_chats = BTreeMap::new();
+        let mut archived_chats_maybe_noticed = false;
+        for report in &mime_parser.mdn_reports {
+            for msg_rfc724_mid in report
+                .original_message_id
+                .iter()
+                .chain(&report.additional_message_ids)
+            {
+                let Some(msg_id) = rfc724_mid_exists(context, msg_rfc724_mid).await? else {
+                    missing_rfc724_mid.get_or_insert(msg_rfc724_mid.as_str());
+                    continue;
+                };
+                let Some(msg) = Message::load_from_db_optional(context, msg_id).await? else {
+                    continue;
+                };
+                if msg.state < MessageState::InFresh || msg.state >= MessageState::InSeen {
+                    continue;
+                }
+                if !mime_parser.was_encrypted() && msg.get_showpadlock() {
+                    warn!(context, "MDN: Not encrypted. Ignoring.");
+                    continue;
+                }
+                message::update_msg_state(context, msg_id, MessageState::InSeen).await?;
+                if let Err(e) = msg_id.start_ephemeral_timer(context).await {
+                    error!(context, "start_ephemeral_timer for {msg_id}: {e:#}.");
+                }
+                if !mime_parser.has_chat_version() {
+                    continue;
+                }
+                archived_chats_maybe_noticed |= msg.state < MessageState::InNoticed
+                    && msg.chat_visibility == ChatVisibility::Archived;
+                updated_chats
+                    .entry(msg.chat_id)
+                    .and_modify(|pos| *pos = cmp::max(*pos, (msg.timestamp_sort, msg.id)))
+                    .or_insert((msg.timestamp_sort, msg.id));
+            }
+        }
+        for (chat_id, (timestamp_sort, msg_id)) in updated_chats {
+            context
+                .sql
+                .execute(
+                    "
+UPDATE msgs SET state=? WHERE
+state=? AND
+hidden=0 AND
+chat_id=? AND
+(timestamp,id)<(?,?)",
+                    (
+                        MessageState::InNoticed,
+                        MessageState::InFresh,
+                        chat_id,
+                        timestamp_sort,
+                        msg_id,
+                    ),
+                )
+                .await
+                .context("UPDATE msgs.state")?;
+            if chat_id.get_fresh_msg_cnt(context).await? == 0 {
+                // Removes all notifications for the chat in UIs.
+                context.emit_event(EventType::MsgsNoticed(chat_id));
+            } else {
+                context.emit_msgs_changed_without_msg_id(chat_id);
+            }
+            chatlist_events::emit_chatlist_item_changed(context, chat_id);
+        }
+        if archived_chats_maybe_noticed {
+            context.on_archived_chats_maybe_noticed();
+        }
+        ensure!(
+            missing_rfc724_mid.is_none(),
+            "Self-MDN: {} not found (SKIP_DEVICE_MSG)",
+            missing_rfc724_mid.unwrap_or(""),
+        );
+    }

    let hidden = mime_parser.parts.iter().all(|part| part.is_reaction);
    let mut parts = mime_parser.parts.iter().peekable();
@@ -2378,10 +2386,7 @@ async fn handle_edit_delete(
                warn!(context, "Edit message: Database entry does not exist.");
            }
        } else {
-            warn!(
-                context,
-                "Edit message: rfc724_mid {rfc724_mid:?} not found."
-            );
+            bail!("Edit message: rfc724_mid {rfc724_mid:?} not found (SKIP_DEVICE_MSG)");
        }
    } else if let Some(rfc724_mid_list) = mime_parser.get_header(HeaderDef::ChatDelete)
        && let Some(part) = mime_parser.parts.first()
--- a/src/receive_imf/receive_imf_tests.rs
+++ b/src/receive_imf/receive_imf_tests.rs
@@ -14,7 +14,9 @@ use crate::contact;
 use crate::imap::prefetch_should_download;
 use crate::imex::{ImexMode, imex};
 use crate::key;
+use crate::message::markseen_msgs;
 use crate::securejoin::get_securejoin_qr;
+use crate::smtp;
 use crate::test_utils::{
    TestContext, TestContextManager, alice_keypair, get_chat_msg, mark_as_verified,
 };
@@ -1978,10 +1980,15 @@ async fn test_no_smtp_job_for_self_chat() -> Result<()> {
    assert!(bob.pop_sent_msg_opt(Duration::ZERO).await.is_none());

    bob.set_config_bool(Config::BccSelf, true).await?;
+    bob.set_config(Config::DeleteServerAfter, Some("1")).await?;
+    let mut msg = Message::new_text("Happy birthday to me".to_string());
+    chat::send_msg(bob, chat_id, &mut msg).await?;
+    assert!(bob.pop_sent_msg_opt(Duration::ZERO).await.is_none());
+
+    bob.set_config(Config::DeleteServerAfter, None).await?;
    let mut msg = Message::new_text("Happy birthday to me".to_string());
    chat::send_msg(bob, chat_id, &mut msg).await?;
    assert!(bob.pop_sent_msg_opt(Duration::ZERO).await.is_some());
-
    Ok(())
 }

@@ -2650,6 +2657,32 @@ async fn test_read_receipts_dont_unmark_bots() -> Result<()> {
    Ok(())
 }

+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn test_self_mdn_before_msg() -> Result<()> {
+    let mut tcm = TestContextManager::new();
+    let alice = &tcm.alice().await;
+    let bob = &tcm.bob().await;
+    let bob2 = &tcm.bob().await;
+    let alice_chat = alice.create_chat(bob).await;
+
+    let sent = alice.send_text(alice_chat.id, "hi").await;
+    let msg = bob.recv_msg(&sent).await;
+    msg.chat_id.accept(bob).await?;
+    markseen_msgs(bob, vec![msg.id]).await?;
+    smtp::queue_mdn(bob).await?;
+    let sent_mdn = bob.pop_sent_msg().await;
+
+    let Err(err) = receive_imf(bob2, sent_mdn.payload().as_bytes(), false).await else {
+        unreachable!();
+    };
+    assert!(format!("{err:#}").contains("(SKIP_DEVICE_MSG)"));
+    let msg = bob2.recv_msg(&sent).await;
+    assert_eq!(msg.get_state(), MessageState::InFresh);
+    bob2.recv_msg_trash(&sent_mdn).await;
+    assert_eq!(msg.id.get_state(bob2).await?, MessageState::InSeen);
+    Ok(())
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn test_gmx_forwarded_msg() -> Result<()> {
    let t = TestContext::new_alice().await;
--- a/src/smtp.rs
+++ b/src/smtp.rs
@@ -13,7 +13,7 @@ use crate::config::Config;
 use crate::contact::{Contact, ContactId};
 use crate::context::Context;
 use crate::events::EventType;
-use crate::log::{LogExt, warn};
+use crate::log::warn;
 use crate::message::Message;
 use crate::message::{self, MsgId};
 use crate::mimefactory::MimeFactory;
@@ -590,44 +590,77 @@ async fn send_mdn_rfc724_mid(
    if context.get_config_bool(Config::BccSelf).await? {
        add_self_recipients(context, &mut recipients, encrypted).await?;
    }
-    let recipients: Vec<_> = recipients
-        .into_iter()
-        .filter_map(|addr| {
-            async_smtp::EmailAddress::new(addr.clone())
-                .with_context(|| format!("Invalid recipient: {addr}"))
-                .log_err(context)
-                .ok()
-        })
-        .collect();
+    #[cfg(not(test))]
+    {
+        use crate::log::LogExt;

-    match smtp_send(context, &recipients, &body, smtp, None).await {
-        SendResult::Success => {
-            if !recipients.is_empty() {
-                info!(context, "Successfully sent MDN for {rfc724_mid}.");
+        let recipients: Vec<_> = recipients
+            .into_iter()
+            .filter_map(|addr| {
+                async_smtp::EmailAddress::new(addr.clone())
+                    .with_context(|| format!("Invalid recipient: {addr}"))
+                    .log_err(context)
+                    .ok()
+            })
+            .collect();
+
+        match smtp_send(context, &recipients, &body, smtp, None).await {
+            SendResult::Success => {
+                if !recipients.is_empty() {
+                    info!(context, "Successfully sent MDN for {rfc724_mid}.");
+                }
+                context
+                    .sql
+                    .transaction(|transaction| {
+                        let mut stmt =
+                            transaction.prepare("DELETE FROM smtp_mdns WHERE rfc724_mid = ?")?;
+                        stmt.execute((rfc724_mid,))?;
+                        for additional_rfc724_mid in additional_rfc724_mids {
+                            stmt.execute((additional_rfc724_mid,))?;
+                        }
+                        Ok(())
+                    })
+                    .await?;
+                Ok(true)
            }
-            context
-                .sql
-                .transaction(|transaction| {
-                    let mut stmt =
-                        transaction.prepare("DELETE FROM smtp_mdns WHERE rfc724_mid = ?")?;
-                    stmt.execute((rfc724_mid,))?;
-                    for additional_rfc724_mid in additional_rfc724_mids {
-                        stmt.execute((additional_rfc724_mid,))?;
-                    }
-                    Ok(())
-                })
-                .await?;
-            Ok(true)
+            SendResult::Retry => {
+                info!(
+                    context,
+                    "Temporary SMTP failure while sending an MDN for {rfc724_mid}."
+                );
+                Ok(false)
+            }
+            SendResult::Failure(err) => Err(err),
        }
-        SendResult::Retry => {
-            info!(
-                context,
-                "Temporary SMTP failure while sending an MDN for {rfc724_mid}."
-            );
-            Ok(false)
-        }
-        SendResult::Failure(err) => Err(err),
    }
+    #[cfg(test)]
+    {
+        let _ = smtp;
+        context
+            .sql
+            .transaction(|t| {
+                t.execute(
+                    "INSERT INTO smtp (rfc724_mid, recipients, mime, msg_id)
+                    VALUES (?, ?, ?, ?)",
+                    (rfc724_mid, recipients.join(" "), body, u32::MAX),
+                )?;
+                let mut stmt = t.prepare("DELETE FROM smtp_mdns WHERE rfc724_mid = ?")?;
+                stmt.execute((rfc724_mid,))?;
+                for additional_rfc724_mid in additional_rfc724_mids {
+                    stmt.execute((additional_rfc724_mid,))?;
+                }
+                Ok(())
+            })
+            .await?;
+        Ok(true)
+    }
+}
+
+#[cfg(test)]
+pub(crate) async fn queue_mdn(context: &Context) -> Result<()> {
+    let queued = send_mdn(context, &mut Smtp::new()).await?;
+    assert!(queued);
+    Ok(())
 }

 /// Tries to send a single MDN. Returns true if more MDNs should be sent.
@@ -699,22 +732,26 @@ pub(crate) async fn add_self_recipients(
    recipients: &mut Vec<String>,
    encrypted: bool,
 ) -> Result<()> {
-    // Avoid sending unencrypted messages to all transports, chatmail relays won't accept
-    // them. Normally the user should have a non-chatmail primary transport to send unencrypted
-    // messages.
-    if encrypted {
-        for addr in context.get_published_secondary_self_addrs().await? {
-            recipients.push(addr);
+    // Previous versions of Delta Chat did not send BCC self
+    // if DeleteServerAfter was set to immediately delete messages
+    // from the server. This is not the case anymore
+    // because BCC-self messages are also used to detect
+    // that message was sent if SMTP server is slow to respond
+    // and connection is frequently lost
+    // before receiving status line. NB: This is not a problem for chatmail servers, so `BccSelf`
+    // disabled by default is fine.
+    if context.get_config_delete_server_after().await? != Some(0) || !recipients.is_empty() {
+        // Avoid sending unencrypted messages to all transports, chatmail relays won't accept
+        // them. Normally the user should have a non-chatmail primary transport to send unencrypted
+        // messages.
+        if encrypted {
+            for addr in context.get_published_secondary_self_addrs().await? {
+                recipients.push(addr);
+            }
        }
+        // `from` must be the last addr, see `receive_imf_inner()` why.
+        let from = context.get_primary_self_addr().await?;
+        recipients.push(from);
    }
-    // `from` must be the last addr
-    // because `receive_imf_inner()` marks the message as 'delivered'
-    // if it arrives to the self-server via `bcc_self`.
-    // This helps with marking messages as delivered
-    // if the server is slow and we never get an `OK` response
-    // before the connection times out.
-    let from = context.get_primary_self_addr().await?;
-    recipients.push(from);
-
    Ok(())
 }
Author	SHA1	Message	Date
iequidoo	67a75a432c	fix: Fail receive_imf to not tombstone self-MDN if original message isn't found	2026-05-01 07:15:03 -03:00
iequidoo	d014255bfe	feat: Apply self-MDN before tombstoning it This way if the self-MDN isn't applied successfully, it can be received again and retried.	2026-05-01 07:15:03 -03:00
iequidoo	537ac50690	test: Add function to queue MDN into `smtp`	2026-05-01 07:15:03 -03:00
iequidoo	e98c6b4fd3	fix: Fail receive_imf to not tombstone Chat-Edit message if original message isn't found	2026-05-01 07:15:03 -03:00
iequidoo	893ad06a61	fix: Fail receive_imf to not tombstone Iroh-Node-Addr message if webxdc instance isn't found	2026-05-01 07:15:03 -03:00
iequidoo	25ac5a2363	fix: Fail receive_imf to not tombstone reaction if the referenced message isn't found A reaction may arrive earler than the referenced message in case of multi-transport. By not creating a tombstone we still can receive it later on another transport.	2026-05-01 07:15:03 -03:00