diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index b0a256224970..39abdb715336 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -50,6 +50,8 @@
 
 - `services.lemmy.settings.federation` was removed in 0.17.0 and no longer has any effect. To enable federation, the hostname must be set in the configuration file and then federation must be enabled in the admin web UI. See the [release notes](https://github.com/LemmyNet/lemmy/blob/c32585b03429f0f76d1e4ff738786321a0a9df98/RELEASES.md#upgrade-instructions) for more details.
 
+- `spamassassin` no longer supports the `Hashcash` module. The module needs to be removed from the `loadplugin` list if it was copied over from the default `initPreConf` option.
+
 ## Other Notable Changes {#sec-release-23.11-notable-changes}
 
 - The Cinnamon module now enables XDG desktop integration by default. If you are experiencing collisions related to xdg-desktop-portal-gtk you can safely remove `xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];` from your NixOS configuration.
diff --git a/nixos/modules/services/mail/spamassassin.nix b/nixos/modules/services/mail/spamassassin.nix
index 49d1d9315985..072172e31451 100644
--- a/nixos/modules/services/mail/spamassassin.nix
+++ b/nixos/modules/services/mail/spamassassin.nix
@@ -77,9 +77,9 @@ in
           loadplugin Mail::SpamAssassin::Plugin::Check
           #loadplugin Mail::SpamAssassin::Plugin::DCC
           loadplugin Mail::SpamAssassin::Plugin::DKIM
+          loadplugin Mail::SpamAssassin::Plugin::DMARC
           loadplugin Mail::SpamAssassin::Plugin::DNSEval
           loadplugin Mail::SpamAssassin::Plugin::FreeMail
-          loadplugin Mail::SpamAssassin::Plugin::Hashcash
           loadplugin Mail::SpamAssassin::Plugin::HeaderEval
           loadplugin Mail::SpamAssassin::Plugin::HTMLEval
           loadplugin Mail::SpamAssassin::Plugin::HTTPSMismatch
diff --git a/pkgs/servers/mail/spamassassin/default.nix b/pkgs/servers/mail/spamassassin/default.nix
index ef87288df29b..95b613f0b478 100644
--- a/pkgs/servers/mail/spamassassin/default.nix
+++ b/pkgs/servers/mail/spamassassin/default.nix
@@ -1,42 +1,71 @@
-{ lib, fetchurl, perlPackages, makeWrapper, gnupg, re2c, gcc, gnumake }:
+{ lib, fetchurl, perlPackages, makeBinaryWrapper, gnupg, re2c, gcc, gnumake, libxcrypt, openssl, coreutils, poppler_utils, tesseract, iana-etc }:
 
 perlPackages.buildPerlPackage rec {
   pname = "SpamAssassin";
-  version = "3.4.6";
+  version = "4.0.0";
 
   src = fetchurl {
     url = "mirror://apache/spamassassin/source/Mail-${pname}-${version}.tar.bz2";
-    sha256 = "044ng2aazqy8g0m17q0a4939ck1ca4x230q2q7q7jndvwkrpaj5w";
+    hash = "sha256-5aoXBQowvHK6qGr9xgSMrepNHsLsxh14dxegWbgxnog=";
   };
 
-  # ExtUtil::MakeMaker is bundled with Perl, but the bundled version
-  # causes build errors for aarch64-darwin, so we override it with the
-  # latest version.  We can drop the dependency to go back to the
-  # bundled version when the version that comes with Perl is ≥7.57_02.
-  #
-  # Check the version bundled with Perl like this:
-  #   perl -e 'use ExtUtils::MakeMaker qw($VERSION); print "$VERSION\n"'
-  nativeBuildInputs = [ makeWrapper perlPackages.ExtUtilsMakeMaker ];
+  patches = [
+    ./satest-no-clean-path.patch
+    ./sa_compile-use-perl5lib.patch
+  ];
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
   buildInputs = (with perlPackages; [
     HTMLParser NetCIDRLite NetDNS NetAddrIP DBFile HTTPDate MailDKIM LWP
     LWPProtocolHttps IOSocketSSL DBI EncodeDetect IPCountry NetIdent
     Razor2ClientAgent MailSPF NetDNSResolverProgrammable Socket6
-  ]);
+    ArchiveZip EmailAddressXS NetLibIDN2 MaxMindDBReader GeoIP MailDMARC
+    MaxMindDBReaderXS
+  ]) ++ [
+    openssl
+  ];
 
-  # Enabling 'taint' mode is desirable, but that flag disables support
-  # for the PERL5LIB environment variable. Needs further investigation.
-  makeFlags = [ "PERL_BIN=${perlPackages.perl}/bin/perl" "PERL_TAINT=no" ];
+  makeFlags = [ "PERL_BIN=${perlPackages.perl}/bin/perl" "ENABLE_SSL=yes" ];
 
   makeMakerFlags = [ "SYSCONFDIR=/etc LOCALSTATEDIR=/var/lib/spamassassin" ];
 
-  doCheck = false;
+  checkInputs = (with perlPackages; [
+    TextDiff  # t/strip2.t
+  ]) ++ [
+    coreutils  # date, t/basic_meta.t
+    poppler_utils  # pdftotext, t/extracttext.t
+    tesseract  # tesseract, t/extracttext.t
+    iana-etc  # t/dnsbl_subtests.t (/etc/protocols used by Net::DNS::Nameserver)
+    re2c gcc gnumake
+  ];
+  preCheck = ''
+    substituteInPlace t/spamc_x_e.t \
+      --replace "/bin/echo" "${coreutils}/bin/echo"
+    export C_INCLUDE_PATH='${lib.makeSearchPathOutput "include" "include" [ libxcrypt ]}'
+    export HARNESS_OPTIONS="j''${NIX_BUILD_CORES}"
+
+    export HOME=$NIX_BUILD_TOP/home
+    mkdir -p $HOME
+    mkdir t/log  # pre-create to avoid race conditions
+  '';
 
   postInstall = ''
     mkdir -p $out/share/spamassassin
     mv "rules/"* $out/share/spamassassin/
 
     for n in "$out/bin/"*; do
-      wrapProgram "$n" --prefix PERL5LIB : "$PERL5LIB" --prefix PATH : ${lib.makeBinPath [ gnupg re2c gcc gnumake ]}
+      # Skip if this isn't a perl script
+      if ! head -n1 "$n" | grep -q bin/perl; then
+        continue
+      fi
+      echo "Wrapping $n for taint mode"
+      orig="$out/bin/.$(basename "$n")-wrapped"
+      mv "$n" "$orig"
+      # We don't inherit argv0 so that $^X works properly in e.g. sa-compile
+      makeWrapper "${perlPackages.perl}/bin/perl" "$n" \
+        --add-flags "-T $perlFlags $orig" \
+        --prefix PATH : ${lib.makeBinPath [ gnupg re2c gcc gnumake ]} \
+        --prefix C_INCLUDE_PATH : ${lib.makeSearchPathOutput "include" "include" [ libxcrypt ]}
     done
   '';
 
diff --git a/pkgs/servers/mail/spamassassin/sa_compile-use-perl5lib.patch b/pkgs/servers/mail/spamassassin/sa_compile-use-perl5lib.patch
new file mode 100644
index 000000000000..ba68142a92d9
--- /dev/null
+++ b/pkgs/servers/mail/spamassassin/sa_compile-use-perl5lib.patch
@@ -0,0 +1,23 @@
+diff -ru orig/t/sa_compile.t new/t/sa_compile.t
+--- orig/t/sa_compile.t	2022-12-14 06:03:26.000000000 +0000
++++ new/t/sa_compile.t	2023-06-25 12:30:39.735577152 +0000
+@@ -40,7 +40,7 @@
+ 
+ # we now have an "installed" version we can run sa-compile with.  Ensure
+ # sarun() will use it appropriately
+-$scr = "$instdir/$temp_binpath/spamassassin";
++$scr = "$perl_cmd -T $instdir/$temp_binpath/spamassassin";
+ $scr_localrules_args = $scr_cf_args = "";      # use the default rules dir, from our "install"
+ 
+ &set_rules('
+@@ -86,8 +86,8 @@
+ # -------------------------------------------------------------------
+ 
+ rmtree( glob "~/.spamassassin/sa-compile.cache". { safe => 1 }); # reset test
+-system_or_die "TMP=$instdir TMPDIR=$instdir $instdir/$temp_binpath/sa-compile --quiet -p $cwd/$workdir/user.cf --keep-tmps -D 2>$instdir/sa-compile.debug";  # --debug
+-$scr = "$instdir/$temp_binpath/spamassassin";
++system_or_die "TMP=$instdir TMPDIR=$instdir $perl_cmd -T $instdir/$temp_binpath/sa-compile --quiet -p $cwd/$workdir/user.cf --keep-tmps -D 2>$instdir/sa-compile.debug";  # --debug
++$scr = "$perl_cmd -T $instdir/$temp_binpath/spamassassin";
+ $scr_localrules_args = $scr_cf_args = "";      # use the default rules dir, from our "install"
+ 
+ %patterns = (
diff --git a/pkgs/servers/mail/spamassassin/satest-no-clean-path.patch b/pkgs/servers/mail/spamassassin/satest-no-clean-path.patch
new file mode 100644
index 000000000000..11f5c31d31e7
--- /dev/null
+++ b/pkgs/servers/mail/spamassassin/satest-no-clean-path.patch
@@ -0,0 +1,18 @@
+diff -ru orig/t/SATest.pm new/t/SATest.pm
+--- orig/t/SATest.pm	2023-06-25 11:26:27.663204415 +0000
++++ new/t/SATest.pm	2023-06-25 11:34:08.902174669 +0000
+@@ -65,9 +65,12 @@
+ 
+   # Clean PATH so taint doesn't complain
+   if (!$RUNNING_ON_WINDOWS) {
+-    $ENV{'PATH'} = '/bin:/usr/bin:/usr/local/bin';
++    # untaint PATH
++    $ENV{'PATH'} =~ /^(.+)$/;
++    $ENV{'PATH'} = $1;
++    # $ENV{'PATH'} = '/bin:/usr/bin:/usr/local/bin';
+     # Remove tainted envs, at least ENV used in FreeBSD
+-    delete @ENV{qw(IFS CDPATH ENV BASH_ENV)};
++    # delete @ENV{qw(IFS CDPATH ENV BASH_ENV)};
+   } else {
+     # Windows might need non-system directories in PATH to run a Perl installation
+     # The best we can do is clean out obviously bad stuff such as relative paths or \..\
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index b2714c0826a7..ffa2532f99b9 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -14256,6 +14256,28 @@ with self; {
     };
   };
 
+  MailDMARC = buildPerlPackage {
+    pname = "Mail-DMARC";
+    version = "1.20230215";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/M/MB/MBRADSHAW/Mail-DMARC-1.20230215.tar.gz";
+      hash = "sha256-V9z1R1nLkkSOVukUE0D2E0QnTFjZ3WWqkKqczw5+uQM=";
+    };
+    buildInputs = [ ExtUtilsMakeMaker FileShareDirInstall ];
+    doCheck = false;  # uses actual DNS at runtime
+    checkInputs = [ XMLSAX XMLValidatorSchema TestException TestFileShareDir TestMore TestOutput ];
+    propagatedBuildInputs = [
+      ConfigTiny DBDSQLite DBIxSimple EmailMIME EmailSender Encode FileShareDir GetoptLong
+      IOCompress IO IOSocketSSL NetDNS NetIDNEncode NetIP NetSSLeay RegexpCommon Socket6
+      SysSyslog URI XMLLibXML
+    ];
+    meta = {
+      description = "Perl implementation of DMARC";
+      homepage = "https://github.com/msimerson/mail-dmarc";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   MailMaildir = buildPerlPackage {
     version = "1.0.0";
     pname = "Mail-Maildir";
@@ -18001,6 +18023,21 @@ with self; {
     };
   };
 
+  NetLibIDN2 = buildPerlModule {
+    pname = "Net-LibIDN2";
+    version = "1.02";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TH/THOR/Net-LibIDN2-1.02.tar.gz";
+      hash = "sha256-0fMK/GrPplQbAMCafkx059jkuknjJ3wLvEGuNcE5DQc=";
+    };
+    propagatedBuildInputs = [ pkgs.libidn2 ];
+    meta = {
+      description = "Perl bindings for GNU Libidn2";
+      homepage = "https://github.com/gnuthor/Net--LibIDN2";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   NetNetmask = buildPerlPackage {
     pname = "Net-Netmask";
     version = "2.0001";