November 2025 - dovecot

Devocot-lda help please
by Jászberényi Szabolcs 17 Nov '25

17 Nov '25

Dear All! I have a strange error after upgrading from Debian Bookworm (12) to Debian Trixie (13). The server was lunched more than 10 years ago, so there are countless possible issues. Motherboard: ASUS P8B-E Series CPU: Intel(R) Xeon(R) CPU E3-1230 V2 @ 3.30GHz Architecture: x64 Memory: 32GB (4 pcs of Kingston 9965525-058.A00LF) Disk: 2 pcs SSD in software RAID1 for / (root filesystem) and 2 pcs HDD with software RAID1 for /home Filesystems: ext4 The server will be soon replaced, but I need working configuration ASAP. After tweeking everything is working, but every time I am sending az email I have a Undelivered Mail Returned to Sender that has an error message: Command died with status 159: "/usr/lib/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT" -d "$USER"". Command output: Bad system call Tried to remove the -f and -a paramteres, but everithing is the same, only the command varies dependent on the config. Postfix in main.cf: mailbox_command = /usr/lib/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT" -d "$USER" # ls -l /usr/lib/dovecot/dovecot-lda -rwxr-sr-x 1 root mail 27024 okt 23 16.01 /usr/lib/dovecot/dovecot-lda The server has winbind configured thru nsswitch, so every other program uses pam for user authentication and paramteres. Postfix has LDAP configured. Can anyone point out what I am missing? I found that dovecot-lda is producing the error, but nothing in dovecot's logs. Postfix shows the error in mail.log, but nothing other than this. If I run the program manually it asks for only the -d parameter, nothing more. Before this version I had only the -f and -a paramteres, no -d. It was working, but now it only works if I set it up with -d. I have attached the sysreports output. Waiting for help! Best regards: -- Tisztelettel: Jászberényi Szabolcs Rendszergazda Győr, PÁGISZ <https://www.pagisz.hu/> Mobil: +36704157707 Dear All! I have a strange error after upgrading from Debian Bookworm (12) to Debian Trixie (13). The server was lunched more than 10 years ago, so there are countless possible issues. Motherboard: ASUS P8B-E Series CPU: Intel(R) Xeon(R) CPU E3-1230 V2 @ 3.30GHz Architecture: x64 Memory: 32GB (4 pcs of Kingston 9965525-058.A00LF) Disk: 2 pcs SSD in software RAID1 for / (root filesystem) and 2 pcs HDD with software RAID1 for /home Filesystems: ext4 The server will be soon replaced, but I need working configuration ASAP. After tweeking everything is working, but every time I am sending az email I have a Undelivered Mail Returned to Sender that has an error message: Command died with status 159: "/usr/lib/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT" -d "$USER"". Command output: Bad system call Tried to remove the -f and -a paramteres, but everithing is the same, only the command varies dependent on the config. Postfix in main.cf: mailbox_command = /usr/lib/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT" -d "$USER" # ls -l /usr/lib/dovecot/dovecot-lda -rwxr-sr-x 1 root mail 27024 okt 23 16.01 /usr/lib/dovecot/dovecot-lda The server has winbind configured thru nsswitch, so every other program uses pam for user authentication and paramteres. Postfix has LDAP configured. Can anyone point out what I am missing? I found that dovecot-lda is producing the error, but nothing in dovecot's logs. Postfix shows the error in mail.log, but nothing other than this. If I run the program manually it asks for only the -d parameter, nothing more. Before this version I had only the -f and -a paramteres, no -d. It was working, but now it only works if I set it up with -d. I have attached the sysreports output. Waiting for help! Best regards: -- Tisztelettel: Jaszberenyi Szabolcs Rendszergazda Gyo"r, [1]PAGISZ Mobil: +36704157707 References Visible links 1. https://www.pagisz.hu/

2 1

doveadm -A finds non existent users
by Kippels, Julian 14 Nov '25

14 Nov '25

Hi, I am trying to iterate through all users using "doveadm sieve list -A" and I am seeing a lot of messages like this one: doveadm(someuser): Info: User no longer exists, skipping When I do "doveadm sieve list -u someuser" I get the following: doveadm(someuser): Error: User doesn't exist I have defined LDAP as my userdb and "someuser" is not present in the LDAP anymore. Where does doveadm -A get this user from and how can I clean this up? Thanks Julian

3 3

authentication back-ends - go to specific one?
by lejeczek 13 Nov '25

13 Nov '25

Hi guys. Is it possible to tell *dovecot* to authenticate with a specific back-end for a given domain? If it would not the only back-end a given account of a specific domain would try, then it would be the first back-end such account would try to auth against - possible? many thanks, L. Hi guys. Is it possible to tell dovecot to authenticate with a specific back-end for a given domain? If it would not the only back-end a given account of a specific domain would try, then it would be the first back-end such account would try to auth against - possible? many thanks, L.

2 1

after upgrade to 2.4 I get passwd-file: Password mismatch
by Helmut K. C. Tessarek 11 Nov '25

11 Nov '25

I upgraded dovecot from 2.3 to 2.4 today and all of a sudden I get an authentication error: passwd-file: Password mismatch My config looks like this: passdb pam { driver = pam } passdb passwd-file { driver = passwd-file auth_username_format = %{user | username} passwd_file_path = /etc/dovecot/alternate/passwd skip = authenticated } I haven't changed the /etc/dovecot/alternate/passwd in ages and its contents look similar to: user:$6$blablablagfsgfsgfsgsbfssfslongbase64stringhere Just earlier today (on 2.3) I was able to login just fine with the alternate password for my user. Did I misconfigure dovecot or are $6$ type passwords no longer supported. Here's the debug output: 2025-11-10 05:44:58 +0100auth(userhere,server-ip-here,sasl:plain)<VrJZMTZD7rtcKosF>: Debug: pam: Finished passdb lookup 2025-11-10 05:44:58 +0100auth(userhere,server-ip-here,sasl:plain)<VrJZMTZD7rtcKosF>: Debug: passwd-file: Performing passdb lookup 2025-11-10 05:44:58 +0100auth(userhere,server-ip-here,sasl:plain)<VrJZMTZD7rtcKosF>: Debug: passwd-file: lookup: user=userhere file=/etc/dovecot/alternate/passwd 2025-11-10 05:44:58 +0100auth(userhere,server-ip-here,sasl:plain)<VrJZMTZD7rtcKosF>: Debug: passwd-file: Finished passdb lookup 2025-11-10 05:44:58 +0100auth(userhere,server-ip-here,sasl:plain)<VrJZMTZD7rtcKosF>: Debug: Auth request finished 2025-11-10 05:44:58 +0100auth(userhere,server-ip-here,sasl:plain)<VrJZMTZD7rtcKosF>: Debug: delaying auth failure Any idea what might be going on? Cheers, K. C.

2 4

Panic: file mail-user.c: line 185 (mail_user_deinit): assertion failed: ((*user)->refcount == 1)
by Szőts Ákos 10 Nov '25

10 Nov '25

Hi everyone, When I'm running a force-resync on my mailbox, it crashes. Unfortunately, after the crash, it left multiple new FTS mailboxes. Command: doveadm -D force-resync -u user(a)domain.ext '*' Error message: doveadm: Debug: Mailbox INBOX/fts-flatcurve/current.1756202040958990: Mailbox opened doveadm: Error: Mailbox INBOX: FTS optimize failed doveadm: Error: cmd force-resync: Forcing a resync on mailbox INBOX failed: FTS optimize failed doveadm: Panic: file mail-user.c: line 185 (mail_user_deinit): assertion failed: ((*user)->refcount == 1) doveadm: Error: Raw backtrace: #0 fatal_handler_real[0x7f7fcd996190] -> #1 default_fatal_handler[0x7f7fcd996260] -> #2 i_panic[0x7f7fcd8b5407] -> #3 mail_user_deinit.cold[0x7f7fcdc5720e] -> #4 doveadm_mail_next_user[0x55b93b0c16b0] -> #5 doveadm_cmd_ver2_to_mail_cmd_wrapper[0x55b93b0c33d0] -> #6 doveadm_cmdline_run[0x55b93b0d76e0] -> #7 doveadm_cmdline_try_run[0x55b93b0d7ee0] -> #8 main[0x55b93b0b0d10] -> #9 __libc_start_call_main[0x7f7fcd50827e] -> #10 __libc_start_main_alias_2[0x7f7fcd50833e] -> #11 _start[0x55b93b0b1320] Backtrace: #0 __pthread_kill_implementation(threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44 #1 0x00007f7fcd57ae33in __pthread_kill_internal(threadid=<optimized out>, signo=6) at pthread_kill.c:89 #2 0x00007f7fcd51f7b6in __GI_raise(sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #3 0x00007f7fcd50634bin __GI_abort() at abort.c:77 #4 0x00007f7fcd8b5575in default_fatal_finish(type=LOG_TYPE_PANIC, status=0) at ../lib/failures.c:461 #5 fatal_handler_real(ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:473 #6 0x00007f7fcd996283in default_fatal_handler(ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:481 #7 0x00007f7fcd8b54d7in i_panic(format=format@entry=0x7f7fcdd3eac8 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:526 #8 0x00007f7fcdc57237in mail_user_deinit(user=<optimized out>) at /usr/src/debug/dovecot-2.4.2/src/lib-storage/mail-user.c:185 #9 mail_user_deinit(user=<optimized out>) at /usr/src/debug/dovecot-2.4.2/src/lib-storage/mail-user.c:183 #10 0x000055b93b0c18f2in doveadm_mail_next_user(ctx=0x55b93ed9dfb8, error_r=<optimized out>) at /usr/src/debug/dovecot-2.4.2/src/doveadm/doveadm-mail.c:505 #11 0x000055b93b0c35e7in doveadm_mail_cmd_exec(ctx=0x55b93ed9dfb8, wildcard_user=0x0) at /usr/src/debug/dovecot-2.4.2/src/doveadm/doveadm-mail.c:705 #12 doveadm_cmd_ver2_to_mail_cmd_wrapper(cctx=<optimized out>) at /usr/src/debug/dovecot-2.4.2/src/doveadm/doveadm-mail.c:1034 #13 0x000055b93b0d7dd7in doveadm_cmdline_run(argc=<optimized out>, argv=0x55b93ed69840, cctx=cctx@entry=0x55b93ed90fa8) at /usr/src/debug/dovecot-2.4.2/src/doveadm/doveadm-cmd-parse.c:451 #14 0x000055b93b0d7f8cin doveadm_cmdline_try_run(cmd_name=cmd_name@entry=0x55b93ed6987c "force-resync", argc=<optimized out>, argv=<optimized out>, cctx=cctx@entry=0x55b93ed90fa8) at /usr/src/debug/dovecot-2.4.2/src/doveadm/doveadm-cmd.c:160 #15 0x000055b93b0b101din main(argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/dovecot-2.4.2/src/doveadm/doveadm.c:406 Unfortunately, this interrupted run left many new mailboxes in place: $ doveadm mailbox list -u user(a)domain.ext Junk Drafts Drafts/fts-flatcurve Drafts/fts-flatcurve/current.1756201209435330 Drafts/fts-flatcurve/index.5092 Trash Trash/fts-flatcurve Trash/fts-flatcurve/current.1756242793225435 Trash/fts-flatcurve/index.5401 Trash/Junk Trash/Junk/fts-flatcurve Trash/Junk/fts-flatcurve/index.6279 Trash/Junk/fts-flatcurve/current.1756366793619309 Interestingly, a short ago I deleted the Junk mailbox with "doveadm mailbox delete -e Junk". Trash/Junk was never a thing. Version: 2.4.2 In case FTS config is useful: mail_plugins { fts = yes fts_flatcurve = yes quota = yes virtual = yes } fts flatcurve { substring_search = yes } fts_autoindex = yes language en { default = yes } language de { } language_tokenizers = generic email-address Ákos Hi everyone, When I'm running a force-resync on my mailbox, it crashes. Unfortunately, after the crash, it left multiple new FTS mailboxes. Command: doveadm -D force-resync -u [1]user(a)domain.ext '*' Error message: doveadm: Debug: Mailbox INBOX/fts-flatcurve/current.1756202040958990: Mailbox opened doveadm: Error: Mailbox INBOX: FTS optimize failed doveadm: Error: cmd force-resync: Forcing a resync on mailbox INBOX failed: FTS optimize failed doveadm: Panic: file mail-user.c: line 185 (mail_user_deinit): assertion failed: ((*user)->refcount == 1) doveadm: Error: Raw backtrace: #0 fatal_handler_real[0x7f7fcd996190] -> #1 default_fatal_handler[0x7f7fcd996260] -> #2 i_panic[0x7f7fcd8b5407] -> #3 mail_user_deinit.cold[0x7f7fcdc5720e] -> #4 doveadm_mail_next_user[0x55b93b0c16b0] -> #5 doveadm_cmd_ver2_to_mail_cmd_wrapper[0x55b93b0c33d0] -> #6 doveadm_cmdline_run[0x55b93b0d76e0] -> #7 doveadm_cmdline_try_run[0x55b93b0d7ee0] -> #8 main[0x55b93b0b0d10] -> #9 __libc_start_call_main[0x7f7fcd50827e] -> #10 __libc_start_main_alias_2[0x7f7fcd50833e] -> #11 _start[0x55b93b0b1320] Backtrace: #0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44 #1 0x00007f7fcd57ae33 in __pthread_kill_internal (threadid=<optimized out>, signo=6) at pthread_kill.c:89 #2 0x00007f7fcd51f7b6 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #3 0x00007f7fcd50634b in __GI_abort () at abort.c:77 #4 0x00007f7fcd8b5575 in default_fatal_finish (type=LOG_TYPE_PANIC, status=0) at ../lib/failures.c:461 #5 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:473 #6 0x00007f7fcd996283 in default_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:481 #7 0x00007f7fcd8b54d7 in i_panic (format=format@entry=0x7f7fcdd3eac8 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:526 #8 0x00007f7fcdc57237 in mail_user_deinit (user=<optimized out>) at /usr/src/debug/dovecot-2.4.2/src/lib-storage/mail-user.c:185 #9 mail_user_deinit (user=<optimized out>) at /usr/src/debug/dovecot-2.4.2/src/lib-storage/mail-user.c:183 #10 0x000055b93b0c18f2 in doveadm_mail_next_user (ctx=0x55b93ed9dfb8, error_r=<optimized out>) at /usr/src/debug/dovecot-2.4.2/src/doveadm/doveadm-mail.c:505 #11 0x000055b93b0c35e7 in doveadm_mail_cmd_exec (ctx=0x55b93ed9dfb8, wildcard_user=0x0) at /usr/src/debug/dovecot-2.4.2/src/doveadm/doveadm-mail.c:705 #12 doveadm_cmd_ver2_to_mail_cmd_wrapper (cctx=<optimized out>) at /usr/src/debug/dovecot-2.4.2/src/doveadm/doveadm-mail.c:1034 #13 0x000055b93b0d7dd7 in doveadm_cmdline_run (argc=<optimized out>, argv=0x55b93ed69840, cctx=cctx@entry=0x55b93ed90fa8) at /usr/src/debug/dovecot-2.4.2/src/doveadm/doveadm-cmd-parse.c:451 #14 0x000055b93b0d7f8c in doveadm_cmdline_try_run (cmd_name=cmd_name@entry=0x55b93ed6987c "force-resync", argc=<optimized out>, argv=<optimized out>, cctx=cctx@entry=0x55b93ed90fa8) at /usr/src/debug/dovecot-2.4.2/src/doveadm/doveadm-cmd.c:160 #15 0x000055b93b0b101d in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/dovecot-2.4.2/src/doveadm/doveadm.c:406 Unfortunately, this interrupted run left many new mailboxes in place: $ doveadm mailbox list -u [2]user(a)domain.ext Junk Drafts Drafts/fts-flatcurve Drafts/fts-flatcurve/current.1756201209435330 Drafts/fts-flatcurve/index.5092 Trash Trash/fts-flatcurve Trash/fts-flatcurve/current.1756242793225435 Trash/fts-flatcurve/index.5401 Trash/Junk Trash/Junk/fts-flatcurve Trash/Junk/fts-flatcurve/index.6279 Trash/Junk/fts-flatcurve/current.1756366793619309 Interestingly, a short ago I deleted the Junk mailbox with "doveadm mailbox delete -e Junk". Trash/Junk was never a thing. Version: 2.4.2 In case FTS config is useful: mail_plugins { fts = yes fts_flatcurve = yes quota = yes virtual = yes } fts flatcurve { substring_search = yes } fts_autoindex = yes language en { default = yes } language de { } language_tokenizers = generic email-address Akos References Visible links 1. mailto:user@domain.ext 2. mailto:user@domain.ext

2 3

doveadm sync: Both source and destination mail_path and mail_index_path point to same directory
by Szőts Ákos 09 Nov '25

09 Nov '25

Hi everyone, When I'm trying to synchronise my e-mails from a backup with doveadm sync, I get an error. Doveadmin sync command: doveadm -D sync -1 -f -a "Virtual/All" -R -u user(a)example.net -n inbox mdbox:/var/spool/mail/example.net/user_backup Error message: dsync: Error: cmd sync: Both source and destination mail_path and mail_index_path point to same directory: /var/spool/mail/example.net/user//mail/mailboxes (name space inbox { mail_path } is set explicitly?) Relevant config section: namespace inbox { separator = / inbox = yes # "home" is set in userdb mail_path = %{home}/mail mail_index_path = %{home}/index/inbox mailbox ... { ... } mailbox ... { ... } } mail_driver = mdbox According to the config, the two directories are explicitly set to be different. I verified and they exist and they are not symlinks. Do you know what causes this issue? Version: 2.4.2 Thank you, Ákos Hi everyone, When I'm trying to synchronise my e-mails from a backup with doveadm sync, I get an error. Doveadmin sync command: doveadm -D sync -1 -f -a "Virtual/All" -R -u [1]user(a)example.net -n inbox mdbox:/var/spool/mail/example.net/user_backup Error message: dsync: Error: cmd sync: Both source and destination mail_path and mail_index_path point to same directory: /var/spool/mail/example.net/user//mail/mailboxes (name space inbox { mail_path } is set explicitly?) Relevant config section: namespace inbox { separator = / inbox = yes # "home" is set in userdb mail_path = %{home}/mail mail_index_path = %{home}/index/inbox mailbox ... { ... } mailbox ... { ... } } mail_driver = mdbox According to the config, the two directories are explicitly set to be different. I verified and they exist and they are not symlinks. Do you know what causes this issue? Version: 2.4.2 Thank you, Akos References Visible links 1. mailto:user@example.net

2 2

Using full email address as login
by Alex 07 Nov '25

07 Nov '25

Hi, I'm using dovecot-2.3.21.1 on fedora42. It seems that increasingly remote clients are only supporting the full email address as the login ID instead of just the username. One such example is Apollo.io, an AI sales platform that uses IMAP to connect to a remote server to send and receive emails. The documentation I've found on this appears to be deprecated or incomplete. Do I want to look for "shared namespace" documentation? Currently, emails are stored in /var/spool/mail/username. Does this need to change to something like /var/spool/domain.com/username? I'll also need to change postfix to use username(a)domain.com with sasl, I believe? Here is my current dovecot.conf. Ideas greatly appreciated. # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21.1 (49005e73) # OS: Linux 6.17.6-200.fc42.x86_64 x86_64 Fedora release 42 (Adams) # Hostname: orion.example.com auth_mechanisms = plain xoauth2 oauthbearer auth_verbose = yes default_vsz_limit = 1500 M mail_gid = mail mail_home = mail/ mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u mail_max_userip_connections = 500 mail_plugins = " listescape acl" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { address = 68.195.111.42 port = 993 } process_min_avail = 6 service_count = 0 } service pop3-login { inet_listener pop3 { address = 127.0.0.1 port = 110 } inet_listener pop3s { port = 995 } } ssl_cert = </etc/letsencrypt/example-fullchain.pem ssl_cipher_list = ALL:!LOW:!EXP:!aNULL:!RC4::!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { driver = passwd } Thanks, Alex Hi, I'm using dovecot-2.3.21.1 on fedora42. It seems that increasingly remote clients are only supporting the full email address as the login ID instead of just the username. One such example is Apollo.io, an AI sales platform that uses IMAP to connect to a remote server to send and receive emails. The documentation I've found on this appears to be deprecated or incomplete. Do I want to look for "shared namespace" documentation? Currently, emails are stored in /var/spool/mail/username. Does this need to change to something like /var/spool/[1]domain.com/username? I'll also need to change postfix to use [2]username(a)domain.com with sasl, I believe? Here is my current dovecot.conf. Ideas greatly appreciated. # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21.1 (49005e73) # OS: Linux 6.17.6-200.fc42.x86_64 x86_64 Fedora release 42 (Adams) # Hostname: [3]orion.example.com auth_mechanisms = plain xoauth2 oauthbearer auth_verbose = yes default_vsz_limit = 1500 M mail_gid = mail mail_home = mail/ mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u mail_max_userip_connections = 500 mail_plugins = " listescape acl" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { address = 68.195.111.42 port = 993 } process_min_avail = 6 service_count = 0 } service pop3-login { inet_listener pop3 { address = 127.0.0.1 port = 110 } inet_listener pop3s { port = 995 } } ssl_cert = </etc/letsencrypt/example-fullchain.pem ssl_cipher_list = ALL:!LOW:!EXP:!aNULL:!RC4::!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { driver = passwd } Thanks, Alex References Visible links 1. http://domain.com/username 2. mailto:username@domain.com 3. http://orion.example.com/

3 3

2.4.2 upgrade oddity
by Andy Baugh 06 Nov '25

06 Nov '25

Howdy y'all, I noticed something odd with the userdb/passdb processing past the 2.4.2 CVE fix, etc. -- namely that the prefixing you previously needed to do to userdb returns, etc. when you set a cache_key is no longer necessary and in fact harmful. It is worth mentioning, as after looking into this a bit and realizing that it "should have been obvious" to me that this would have been the case. That said I didn't make the logical leap till doveadm screamed at me about it during mailbox creation after upgrade (can't very well do `doveadm mailbox create -s -u user(a)domain.test INBOX.spam` when your userdb returns `${CACHE_KEY}_mailbox/INBOX/spam/...` for the relevant config values, etc.). TL;DR: disabling the cache = do NOT prefix any userdb/passdb returns in accordance with cache_key you set. This is true for lua passdb/authdb or any other authdb, not just passwd/oauth2. Cheers, -- Thomas "Andy" Baugh | Software Development Engineer IV andy.baugh(a)webpros.com www.webpros.com

2 2

doveadm sync issue
by Dan Whitehouse 06 Nov '25

06 Nov '25

Hi, I am running Dovecot on Debian trixie (dovecot-core/stable,now 1:2.4.1+dfsg1-6 amd64). Under the previous version, which I believe was 2.3, I was able to run a sync script with the following syntax: doveadm sync -u <user> remote:<user>@<host.tld> This worked very well and I was able to sync my mail. Having upgraded, this syntax produces the following error: dsync-server: invalid option -- ‘U' Error: doveadm: Unexpected or incomplete option: -U Even though my script doesn’t pass “-U” explicitly I believe that it is passed internally: https://github.com/dovecot/core/blob/main/src/doveadm/doveadm-settings.c#L1… core/src/doveadm/doveadm-settings.c at main · dovecot/core github.com Confusingly the online help still displays: doveadm dsync-server —help doveadm dsync-server [-r <rawlog path>] [-T <timeout secs>] [-U] Here we can see that the “-U” option (despite all the above) appears to have been removed from the code: https://github.com/dovecot/core/commit/4c04e4c30fd4817a8b0e11d04d9681173f69… global: Remove replicator · dovecot/core@4c04e4c github.com I have added the following to /etc/dovecot/local.conf: dsync_remote_cmd = "ssh -l%{login} %{host} doveadm dsync-server -u%{user}” (Note that I override the “-U”) and sync once again works properly. Many thanks for your attention, Dan Whitehouse

4 3

2.4.2 breaks user iterations for LDAP
by cpfeiffer＠rev-crew.info 06 Nov '25

06 Nov '25

Hello everyone, Due to the fix for CVE-2025-30189, routines like userdb_ldap_preinit() call auth_cache_parse_key_and_fields() unconditionally, with the eventually called auth_cache_parse_key_exclude() erroring if a cache key could not be constructed. It’s also noteworthy that this call happens regardless of whether use_cache is set or not, and as of such failing to construct a cache key would cause an error even if use_cache = no was set for that database. This is however an issue for user iteration with LDAP, as documented here LDAP | Dovecot CE <https://doc.dovecot.org/2.4.2/core/config/auth/databases/ldap.html#user-ite…> . Such a userdb only has iterate_filter fields that would inherently not be containing any user variables. The call to auth_cache_parse_key_and_fields() uses a combination of ldap_base and userdb_ldap_filter anyway (so whatever is in iterate_filter isn’t considered), and for an iteration userdb as described in the documentation, the latter would be empty. Alas, I ended up getting the rather confusing error * auth: Fatal: auth-cache: dc=rev-crew,dc=info: Cache key must contain at least one variable With dc=rev-crew,dc=info being my ldap_base setting for the iteration userdb. I’m not critically dependent on the user iteration, so I’ve commented the userdb out for now, but this would need fixing. Regards, Christian Pfeiffer Hello everyone, Due to the fix for CVE-2025-30189, routines like userdb_ldap_preinit() call auth_cache_parse_key_and_fields() unconditionally, with the eventually called auth_cache_parse_key_exclude() erroring if a cache key could not be constructed. It's also noteworthy that this call happens regardless of whether use_cache is set or not, and as of such failing to construct a cache key would cause an error even if use_cache = no was set for that database. This is however an issue for user iteration with LDAP, as documented here [1]LDAP | Dovecot CE. Such a userdb only has iterate_filter fields that would inherently not be containing any user variables. The call to auth_cache_parse_key_and_fields() uses a combination of ldap_base and userdb_ldap_filter anyway (so whatever is in iterate_filter isn't considered), and for an iteration userdb as described in the documentation, the latter would be empty. Alas, I ended up getting the rather confusing error o auth: Fatal: auth-cache: dc=rev-crew,dc=info: Cache key must contain at least one variable With dc=rev-crew,dc=info being my ldap_base setting for the iteration userdb. I'm not critically dependent on the user iteration, so I've commented the userdb out for now, but this would need fixing. Regards, Christian Pfeiffer References Visible links 1. https://doc.dovecot.org/2.4.2/core/config/auth/databases/ldap.html#user-ite…

2 2