November 2025 - dovecot

Using full email address as login
by Alex 07 Nov '25

07 Nov '25

Hi, I'm using dovecot-2.3.21.1 on fedora42. It seems that increasingly remote clients are only supporting the full email address as the login ID instead of just the username. One such example is Apollo.io, an AI sales platform that uses IMAP to connect to a remote server to send and receive emails. The documentation I've found on this appears to be deprecated or incomplete. Do I want to look for "shared namespace" documentation? Currently, emails are stored in /var/spool/mail/username. Does this need to change to something like /var/spool/domain.com/username? I'll also need to change postfix to use username(a)domain.com with sasl, I believe? Here is my current dovecot.conf. Ideas greatly appreciated. # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21.1 (49005e73) # OS: Linux 6.17.6-200.fc42.x86_64 x86_64 Fedora release 42 (Adams) # Hostname: orion.example.com auth_mechanisms = plain xoauth2 oauthbearer auth_verbose = yes default_vsz_limit = 1500 M mail_gid = mail mail_home = mail/ mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u mail_max_userip_connections = 500 mail_plugins = " listescape acl" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { address = 68.195.111.42 port = 993 } process_min_avail = 6 service_count = 0 } service pop3-login { inet_listener pop3 { address = 127.0.0.1 port = 110 } inet_listener pop3s { port = 995 } } ssl_cert = </etc/letsencrypt/example-fullchain.pem ssl_cipher_list = ALL:!LOW:!EXP:!aNULL:!RC4::!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { driver = passwd } Thanks, Alex Hi, I'm using dovecot-2.3.21.1 on fedora42. It seems that increasingly remote clients are only supporting the full email address as the login ID instead of just the username. One such example is Apollo.io, an AI sales platform that uses IMAP to connect to a remote server to send and receive emails. The documentation I've found on this appears to be deprecated or incomplete. Do I want to look for "shared namespace" documentation? Currently, emails are stored in /var/spool/mail/username. Does this need to change to something like /var/spool/[1]domain.com/username? I'll also need to change postfix to use [2]username(a)domain.com with sasl, I believe? Here is my current dovecot.conf. Ideas greatly appreciated. # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21.1 (49005e73) # OS: Linux 6.17.6-200.fc42.x86_64 x86_64 Fedora release 42 (Adams) # Hostname: [3]orion.example.com auth_mechanisms = plain xoauth2 oauthbearer auth_verbose = yes default_vsz_limit = 1500 M mail_gid = mail mail_home = mail/ mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u mail_max_userip_connections = 500 mail_plugins = " listescape acl" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { address = 68.195.111.42 port = 993 } process_min_avail = 6 service_count = 0 } service pop3-login { inet_listener pop3 { address = 127.0.0.1 port = 110 } inet_listener pop3s { port = 995 } } ssl_cert = </etc/letsencrypt/example-fullchain.pem ssl_cipher_list = ALL:!LOW:!EXP:!aNULL:!RC4::!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { driver = passwd } Thanks, Alex References Visible links 1. http://domain.com/username 2. mailto:username@domain.com 3. http://orion.example.com/

3 3

2.4.2 upgrade oddity
by Andy Baugh 06 Nov '25

06 Nov '25

Howdy y'all, I noticed something odd with the userdb/passdb processing past the 2.4.2 CVE fix, etc. -- namely that the prefixing you previously needed to do to userdb returns, etc. when you set a cache_key is no longer necessary and in fact harmful. It is worth mentioning, as after looking into this a bit and realizing that it "should have been obvious" to me that this would have been the case. That said I didn't make the logical leap till doveadm screamed at me about it during mailbox creation after upgrade (can't very well do `doveadm mailbox create -s -u user(a)domain.test INBOX.spam` when your userdb returns `${CACHE_KEY}_mailbox/INBOX/spam/...` for the relevant config values, etc.). TL;DR: disabling the cache = do NOT prefix any userdb/passdb returns in accordance with cache_key you set. This is true for lua passdb/authdb or any other authdb, not just passwd/oauth2. Cheers, -- Thomas "Andy" Baugh | Software Development Engineer IV andy.baugh(a)webpros.com www.webpros.com

2 2

doveadm sync issue
by Dan Whitehouse 06 Nov '25

06 Nov '25

Hi, I am running Dovecot on Debian trixie (dovecot-core/stable,now 1:2.4.1+dfsg1-6 amd64). Under the previous version, which I believe was 2.3, I was able to run a sync script with the following syntax: doveadm sync -u <user> remote:<user>@<host.tld> This worked very well and I was able to sync my mail. Having upgraded, this syntax produces the following error: dsync-server: invalid option -- ‘U' Error: doveadm: Unexpected or incomplete option: -U Even though my script doesn’t pass “-U” explicitly I believe that it is passed internally: https://github.com/dovecot/core/blob/main/src/doveadm/doveadm-settings.c#L1… core/src/doveadm/doveadm-settings.c at main · dovecot/core github.com Confusingly the online help still displays: doveadm dsync-server —help doveadm dsync-server [-r <rawlog path>] [-T <timeout secs>] [-U] Here we can see that the “-U” option (despite all the above) appears to have been removed from the code: https://github.com/dovecot/core/commit/4c04e4c30fd4817a8b0e11d04d9681173f69… global: Remove replicator · dovecot/core@4c04e4c github.com I have added the following to /etc/dovecot/local.conf: dsync_remote_cmd = "ssh -l%{login} %{host} doveadm dsync-server -u%{user}” (Note that I override the “-U”) and sync once again works properly. Many thanks for your attention, Dan Whitehouse

4 3

Dovecot upgrade from 2.3.x to 2.4.x: and mailbox_alias plugin
by Gerhard Wiesinger 06 Nov '25

06 Nov '25

Hello, Regarding dovecot upgrade from 2.3.x to 2.4.x and mailbox_alias plugin: I've already converted my config and scripts but I'm still missing this config change: plugin { mailbox_alias_old = Spam mailbox_alias_new = Junk } I saw in the link https://doc.dovecot.org/2.4.0/installation/upgrade/2.3-to-2.4.html mailbox-alias plugin Depending on the use case, replacement may be the mailbox_special_use mailbox setting and/or Sieve filters. Any ideas what's the best alternative? Another question, is the following correct: mail_home = /home/vmail/%n mail_location = maildir:~/Maildir => mail_home = /home/vmail/%{user | username} mail_driver = maildir mail_path = ~/Maildir mail_inbox_path = ~/Maildir (Especially mail_inbox_path, I don't have a ".INBOX" directory currently, I guess .INBOX is now default. How to deal with this?) Thnx. Ciao, Gerhard

2 4

Build failure due to non-constant initializers in unicode-transform.c
by adesh＠backuply.com 05 Nov '25

05 Nov '25

When building Dovecot 2.4.2 on modern compilers (GCC ≥ 5, Clang, or any C99/C11-compliant environment), the build fails in src/lib/unicode-transform.c due to the use of non-constant initializers in static const global variables. The affected lines define Hangul composition constants using other const variables instead of compile-time constants, which is not allowed in standard C99 and later. error log: unicode-transform.c:211:1: error: initializer element is not constant static const size_t uni_hangul_n_count = uni_hangul_v_count * uni_hangul_t_count; ^ unicode-transform.c:212:1: error: initializer element is not constant static const uint16_t uni_hangul_l_end = uni_hangul_l_base + uni_hangul_l_count; ^ unicode-transform.c:213:1: error: initializer element is not constant static const uint16_t uni_hangul_v_end = uni_hangul_v_base + uni_hangul_v_count; ^ unicode-transform.c:214:1: error: initializer element is not constant static const uint16_t uni_hangul_t_end = uni_hangul_t_base + uni_hangul_t_count; ^ This issue prevents building Dovecot 2.4.x on modern systems without non-standard compiler flags, breaking out-of-the-box builds on up-to-date Linux distributions.

2 2

configuration fails at the last hurdle
by demo＠manx.net 04 Nov '25

04 Nov '25

as a newbie suddenly requiring a mail server the configuration of dovecot and postfix is proving elusive. if i get one element working another fails. i think it would help readers if i supply my status report and ask for suggestions as to how to ensure a remote client can access the mail just delivered from another remote in addition for mutt to see the mail on the sever. cat <<EOF > ~/mailserver-status.txt 📨 Mail Server Status – Ryzen2 (Ubuntu 25.10) Objective: To host email services independently, replacing Manx Telecom’s legacy offering. Rationale: Manx Telecom has been acquired by Jersey Telecom, with plans to charge £65 per annum per email address. This migration aims to preserve autonomy and reduce costs. ✅ Current Achievements - Mail Receipt Confirmed: Mail addressed to jsm(a)mckenzietrust.com (a domain owned by us) is successfully received via encrypted POP3S (port 995) using both Thunderbird and OpenSSL. - Maildir Workflow Operational: Messages arrive in Maildir/new and are moved every minute to Maildir/cur via a cron job. They are accessible locally using mutt. - SSL Layer Functional: POP3S handshake completes successfully, confirming certificate and encryption setup is sound. ⚠️ Known Issues - Remote Access Fails Silently: Thunderbird and OpenSSL clients connect but cannot retrieve messages from Maildir/cur or new. No errors are returned—access appears to die silently. - Dovecot Configuration Fragility: Any attempt to explicitly define mail_location in config files (e.g., 10-mail.conf) causes Dovecot to crash on startup. This behavior is consistent across both Ubuntu 25.04 and 25.10 builds. It is imperative not to attempt location overrides, as recovery requires reverting to a clean config state. - Post-Reboot Regression: Remote access was briefly functional but failed after a system reboot triggered by a firmware update. This suggests a state-dependent or ephemeral config success. 🧭 Configuration Notes - Dovecot and Postfix Versions: Packages from Ubuntu 25.04 were manually installed and locked to prevent auto-updates. This avoids compatibility issues with newer builds. - POP3S Listener Enabled: The following stanza is active in 10-master.conf: service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } - SSL Configuration: ssl = yes ssl_server_cert_file = /etc/dovecot/private/dovecot.pem ssl_server_key_file = /etc/dovecot/private/dovecot.key These paths are valid and readable by root. 🧱 Constraints and Priorities - No Urgency: At least one month is available for debugging and refinement. - Web Server Stability Is Critical: The live web server must remain uninterrupted, as it hosts the McKenzie Trust’s public-facing structure. - Outbound Mail Deliverability: The domain currently uses DDNS. Without a PTR record, outbound mail from Ryzen2 may be rejected. A fixed IP or relay forwarding will be required. 🧩 Next Steps - Investigate mailbox visibility for remote clients—likely a permissions or UID mapping issue. - Consider enabling auth-master socket for privileged access if needed. - Explore relay options or static IP acquisition to ensure outbound mail acceptance. EOF regards jsm

5 6

doveadm sync -1 -R only downloads Inbox but not Sent Items
by r.barclay＠habmalnefrage.de 02 Nov '25

02 Nov '25

Hi, When my free mail provider mailbox runs out of free space, I have my local Dovecot server one-way sync that free mail mailbox and then I delete the contents of the free mail mailbox. So I can archive my emails in an "offline archive". Initially, I used "doveadm backup", but later always used: doveadm -Dv sync -u offline(a)example.org -1 -f -R imapc: At large, this works. But only during the first "backup" the "Sent" folder was synced as well. Nowdays, it only downloads the Inbox, but not my Sent Items. I tried adding the "-N" parameter, but that said: "Fatal: -N parameter requires syncing with remote host" I'm on Debian 12 and Dovecot 2.3.x: 1:2.3.19.1+dfsg1-2.1+deb12u1 amd64. What could I check or try? And one more question: To better understand the debug output: What is "brain M" and "brain S"? Yours, Reg

1 0