December 2025 - dovecot

LDAP AD Quota override not working
by wt.forsaken＠gmail.com 26 Feb '26

26 Feb '26

Hi there, I'm testing the new version of Dovecot 2.4 in Debian 13 before upgrading to my customers and I'm having difficult on trying to override the user's quota. The LDAP base is from Samba4 AD and having been trying the following configuration: auth-ldap.conf.ext: ldap_uris = ldap://localhost ldap_auth_dn = cn=admin,dc=localdomain ldap_auth_dn_password = password ldap_base = ou=users, dc=localdomain passdb ldap { filter = (&(objectClass=person)(sAMAccountName=%{user})) bind = yes fields { userdb_quota_storage_size = %{ldap:telephoneNumber}B } } userdb prefetch { driver = prefetch } userdb ldap { fields { quota_storage_size = %{ldap:telephoneNumber}B } } 90-quota.conf mail_plugins { quota = yes } quota "User quota" { } quota_storage_size = 40M Since there is no quotaBytes in Samba AD, I'm testing to map the telephoneNumber parameters to override the quota, also I'm just testing a 40M to see how it works. Roundcube webmail can see the quota being overriden in its inferior bar, but when I send an email to the user which is above the quota, the journal log inform "failed to store into mailbox 'INBOX': Quota exceeded (mailbox for user is full)". I don't know how to override the quota, since in passdb section I used the "userdb_" prefix but it is not being passed to userdb when I input the "doveadm user ..." command. I don't know if I have been clear in my request, but I'd appreciate any help.

3 3

Panic in logs
by Kamil Jońca 22 Feb '26

22 Feb '26

Recently I found in my lda logs: 2025-12-30T07:55:14.717927+01:00 alfa dovecot: lda(kjonca): Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 i_syslog_fatal_handler[0x7f99a2351430] -> #3 i_panic[0x7f99a226d453] -> #4 [unw_get_proc_name() failed: -10] -> #5 [unw_get_proc_name() failed: -10] -> #6 [unw_get_proc_name() failed: -10] -> #7 buffer_append[0x7f99a2345270] -> #8 dregex_code_match_groups[0x7f99a233f1a0] -> #9 [unw_get_proc_name() failed: -10] -> #10 [unw_get_proc_name() failed: -10] -> #11 sieve_match_value[0x7f99a117f770] -> #12 sieve_match[0x7f99a117fa30] -> #13 [unw_get_proc_name() failed: -10] -> #14 sieve_interpreter_continue[0x7f99a117e100] -> #15 sieve_multiscript_run[0x7f99a1190330] -> #16 [unw_get_proc_name() failed: -10] -> #17 mail_deliver[0x7f99a27e54a0] -> #18 main[0x55e371c555e0] -> #19 __libc_start_call_main[0x7f99a1e29f00] -> #20 __libc_start_main_alias_2[0x7f99a1e29fa0] -> #21 _start[0x55e371c566a0] And sadly it seems, that mail is missing (it was passed to pipe program to further processing) KJ -- http://wolnelektury.pl/wesprzyj/teraz/ When you go out to buy, don't show your silver.

4 4

2.4.2 breaks user iterations for LDAP
by cpfeiffer＠rev-crew.info 19 Feb '26

19 Feb '26

Hello everyone, Due to the fix for CVE-2025-30189, routines like userdb_ldap_preinit() call auth_cache_parse_key_and_fields() unconditionally, with the eventually called auth_cache_parse_key_exclude() erroring if a cache key could not be constructed. It’s also noteworthy that this call happens regardless of whether use_cache is set or not, and as of such failing to construct a cache key would cause an error even if use_cache = no was set for that database. This is however an issue for user iteration with LDAP, as documented here LDAP | Dovecot CE <https://doc.dovecot.org/2.4.2/core/config/auth/databases/ldap.html#user-ite…> . Such a userdb only has iterate_filter fields that would inherently not be containing any user variables. The call to auth_cache_parse_key_and_fields() uses a combination of ldap_base and userdb_ldap_filter anyway (so whatever is in iterate_filter isn’t considered), and for an iteration userdb as described in the documentation, the latter would be empty. Alas, I ended up getting the rather confusing error * auth: Fatal: auth-cache: dc=rev-crew,dc=info: Cache key must contain at least one variable With dc=rev-crew,dc=info being my ldap_base setting for the iteration userdb. I’m not critically dependent on the user iteration, so I’ve commented the userdb out for now, but this would need fixing. Regards, Christian Pfeiffer Hello everyone, Due to the fix for CVE-2025-30189, routines like userdb_ldap_preinit() call auth_cache_parse_key_and_fields() unconditionally, with the eventually called auth_cache_parse_key_exclude() erroring if a cache key could not be constructed. It's also noteworthy that this call happens regardless of whether use_cache is set or not, and as of such failing to construct a cache key would cause an error even if use_cache = no was set for that database. This is however an issue for user iteration with LDAP, as documented here [1]LDAP | Dovecot CE. Such a userdb only has iterate_filter fields that would inherently not be containing any user variables. The call to auth_cache_parse_key_and_fields() uses a combination of ldap_base and userdb_ldap_filter anyway (so whatever is in iterate_filter isn't considered), and for an iteration userdb as described in the documentation, the latter would be empty. Alas, I ended up getting the rather confusing error o auth: Fatal: auth-cache: dc=rev-crew,dc=info: Cache key must contain at least one variable With dc=rev-crew,dc=info being my ldap_base setting for the iteration userdb. I'm not critically dependent on the user iteration, so I've commented the userdb out for now, but this would need fixing. Regards, Christian Pfeiffer References Visible links 1. https://doc.dovecot.org/2.4.2/core/config/auth/databases/ldap.html#user-ite…

4 5

"Synchronization corrupted index header" with mdbox: thousands of deleted e-mails reappeared in INBOX
by Ákos Szőts 17 Feb '26

17 Feb '26

Hi everyone, Suddenly, the following messages appeared in my Dovecot error log: master: Warning: Killed with signal 15 (by pid=0 uid=0 code=kill) Error: Mailbox Trash: Synchronization corrupted index header [...]/Trash/dbox-Mails/dovecot.index: uidvalidity=0, but next_uid=73 Warning: Mailbox Trash: fscking index file [...]/Trash/dbox-Mails/dovecot.index Warning: mdbox([...]/mail/storage): rebuilding indexes: Mailbox Trash index was fsck'd Warning: mdbox([...]/mail/storage): fscking index file [...]/index/inbox/storage/dovecot.map.index Error: Mailbox INBOX: [...]/INBOX/dbox-Mails/dovecot.index reset, view is now inconsistent The first message is because I restarted the container. Since then, Thunderbird shows thousands of previously deleted e-mails again in INBOX where all my messages are marked as unread. - Do you know what can cause it and how can I avoid to happen again? - Is the used mdbox storage engine that fragile? Is the fault tolerance of other engines better? I have a backup from some days ago. Is it possible to somehow revert back to it and sync the new e-mails on top of those? Version: 2.4.2. Thank you, Ákos

2 1

About mail_inbox_path and mail location
by Aki Tuomi 06 Feb '26

06 Feb '26

Hi! We've been noticing that many people are configuring mail_inbox_path. I assume that for most people this is because debian decided to include it in their default config, so that it would use /var/mail boxes for user INBOXes. If your inbox *does not* reside in some weird location, you should *not* set this setting to any value, instead you can either ensure it's commented out, or set to empty value. IN PARTICULAR, IT IS **NOT** REQUIRED SETTING. Setting it to some random weird value like '.' will just cause Problems, setting it to $MAIL_HOME/ or something else will just be either pointless or cause problems. Some most common conversions (please adjust to your environment) mail_home= /home/vmail/%u => mail_home = /home/vmail/%{user} mail_home = /home/vmail/%d/%u => mail_home = /home/vmail/%{user|domain}/%{user|username} or some variant of this. mail_location = maildir:~/ => mail_path = ~/ mail_driver = maildir mail_location = maildir:/var/srv/foo/%d/%u => mail_path = /var/srv/foo/%{user|domain}/%{user|username} mail_driver = maildir In addition you might want to convert INDEX=~/.index => mail_index_path=~/.index CONTROL=~/.control => mail_control_path=~/.control LAYOUT=fs => mailbox_list_layout=fs A minimal working config is mail_home=/home/vmail/%{user} mail_driver=maildir mail_path=~/maildir mail_uid=vmail mail_gid=vmail ## If you have settings like namespace other { location = maildir:/foo/bar } this converts into namespace other { mail_path = /foo/bar # optional, if this is matches your top level mail_driver = maildir } Hope this clears out some of the confusion. Aki

3 4

2.4.2 breaks big-endian builds
by Noah Meyerhans 19 Jan '26

19 Jan '26

From the Debian s390 build log, no merging parent is NULL ............................................ : ok no merging parent sent to stats ...................................... : ok no merging parent timestamp differs .................................. : ok merge events parent NULL ............................................. : ok merge events parent sent to stats .................................... : ok skip empty parents ................................................... : ok merge events and skip empty parents .................................. : ok parent updated after send ............................................ : ok large event id ....................................................... : ok merge events global .................................................. : ok 0 / 10 tests failed test-master-service-settings.c:472: Assert(#16) failed: strstr(error, tests[i].error) != NULL test-master-service-settings: Error: Failed to parse configuration: Settings block doesn't end with NUL at offset 70 test-master-service-settings.c:472: Assert(#19) failed: strstr(error, tests[i].error) != NULL test-master-service-settings: Error: Failed to parse configuration: Settings block doesn't end with NUL at offset 84 master_service_settings_read() - binary corruption ................... : FAILED 1 / 1 tests failed make[4]: *** [Makefile:958: check-local] Error 1 make[4]: Leaving directory '/build/reproducible-path/dovecot-2.4.2+dfsg1/src/lib-master' make[3]: *** [Makefile:806: check-am] Error 2 make[3]: Leaving directory '/build/reproducible-path/dovecot-2.4.2+dfsg1/src/lib-master' make[2]: *** [Makefile:604: check-recursive] Error 1 make[2]: Leaving directory '/build/reproducible-path/dovecot-2.4.2+dfsg1/src' make[1]: *** [Makefile:739: check-recursive] Error 1 make[1]: Leaving directory '/build/reproducible-path/dovecot-2.4.2+dfsg1' The build failure was introduced with commit 41bd7a502 ("lib-settings, config: Use native CPU endianess in binary config file"). The build is successful at the previous commit, but fails at that commit. I haven't yet determined whether the failure is with the code itself or the test. Full build log is available at https://buildd.debian.org/status/fetch.php?pkg=dovecot&arch=s390x&ver=1%3A2… noah

2 2

mail-crypt transition from Dovecot 2.3 to 2.4
by m＠maltris.org 11 Jan '26

11 Jan '26

In Dovecot 2.3 I had used the following query: password_query = \ SELECT USER.user, USER.host, \ SECRET.password, SECRET.public_key AS mail_crypt_global_public_key, SECRET.private_key AS mail_crypt_global_private_key \ FROM USER \ WHERE USER.user = '%Lu' This worked fine, enabling encryption and decryption properly. For Dovecot 2.4 this does not work anymore. Example from LMTP: Dec 11 15:02:59 lmtp(975838): Info: lmtp-server: conn unix:pid=975905,uid=113 [1]: rcpt user(a)test.de: <Ti6aNxPPOmne4w4APAc66w>: Failed to send message to <user(a)test.de> at server:24: 451 4.2.0 <user(a)test.de> get_public_key(INBOX) failed: mailbox_attribute_get(INBOX, /shared/vendor/vendor.dovecot/pvt/crypt/active) failed: Mailbox attributes not enabled (1/1 at 12 ms) I tried to adapt it to Dovecot 2.4 per the documentation, ending up with this: query = \ SELECT \ USER.user, USER.host, \ SECRET.password, \ concat('inline:', SECRET.public_key) AS crypt_global_public_key_file, \ 'main' AS crypt_global_private_key, \ concat('inline:', SECRET.private_key) AS 'crypt_global_private_key/main/crypt_private_key_file' \ FROM USER \ WHERE USER.user = '%{user | lower}' Still the error message: get_public_key(INBOX) failed: mailbox_attribute_get(INBOX, /shared/vendor/vendor.dovecot/pvt/crypt/active) failed: Mailbox attributes not enabled Additionally I tried without the "inline:" prefix, because without, doveadm mailbox cryptokey list would return a "no such file or directory error" trying to treat the key as a filename. With the "inline:" prefix it returns nothing except a warning: Warning: mailbox cryptokey list: Nothing was matched. Use -U or specify mask? What is the right way to proceed here?

2 2

How can I use /etc/passwd auth for linux users and a passwd-file for virtual mailbox users?
by Ethan Merrill 06 Jan '26

06 Jan '26

Hello, I hope this is the right mailing list to send questions to. Please direct me where to go if it is not. Thanks. --- I am setting up a postfix/dovecot email server on a Debian 13 VPS. Dovecot is v2.4.1. I have thus far been able to successfully configure the server for smtp and imap support for my primary domain (we'll say `user(a)example.com` who is a linux user with a home folder). I have been even been able to configure postfix to have virtual mailboxes and aliases, and from ssh I can can even see that the mail gets delivered to the correct place. However, I am struggling to set up dovecot to authenticate a virtual mailbox user (we'll say `user(a)example.net` who only has a virtual mailbox). [This documentation page](https://doc.dovecot.org/2.4.2/core/config/auth/mutltiple.html) describes the process to configure multiple authentication databases. It describes being able to use multiple `passdb` and `userdb` sections in order to authenticate dovecot users. Based upon what it suggested, I tried this configuration: > ## Snippet from /etc/dovecot/dovecot.conf ## > passdb passwd-file { > # So example.net => /etc/dovecot/passwd/example.net > passwd_file_path = /etc/dovecot/passwd/%{user | domain} > } > # Fall thru to PAM for unix users > passdb pam { > } > > userdb passwd-file { > passwd_file_path = /etc/dovecot/passwd/%{user | domain} > } > # Fall thru to /etc/passwd for unix users > userdb passwd { > } > > ## Snippet from /etc/dovecot/passwd/example.net ## > support@example.net:$y$j9...hash...:800:800::/var/postfix/virtual/example.net/support:: This is the configuration I landed on that hypothetically checks multiple databases for authentication that allows at least `user(a)example.com` to still login with Thunderbird and do email stuff. However it does not authenticate `user(a)example.net`. The biggest difference between my config and the example is that they use a `sql` database while I am trying the `passwd-file` database. In principle this seems like it should work, unless I am understanding the dovecot docs or have made my passwd file incorrectly. I even tried reversing the order of `userdb` and `passdb` sections to see if it would help to no avail. [This thread](https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thre… seems to address a similar issue, and more or less has the same configuration setup suggested as the one in the snippet above. It's also from 2006 so the API looks kinda different from the current docs. [This thread](https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thre… is from 2013 addressing a similar issue, but despite again different API it translates to more or less what the snippet above shows. Here is the journalctl output from when I tried to login as `user(a)example.net`: > # journalctl -xeu dovecot | tail > Dec 29 11:38:19 example.com auth[4719]: pam_unix(dovecot:auth): check pass; user unknown > Dec 29 11:38:19 example.com auth[4719]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=user(a)example.net rhost=10.0.0.1 > Dec 29 11:38:28 example.com auth[4719]: pam_unix(dovecot:auth): check pass; user unknown > Dec 29 11:38:28 example.com auth[4719]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=user(a)example.net rhost=10.0.0.1 > Dec 29 11:41:19 example.com dovecot[4700]: imap-login: Login aborted: Inactivity (auth failed, 2 attempts in 180 secs) (auth_failed): user=<user(a)example.net>, method=LOGIN, rip=10.0.0.1, lip=10.0.0.2, TLS, session=<z8Tj3hlHkLxJMmuL> The last message referring to "Inactivity" is because at that point fail2ban blocked my IP, but before that it was consistent with results I have been getting. I'm at an absolute loss. I feel like I've trawled every doc I could find, every config file involved in the setup process, all the Stack Exchange answers that seem to exist. Honestly it baffles me to see that even what looks like the same setup as official documentation, it just doesn't... work? Can anybody point to me what is going wrong? Thanks for reading, ~ Ethan Merrill Hello, I hope this is the right mailing list to send questions to. Please direct me where to go if it is not. Thanks. --- I am setting up a postfix/dovecot email server on a Debian 13 VPS. Dovecot is v2.4.1. I have thus far been able to successfully configure the server for smtp and imap support for my primary domain (we'll say `user(a)example.com` who is a linux user with a home folder). I have been even been able to configure postfix to have virtual mailboxes and aliases, and from ssh I can can even see that the mail gets delivered to the correct place. However, I am struggling to set up dovecot to authenticate a virtual mailbox user (we'll say `user(a)example.net` who only has a virtual mailbox). [1]This documentation page describes the process to configure multiple authentication databases. It describes being able to use multiple `passdb` and `userdb` sections in order to authenticate dovecot users. Based upon what it suggested, I tried this configuration: ## Snippet from /etc/dovecot/dovecot.conf ## passdb passwd-file { # So [2]example.net => /etc/dovecot/passwd/example.net passwd_file_path = /etc/dovecot/passwd/%{user | domain} } # Fall thru to PAM for unix users passdb pam { } userdb passwd-file { passwd_file_path = /etc/dovecot/passwd/%{user | domain} } # Fall thru to /etc/passwd for unix users userdb passwd { } ## Snippet from /etc/dovecot/passwd/example.net ## [3]support@example.net:$y$j9...hash...:800:800::/var/postfix/virtual/example.net/support:: This is the configuration I landed on that hypothetically checks multiple databases for authentication that allows at least `user(a)example.com` to still login with Thunderbird and do email stuff. However it does not authenticate `user(a)example.net`. The biggest difference between my config and the example is that they use a `sql` database while I am trying the `passwd-file` database. In principle this seems like it should work, unless I am understanding the dovecot docs or have made my passwd file incorrectly. I even tried reversing the order of `userdb` and `passdb` sections to see if it would help to no avail. [4]This thread seems to address a similar issue, and more or less has the same configuration setup suggested as the one in the snippet above. It's also from 2006 so the API looks kinda different from the current docs. [5]This thread is from 2013 addressing a similar issue, but despite again different API it translates to more or less what the snippet above shows. Here is the journalctl output from when I tried to login as `user(a)example.net`: # journalctl -xeu dovecot | tail Dec 29 11:38:19 [6]example.com auth[4719]: pam_unix(dovecot:auth): check pass; user unknown Dec 29 11:38:19 [7]example.com auth[4719]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot [8]ruser=user(a)example.net rhost=10.0.0.1 Dec 29 11:38:28 [9]example.com auth[4719]: pam_unix(dovecot:auth): check pass; user unknown Dec 29 11:38:28 [10]example.com auth[4719]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot [11]ruser=user(a)example.net rhost=10.0.0.1 Dec 29 11:41:19 [12]example.com dovecot[4700]: imap-login: Login aborted: Inactivity (auth failed, 2 attempts in 180 secs) (auth_failed): user=<[13]user(a)example.net>, method=LOGIN, rip=10.0.0.1, lip=10.0.0.2, TLS, session=<z8Tj3hlHkLxJMmuL> The last message referring to "Inactivity" is because at that point fail2ban blocked my IP, but before that it was consistent with results I have been getting. I'm at an absolute loss. I feel like I've trawled every doc I could find, every config file involved in the setup process, all the Stack Exchange answers that seem to exist. Honestly it baffles me to see that even what looks like the same setup as official documentation, it just doesn't... work? Can anybody point to me what is going wrong? Thanks for reading, ~ Ethan Merrill References Visible links 1. This documentation page https://doc.dovecot.org/2.4.2/core/config/auth/mutltiple.html 2. http://example.net/ 3. mailto:support@example.net 4. This thread https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/VMXU2… 5. This thread https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/YO3DF… 6. http://example.com/ 7. http://example.com/ 8. mailto:ruser=user@example.net 9. http://example.com/ 10. http://example.com/ 11. mailto:ruser=user@example.net 12. http://example.com/ 13. mailto:user@example.net

6 10

Missing dovecot-pigeonhole packages in official CE-2.4 repo for RHEL/Rocky Linux 10
by Mateusz Kiczela 06 Jan '26

06 Jan '26

Hello Dovecot Team, I am attempting to install Dovecot 2.4.2 on Rocky Linux 10 (RHEL 10 compatible) using the official repository found at: http://repo.dovecot.org/ce-2.4-latest/rhel/10/RPMS/x86_64/ The Issue: Although the core Dovecot packages (dovecot, dovecot-imapd, etc.) are present, the Pigeonhole (Sieve/ManageSieve) packages are completely missing from the repository index. I have verified this by browsing the directory listing directly. Missing Packages: - dovecot-pigeonhole - dovecot-sieve - dovecot-managesieved Could you please check the build pipeline for RHEL/CentOS/Rocky Linux 10? It appears the Pigeonhole artifacts are not being published, and the base dependencies might need a rebuild against current EL10 libraries. Thank you for your support! Best regards. Mateusz Kiczela Hello Dovecot Team, I am attempting to install Dovecot 2.4.2 on Rocky Linux 10 (RHEL 10 compatible) using the official repository found at: [1]http://repo.dovecot.org/ce-2.4-latest/rhel/10/RPMS/x86_64/ The Issue: Although the core Dovecot packages (dovecot, dovecot-imapd, etc.) are present, the Pigeonhole (Sieve/ManageSieve) packages are completely missing from the repository index. I have verified this by browsing the directory listing directly. Missing Packages: - dovecot-pigeonhole - dovecot-sieve - dovecot-managesieved Could you please check the build pipeline for RHEL/CentOS/Rocky Linux 10? It appears the Pigeonhole artifacts are not being published, and the base dependencies might need a rebuild against current EL10 libraries. Thank you for your support! Best regards. Mateusz Kiczela References Visible links 1. http://repo.dovecot.org/ce-2.4-latest/rhel/10/RPMS/x86_64/

2 3

Hello, i came here for Your help cant do a proper configuration of dovecot from 2.3.X to 2.4.1
by revolt2＠wp.pl 31 Dec '25

31 Dec '25

I would like to ask if someone could correct the configuration file for Dovecot dovecot.conf for version 2.4.1? Its the old file from 2.3.X but I'm sorry to say it doesn't work ;( https://pastebin.com/BjXuPEvv , and here is an dovecot-sql.conf file : https://pastebin.com/C4dFG2Zi If any further changes are needed, please let me know, I will adapt, I tried to understand the AI documentation but I couldn't, so we have to meet here,, Thank you in advance for your help

3 2