May 2025 - dovecot - dovecot.org

Dovecot and pigeonhole/sieve without ldap
by ppn＠parhuet.fr 26 May '25

26 May '25

Hi, First of all, thanks for your work on this software overall. Since 2.4 dovecot/pigeonhole (2.4.1 gentoo here), it fails to build without ldap support. I've seen nothing that justifies this requirement so it seems like a bug/issue? Configure for dovecot : ./configure --prefix=/usr --build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --datarootdir=/usr/share --disable-dependency-tracking --disable-silent-rules --disable-static --docdir=/usr/share/doc/dovecot-2.4.1-r1 --htmldir=/usr/share/doc/dovecot-2.4.1-r1/html --with-sysroot=/ --libdir=/usr/lib64 --with-rundir=/run/dovecot --with-statedir=/var/lib/dovecot --with-moduledir=/usr/lib64/dovecot --disable-hardening --disable-rpath --with-bzlib --without-libbsd --with-libcap --with-icu --enable-experimental-mail-utf8 --without-sodium --without-cdb --without-gssapi --without-lua --without-ldap --without-flatcurve --without-lz4 --without-mysql --with-pam --without-pgsql --without-sqlite --without-solr --without-stemmer --without-systemd --without-textcat --without-libunwind --without-zstd --disable-static userdbs ........ : static prefetch passwd passwd-file : -ldap -sql Configure for pigeonhole : ./configure --prefix=/usr --build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --datarootdir=/usr/share --disable-dependency-tracking --disable-silent-rules --disable-static --docdir=/usr/share/doc/dovecot-2.4.1-r1 --htmldir=/usr/share/doc/dovecot-2.4.1-r1/html --with-sysroot=/ --libdir=/usr/lib64 --disable-static --localstatedir=/var --enable-shared --disable-hardening --with-dovecot=/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4 --without-ldap --without-managesieve script drivers . : file dict : -ldap Error : age/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-sasl -I/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/li b-dcrypt -I/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-program-client -I/var/tmp/portage/net-mail/dovecot-2. 4.1-r1/work/dovecot-2.4.1-4/src/lib-oauth2 -I/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-var-expand -I/var/t mp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-index -I/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1- 4/src/lib-storage -I/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-storage/list -I/var/tmp/portage/net-mail/dov ecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-storage/index -I/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-stora ge/index/raw -I/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-imap-storage -I/var/tmp/portage/net-mail/dovecot- 2.4.1-r1/work/dovecot-2.4.1-4/src/plugins/quota -I/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-ldap -I../../. ./.. -I../../../../src/lib-sieve -O2 -pipe -frecord-gcc-switches -flto -Werror=odr -Werror=lto-type-mismatch -Werror=strict-aliasing -fa synchronous-unwind-tables -c sieve-ldap-storage.c -fPIC -DPIC -o .libs/sieve-ldap-storage.o In file included from sieve-ldap-storage.c:6: /var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-ldap/ldap-utils.h:4:10: fatal error: ldap.h: No such file or dir ectory 4 | #include <ldap.h> | ^~~~~~~~ compilation terminated. make[5]: *** [Makefile:607: sieve-ldap-storage.lo] Error 1 Regards, NicoP

3 12

lmtp user verification
by Christian H. Kuhn 26 May '25

26 May '25

Hi, after a new install and avoiding a lot of simple faults, i try to run my system postfix as smtpd, smtpds, and submission, and dovecot as imap and lmtp server. I can login to imap, and i can send via 587 with sasl authentification. So i think that most things are ok :-) What does NOT work is the local transport to my maildir. christian.kuhn(a)qno.de is not resolved to qno(a)qno.de but to qno(a)bywater.qno.de, and lmtp rejects that unverified user: 2025-05-25T18:13:25.431342+02:00 bywater postfix/smtpd[987726]: NOQUEUE: reject: RCPT from mail-lj1-f176.google.com[209.85.208.176]: 450 4.1.1 <qno(a)bywater.qno.de>: Recipient address rejected: unverified address: host bywater.qno.de[private/dovecot-lmtp] said: 550 5.1.1 <qno(a)bywater.qno.de> User doesn't exist: qno(a)bywater.qno.de (in reply to RCPT TO command) also mails to qno-anyextension(a)qno.de are rejected. I set recipient_delimiter to -, but it seems to be ignored by lmtp: 2025-05-25T15:24:10.147369+02:00 bywater postfix/smtpd[985952]: NOQUEUE: reject: RCPT from higher.littydate.com[104.244.79.41]: 450 4.1.1 <qno-planets(a)qno.de>: Recipient address rejected: unverified address: host bywater.qno.de[private/dovecot-lmtp] said: 550 5.1.1 <qno-planets(a)qno.de> User doesn't exist: qno-planets(a)qno.de (in reply to RCPT TO command); from=<webmaster(a)littydate.com> to=<qno-planets(a)qno.de> proto=ESMTP helo=<higher.littydate.com> postconf -n: (postfix 3.8.6) broken_sasl_auth_clients = yes compatibility_level = 3.6 content_filter = amavis:[127.0.0.1]:10024 default_database_type = cdb indexed = ${default_database_type}:${tabledir} inet_interfaces = 127.0.0.1, 65.21.136.15, [::1], [2a01:4f9:3b:25b0:9:6:1:e01] local_recipient_maps = mailbox_transport = lmtp:unix:private/dovecot-lmtp mydestination = $myhostname mydomain = qno.de myhostname = bywater.qno.de mynetworks = 127.0.0.0/8 65.21.136.15/32 [::1]/128 [2a01:4f9:3b:25b0:9:6:1:e01]/128 [2a01:4f8:171:b85:9:6:1:e01]/128 136.243.102.134/32 myorigin = $mydomain policyd-spf_time_limit = 3600 postscreen_access_list = permit_mynetworks postscreen_bare_newline_action = enforce postscreen_bare_newline_enable = no postscreen_dnsbl_action = enforce postscreen_dnsbl_reply_map = ${indexed}dnsbl_reply postscreen_dnsbl_sites = zusbyxqsairu6mu6ayyhstc3ua.zen.dq.spamhaus.net postscreen_dnsbl_threshold = 1 postscreen_non_smtp_command_action = enforce postscreen_non_smtp_command_enable = no postscreen_pipelining_action = enforce postscreen_pipelining_enable = no receive_override_options = no_address_mappings recipient_delimiter = - smtp_bind_address = 65.21.136.15 smtp_bind_address6 = 2a01:4f9:3b:25b0:9:6:1:e01 smtp_generic_maps = ${indexed}generic smtp_tls_exclude_ciphers = aNULL smtp_tls_loglevel = 1 smtp_tls_mandatory_ciphers = medium smtp_tls_mandatory_exclude_ciphers = RC4, MD5, SHA1 smtp_tls_security_level = may smtpd_data_restrictions = reject_unauth_pipelining smtpd_helo_required = yes smtpd_helo_restrictions = reject_unknown_helo_hostname smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_unverified_recipient, check_policy_service unix:private/policyd-spf, reject_rbl_client zusbyxqsairu6mu6ayyhstc3ua.zen.dq.spamhaus.net, reject_rhsbl_reverse_client zusbyxqsairu6mu6ayyhstc3ua.dbl.dq.spamhaus.net, reject_rhsbl_helo zusbyxqsairu6mu6ayyhstc3ua.dbl.dq.spamhaus.net, reject_rhsbl_sender zusbyxqsairu6mu6ayyhstc3ua.dbl.dq.spamhaus.net smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous smtpd_sasl_tls_security_options = $smtpd_sasl_security_options smtpd_sasl_type = dovecot smtpd_sender_restrictions = reject_unknown_sender_domain smtpd_tls_auth_only = yes smtpd_tls_eccert_file = /etc/letsencrypt/live/mail.qno.de/fullchain.pem smtpd_tls_eckey_file = /etc/letsencrypt/live/mail.qno.de/privkey.pem smtpd_tls_mandatory_ciphers = high smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5, SHA1 smtpd_tls_mandatory_protocols = >=TLSv1.2 smtpd_tls_received_header = yes smtpd_tls_security_level = may tabledir = ${config_directory}/tables.d/ virtual_alias_domains = $mydomain virtual_alias_maps = ${indexed}virtual virtual_gid_maps = static:5000 virtual_mailbox_base = /var/mail/vhosts virtual_mailbox_domains = sk-koenig-tegel.de virtual_mailbox_maps = mysql:${tabledir}virtual_mailbox_maps.cf virtual_minimum_uid = 10000 virtual_transport = lmtp:unix:private/dovecot-lmtp virtual_uid_maps = static:5000 doveconf -n: # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21 (f6cd4b8e) # OS: Linux 6.8.0-60-generic x86_64 Ubuntu 24.04.2 LTS # Hostname: bywater.qno.de auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_username_format = %Ln auth_verbose = yes auth_verbose_passwords = yes listen = 65.21.136.15, 2a01:4f9:3b:25b0:9:6:1:c01 mail_debug = yes mail_location = maildir:~/Maildir mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp sieve" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/letsencrypt/live/imap2.qno.de/fullchain.pem ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it syslog_facility = local0 userdb { driver = passwd } verbose_proctitle = yes verbose_ssl = yes TIA QNo

2 3

Two instances on one machine — can they share indexes?
by dove＠redir.desz.cz 24 May '25

24 May '25

Hello, I (think I) need to run two instances of Dovecot on one machine (rationale below, if someone's interested). They access the same mail share (NFS, maildir), but the indexes are kept on local storage. One of them would also provide lmtp service to local MTA. For now I set the instances to keep indexes separate, in different directories, but I wonder, if they can share the indexes, to avoid unnecessary duplication? Of course, mmap_disable = yes, but would locking suffice? The platform is Linux (Devuan chimaera ATM, equivalet of Debian 11), filesystem - ext4, Dovecot version 2.3.13 (from distribution packages). Why? I have to provide different authentication methods to external IMAP clients and locally-running webmail; at first I hoped to make it via remote filter, but docs state that “auth settings currently only support the protocol filter”, so I had to come with some other idea. It _is_ possible that users would be logged in both via external mail client and webmail at the same time – and even if not, there's also lmtp, that can run at any moment. Sincerely, Bartosz Stępień

1 0

Guidance re doveadm sync full (-f) and stateful (-s)
by Georgios Kontaxis 24 May '25

24 May '25

Hi, I’m looking for guidance on how to use doveadm sync with flags -f (full synchronization) and -s. (stateful synchronization) After reading the doveadm-sync man page it seems one should do the following: (omitting -u -l -N flags for clarity) 1. First sync: doveadm sync -f 2. Second sync: doveadm sync -s “" > state 3. Subsequent infrequent syncs: doveadm sync -f 4. Subsequent frequent syncs: doveadm sync -s “$(<state)” > state (I’m assuming that before the first sync replica A has all the mailboxes and replica B has no mailboxes. I’m also assuming that the above commands are executed from replica A. The goal is to do master/master sync continuously.) Can you help me answer the following questions? a. Each time we execute (4) stateful sync after (3) full sync, is it correct to include previous state? b. What happens if we do: doveadm sync -f -s “” or doveadm sync -f -s “$(<state)” I think the replicator code does (b) in https://github.com/dovecot/core/blob/47349e24828be3ec7f591570e02c0b15ae26c6… and I’m not sure why. Overall, it would be good to have more examples in the man page demonstrating the various synchronization modes. Thanks, Georgios

1 0

GSSAPI authentication for sieve
by Paul Zirnik 24 May '25

24 May '25

Hi all, I try to get GSSAPI working for sieve. I already found there was an issue with GSSAPI in dovecot 2.4 and applied the patch from this thread https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/MWCLQ… With the patch GSSAPI now works for imap. I do test this with "imtest" from cyrus tools imat@speedy:~> imtest -v -p 143 -u imat -m GSSAPI manitou.disconnected.homeip.net S: * OK [CAPABILITY IMAP4rev1 LOGIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ STARTTLS LOGINDISABLED AUTH=GSSAPI] Dovecot ready. C: A01 AUTHENTICATE GSSAPI YIIDIgYJKoZIhvcSAQICAQBuggMRMIIDDaADAgEFoQMCAQ6iBwMFACAAAACjggIaYYICFjCCAhKgAwIBBaEZGxdESVNDT05ORUNURUQuSE9NRUlQLk5FVKIyMDCgAwIBA6EpMCcbBGltYXAbH21hbml0b3UuZGlzY29ubmVjdGVkLmhvbWVpcC5uZXSjggG6MIIBtqADAgESoQMCAQKiggGoBIIBpFcei+vGql9tb5TpNjKFgdKAo7p1IiSW8DXPJR2GkCrHVrm0LdtsUaky4zOCskwEQkLURA8CuxM5HGmXT38O56434VTStpRHWZx7Xu43UHHJpOjdf76YYqnIA7WEk76QQyUpnO3hQWCEwyAPf1GhQKGDWCosHEuvn3jNE8t8fWmnRtWSgr35w5GD9OHsYKwca14yUruNU/qfVL9I41bjiFcJ1FFjMyVa/+ogghBm4jDoiFTV7vB8WYpx8Vuuev0d48TZDqv7Kf5/G8TgH3bc59VLjCemLAzTjOQ4mZxTXBEh9OpibKPUozRd266ao7dAD4OHMWNORXKqWl/Ch0iC7q/QEg/qY7E0dm7wqMDROrzmaxWW8p5+y69AbjwylsgivknVcTmbQjVnGGvniDLTke8O6CvqeIum/uUli2FyBmSUt8kVju1GIfoysFP8BEu6gDXdbcsG2XbuoTvfzLyJNT7eomILhF9nZI1vFariqF3TJLo14/L4OCG05RrAH3o8kHTkUMz8rrZj5y0yzfQqlME66yBRezRRSccrrD5AWdHzRMvw26SB2TCB1qADAgESooHOBIHLTo7UMx+G8Q+Ly+Mmj35JBfLm+SWeCV1YGcJQ8O1hI6F3pKh4fMjx5L9v4v4NzbDWpZ8YlQtSBcDgyebiZjHaeqGf4bIcOaGyzfor3DhAn0q0n0Zx/SKJiTJuT9eT0pHwb/yaT9MzOZTP6C5HuXgxUN/2Po2qNwkzaU5gOH+sOYu6Y0AKoKGlkIQHejzns70FehWRn8wBbu8T9+8zKRU0qmBQXnqg/C10pSW7EUVD37VPhY0kLY6SB77KS/8aguWWC3OVAfw6bcAXVVM= S: + YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvzFWfR5FTOl77CqiMZ7qWR4I6JqXdi0JbIG4xTYJNYvQSsvxAxyfEiGINTMW5QytlcMvfiJpTj0U2Fd3Hr/MzLcCeCRwJ9jTg8m2E1ZgpmzmpXzl7xGq+MRIvetu3Wdgxum+ZQ8jPS1obTnI1Vh7I C: S: + BQQF/wAMAAAAAAAAHJz31AH///+2dWHfKNY/6f01FUw= C: BQQE/wAMAAAAAAAABI42iwEAAABpbWF0C53m6npnJwjAfaEu S: A01 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE REPLACE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW SPECIAL-USE STATUS=SIZE SAVEDATE COMPRESS=DEFLATE INPROGRESS NOTIFY LITERAL+] Logged in Authenticated. Security strength factor: 0 C: Q01 LOGOUT * BYE Logging out Q01 OK Logout completed (0.001 + 0.000 secs). Connection closed. When i try to use "sivtest" from cyrus tools, this does hang and it looks like sievtest is still waiting for some data imat@speedy:~> sivtest -v -p 4190 -u imat -m GSSAPI manitou.disconnected.homeip.net S: "IMPLEMENTATION" "Dovecot Pigeonhole" S: "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include body variables enotify environment mailbox date index ihave duplicate mime foreverypart extracttext" S: "NOTIFY" "mailto" S: "SASL" "GSSAPI" S: "STARTTLS" S: "VERSION" "1.0" S: OK "Dovecot ready." C: AUTHENTICATE "GSSAPI" {1076+} YIIDIwYJKoZIhvcSAQICAQBuggMSMIIDDqADAgEFoQMCAQ6iBwMFACAAAACjggIbYYICFzCCAhOgAwIBBaEZGxdESVNDT05ORUNURUQuSE9NRUlQLk5FVKIzMDGgAwIBA6EqMCgbBXNpZXZlGx9tYW5pdG91LmRpc2Nvbm5lY3RlZC5ob21laXAubmV0o4IBujCCAbagAwIBEqEDAgECooIBqASCAaTS89GNFHQk6FCilKJkEP8Xl27g/A8b1T0pxGwipjYBug0+bprqG0xJucYaULvqi1PnTI+A6WJesi2434B+L0WAv1sdWhI60SpmmfnsZPD8uqbJmZEFMj9bQnS4VbNgduhEA+pgYp85q0PcP3I5DcMeypIC7rk2hv15qYnVSYhND/P3tOANikXc5JB3cWnnPc79gRW+Ozi75waihMIv7C3UvllUtb2tTUKqdGwz2D9/BT3e1ZfcueaWznhXmzieh4dHZyqvbm4UVVUuc4paI1QMUrImy6zEfXjEH0O8dbZN3FbiKjCdP7E/zFtd6PkWaI0lgk8qGP1JqaFtGgqo+EcDEgyh4DoTRuNGGJp7n1zmQGkgIHzsUNR+SydUhWijdWJSegeIrGsZ4/s8YZupdxpC8g1qComP0+holawe9/iAnCxmRNGrNXDSRnL8wMaVAgm7t0SrBUSOm/YHKZSlHpMIWw438Dp/FdWwuCm2jA5pTksRbzmpS9fguMwp65bX0xh/a0NkI2VWJfwUmgqws3LRv1WHsn2FB/k+w55oOMboOtO3SCCkgdkwgdagAwIBEqKBzgSBy9PZObV0yc813IAR4TwEzPtKepfhzLvT0vFekCieE0sCu7jig2m+bpKt1IbIngs+hiztVx4TXYJu/UjH8UKNYct7xFWAOamuh/Fp4AnTBQXxieMM9TGZsiot7NzH75kRUY6SifNYYbz579wBAMbPzId5n2NVdp2blEpaCDKhMdZf/AQqUj3eFbafs5ociy4cOfmQSNuW7hY4KpQ0JU0cdWQyh0+Xl+fE9tz1ctmRoTA4WIF3U1UcwB0CPxlFxlw6cW+OAP0mlWqJE5Yx S: "YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvEb5fwEVTKq3wm3xJawxEVD9Ngdz3tmzW5a8wJAh9lSRYSE0aJS97LvUtT1mWqZTFx5AZMJGfM7KpcbmJc3cOkVhe5lTUQDir58n1RywkyWYM6RvKd1Vzeonxt/AyJi7rN1CMR9VIh2KZUItIsz1y" here it hangs until timeout. May 24 10:10:36 manitou dovecot[45007]: auth(imat@disconnected.homeip.net,192.168.42.24,sasl:gssapi)<mh73Nt01+OHAqCoY>: Request timed out waiting for client to continue authentication (150 secs) May 24 10:11:06 manitou dovecot[45007]: managesieve-login: Login aborted: Inactivity during authentication (client didn't finish SASL auth, 1 attempts in 180 secs) (auth_waiting_client): user=<>, method=GSSAPI, rip=192.168.42.24, lip=192.168.42.42, session=<mh73Nt01+OHAqCoY> and sievtest does end with this S: BYE "Disconnected for inactivity during authentication." base64 decoding error Authentication failed. generic failure Security strength factor: 0 Connection closed. The "base64 decoding error" probably is unrelated as it does try to decode the "S: BYE .....". I also tested with other sieve clients, none does work (however different issues reported), while all tested imap clients do work. My guess is some small fix like the one from above is also needed for dovecot-pigeonhole. This is my used config manitou:~ # dovecot -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.14.6-1-default x86_64 # Hostname: manitou.disconnected.homeip.net # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_debug_passwords = yes auth_gssapi_hostname = manitou.disconnected.homeip.net auth_krb5_keytab = /etc/dovecot/dovecot.keytab auth_mechanisms = plain login gssapi dovecot_storage_version = 2.4.0 protocols { imap = yes lmtp = yes sieve = yes } protocol lmtp { auth_username_format = %{user | username} mail_plugins = sieve } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { } } namespace inbox { mail_driver = maildir mail_inbox_path = ~/Maildir/.INBOX mail_path = ~/Maildir inbox = yes separator = / } passdb pam { service_name = dovecot } userdb passwd { use_worker = yes } ssl_server { cert_file = /etc/ssl/servercerts/servercert.pem key_file = /etc/ssl/servercerts/serverkey.pem } service managesieve-login { } service managesieve { } sieve_script personal { active_path = ~/.dovecot.sieve path = ~/.sieve } What logs/infos are needed to dig into it ? thanks and regards, Tami

1 0

Dovecot 2.4.1 userdb override for autoexpunge on specific mailbox
by Thomas Leuxner 24 May '25

24 May '25

Hi, I'm trying to override the autoexpunge setting for the "Deleted Messages" mailbox in the INBOX namespace. [...] mailbox "Deleted Messages" { autoexpunge = 2d special_use = "\\Trash" } doveconf -nF # mail_namespace :FILTER settings_filter_name="namespace/inbox" namespace_name=inbox namespace_type=private namespace_separator=/ namespace_prefix= namespace_inbox=yes namespace_hidden=no mailbox=INBOX Drafts Junk Deleted\_Messages Spam Sent Sent\_Messages The setting seems to be pulled from the userdb and matches the escaping above. It doesn't seem to alter the global "autoexpunge = 2d" setting for this user though. doveadm user -u tlx(a)leuxner.net userdb: tlx(a)leuxner.net user : tlx(a)leuxner.net home : /var/vmail/domains/leuxner.net/tlx uid : 5000 gid : 5000 quota_storage_size: 5G acl_groups: PublicMailboxAdmins namespace/inbox/mailbox/Deleted\_Messages/autoexpunge: 6h Regards Thomas

1 1

NAMESPACE empty when logging via haproxy but populated properly when logging directly
by dk+lists.dovecot.org＠7ns.eu 23 May '25

23 May '25

Hello there. I have a problem with newest dovecots (2.3 and 2.4). Dovecot server for some reason is not providing NAMESPACE via IMAP commands when logging via haproxy (rawlog provided below). Server config: inet_listener imap { port = 143 haproxy = yes } inet_listener imap0 { port = 1143 haproxy = no } When I login directly to dovecot server on port 1143 I get this response from server: 1747853284.039953 * NAMESPACE (("INBOX/" "/")) (("Shared/" "/")) (("Public/" "/")) 1747853284.039986 52 OK Namespace completed (0.001 + 0.000 secs). However when I login to the exact same dovecot server but via haproxy host on port 143 I get this response from server: 1747853284.076121 * NAMESPACE (("" "/")) NIL NIL 1747853284.076160 27 OK Namespace completed (0.001 + 0.000 secs). Tested on: - debian dovecot 2.3.21.1+dfsg1-1+b2 - debian dovecot 2.4.1+dfsg1-4 Could some dev look into it please? Clearly something is broken with dovecot haproxy listener. I just deployed dovecot 2.4 to check if it was fixed but the same problem exists there. Greets. dk Hello there. I have a problem with newest dovecots (2.3 and 2.4). Dovecot server for some reason is not providing NAMESPACE via IMAP commands when logging via haproxy (rawlog provided below). Server config: inet_listener imap { port = 143 haproxy = yes } inet_listener imap0 { port = 1143 haproxy = no } When I login directly to dovecot server on port 1143 I get this response from server: 1747853284.039953 * NAMESPACE (("INBOX/" "/")) (("Shared/" "/")) (("Public/" "/ ")) 1747853284.039986 52 OK Namespace completed (0.001 + 0.000 secs). However when I login to the exact same dovecot server but via haproxy host on port 143 I get this response from server: 1747853284.076121 * NAMESPACE (("" "/")) NIL NIL 1747853284.076160 27 OK Namespace completed (0.001 + 0.000 secs). Tested on: - debian dovecot 2.3.21.1+dfsg1-1+b2 - debian dovecot 2.4.1+dfsg1-4 Could some dev look into it please? Clearly something is broken with dovecot haproxy listener. I just deployed dovecot 2.4 to check if it was fixed but the same problem exists there. Greets. dk

4 6

Upgrade 2.3 to 2.4 - Dovecot cannot find user mailbox
by Cam Ellison 22 May '25

22 May '25

The system in question primarily sends emails to group members but also has a few virtual email accounts for officers. Usernames and passwords are looked up from a mysql (MariaDB) database. After the upgrade incoming mail now goes to a vmail account that Dovecot creates because it cannot match the email to the user for whom it is intended (there is no user 'vmail' in the system). Users can log in and read their mail and send mail, but any emails received since the change to 2.4 are understandably inaccessible. Below is the output from doveconf -n. Can anyone see what is wrong? # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.1.0-20-rt-686-pae i686 Debian 13.0 ext4 # Hostname: football.scasl.ca # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login base_dir = /var/run/dovecot/ dovecot_storage_version = 2.4.0 first_valid_gid = 5000 first_valid_uid = 5000 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes hostname = scasl.ca listen = * :: login_trusted_networks = 209.121.143.10/32 mail_debug = yes mail_driver = maildir mail_gid = 5000 mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir mail_privileged_group = vmail mail_uid = 5000 postmaster_address = postmaster(a)scasl.ca protocols { imap = yes } sql_driver = mysql dict quota { } mysql scasl.ca { dbname = scasl host = localhost password = # hidden, use -P to show it port = 3306 user = scasl } userdb sql { iterate_query = SELECT email_username AS username, domain FROM league query = SELECT CONCAT('/var/vmail/',email_username) AS home, 5000 AS uid, 5000 AS gid FROM league WHERE email_username = '%{user|username}' } passdb sql { default_password_scheme = BLF-CRYPT query = SELECT password FROM login WHERE ID IN (SELECT ID FROM league WHERE email_username='%{user|username}') } maildir { very_dirty_syncs = yes } namespace inbox { mail_driver = maildir mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir inbox = yes separator = / mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service submission-login { inet_listener submission { } } service lmtp { unix_listener lmtp { mode = 0666 } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { mode = 0666 } unix_listener auth-client { mode = 0666 } } service auth-worker { } service dict { unix_listener dict { } } service stats { unix_listener stats-reader { group = vmail mode = 0666 } unix_listener stats-writer { group = vmail mode = 0666 } } ssl_server { cert_file = /etc/letsencrypt/live/scasl.ca/fullchain.pem key_file = /etc/letsencrypt/live/scasl.ca/privkey.pem } Cheers Cam The system in question primarily sends emails to group members but also has a few virtual email accounts for officers. Usernames and passwords are looked up from a mysql (MariaDB) database. After the upgrade incoming mail now goes to a vmail account that Dovecot creates because it cannot match the email to the user for whom it is intended (there is no user 'vmail' in the system). Users can log in and read their mail and send mail, but any emails received since the change to 2.4 are understandably inaccessible. Below is the output from doveconf -n. Can anyone see what is wrong? # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.1.0-20-rt-686-pae i686 Debian 13.0 ext4 # Hostname: football.scasl.ca # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login base_dir = /var/run/dovecot/ dovecot_storage_version = 2.4.0 first_valid_gid = 5000 first_valid_uid = 5000 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes hostname = scasl.ca listen = * :: login_trusted_networks = 209.121.143.10/32 mail_debug = yes mail_driver = maildir mail_gid = 5000 mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir mail_privileged_group = vmail mail_uid = 5000 postmaster_address = postmaster(a)scasl.ca protocols { imap = yes } sql_driver = mysql dict quota { } mysql scasl.ca { dbname = scasl host = localhost password = # hidden, use -P to show it port = 3306 user = scasl } userdb sql { iterate_query = SELECT email_username AS username, domain FROM league query = SELECT CONCAT('/var/vmail/',email_username) AS home, 5000 AS uid, 5000 AS gid FROM league WHERE email_username = '%{user|username}' } passdb sql { default_password_scheme = BLF-CRYPT query = SELECT password FROM login WHERE ID IN (SELECT ID FROM league WHERE email_username='%{user|username}') } maildir { very_dirty_syncs = yes } namespace inbox { mail_driver = maildir mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir inbox = yes separator = / mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service submission-login { inet_listener submission { } } service lmtp { unix_listener lmtp { mode = 0666 } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { mode = 0666 } unix_listener auth-client { mode = 0666 } } service auth-worker { } service dict { unix_listener dict { } } service stats { unix_listener stats-reader { group = vmail mode = 0666 } unix_listener stats-writer { group = vmail mode = 0666 } } ssl_server { cert_file = /etc/letsencrypt/live/scasl.ca/fullchain.pem key_file = /etc/letsencrypt/live/scasl.ca/privkey.pem } Cheers Cam

2 2

Upgrade 2.3 to 2.4 - virtual mail - dovecot-lda flags ignored
by Cam Ellison 22 May '25

22 May '25

When running v2.3, Dovecot correctly identifies both recipient and domain when receiving mail from Debian exim4 via dovecot-lda, with no flags set. With v2.4, whether the flags are set or not, Dovecot throws error 75. If lda_mailbox_autocreate is set to yes, it creates the mailuser vmail and delivers to /var/vmail/vmail/INBOX. Users are able to log in and read email as before. doveadm user admin(a)example.ca output is: field value uid 5000 gid 5000 home /var/vmail/admin mail_path /var/vmail/admin/Maildir Here is the full printout of doveconf -n. # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.1.0-20-rt-686-pae i686 Debian 13.0 ext4 # Hostname: football.scasl.ca # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login base_dir = /var/run/dovecot/ dovecot_storage_version = 2.4.0 first_valid_gid = 5000 first_valid_uid = 5000 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes hostname = scasl.ca listen = * :: login_trusted_networks = 209.121.143.10/32 mail_debug = yes mail_driver = maildir mail_gid = 5000 mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir mail_privileged_group = vmail mail_uid = 5000 postmaster_address = postmaster(a)scasl.ca protocols { imap = yes } sql_driver = mysql mysql scasl.ca { dbname = scasl host = localhost password = # port = 3306 user = scasl } userdb sql { iterate_query = SELECT email_username AS username, domain FROM league query = SELECT CONCAT('/var/vmail/',email_username) AS home, 5000 AS uid, 5000 AS gid FROM league WHERE email_username = '%{user|username}' } passdb sql { default_password_scheme = BLF-CRYPT query = SELECT password FROM login WHERE ID IN (SELECT ID FROM league WHERE email_username='%{user|username}') } maildir { very_dirty_syncs = yes } namespace inbox { mail_driver = maildir mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir inbox = yes separator = / type = private mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service submission-login { inet_listener submission { } } service lmtp { unix_listener lmtp { mode = 0666 } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { mode = 0666 } unix_listener auth-client { mode = 0666 } } service auth-worker { } service dict { unix_listener dict { } } service stats { unix_listener stats-reader { group = vmail mode = 0666 } unix_listener stats-writer { group = vmail mode = 0666 } } ssl_server { cert_file = /etc/letsencrypt/live/scasl.ca/fullchain.pem key_file = /etc/letsencrypt/live/scasl.ca/privkey.pem } protocol lda { mail_plugins = $mail_plugins } I assume I am missing a parameter that needs setting. Is it that, do I have something set incorrectly, or is it really a bug? Cheers Cam When running v2.3, Dovecot correctly identifies both recipient and domain when receiving mail from Debian exim4 via dovecot-lda, with no flags set. With v2.4, whether the flags are set or not, Dovecot throws error 75. If lda_mailbox_autocreate is set to yes, it creates the mailuser vmail and delivers to /var/vmail/vmail/INBOX. Users are able to log in and read email as before. doveadm user admin(a)example.ca output is: field value uid 5000 gid 5000 home /var/vmail/admin mail_path /var/vmail/admin/Maildir Here is the full printout of doveconf -n. # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.1.0-20-rt-686-pae i686 Debian 13.0 ext4 # Hostname: football.scasl.ca # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login base_dir = /var/run/dovecot/ dovecot_storage_version = 2.4.0 first_valid_gid = 5000 first_valid_uid = 5000 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes hostname = scasl.ca listen = * :: login_trusted_networks = 209.121.143.10/32 mail_debug = yes mail_driver = maildir mail_gid = 5000 mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir mail_privileged_group = vmail mail_uid = 5000 postmaster_address = postmaster(a)scasl.ca protocols { imap = yes } sql_driver = mysql mysql scasl.ca { dbname = scasl host = localhost password = # port = 3306 user = scasl } userdb sql { iterate_query = SELECT email_username AS username, domain FROM league query = SELECT CONCAT('/var/vmail/',email_username) AS home, 5000 AS uid, 5000 AS gid FROM league WHERE email_username = '%{user|username}' } passdb sql { default_password_scheme = BLF-CRYPT query = SELECT password FROM login WHERE ID IN (SELECT ID FROM league WHERE email_username='%{user|username}') } maildir { very_dirty_syncs = yes } namespace inbox { mail_driver = maildir mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir inbox = yes separator = / type = private mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service submission-login { inet_listener submission { } } service lmtp { unix_listener lmtp { mode = 0666 } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { mode = 0666 } unix_listener auth-client { mode = 0666 } } service auth-worker { } service dict { unix_listener dict { } } service stats { unix_listener stats-reader { group = vmail mode = 0666 } unix_listener stats-writer { group = vmail mode = 0666 } } ssl_server { cert_file = /etc/letsencrypt/live/scasl.ca/fullchain.pem key_file = /etc/letsencrypt/live/scasl.ca/privkey.pem } protocol lda { mail_plugins = $mail_plugins } I assume I am missing a parameter that needs setting. Is it that, do I have something set incorrectly, or is it really a bug? Cheers Cam

2 2

Re: Upgrade 2.3 to 2.4 - virtual mail - dovecot-lda flags ignored
by Cam Ellison 22 May '25

22 May '25

On 2025-05-21 14:11, Odhiambo Washington wrote: > Hi Cam, > > I suffered something similar during my migration and an old post > somewhere saved the day for me: https://skeletor.org.ua/?p=2497 > I hope it helps you too. > It was worth a try, and at least has changed the focus to Exim from Dovecot: the existing lookups for identifying user@domain in Exim are not working. What he has is not significantly different from my own setup. Thank you for the link Cam

1 1