August 2025 - dovecot

Crash in dovecot snippet when using imapc
by John van der Kamp 03 Sep '25

03 Sep '25

Hello, I've found a crash in a very specific setup. A dovecot server with imapc connection needs to receive an email with no body contents for the intent of generating a preview/snippet. It crashes somewhere deep in the jungle of istream and snapshots. I've included a script which sets up the systems to reproduce the crash. I've tested this with several versions. 2.3.16 doesn't seem to be affected, but 2.3.20 and 2.3.21 are affect. For me it produces a traceback like this, using the ubuntu version from here: https://packages.ubuntu.com/noble/dovecot-core (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=140530132887360, signo=signo@entry=6) at ./nptl/pthread_kill.c:89 #3 0x00007fcfb8842476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #4 0x00007fcfb88287f3 in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007fcfb8b37fe5 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #6 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #7 0x00007fcfb8be50d7 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:879 #8 0x00007fcfb8b37eea in i_panic (format=0x7fcfb8c29020 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:530 #9 0x00007fcfb8b3387b in i_stream_header_filter_snapshot_free (_snapshot=<optimized out>) at ../lib-mail/istream-header-filter.c:663 #10 i_stream_header_filter_snapshot_free (_snapshot=0x55dabe297a60) at ../lib-mail/istream-header-filter.c:655 #11 0x00007fcfb8bf25ac in i_stream_snapshot_free (_snapshot=_snapshot@entry=0x55dabe29b0d0) at ../lib/istream.c:253 #12 0x00007fcfb8bf2654 in i_stream_unref (stream=0x7ffc16cc7fa0) at ../lib/istream.c:66 #13 0x00007fcfb8d96baa in index_mail_write_body_snippet (mail=0x55dabe292058) at index/index-mail.c:1151 #14 0x00007fcfb8d97e48 in index_mail_parse_bodystructure (mail=0x55dabe292058, field=MAIL_CACHE_BODY_SNIPPET) at index/index-mail.c:1551 #15 0x00007fcfb8d97fe2 in index_mail_fetch_body_snippet (value_r=0x7ffc16cc8050, mail=0x55dabe292058) at index/index-mail.c:1602 #16 index_mail_get_special (_mail=0x55dabe292058, field=<optimized out>, value_r=0x7ffc16cc8050) at index/index-mail.c:1730 #17 0x00007fcfb8d16ffe in mail_get_special (mail=mail@entry=0x55dabe292058, field=field@entry=MAIL_FETCH_BODY_SNIPPET, value_r=value_r@entry=0x7ffc16cc8050) at /home/ubuntu/dovecot/new/dovecot-2.3.21+dfsg1/src/lib-storage/mail.c:418 #18 0x000055dabc52645c in fetch_snippet (ctx=0x55dabe26e050, mail=0x55dabe292058, preview=0x55dabe28f1f8) at ./src/imap/imap-fetch-body.c:615 #19 0x000055dabc52b5cc in imap_fetch_more_int (ctx=0x55dabe26e050, cancel=false) at ./src/imap/imap-fetch.c:562 #20 0x000055dabc52b8ad in imap_fetch_more (ctx=0x55dabe26e050, cmd=0x55dabe26de98) at ./src/imap/imap-fetch.c:617 #21 0x000055dabc51fd07 in cmd_fetch (cmd=0x55dabe26de98) at ./src/imap/cmd-fetch.c:382 #22 0x000055dabc528af4 in command_exec (cmd=0x55dabe26de98) at ./src/imap/imap-commands.c:201 #23 0x000055dabc52e9e2 in client_command_input (cmd=<optimized out>) at ./src/imap/imap-client.c:1237 #24 0x000055dabc52ea96 in client_command_input (cmd=<optimized out>) at ./src/imap/imap-client.c:1307 #25 0x000055dabc52eeed in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1349 #26 client_handle_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1363 #27 0x000055dabc52f2c4 in client_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1407 #28 0x00007fcfb8bfe27d in io_loop_call_io (io=0x55dabe26e660) at ../lib/ioloop.c:737 #29 0x00007fcfb8bff81a in io_loop_handler_run_internal (ioloop=0x55dabe243fd0) at ../lib/ioloop-epoll.c:222 #30 0x00007fcfb8bff8d4 in io_loop_handler_run (ioloop=0x55dabe243fd0) at ../lib/ioloop.c:789 #31 0x00007fcfb8bffa90 in io_loop_run (ioloop=0x55dabe243fd0) at ../lib/ioloop.c:762 #32 0x00007fcfb8b6ce57 in master_service_run (service=0x55dabe243e20, callback=callback@entry=0x55dabc533210 <client_connected>) at ../lib-master/master-service.c:878 #33 0x000055dabc51ad37 in main (argc=<optimized out>, argv=<optimized out>) at ./src/imap/main.c:575 John Hello, I've found a crash in a very specific setup. A dovecot server with imapc connection needs to receive an email with no body contents for the intent of generating a preview/snippet. It crashes somewhere deep in the jungle of istream and snapshots. I've included a script which sets up the systems to reproduce the crash. I've tested this with several versions. 2.3.16 doesn't seem to be affected, but 2.3.20 and 2.3.21 are affect. For me it produces a traceback like this, using the ubuntu version from here: https://packages.ubuntu.com/noble/dovecot-core (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=140530132887360) at ./nptl/ pthread_kill.c:78 #2 __GI___pthread_kill (threadid=140530132887360, signo=signo@entry=6) at ./ nptl/pthread_kill.c:89 #3 0x00007fcfb8842476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/ raise.c:26 #4 0x00007fcfb88287f3 in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007fcfb8b37fe5 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #6 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #7 0x00007fcfb8be50d7 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:879 #8 0x00007fcfb8b37eea in i_panic (format=0x7fcfb8c29020 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:530 #9 0x00007fcfb8b3387b in i_stream_header_filter_snapshot_free (_snapshot=<optimized out>) at ../lib-mail/istream-header-filter.c:663 #10 i_stream_header_filter_snapshot_free (_snapshot=0x55dabe297a60) at ../lib- mail/istream-header-filter.c:655 #11 0x00007fcfb8bf25ac in i_stream_snapshot_free (_snapshot=_snapshot@entry=0x55dabe29b0d0) at ../lib/istream.c:253 #12 0x00007fcfb8bf2654 in i_stream_unref (stream=0x7ffc16cc7fa0) at ../lib/ istream.c:66 #13 0x00007fcfb8d96baa in index_mail_write_body_snippet (mail=0x55dabe292058) at index/index-mail.c:1151 #14 0x00007fcfb8d97e48 in index_mail_parse_bodystructure (mail=0x55dabe292058, field=MAIL_CACHE_BODY_SNIPPET) at index/index-mail.c:1551 #15 0x00007fcfb8d97fe2 in index_mail_fetch_body_snippet (value_r=0x7ffc16cc8050, mail=0x55dabe292058) at index/index-mail.c:1602 #16 index_mail_get_special (_mail=0x55dabe292058, field=<optimized out>, value_r=0x7ffc16cc8050) at index/index-mail.c:1730 #17 0x00007fcfb8d16ffe in mail_get_special (mail=mail@entry=0x55dabe292058, field=field@entry=MAIL_FETCH_BODY_SNIPPET, value_r=value_r@entry=0x7ffc16cc8050) at /home/ubuntu/dovecot/new/dovecot-2.3.21+dfsg1/src/lib-storage/mail.c:418 #18 0x000055dabc52645c in fetch_snippet (ctx=0x55dabe26e050, mail=0x55dabe292058, preview=0x55dabe28f1f8) at ./src/imap/imap-fetch-body.c: 615 #19 0x000055dabc52b5cc in imap_fetch_more_int (ctx=0x55dabe26e050, cancel=false) at ./src/imap/imap-fetch.c:562 #20 0x000055dabc52b8ad in imap_fetch_more (ctx=0x55dabe26e050, cmd=0x55dabe26de98) at ./src/imap/imap-fetch.c:617 #21 0x000055dabc51fd07 in cmd_fetch (cmd=0x55dabe26de98) at ./src/imap/cmd- fetch.c:382 #22 0x000055dabc528af4 in command_exec (cmd=0x55dabe26de98) at ./src/imap/imap- commands.c:201 #23 0x000055dabc52e9e2 in client_command_input (cmd=<optimized out>) at ./src/ imap/imap-client.c:1237 #24 0x000055dabc52ea96 in client_command_input (cmd=<optimized out>) at ./src/ imap/imap-client.c:1307 #25 0x000055dabc52eeed in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1349 #26 client_handle_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c: 1363 #27 0x000055dabc52f2c4 in client_input (client=0x55dabe26d2c8) at ./src/imap/ imap-client.c:1407 #28 0x00007fcfb8bfe27d in io_loop_call_io (io=0x55dabe26e660) at ../lib/ ioloop.c:737 #29 0x00007fcfb8bff81a in io_loop_handler_run_internal (ioloop=0x55dabe243fd0) at ../lib/ioloop-epoll.c:222 #30 0x00007fcfb8bff8d4 in io_loop_handler_run (ioloop=0x55dabe243fd0) at ../ lib/ioloop.c:789 #31 0x00007fcfb8bffa90 in io_loop_run (ioloop=0x55dabe243fd0) at ../lib/ ioloop.c:762 #32 0x00007fcfb8b6ce57 in master_service_run (service=0x55dabe243e20, callback=callback@entry=0x55dabc533210 <client_connected>) at ../lib-master/ master-service.c:878 #33 0x000055dabc51ad37 in main (argc=<optimized out>, argv=<optimized out>) at ./src/imap/main.c:575 John

2 7

dovecot-core: dovecot imap attempts to rmdir the configured mail_inbox_path
by pelzi＠feldner-bv.de 29 Aug '25

29 Aug '25

Package: dovecot-core Version: 1:2.4.1+dfsg1-6 Severity: important Dear Maintainer, after upgrading to trixie, I reconfigure dovecot - starting with the maintainer's config files due to the complete change of config syntax - and got it working again serving the existing mailboxes. I again configured /var/mail/%{user | username} as mail_inbox_path, at a separate location from all other mailboxes at some directory at user's home. All mailboxes remain in mbox format as before. When I set up a mail inbox path in shared namespace, dovecot is attempting to delete the lexicographically first user "someotheruser" who is sharing their mailboxes, whenever a user "someuser" with read access to that mailboxes is updating the mailbox list: journalctl output with mail_inbox_path setup for shared namespace ----------------------------------------------------------------- Aug 16 16:43:59 somehost systemd[1]: Started dovecot.service - Dovecot IMAP/POP3 email server. Aug 16 16:44:05 somehost dovecot[65636]: imap-login: Login aborted: Logged out (no auth attempts in 0 secs) (no_auth_attempts): user=<>, rip=some::ipv6, lip=some::ipv6, session=<xojHiXw8zKP95iU4WzA7U7on6//+m0as> Aug 16 16:44:14 somehost auth[65647]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=someuser rhost=some::ipv6 user=someuser Aug 16 16:44:14 somehost dovecot[65636]: imap-login: Logged in: user=<someuser>, method=PLAIN, rip=some::ipv6, lip=some::ipv6, mpid=65651, TLS, session=<0klNinw8fJIqAgkIAbCIAAL////+ESJD> Aug 16 16:44:14 somehost dovecot[65636]: imap(someuser)<65651><0klNinw8fJIqAgkIAbCIAAL////+ESJD>: Disconnected: Logged out in=98 out=1253 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Aug 16 16:44:14 somehost auth[65647]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=someuser rhost=some::ipv6 user=someuser Aug 16 16:44:14 somehost dovecot[65636]: imap-login: Logged in: user=<someuser>, method=PLAIN, rip=some::ipv6, lip=some::ipv6, mpid=65656, TLS, session=<tE5Oinw8hpIqAgkIAbCIAAL////+ESJD> Aug 16 16:44:14 somehost dovecot[65636]: imap(someuser)<65656><tE5Oinw8hpIqAgkIAbCIAAL////+ESJD>: Error: rmdir(/var/mail/someotheruser) failed: Permission denied ----------------------------------------------------------------- (Note: the authentication failure listed here appears to come from a certain pam module that doesn't know someuser, but is cured by another pam module in the stack that can authenticate someuser) This otheruser's INBOX will _not_ be displayed in the folder list for someuser, whereas the INBOX of lexicographically following user is not attempted to rmdir, and _do_ show up for the authorized someuser. When, for testing purposes, I remove mail_inbox_path from the shared namespace's configuration, obviously all otheruser's INBOX'es disappear from the folder list of someuser. But now dovecat attempts to rmdir someuser's own inbox: journalctl output with no mail_inbox_path configured for shared namespace, but only for inbox namespace ---------------------------------------------------------------- Aug 16 16:34:48 mailserver systemd[1]: Started dovecot.service - Dovecot IMAP/POP3 email server. Aug 16 16:34:48 mailserver unix_chkpwd[65322]: password check failed for user (someuser) Aug 16 16:34:48 mailserver auth[65320]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=someuser rhost=some::ipv6 user=someuser Aug 16 16:34:48 mailserver dovecot[65315]: imap-login: Logged in: user=<someuser>, method=PLAIN, rip=some::ipv6 lip=some::ipv6, mpid=65324, TLS, session=<uViUaHw8psgqAgkIAbCIAAL////+ESJD> Aug 16 16:34:48 mailserver dovecot[65315]: imap(someuser)<65324><uViUaHw8psgqAgkIAbCIAAL////+ESJD>: Error: rmdir(/var/mail/someuser) failed: Permission denied ---------------------------------------------------------------- In this case, however someuser's INBOX remains in the folder list. *** Reporter, please consider answering these questions, where appropriate *** * What led up to the situation? The upgrade to version 2.4.1 combined with a complete new configuration. -- Package-specific info: dovecot configuration --------------------- ... mail_driver = mbox mail_gid = familie mail_home = /home/%{user | username} mail_inbox_path = /var/mail/%{user | username} mail_path = ~/IMail mail_plugins { acl = yes fts = yes fts_solr = yes } mail_privileged_group = mail ... mail_shared_explicit_inbox = yes protocols { imap = yes sieve = yes } passdb pam { } userdb passwd { } namespace inbox { mail_driver = mbox mail_inbox_path = /var/mail/%{user | username} mail_path = ~/IMail inbox = yes subscriptions = yes type = private mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } namespace shared { mail_driver = mbox # this following setting removed for 2nd test mail_inbox_path = /var/mail/%{owner_user | username } mail_index_private_path = ~/.dovecot-index/shared/%{owner_user} mail_path = %{owner_home}/IMail list = yes prefix = shared/$username/ separator = / subscriptions = no type = shared } acl_sharing_map { dict file { path = /var/lib/dovecot/db/shared-mailboxes.db } } protocol imap { mail_plugins { imap_acl = yes } } service imap-login { inet_listener imap { } inet_listener imaps { } } service lmtp { unix_listener lmtp { } } service imap { } service pop3 { } service auth { unix_listener auth-userdb { group = users mode = 0660 user = mail } unix_listener auth-exim { group = sasl mode = 0660 type = auth-legacy user = mail } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/letsencrypt/live/somedomain/fullchain.pem key_file = /etc/letsencrypt/live/somedomain/privkey.pem } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service managesieve { } language de { default = yes } language en { } fts solr { url = http://localhost:8983/solr/dovecot/ } -- System Information: Debian Release: 13.0 APT prefers stable-security APT policy: (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 6.12.41+deb13-amd64 (SMP w/4 CPU threads; PREEMPT) Kernel taint flags: TAINT_FIRMWARE_WORKAROUND, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) Versions of packages dovecot-core depends on: ii adduser 3.152 ii dovecot-sieve 1:2.4.1+dfsg1-6 ii init-system-helpers 1.68 ii libapparmor1 4.1.0-1 ii libbz2-1.0 1.0.8-6 ii libc6 2.41-12 ii libcap2 1:2.75-10+b1 ii libcrypt1 1:4.4.38-1 ii libexttextcat-2.0-0 3.4.7-1+b1 ii libicu76 76.1-4 ii liblua5.4-0 5.4.7-1+b2 ii liblz4-1 1.10.0-4 ii libpam-runtime 1.7.0-5 ii libpam0g 1.7.0-5 ii libsodium23 1.0.18-1+b2 ii libssl3t64 3.5.1-1 ii libstemmer0d 2.2.0-4+b2 ii libsystemd0 257.7-1 ii libtirpc3t64 1.3.6+ds-1 ii libunwind8 1.8.1-0.1 ii libzstd1 1.5.7+dfsg-1 ii openssl 3.5.1-1 ii ssl-cert 1.1.3 ii ucf 3.0052 ii zlib1g 1:1.3.dfsg+really1.3.1-1+b1 dovecot-core recommends no packages. Versions of packages dovecot-core suggests: pn dovecot-flatcurve <none> pn dovecot-gssapi <none> ii dovecot-imapd 1:2.4.1+dfsg1-6 pn dovecot-ldap <none> pn dovecot-lmtpd <none> ii dovecot-managesieved 1:2.4.1+dfsg1-6 pn dovecot-mysql <none> pn dovecot-pgsql <none> pn dovecot-pop3d <none> ii dovecot-solr 1:2.4.1+dfsg1-6 pn dovecot-sqlite <none> pn dovecot-submissiond <none> pn ntp <none> Versions of packages dovecot-core is related to: ii dovecot-core [dovecot-common] 1:2.4.1+dfsg1-6 pn dovecot-dev <none> pn dovecot-gssapi <none> ii dovecot-imapd 1:2.4.1+dfsg1-6 pn dovecot-ldap <none> pn dovecot-lmtpd <none> ii dovecot-managesieved 1:2.4.1+dfsg1-6 pn dovecot-mysql <none> pn dovecot-pgsql <none> pn dovecot-pop3d <none> ii dovecot-sieve 1:2.4.1+dfsg1-6 pn dovecot-sqlite <none> -- Configuration Files: /etc/default/dovecot changed: ENABLED=1 ALLOW_COREDUMPS=1 -- debconf information: dovecot-core/ssl-cert-name: localhost dovecot-core/create-ssl-cert: false * dovecot-core/ssl-cert-exists:

2 5

Debian 13 with Dovecot-2.3 from dovecot repos
by Stefan G. Weichinger 29 Aug '25

29 Aug '25

I have 2 servers with Debian, set up with postfixadmin back then. So far they ran on Debian-12.x (12.11) with this as external repo.list: https://repo.dovecot.org/ce-2.3-latest/debian/bullseye/ This gives me: dovecot-core 2.3.21.1-2+debian11 Fine. Now I upgraded one of these servers to debian-13 and did NOT remove or edit the repo.list. Now I have Debian-13.0.0 with still dovecot-core 2.3.21.1-2+debian11: apt-cache policy dovecot-core dovecot-core: Installed: 2:2.3.21.1-2+debian11 Candidate: 2:2.3.21.1-2+debian11 Version table: *** 2:2.3.21.1-2+debian11 500 500 https://repo.dovecot.org/ce-2.3-latest/debian/bullseye bullseye/main amd64 Packages 100 /var/lib/dpkg/status 1:2.4.1+dfsg1-6 500 500 http://ftp.at.debian.org/debian trixie/main amd64 Packages 500 http://deb.debian.org/debian trixie/main amd64 Packages I don't mind, it's OK for me, I still have to work through the config changes needed to upgrade to dovecot-2.4 Is this combination OK, is it problematic? (for me things work so far, I can mail quite fine) I consider doing it on a customer server this evening, and hope for a quick "it's fine!" from this ml ;-) thanks all, Stefan

5 10

Supporting both "username" to username@domain.com
by Alex 26 Aug '25

26 Aug '25

Hi, I'm using dovecot-2.3.21 on fedora40 and have configured it to use only usernames without domain when logging in. Now apparently the new Outlook (1.2025.617.000) no longer supports the ability to change username for IMAP. Now what? We have other users who are using older versions of Outlook and Thunderbird and webmail that still support this login method. How can I support both? Here is my dovecot info. # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: Linux 6.12.6-100.fc40.x86_64 x86_64 Fedora release 40 (Forty) btrfs auth_mechanisms = plain login default_client_limit = 3000 default_process_limit = 4000 default_vsz_limit = 1 G dict { sql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = 209.216.XXX.60, 127.0.0.1 mail_gid = users mail_location = maildir:/home/%u/Maildir mail_max_userip_connections = 100 mail_plugins = " listescape last_login" mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { last_login_dict = proxy::sql last_login_key = # hidden, use -P to show it last_login_precision = ms sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = pop3 imap lmtp service anvil { client_limit = 12003 } service auth-worker { client_limit = 20000 } service auth { client_limit = 20000 unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { port = 993 ssl = yes } process_min_avail = 20 service_count = 0 vsz_limit = 1 G } service lmtp { executable = lmtp -L inet_listener lmtp { address = 127.0.0.1 port = 24 } process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_ca = </var/www/example.com-443/ssl/DigiCertCA-2022.crt ssl_cert = </var/www/example.com-443/ssl/example-combined-2025.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol lda { info_log_path = /var/log/dovecot-lda.log log_path = /var/log/dovecot-lda-errors.log } protocol imap { mail_max_userip_connections = 100 } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } local_name example.com { ssl_cert = </var/www/example.com-443/ssl/example-combined-2025.crt ssl_key = # hidden, use -P to show it } local_name users.example1.com { ssl_cert = </etc/letsencrypt/example1-fullchain.pem ssl_key = # hidden, use -P to show it } We're also using postfix to support this basic sasl username when sending. smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $myhostname broken_sasl_auth_clients = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanonymous Hi, I'm using dovecot-2.3.21 on fedora40 and have configured it to use only usernames without domain when logging in. Now apparently the new Outlook (1.2025.617.000) no longer supports the ability to change username for IMAP. Now what? We have other users who are using older versions of Outlook and Thunderbird and webmail that still support this login method. How can I support both? Here is my dovecot info. # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: Linux 6.12.6-100.fc40.x86_64 x86_64 Fedora release 40 (Forty) btrfs auth_mechanisms = plain login default_client_limit = 3000 default_process_limit = 4000 default_vsz_limit = 1 G dict { sql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = 209.216.XXX.60, 127.0.0.1 mail_gid = users mail_location = maildir:/home/%u/Maildir mail_max_userip_connections = 100 mail_plugins = " listescape last_login" mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { last_login_dict = proxy::sql last_login_key = # hidden, use -P to show it last_login_precision = ms sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = pop3 imap lmtp service anvil { client_limit = 12003 } service auth-worker { client_limit = 20000 } service auth { client_limit = 20000 unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { port = 993 ssl = yes } process_min_avail = 20 service_count = 0 vsz_limit = 1 G } service lmtp { executable = lmtp -L inet_listener lmtp { address = 127.0.0.1 port = 24 } process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_ca = </var/www/example.com-443/ssl/DigiCertCA-2022.crt ssl_cert = </var/www/example.com-443/ssl/example-combined-2025.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol lda { info_log_path = /var/log/dovecot-lda.log log_path = /var/log/dovecot-lda-errors.log } protocol imap { mail_max_userip_connections = 100 } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } local_name [1]example.com { ssl_cert = </var/www/example.com-443/ssl/example-combined-2025.crt ssl_key = # hidden, use -P to show it } local_name [2]users.example1.com { ssl_cert = </etc/letsencrypt/example1-fullchain.pem ssl_key = # hidden, use -P to show it } We're also using postfix to support this basic sasl username when sending. smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $myhostname broken_sasl_auth_clients = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanonymous References Visible links 1. http://example.com/ 2. http://users.example1.com/

9 14

INBOX is not part of "*" in dovecot-virtual
by Ákos Szőts 26 Aug '25

26 Aug '25

Hi everyone, I noticed that if I specify the following pattern in dovecot-virtual for my Virtual/Unseen mailbox, mails in INBOX are excluded: * -Drafts -Trash -Junk -Sent -Virtual/* UNSEEN It returns with 23 mails: a EXAMINE Virtual/Unseen * 23 EXISTS * 23 RECENT * OK [UNSEEN 1] First unseen. But when I add INBOX additionally after "*", the number grows to 42: a EXAMINE Virtual/Unseen * 42 EXISTS * 42 RECENT * OK [UNSEEN 1] First unseen. Is it expected that "*" doesn't include INBOX by default? As I see, the rest of the mailboxes within the same root (/) namespace are included by default. Config: namespace inbox { separator = / inbox = yes mail_path = %{home}/mail mail_index_path = %{home}/index/inbox mailbox INBOX { auto = subscribe } mailbox Trash { special_use = \Trash auto = subscribe } [...] } Dovecot version: 2.4.1. Thank you, Ákos

2 1

What's the difference between "UNKEYWORD \Seen" and "UNSEEN"?
by Ákos Szőts 25 Aug '25

25 Aug '25

Hi everyone, These two IMAP search commands return different values: a SEARCH UNSEEN * SEARCH 38 61 62 63 65 69 74 75 76 82 86 87 102 120 121 141 142 143 144 145 146 158 159 160 a SEARCH UNKEYWORD \Seen * SEARCH [All email IDs in the mailbox] a SEARCH KEYWORD \Seen * SEARCH [Empty] According to RFC 3501 <https://datatracker.ietf.org/doc/html/rfc3501#section-6.4.4>, in my interpretation, these two should be equal: > UNSEEN > Messages that do not have the \Seen flag set. Can you tell me what is causing this difference? I also ran force-resync on all my mails, just to be sure. Ákos Hi everyone, These two IMAP search commands return different values: a SEARCH UNSEEN * SEARCH 38 61 62 63 65 69 74 75 76 82 86 87 102 120 121 141 142 143 144 145 146 158 159 160 a SEARCH UNKEYWORD \Seen * SEARCH [All email IDs in the mailbox] a SEARCH KEYWORD \Seen * SEARCH [Empty] According to [1]RFC 3501, in my interpretation, these two should be equal: > UNSEEN > Messages that do not have the \Seen flag set. Can you tell me what is causing this difference? I also ran force-resync on all my mails, just to be sure. Akos References Visible links 1. https://datatracker.ietf.org/doc/html/rfc3501#section-6.4.4

2 2

Dovecot 2.4.1-4: Server SSL cert loaded in ssl_server_settings_check but lost in openssl_iostream_use_certificate_error
by Louis Villedieu 25 Aug '25

25 Aug '25

Dear dovecot mailing list, Maybe you'll have an idea. I upgraded from Debian bookworm to trixie this morning. Along with this upgrade, dovecot went to 2.4.1 . I adapted the configuration files. The server starts but the clients cannot retrieve emails. The error message in the logs is: dovecot: pop3-login: Error: Failed to initialize SSL connection: Couldn't initialize SSL server context: Can't load SSL certificate (ssl_server_cert_file setting): The certificate is empty In iostream-openssl-context.c:ssl_iostream_context_set(), I adapted this error message to see whether a path could be found for this server cert file: t_strdup_printf( "Can't load SSL certificate (%s setting with path '%s'): %s", ctx->client_ctx ? "ssl_client_cert_file" : "ssl_server_cert_file", set->cert.cert.path, openssl_iostream_use_certificate_error(set->cert.cert.content) The outcome was that the path is empty as well:dovecot: pop3-login: Error: Failed to initialize SSL connection: Couldn't initialize SSL server context: Can't load SSL certificate (ssl_server_cert_file setting with path ''): The certificate is empty Then, I adapted ssl-settings.c:ssl_server_settings_check() to show the content of the server certificate file at that stage (with stdio):FILE *file_ptr;file_ptr=fopen("/tmp/output.txt","a");if(file_ptr!=NULL){fprintf(file_ptr,"server check %s\n",set->ssl_server_cert_file);fclose(file_ptr);} The outcome was that the file is not empty at this stage: server check /etc/letsencrypt/live/<MY_SERVER>/fullchain.pem -----BEGIN CERTIFICATE----- <MY_CERT> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- <MY_CERT> -----END CERTIFICATE----- Is there any potential reason for this disappearance between the calls? Thanks! Louis. Dear dovecot mailing list, Maybe you'll have an idea. I upgraded from Debian bookworm to trixie this morning. Along with this upgrade, dovecot went to 2.4.1 . I adapted the configuration files. The server starts but the clients cannot retrieve emails. The error message in the logs is: dovecot: pop3-login: Error: Failed to initialize SSL connection: Couldn't initialize SSL server context: Can't load SSL certificate (ssl_server_cert_file setting): The certificate is empty In iostream-openssl-context.c:ssl_iostream_context_set(), I adapted this error message to see whether a path could be found for this server cert file: t_strdup_printf( "Can't load SSL certificate (%s setting with path '%s'): %s", ctx->client_ctx ? "ssl_client_cert_file" : "ssl_server_cert_file", set->cert.cert.path, openssl_iostream_use_certificate_error(set->cert.cert.content) The outcome was that the path is empty as well: dovecot: pop3-login: Error: Failed to initialize SSL connection: Couldn't initialize SSL server context: Can't load SSL certificate (ssl_server_cert_file setting with path ''): The certificate is empty Then, I adapted ssl-settings.c:ssl_server_settings_check() to show the content of the server certificate file at that stage (with stdio): FILE *file_ptr;file_ptr=fopen("/tmp/output.txt","a");if(file_ptr!=NULL){fprintf(file_ptr,"server check %s\n",set->ssl_server_cert_file);fclose(file_ptr);} The outcome was that the file is not empty at this stage: server check /etc/letsencrypt/live/<MY_SERVER>/fullchain.pem -----BEGIN CERTIFICATE----- <MY_CERT> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- <MY_CERT> -----END CERTIFICATE----- Is there any potential reason for this disappearance between the calls? Thanks! Louis.

3 2

Re: Dovecot 2.4.1-4: Server SSL cert loaded in ssl_server_settings_check but lost in openssl_iostream_use_certificate_error
by Rory Campbell-Lange 24 Aug '25

24 Aug '25

On 24/08/25, louis.villedieu(a)yahoo.com (louis.villedieu(a)yahoo.com) wrote: > I tried yesterday all the options you proposed in terms of configuration. > > I don't think the configuration has an issue since the settings are loaded > successfully but not kept. > > I presume this can be due to an incompatibility of 2.4.1 with my system. That seems a bit odd. Are you sure you have cut out the "<" symbols relating to ssl certificate/key paths, and that the certificates are the full-chain certs? Anyhow, with reference to https://github.com/rorycl/dovecot-config, you can easily debug your issue with Dovecot 2.4.1's official docker image. Simply edit the provided dovecot.conf to include your ssl settings and the debugging log to stderr should quickly show you where your issue is in a safe environment. Be aware that if you run docker from the local directory with your dovecot.conf etc to load into docker you need to use the --volume/v or --mount options to put that directory at /etc/dovecot in the container: docker run -p 1143:143 -p 1993:993 \ -v ./:/etc/dovecot \ dovecot/dovecot:latest If you have specified ssl files at, for example, /etc/dovecot/ssl, you need to put your ssl certificates and keys in an ssl directory of the current directory, or make another -v / --mount mount.

1 0

Virtual inbox in imap with dovecot 2.4
by aholiveira＠gmail.com 24 Aug '25

24 Aug '25

Hello, I've recently upgraded to debian 13 (trixie), from debian 12 (bookworm). In bookworm I had the following setup working like perfection: - All mail is sorted to some mailbox folder through sieve (either a "specialized" one, or a generic folder under the inbox name like year.month - 2025.08). - No email whatsoever was ever reaching the inbox. - Then I had a virtual inbox which would get me all the "unread" or "flagged" messages This way I had all my email sorted out from the delivery and my inbox cleared itself once I had read an email. For this I was using the stock debian dovecot packages, and now, after the upgrade to debian 13 I'm also using the stock debian packages. However, this whole neat setup broke and I can't get it to work again. I've searched dovecot's manual, asked two different AIs, did a number of web searches and adapted the new configuration files to the new syntax but dovecot refuses to list the emails in my INBOX folder. I've spent already several hours around this, to no avail. Unfortunately I didn't keep a copy of the config files from debian 12 so now I can't really compare but I did manually change the dovecot config files after the upgrade so that what I had running in debian 12 should work as before (it was refusing to start after the upgrade). Here is the output of dovecot -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.41+deb13-amd64 x86_64 Debian 13.0 # Hostname: myhost # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_mechanisms = plain login dovecot_storage_version = 2.4.0 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_driver = maildir mail_inbox_path = ~/Maildir mail_path = ~/Maildir mail_plugins { notify = yes mail_log = yes virtual = yes } mail_privileged_group = mail namespace_subscriptions = no protocols { imap = yes sieve = yes } passdb pam { } userdb passwd { } namespace inbox { inbox = yes prefix = separator = . subscriptions = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service submission-login { inet_listener submission { port = 587 } inet_listener submissions { } } service lmtp { unix_listener lmtp { } } service imap { executable = imap imap-postlogin } service pop3 { } service submission { } service auth { unix_listener auth-userdb { } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/dovecot/private/dovecot.pem dh_file = /usr/share/dovecot/dh.pem key_file = /etc/dovecot/private/dovecot.key } protocol lda { mail_plugins { sieve = yes } } protocol imap { mail_max_userip_connections = 40 } service managesieve-login { inet_listener sieve { port = 4190 } } namespace 00-virtual { mail_driver = virtual mail_path = ~/Maildir/virtual hidden = no inbox = no list = yes prefix = 00-virtual. separator = . } namespace virtual { mail_driver = virtual mail_path = ~/Maildir/virtual hidden = no inbox = no list = yes prefix = virtual. separator = . } namespace real { hidden = yes inbox = no list = no prefix = real. separator = . subscriptions = no } service imap-postlogin { executable = script-login /usr/local/bin/dovecot-postlogin.sh unix_listener imap-postlogin { } } passdb deny { deny = yes driver = passwd-file passwd_file_path = /etc/dovecot/deny-users } This is /usr/local/bin/dovecot-postlogin.sh #!/bin/sh VIRTUAL=$HOME/Maildir/virtual # AUTOMATICALLY VIRTUALIZE INBOX # # If the user creates a virtual/INBOX/dovecot-virtual, # switch the inbox to the virtual namespace. if [ -d "${VIRTUAL}/INBOX" ]; then export USERDB_KEYS="$USERDB_KEYS NAMESPACE/VIRTUAL/INBOX NAMESPACE/INBOX/INBOX" logger -p mail.debug "$USERDB_KEYS $VIRTUAL $@" /usr/bin/env USERDB_KEYS="$USERDB_KEYS" NAMESPACE/VIRTUAL/INBOX=yes NAMESPACE/INBOX/INBOX=no "$@" else exec "$@" fi This is the content of $HOME/Maildir/virtual/INBOX/dovecot-virtual real.* OR UNSEEN FLAGGED I'm also getting this message anytime that I login with a mail client: 2025-08-22T21:52:29.466584+01:00 ****** dovecot: imap(***)<316863><svBRYvo8+pXAqFoB>: Error: Mailbox INBOX: Failed to autocreate mailbox: Can't create virtual mailboxes Note that the 00-virtual namespace was added just as a temporary check and I want to delete it once this is working again. I have also a file under $HOME/Maildir/virtual/Flagged/dovecot-virtual with the exact same contents as the INBOX one above which get's me a virtual folder that works correctly (getting all my unread and flagged email in a single folder), so the filter works. Just changing the INBOX from the real to the virtual one fails and I can't understand what am I doing wrong or what am I missing. Can someone please help me? I'm completely lost and frustrated on this. Thank you very much.

4 5

2.4 config nightmares
by Dharma Mati 24 Aug '25

24 Aug '25

I have been trying for weeks to make it work.But I simply cant. Would you plz kindly tell me how it should be? : doveconf -n # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: Linux 6.1.67-gentoo x86_64 Gentoo Base System release 2.17 ext4 # Hostname: .................. auth_mechanisms = cram-md5 plain login disable_plaintext_auth = no listen = * mail_location = maildir:/home/vmail/%d/%n/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = * driver = pam } passdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } ssl_cert = </etc/ssl/private/server.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } userdb { args = uid=vmail gid=vmail home=/home/vmail/%d/%n driver = static } local_name asl.dynu.net { ssl_cert = </etc/letsencrypt/live/asl.dynu.net/fullchain.pem ssl_key = # hidden, use -P to show it } local_name { ssl_cert = </etc/letsencrypt/live//fullchain.pem ssl_key = # hidden, use -P to show it } etc. Plz help me.And kindly consider creating a migration tool.Thanks a lot Andreas I have been trying for weeks to make it work.But I simply cant. Would you plz kindly tell me how it should be? : doveconf -n # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: Linux 6.1.67-gentoo x86_64 Gentoo Base System release 2.17 ext4 # Hostname: .................. auth_mechanisms = cram-md5 plain login disable_plaintext_auth = no listen = * mail_location = maildir:/home/vmail/%d/%n/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = * driver = pam } passdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } ssl_cert = </etc/ssl/private/server.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } userdb { args = uid=vmail gid=vmail home=/home/vmail/%d/%n driver = static } local_name [1]asl.dynu.net { ssl_cert = </etc/letsencrypt/live/[2]asl.dynu.net/fullchain.pem ssl_key = # hidden, use -P to show it } local_name { ssl_cert = </etc/letsencrypt/live//fullchain.pem ssl_key = # hidden, use -P to show it } etc. Plz help me.And kindly consider creating a migration tool.Thanks a lot Andreas References Visible links 1. http://asl.dynu.net/ 2. http://asl.dynu.net/fullchain.pem

8 9