September 2025 - dovecot

Using MongoDB as a custom message store via plugin
by The Sixth Serpent 30 Sep '25

30 Sep '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello Dovecot Community! I have recently written a NodeJS-based mail system that I hope to eventually open-source. The SMTP daemon (accepting inbound for delivery/relay) and queue processor (handing off messages to remote MTAs for relay messages) both use MongoDB (utilizing Mongoose Schema) to store/queue the messages (emails). All of this is in-place and working. Now, I turn my attention to making the emails accessible to the end user (i.e., webmail, POP3, and/or IMAP). I already have a working POP3+TLS daemon (NodeJS + Mongoose), though it is unlikely that I'll make the POP3 service available to my users. I'm hoping to make use of RoundCube or other open-source webmail clients. IMAP provides the interface between my message store and webmail/user's clients. I've chosen Dovecot (yay!) to provide this interface (as opposed to the nightmare of writing one from scratch) given that it's open source and it's extensibility via plugins. Does the idea of providing a MongoDB-based message store sound like something that can be done sole via plugins - or might this require modification of the actual Dovecot core? Is support for a MongoDB message store interesting to anyone beyond myself? I'd be happy to share my Mongoose schema (as the intent is to open source the entire project once I get it together). I'll also need Dovecot to authenticate against my MongoDB instance. I have a collection, called "mailboxes" that defines the username and password (hashed with ARGON2), among other things. I'm imagining that custom authentication is something that can be achieved via plugins alone? What does everyone think to be simpler/more appropriate: 1. authentication plugin that connects directly to MongoDB, fetches the authen creds, and verifies the password via ARGON2 2. authentication plugin that accesses a NodeJS-express API endpoint that provides a boolean result From my perspective, option (a) makes the most sense. I consider option (b) in case the plugin system doesn't support MongoDB, or doesn't support ARGON2, or .... Can anyone recommend any good docs/howtos on writing Dovecot plugins? Any plugins' whose source might be of interest to me (i.e., custom message store, custom auth, etc)? Thank you for taking the time to consider these questions! I appreciate any responses. I'll make available, or describe further, any aspect of my system if it will help. Regards, TJ Easter II -- "The Information Age offers much to mankind, and I would like to think that we will rise to the challenges it presents. But it is vital to remember that information - in the sense of raw data - is not knowledge; that knowledge is not wisdom; and that wisdom is not foresight. But information is the first essential step to all of these." -- Arthur C. Clarke; 12/2003 Sent with Proton Mail secure email. -----BEGIN PGP SIGNATURE----- Version: ProtonMail wsC5BAEBCgBtBYJo209sCRDKQ0X/3WTf3EUUAAAAAAAcACBzYWx0QG5vdGF0 aW9ucy5vcGVucGdwanMub3JnOD2KL5NSk5rYX75gCW+d8bYmHLJNP8m5nkVy wnHpCHMWIQTQAEbAbK1F7TqiE2jKQ0X/3WTf3AAAChQH/iXWnG3kBM3oQpfe Yd4Hv2TkN/iduzaXfOwWDBcUCP4Dc2YDnYR2W/6OI6hcFLaPw+RvEWe6FMvu aik7s5wypDdQv8bNugO7FkyyooA4UYDLoffRDNIHv+vTXviAmByjywU64Qor hNwajt+vXCuJZY21+vElXhk0Nnea62DrBhRjrVWjxEQAmj9dNSP0HG5woqcX mCYC/PufJLbQatcortFZV5Eiq0OQCfe7C7AEtPjA+isbx2lzqTpMhcmJ87qn 95FwmMoEUuQPoLiUfrzkbBcFECFRi9EZsMhPr4vwuZLlGr49vIyzzqMgI/gX /XJq4cu6mZ1j0Hp+N2zq1iDG55I= =6CWa -----END PGP SIGNATURE-----

1 0

ENV var expansions work mostly in 2.4, but not in some locations
by publists＠emailgroups.net 29 Sep '25

29 Sep '25

Hi, I'm trying to clean up my migrated v2.4 config. I'm still having a hard time with environment variable expansions :-( They work in most places. But so far for me not in mail_plugin_dir ssl_client_* or ssl_server_* listen= For example, this config using literal file paths works great ssl_server { ca_file = /path/to/CA.crt.pem ... } ssl_client { ca_file = /path/to/CA.crt.pem ... } protocol doveadm { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol imap { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol lmtp { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol sieve { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol submission { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } When I add an env var import_environment { CA_FILE=/path/to/CA.crt.pem } and change any of those /path/to/CA.crt.pem instances to this %{env:CA_FILE} OR this $ENV:CA_FILE I get errors os startup like dovecot[13660]: doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf: ssl_server_request_client_cert=yes, but ssl_server_ca_file not provided If I go back to literal paths, everything works OK. I've read these https://doc.dovecot.org/main/core/settings/variables.html https://doc.dovecot.org/main/core/settings/syntax.html#environment-variables https://doc.dovecot.org/main/core/settings/types.html#file and as far as I can tell this should work. Something's different about these that I'm not understanding. Or there's a list of keys that can't use these vars in values. How do you use ENV var expansion in ssl file paths, listen addresses, etc? Dave

1 0

Enforce LMTP auth with client certs
by rhi＠pengutronix.de 29 Sep '25

29 Sep '25

Hello, I'm trying to get TLS client cert authentication to work on the LMTP socket via TCP port 24 with Dovecot 2.4. I was already able to get TLS working on the LMTP socket, but if I connect to it via 'openssl s_client' from another machine, and type in a few LMTP commands, Dovecot accepts all mail without requesting a client cert from me. The server running Dovecot is behind a firewall, so LMTP connections should only be possible from the SMTP server in the same local network, not from the whole internet. However I want to guard against possible firewall misconfigs by enforcing client certs between the incoming SMTP server and Dovecot for mail delivery. Is there a way to do this in Dovecot? My /etc/dovecot/conf.d/20-lmtp.conf effectively looks like this: lmtp_save_to_detail_mailbox = yes lmtp_add_received_header = yes protocol lmtp { mail_plugins { sieve = yes } ssl = required ssl_server_ca_file = /etc/lmtp-ca/ca.crt ssl_server_cert_file = /etc/lmtp-ca/local.crt ssl_server_key_file = /etc/lmtp-ca/private/local.key ssl_server_request_client_cert = yes # TODO: this should enforce client certs, but it does not work... auth_ssl_require_client_cert = yes ssl_server_require_crl = no log_debug = category=ssl OR category=auth } … and /etc/dovecot/conf.d/10-master.conf has: service lmtp { #unix_listener lmtp { # mode = 0666 #} inet_listener lmtp { # Accept connections from anywhere, but 20-lmtp.conf configures LMTP to require client certs listen = * :: port = 24 inet_listener_ssl = yes # TODO: this should enforce client certs, but it does not work... auth_ssl_require_client_cert = yes } } I also tried enabling ssl_server_request_client_cert = yes and auth_ssl_require_client_cert = yes globally, but this did not make a difference. I already tried looking at the Dovecot source code, but didn't find anything yet. I'm happy for any pointers in the right direction. Thanks, - Roland

2 2

postfix alias and dovecot quota
by Alexandre Ellert 28 Sep '25

28 Sep '25

Hello, Can someone tell me if it’s possible to configure dovecot to answer quota information about real mailbox when I query a postfix alias mailbox (this information is actually in a mysql database) ? Example : doveadm quota get - u alias(a)domain.com doveadm(alias(a)domain.com): Fatal: User doesn't exist doveadm quota get - u realmailbox(a)domain.com Quota name Type Value Limit % user STORAGE 2048853 2048000 100 user MESSAGE 6783 - 0 I’d like to have this result : doveadm quota get - u alias(a)domain.com Quota name Type Value Limit % user STORAGE 2048853 2048000 100 user MESSAGE 6783 - 0 doveadm quota get - u realmailbox(a)domain.com Quota name Type Value Limit % user STORAGE 2048853 2048000 100 user MESSAGE 6783 - 0 Thanks for your help. Alexandre.

6 9

Dovecot 2.4.1 sieve
by Martin Brampton 28 Sep '25

28 Sep '25

Just upgraded mail server from Debian 12 to 13. Fixed a number of issues with changed Dovecot, but stuck getting sieve working. The server uses LMTP. I’ll post some configuration if it helps. But the messages in the log saying the plugin sieve_lmtpsieve is missing seems fundamental and relevant. I can’t find anything called that in the Debian repository. How is it installed? Or am I doing something fundamentally wrong? Martin Just upgraded mail server from Debian 12 to 13. Fixed a number of issues with changed Dovecot, but stuck getting sieve working. The server uses LMTP. I'll post some configuration if it helps. But the messages in the log saying the plugin sieve_lmtpsieve is missing seems fundamental and relevant. I can't find anything called that in the Debian repository. How is it installed? Or am I doing something fundamentally wrong? Martin

7 21

2.4.1 Config woes
by Anthony Mellor 27 Sep '25

27 Sep '25

Hi, greetings Do sing out please if this is the wrong place or style for this mailing list, please - and there's a community somewhere isn't there? spent days not succeeding with these configs. I'm a new install on Trixie and Dovecot 2.4.1 and going round in many circles with nano /etc/dovecot/dovecot.conf nano /etc/dovecot/conf.d/10-auth.conf nano /etc/dovecot/conf.d/auth-sql.conf.ext nano /etc/dovecot/conf.d/10-master.conf MariaDB having tried one million variations of this, so this is just one, being the latest suggestion # Declare named instances of passdb/userdb using the SQL driver passdb sql { } userdb sql { } # Passdb (authentication) SQL settings passdb_sql_driver = mysql # MariaDB uses "mysql" passdb_sql_host = 127.0.0.1 # or: /run/mysqld/mysqld.sock passdb_sql_port = 3306 passdb_sql_dbname = maildb passdb_sql_user = dovecot passdb_sql_password = CHANGEME # Choose the scheme to match your DB: # - MD5-CRYPT for $1$... hashes or {MD5-CRYPT} prefix # - PLAIN-MD5 for 32-hex unsalted MD5 passdb_sql_default_pass_scheme = MD5-CRYPT passdb_sql_password_query = \ SELECT username AS user, password \ FROM users \ WHERE username = '%u' (thought this is now changed) # Userdb (user lookup) SQL settings userdb_sql_driver = mysql userdb_sql_host = 127.0.0.1 userdb_sql_port = 3306 userdb_sql_dbname = maildb userdb_sql_user = dovecot userdb_sql_password = CHANGEME # Must return at least uid, gid and home or mail userdb_sql_user_query = \ SELECT \ 5000 AS uid, 5000 AS gid, \ home, \ CONCAT('maildir:', maildir) AS mail \ FROM users \ WHERE username = '%u' (thought this is now changed) I have never used Dovecot before this install ten days ago - any example files that work will be forever gratefully appreciated to give me a basic starting point. Very frustratingly at one 3am morning I did get it working and the lost it. a t b Anthony _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org

1 0

2.4.1 Config woes
by Anthony Mellor 27 Sep '25

27 Sep '25

Hi, greetings Do sing out please if this is the wrong place or style for this mailing list, please - and there's a community somewhere isn't there? spent days not succeeding with these configs. I'm a new install on Trixie and Dovecot 2.4.1 and going round in many circles with nano /etc/dovecot/dovecot.conf nano /etc/dovecot/conf.d/10-auth.conf nano /etc/dovecot/conf.d/auth-sql.conf.ext nano /etc/dovecot/conf.d/10-master.conf MariaDB having tried one million variations of this, so this is just one, being the latest suggestion # Declare named instances of passdb/userdb using the SQL driver passdb sql { } userdb sql { } # Passdb (authentication) SQL settings passdb_sql_driver = mysql # MariaDB uses "mysql" passdb_sql_host = 127.0.0.1 # or: /run/mysqld/mysqld.sock passdb_sql_port = 3306 passdb_sql_dbname = maildb passdb_sql_user = dovecot passdb_sql_password = CHANGEME # Choose the scheme to match your DB: # - MD5-CRYPT for $1$... hashes or {MD5-CRYPT} prefix # - PLAIN-MD5 for 32-hex unsalted MD5 passdb_sql_default_pass_scheme = MD5-CRYPT passdb_sql_password_query = \ SELECT username AS user, password \ FROM users \ WHERE username = '%u' (thought this is now changed) # Userdb (user lookup) SQL settings userdb_sql_driver = mysql userdb_sql_host = 127.0.0.1 userdb_sql_port = 3306 userdb_sql_dbname = maildb userdb_sql_user = dovecot userdb_sql_password = CHANGEME # Must return at least uid, gid and home or mail userdb_sql_user_query = \ SELECT \ 5000 AS uid, 5000 AS gid, \ home, \ CONCAT('maildir:', maildir) AS mail \ FROM users \ WHERE username = '%u' (thought this is now changed) I have never used Dovecot before this install ten days ago - any example files that work will be forever gratefully appreciated to give me a basic starting point. Very frustratingly at one 3am morning I did get it working and the lost it. a t b Anthony

1 0

Slow inbox
by Rupert Gallagher 26 Sep '25

26 Sep '25

Hello, I note the following problem. If the inbox holds many subfolders with mail, thunderbird spends a lot of time on startup. To mitigate the problem, I asked users to keep the inbox clear of subfolders. However, a user keeps ignoring the local policy while also lamenting the mail is slow. Please write instructions to enforce this local policy in dovecot, so that when users try to create an inbox subfolder, dovecot refuses the action. Thank you

6 12

Dovecot and iOS 26 Mail.app
by Florian Effenberger 25 Sep '25

25 Sep '25

Hello, with the release of iOS 26, I had a look again at the infamous issue regarding Apple‘s Mail.app with Dovecot, when folder content does not reliably sync or mail content is not fully loaded. Some made a workaround by disabling pipelining (I didn‘t), and some pointed out Stalwart implemented some changes to work around the issue. A year ago, this was also prominently featured at Heise at least. I am not sure this is still a recent issue, but I wanted to share my findings. I have two different mail accounts on two different servers which have also different configurations. At least with iOS 26 I discovered that once the secondary mail account is added, both accounts suffer from the same problem again. The mere fact that I have two accounts is not the issue, because the secondary account also doesn’t work when the primary is disabled, but the other way round things have been working fine for at least a few days now. I assume that hiccups on one account affect both somehow. I did not yet get to compare the system configuration as to why the secondary account has hiccups, but maybe it helps those who debug the issue to reproduce it. Florian

1 0

Permissions Issues with shared Mailboxes, Unix Permissions and ACL
by fc26wuqa＠studserv.uni-leipzig.de 24 Sep '25

24 Sep '25

Hi, I use pam_ldap.so to use LDAP to authenticate my users. I don't use virtual accounts, but every account is a unix account. I use a post login script to export the `ACL_GROUPS` variable to hold all unix groups the user belongs to. Each group corresponds to a shared mailbox, where UNIX group permission handle which user gets access to the mailbox. Recently I added acl files to the shared mailboxes that look like: `group=some_group kxeilprwts` The Permissions of the user Mailboxes are generally 0700 and 0770 for shared mailboxes. The namespace of the shared Mailboxes looks something like: `type=shared, prefix=Shared/%%u/ location= maildir:/somewhere/'%%d/%%n/Maildir:INDEX=/srv/mails/%d/%n/Maildir/shared/%%u` Everything works fine, except my log gets flooded with messages saying: `open(/path/to/shared/mailbox) failed: Permission denied` and `opendir(/path/to/shared) failed: Permission denied, missing +x perm, we're not in group`. The user should also not be in the group. This is also reproducible when I do `doveadm mailbox list -u some_unix_user`, where dovecot tries to list all of the mailboxes, even though the user does not have permissions to do so. Referenced here: https://doc.dovecot.org/main/core/config/shared_mailboxes.html it says "Dovecot assumes that it can access the other users' mailboxes". So should I just ignore the messages/write a syslog filter for them? How can I prevent dovecot from checking every shared mailbox, even though they don't have access to it?

2 1