February 2026 - dovecot

How to let postfix use dovecot to check quotas for virtual aliases
by jerome＠jolimont.fr 04 Feb '26

04 Feb '26

Hi all. Receiving an email for an alias, I got those errors: <alias(a)domain.tld>Recipient address rejected: Unknown user; I realized this happened when postfix queries dovecot about user quota. Basically, what happens is that postfix queries dovecot using the virutal alias as name, not the virtual user. And since dovecot doesn't find a user under that name, it returns an error and postfix rejects the mail. ### Configuration I followed the docs at https://doc.dovecot.org/latest/core/plugins/quota.html when setting up the server. /etc/postfix/main.cf ``` smtpd_recipient_restrictions = check_policy_service unix:private/quota-status ``` /etc/dovecot/conf.d/90-quota.conf ``` service quota-status { executable = quota-status -p postfix unix_listener /var/spool/postfix/private/quota-status { user = postfix } client_limit = 1 } ``` /etc/dovecot/conf.d/auth-sql.conf.ext ``` userdb sql { query = SELECT '/var/mail/vmail/'||maildir AS home, 110 AS uid, 113 AS gid, quota || 'B' AS quota_storage_size FROM mailbox WHERE username = '%{user}' iterate_query = SELECT username FROM mailbox } ``` ### Solution 1: modify user query This issue was reported and analyzed here: https://dovecot.dovecot.narkive.com/FtjhqCuU/postfix-aliases-with-quota-sta… and there: https://github.com/docker-mailserver/docker-mailserver/issues/2091 A comment (https://dovecot.dovecot.narkive.com/FtjhqCuU/postfix-aliases-with-quota-sta…) suggests to modify the SQL query to also look for aliases. I modified my query like so: ``` query = SELECT '/var/mail/vmail/'||maildir AS home, 110 AS uid, 113 AS gid, quota || 'B' AS quota_storage_size FROM mailbox JOIN alias ON mailbox.username = alias.goto WHERE alias.address = '%{user}'; ``` and it seemed to work. I mean, I can query user quota with an alias: doveadm quota get -u alias(a)domain.tld but the iterate query ignores aliases so doveadm quota get -A only lists users, not aliases (which is what I want) and I can't IMAP login using aliases (which is also what I want) since I didn't modify the password query either. I find this configuration slightly inconsistent: the user query returns aliases, not the iterate query. Is the user query really meant to return aliases as well? Also, I realized this query is broken for alias to multiple addresses. I'd get the following error: Recipient address rejected: Unknown user Surprisingly, it seems to only affect messages from an external source to an alias pointing to an external mailbox. Messages submitted locally (and perhaps messages sent to an alias to local destinations only, I'm not sure) were not affected. ### Solution 2: ignore aliases, it will fail later anyway On another server, I had this configuration: /etc/dovecot/conf.d $ vi 90-quota.conf (Don't put this in `plugin` on dovecot 2.4+.) ``` plugin { quota_status_success = DUNNO quota_status_nouser = DUNNO quota_status_overquota = "552 5.2.2 Mailbox is full" } ``` The alias is unknown so the check returns DUNNO and postfix lets the message pass (postfix log read "delivered via spamassassin service") but then it fails at sieve stage when writing the message: sieve: msgid=<xxx>: failed to store into mailbox 'INBOX': Quota exceeded (mailbox for user is full) The result is what is expected: the message is rejected due to mailbox full. But I don't think it was intended to work this way. And since the message is quota-rejected at sieve stage, I could remove the `check_policy_service` line since it will be rejected for a virtual user (not alias) as well anyway. Right? ### Question What is the recommended configuration to let postfix use dovecot to check quotas for virtual aliases? I couldn't find documentation for this specific use case. Ideally, postfix would query using the resolved user, not the alias. Can this be achieved? Should I remove the check and rely on the fact that writing the message fails at a later step anyway? Thanks. (Question also posted on ServerFault: https://serverfault.com/questions/1197914/how-to-let-postfix-use-dovecot-to…)

3 3

Question about behavior I wound up patching 2.4 to fix
by Andy Baugh 03 Feb '26

03 Feb '26

Howdy, I had a complaint from RoundCube users that the maildir quotas weren't accurate when they logged in after something wound up deleting their maildirsize file on Dovecot 2.4. Since that does IMAP GETQUOTAROOT to fetch the info, I figured we're probably not triggering quota recalculation on maildir like we did on dovecot 2.3 (which doesn't seem to have this issue). Wound up writing a patch to src/plugins/imap-quota/imap-quota-plugin.c to add a hook into cmd_setquota which looks to see if imap_quota is enabled, and if so trigger maildir quota recalculation on IMAP login. This does work to solve the reported issue, but I'm ultimately more curious whether this could even be considered a regression, as per your own documentation for the quota plugin: > Once the maildirsize reaches 5120 bytes, the quota is recalculated and the file is recreated. This makes sure that if quota happens to be broken (e.g. externally deleted files) it won't stay that way forever. This suggests to me that the behavior I'm "fixing" a regression in is actually working "as designed." As such my question would be: Is there a good reason I *should not* be doing this? I would of course be happy to share this patch with the list, but I'm not going to bother if it's actually something the maintainers are not interested in due to it not being a good idea in the first place. Thanks, -- Thomas "Andy" Baugh | Software Development Engineer IV andy.baugh(a)webpros.com www.webpros.com

1 0

Unexpected Configuration Error `Unknown setting: ssl_server_cert_file`
by David Weingut 02 Feb '26

02 Feb '26

Hello, I upgraded from Debian 12 to 13 and thereby also from dovecot 2.3 to 2.4. Now I am facing a weird error in dovecot. The actual error is the following # doveconf -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 22: ssl_server_cert_file : Unknown setting: ssl_server_cert_file The corresponding entry in my config is ssl = yes ssl_server_cert_file = /etc/letsencrypt/live/example.com/fullchain.pem ssl_server_key_file = /etc/letsencrypt/live/example.com/privkey.pem I am sorry if I missed something in the archives but I did not find any similar posts. Is there something I am missing here and what would be further required to debug this? Best, David Hello, I upgraded from Debian 12 to 13 and thereby also from dovecot 2.3 to 2.4. Now I am facing a weird error in dovecot. The actual error is the following # doveconf -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 22: ssl_server_cert_file : Unknown setting: ssl_server_cert_file The corresponding entry in my config is ssl = yes ssl_server_cert_file = /etc/letsencrypt/live/example.com/fullchain.pem ssl_server_key_file = /etc/letsencrypt/live/example.com/privkey.pem I am sorry if I missed something in the archives but I did not find any similar posts. Is there something I am missing here and what would be further required to debug this? Best, David

2 3

Compiling Dovecot 2.4 on OpenBSD
by Joel Mawhorter 02 Feb '26

02 Feb '26

I'm writing to see if anyone has had success compiling Dovecot 2.4 on OpenBSD. I can't seem to find any documentation that lists prerequisites. At the moment, the 2.4.2 source tarball from the Dovecot site does not seem to compile on my OpenBSD 7.8 system and the error message is not very helpful. I'm unsure if this is just a problem of some required package not being installed. If anyone could point me to info to help move forward, I would appreciate that. Joel

6 19