March 2026 - dovecot - dovecot.org

[BUG?] Dovecot 2.4.2 from Dovecot repo (RHEL 9) does not implement Sieve (properly/fully)
by Patrick S 09 Mar '26

09 Mar '26

Hi all Below is report of what I suspect is a bug arising in Dovecot 2.4.x regarding Sieve functionality after Pigeonhole functionality was folded into Dovecot/Dovecot-sieve. ISSUE: ====== I am building a new mail server on Rocky Linux 9.7 with Postfix 3.10 and Dovecot 2.4.2. The base installation & setup of Dovecot was OK with core functionality (Postfix interoperability and mail into virtual mail domain mailboxes no problem). Once I had the base setup done I started with Sieve functionality: 1) Incoming mail marked as SPAM by Rspamd auto moved into /Junk 2) Mail manually moved in/out of /Junk handed to Rspamd for training as SPAM/HAM This consistantly failed - the first issue I found was Dovecot failing to restart and `dovecot -n` reporting fatal errors related to sieve — section not found etc. etc. From my reading previously I knew I needed to install `dovecot-sieve` and it was installed before I started working on Sieve functionality. I also saw `dovecot-pigeonhole` but I seemed to read that (version >= 2.4) the functionality for that had been included in `dovecot-sieve` **and** there was no Pigeonhole included in the Dovecot 2.4.2 repo — also if I tried to install it I got errors of course because of the version mismatch, and it was not in the dovecot-2.4-latest repo. ``` # dnf info dovecot-pigeonhole Last metadata expiration check: 1:21:15 ago on Fri 06 Mar 2026 08:05:08. Available Packages Name : dovecot-pigeonhole Epoch : 1 Version : 2.3.16 Release : 15.el9 Architecture : x86_64 Size : 371 k Source : dovecot-2.3.16-15.el9.src.rpm Repository : appstream Summary : Sieve and managesieve plug-in for dovecot URL : https://www.dovecot.org/ License : MIT and LGPLv2 Description : This package provides sieve and managesieve plug-in for dovecot LDA. ``` I also saw `dovecot-managesieved` but as I was **not** going to implement a client sieve functionality I did not install that. Anyway I could not even get to first base with Sieve, Dovecot simply did not know about it. I went on IRC and chatted with Aki Tuomi who confirmed that "yeah, looks like there is some packaging mistake." because the directory `/usr/lib64/dovecot/settings` was empty. As a workaround he suggested "you need to install dovecot-managesieved as workaround". I did that and as a result the following files appeared: ``` -rwxr-xr-x 1 root root 15560 Jan 8 12:13 libmanagesieve_login_settings.so -rwxr-xr-x 1 root root 15840 Jan 8 12:13 libmanagesieve_settings.so -rwxr-xr-x 1 root root 19656 Jan 8 12:13 libpigeonhole_settings.so ``` The `dovecot -n` errors went away, it recognised the sieve directives, and I continued with the Sieve setup. All — `dovecot.conf`, sieve files source and compiled — installed OK. But the sieve functionality simply refused to work. I got advice and we found the following which essentially points to sieve (even with `dovecot-managesieved` installed) not working. After installing everything — dovecot.conf, sieve files (compiled successfully) and a pipe to a shell script to call `rspamc` nothing seemed to happen. * `journalctl -f -u dovecot | grep -E "sieve|pipe"` -> nothing showed * `rspamc stat` -> 'Messages scanned' & 'Messages learned' no increase When we checked we found the following: 1) `lib90_sieve_settings.so` (which should be in `/etc/lib64/dovecot/settings`) is missing from the system. `find / -name "lib90_sieve_settings.so"` -> not found I believe the file is critical for the running of (Dovecot using) Sieve? 2) The Dovecot build options missing any sieve functionality: ``` #dovecot --build-options Build options: ioloop=epoll notify=inotify openssl io_block_size=8192 SQL driver plugins: mysql postgresql sqlite Passdb: ldap pam passwd passwd-file sql Userdb: ldap(plugin) passwd prefetch passwd-file sql ``` I believe (I was told) that minus the above (even though `dovecot-managesieved` was installed as well as `dovecot-sieve`) Sieve simply will not function. Is this a bug/packaging error? Regards Patrick ENVIRONMENT: ============ Software -------- * Rocky Linux 9.7 (RHEL) * Postfix 3.10 Built from source * Postscreen running in Postfix * Dovecot 2.4 installed from Dovecot repo * Valkey 9.0.3 (Redis replacement) * Rspamd 3.14.3 Setup ----- * Rspamd <-> Valkey communicate via Unix socket * Postfix & Dovecot <-> Rspamd via inet port/milter: smtpd_milters = inet:localhost:11332 non_smtpd_milters = inet:localhost:11332 * 'First line defence' = DNSBL via postscreen * Rspamd SPF checking, DKIM signing and DMARC configured All of the above installed, working and tested. DOVECOT PACKAGES INSTALLED: =========================== ``` Name : dovecot Version : 2.4.2 Architecture : x86_64 Source : dovecot-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-sieve Version : 2.4.2 Architecture : x86_64 Source : dovecot-sieve-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-managesieved (see note about this in the email) Version : 2.4.2 Architecture : x86_64 Source : dovecot-sieve-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-submissiond Version : 2.4.2 Architecture : x86_64 Source : dovecot-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-imapd Version : 2.4.2 Architecture : x86_64 Source : dovecot-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-lmtpd Version : 2.4.2 Architecture : x86_64 Source : dovecot-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-lua Version : 2.4.2 Architecture : x86_64 Source : dovecot-2.4.2-2.src.rpm From repo : dovecot-2.4-latest ``` OUTPUT OF `dovecot -n`: ======================= ``` # dovecot -n # 2.4.2-2 (0962ed2104): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.2-2 (767418c3) # OS: Linux 5.14.0-611.34.1.el9_7.x86_64 x86_64 Rocky Linux release 9.7 (Blue Onyx) # Hostname: srv01.example.com dovecot_config_version = 2.4.2 auth_default_domain = example.com auth_mechanisms = plain auth_username_format = %{user | lower } dovecot_storage_version = 2.4.2 mail_access_groups = vmail mail_control_path = ~/control mail_driver = maildir mail_gid = 5000 mail_home = /var/vmail/%{user | domain }/%{user | username } mail_index_path = ~/indexes mail_path = %{home}/Maildir mail_privileged_group = vmail mail_uid = 5000 mailbox_list_utf8 = yes protocols = imap lmtp sieve_global_extensions { vnd.dovecot.pipe = yes } sieve_pipe_bin_dir = /etc/dovecot/sieve/bin sieve_plugins { sieve_imapsieve = yes sieve_extprograms = yes } sieve_trace_dir = /var/log/dovecot/sieve-trace sieve_trace_level = actions ssl = required syslog_facility = local5 protocol lmtp { mail_plugins { sieve = yes } } ssl_server { cert_file = /etc/ssl/server/server_example_com.crt key_file = /etc/ssl/server/server_example_com.key } passdb passwd-file { auth_username_format = %{user | username} default_password_scheme = SHA512-CRYPT passwd_file_path = /etc/dovecot/passwd } userdb passwd-file { auth_username_format = %{user | username} passwd_file_path = /etc/dovecot/passwd fields { gid:default = 5000 uid:default = 5000 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service auth-worker { user = $SET:default_internal_user } service anvil { unix_listener anvil { group = $SET:default_internal_group mode = 0660 } } service doveadm { unix_listener doveadm-server { mode = 0600 user = $SET:default_internal_user } } sieve_script rspamd_to_junk { driver = file path = /etc/dovecot/sieve/rspamd-to-junk.sieve type = before } namespace inbox { mail_plugins { imap_sieve = yes } inbox = yes mailbox Junk { auto = create autoexpunge = 90d special_use = "\\Junk" sieve_script report-spam { cause = copy path = /etc/dovecot/sieve/report-spam.sieve type = before } } imapsieve_from Junk { sieve_script report-ham { cause = copy path = /etc/dovecot/sieve/report-ham.sieve type = before } } mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Sent { auto = subscribe special_use = "\\Sent" } mailbox Trash { auto = subscribe special_use = "\\Trash" } } ```

4 7

Curve25519/Ed25519 ?
by Steve Litt 09 Mar '26

09 Mar '26

On my new Dovecot 2.4.2 IMAP server, which when completed will be accessible only via SSL, I plan to use Curve25519/Ed25519 self-signed-cert/private-key. Is there any reason this would be a mistake? Thanks, SteveT Steve Litt http://444domains.com

2 2

Dovecot 2.4 doveadm_worker_count corrupts tab-formatted output
by Philip Iezzi 08 Mar '26

08 Mar '26

Hi there On a Dovecot 2.4.2 (Debian Bookworm) server with over 1300 users, I am using the following config to retrieve quota usage information with doveadm: --------------------------------------- quota "User quota" { } mail_plugins = quota acl mail_log notify userdb sql { iterate_query = SELECT username AS user, CONCAT(quota, 'M') AS quota_storage_size FROM mailaccounts WHERE active = 1 query = \ SELECT '/var/vmail/%{user | domain}/%{user | username}' AS home, 'vmail' AS uid, 'vmail' AS gid, CONCAT(quota, 'M') AS quota_storage_size \ FROM mailaccounts \ WHERE username = '%{user}' AND (active = 1 OR transport_suspended = 0) } --------------------------------------- Initially, I had to run `doveadm quota recalc -A` to recalc quotas and populate the `count` quota driver which is enabled by default for "User quota". But still, it took roughly 20ms per single user or 15-20s for all users: $ time doveadm -f tab quota get -u demo(a)example.com real 0m0.020s $ time doveadm -f tab quota get -A real 0m16.800s Now, to greatly speed this up, I have introduced parallel processing: doveadm_worker_count = 4 Like this, `doveadm -f tab quota get -A` runs approx 10x faster, done in 1.5 - 2.5s But there is one major drawback which I assume to be a bug: # sane output without `doveadm_worker_count = 4` => always 6 fields demo(a)example.com User quota STORAGE 29 204800 0 demo(a)example.com User quota MESSAGE 1 - 0 # broken output with `doveadm_worker_count = 4` => sometimes 7 fields demo(a)example.com User quota STORAGE 29 2048 00 0 demo(a)example.com User quota MESSAGE 1 - 0 Somehow, the tab formatter does not play nicely together with parallel processing. On some output, the value gets split apart by an extra tab, e.g. '2024<TAB>00' in above example. Can you explain this corrupted data? Some kind of "output interleaving" seems to happen when running parallel workers. If I switch to json output (`doveadm -f json quota get -A`), this does not seem to happen and I always get valid JSON output, even with `doveadm_worker_count = 4`. Cheers, Philip

2 8

Getting quota limits from DB
by Alberto 04 Mar '26

04 Mar '26

Hi group: I have a Docker Dovecot 2.4.2 installation with MySQL user management, with this record: SELECT * FROM users; +---------------------------------------------------------------------------- | username | domain | password | home | uid | gid | active | quota | quotamsgs | crampassword +---------------------------------------------------------------------------- | alberto | bersol.info | {MD5-CRYPT}$1$Jm... | /var/mail/alberto | 1000 | 1000 | Y | 3221225472 | 149999 | {CRAM-MD5}fd246... | +---------------------------------------------------------------------------- But I have a problem with user quota definitions... If I run "doveadm" command, I get the user quota occupation, I have "quota_clone" plugin working, but I don't get user quota limit, I don't know why: ----- # docker exec -it midovecot doveadm quota get -A Username Quota name Type Value Limit % alberto(a)bersol.info User quota STORAGE 1925805 3145728 61 alberto(a)bersol.info User quota MESSAGE 37608 100000 37 ----- That limit isn't the correct limit set in DB, but the one is put in the config, and it must to be override in my userdb:Extra Fields. ----- # # docker exec -it midovecot doveadm config # 2.4.2 (0962ed2104): /etc/dovecot/dovecot.conf ... userdb sql { iterate_query = SELECT CONCAT(username,'@',domain) AS user FROM users query = SELECT home,CONCAT(username,'@',domain) AS username,crampassword AS password,uid AS userdb_uid,gid AS userdb_gid,CONCAT(quota,'B') AS userdb_quota_storage_size,concat('*:messages=',quotamsgs) AS userdb_quota_storage_size FROM users WHERE username = '%{ user | username | lower }' AND domain = '%{ user | domain | lower }' } ... quota_storage_size = 3G quota_message_count = 100000 ... ----- Do you have any idea of the problem? Best Regards, Alberto

2 3

Dovecot marking outgonig emails as unread
by stef204 03 Mar '26

03 Mar '26

Starting a few days ago, I have one email account where ALL outgoing emails are automatically marked as UNREAD. The message is sent, then copied to the "Sent" folder, and has status "unread". Then, a couple of minutes later, something happens where this message gets marked as UNREAD, without ANY interaction of client side. This occurs not matter the email client used, I have tried it with multiple email clients, both local and via web interface, the behavior does not change. This is via Dovevot on Cpanel. if I look at the [1]changelog, it is difficult to identify which changes could have triggered this as there seem to be changes impacting Dovecot almost with every update. I do not control the server myself, this is on a shared hosting plan; tech support has been willing to troubleshoot but is unable to locate the problem. This problem does NOT occur on other email accounts on the same domain, so it looks to me like some corruption or problem syncing flags perhaps? I am at a loss at the moment to fix this behavior. Any suggestions or ideas welcome. Thanks. References Visible links 1. https://docs.cpanel.net/changelogs/132-change-log/

3 5

[Pigeonhole] extracttext on "message/rfc822" attachment ignores included headers
by quentinduchemin＠tuta.io 03 Mar '26

03 Mar '26

Hi everyone! I'm not sure this is a design decision, a bug, something not implemented or malformed input on my side. My use case is the following: users that forward their mails outside the domain I manage have the option to report spam as attachment so the spam classifier can learn anyway. I prefer attachment over forward because MUAs have their own way to do it and it's difficult to reliably reconstruct some headers/email structure that can be important for the spam classifier. Each input message is processed through a Sieve extensions of RFC 5703 to extract the attachment. I ask user to produce a file with .eml extension through any export-like feature of their MUA. Below is an example EML file produced by Tuta (Thunderbird does a similar thing with a different encoding for the body). I'll use a bunch of = characters as a separator in the rest of this. =============================================== [...bunch of header...] X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-0000000000 00 X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYSPR04MB7035 Content-Type: multipart/related; boundary="------------79Bu5A16qPEYcVIZL@tutanota" --------------79Bu5A16qPEYcVIZL@tutanota Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 DQo8ZGl2IHN0eWxlPSJmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3 NfTVNGb250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6 [...base64 encoding of the body...] =============================================== While attached and sent, the received messaged looks like this: =============================================== [...headers of the actual email...] X-Infomaniak-Routing: alpha This is a multi-part message in MIME format. --------------5jyKrhQ08xXUif7LHhgg648N Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit --------------5jyKrhQ08xXUif7LHhgg648N Content-Type: message/rfc822; name="a.eml" Content-Disposition: attachment; filename="a.eml" Content-Transfer-Encoding: 7bit [...headers of the spam....] Subject: Re: //Re: AI + Ranking /// Thread-Topic: //Re: AI + Ranking /// [....] Content-Type: multipart/related; boundary="------------79Bu5A16qPEYcVIZL@tutanota" --------------79Bu5A16qPEYcVIZL@tutanota Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 DQo8ZGl2IHN0eWxlPSJmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3 NfTVNGb250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6 [...base64 encoding of the spam....] --------------79Bu5A16qPEYcVIZL@tutanota-- --------------5jyKrhQ08xXUif7LHhgg648N-- =============================================== I face two issues: 1. Only the base64 decoded string can be retrived through foreverypart/extracttext; 2. It has a lot of newlines. - 2. is not a big deal. The original spam has a lot of HTML junk, and each line with HTML without an inner text node is stripped, but the newline is kept. I don't know if this is intended. - 1. is more of a big deal. To try to confirm that, I made an over-simplified version of the Sieve script (I skip configuration but plugins are loaded etc, please ask if useful). =============================================== [...require...] foreverypart { extracttext "eml"; debug_log "PART ============================== ${eml}"; } =============================================== mail_debug is activated. In the logs, I can read: =============================================== Info: sieve: DEBUG: PART ============================== Info: sieve: DEBUG: PART ============================== Info: sieve: DEBUG: PART ============================== Info: sieve: DEBUG: PART ============================== Info: sieve: DEBUG: PART ============================== Info: sieve: Info: sieve: Info: sieve: Info: sieve: Info: sieve: Info: sieve: Info: sieve: Hello, Info: sieve: Info: sieve: Hope you're doing well. Info: sieve: Info: sieve: Info: sieve: Info: sieve: Info: sieve: Would you like attract more traffic with our AEO + GEO + SEO services. AI-driven search is here—don’t miss out. =============================================== So multiple parts are analyzed but only the last gives something. The RFC says that "If the transfer encoding or character set is unrecognized by the implementation or recognized but invalid, an empty string will result.". But it's over my knowledge. I activated trace for Sieve with "matching" level, and the file looks like (this is another test but was the same result): =============================================== Sieve trace log for message delivery: Username: REDACTED Session ID: ozNMOEPNl2nlAAAAO14Lzw Sender: REDACTED Final recipient: REDACTED Default mailbox: INBOX ## Started executing script 'move-spam' 33: foreverypart loop begin 33: loop ends at line 36 35: extracttext command 36: assign 'eml' [0] = "" 36: debug_log "PART ============================== " 36: foreverypart loop end 36: switched to next message part 36: looping back to line 35 35: extracttext command 36: assign 'eml' [0] = "" 36: debug_log "PART ============================== " 36: foreverypart loop end 36: switched to next message part 36: looping back to line 35 35: extracttext command 36: assign 'eml' [0] = "" 36: debug_log "PART ============================== " 36: foreverypart loop end 36: switched to next message part 36: looping back to line 35 35: extracttext command 36: assign 'eml' [0] = "" 36: debug_log "PART ============================== " 36: foreverypart loop end 36: switched to next message part 36: looping back to line 35 35: extracttext command 36: assign 'eml' [0] = "Hi, Just checking in to see if you had a chance to review my earlier message. [...body spam....] 36: debug_log "PART ============================== ????????????Hi, ?? ??Just checking in t..." 36: foreverypart loop end 36: no more message parts 36: exiting loops at line 36 ## Finished executing script 'move-spam' =============================================== Hypothesis: A. Could it be because the mail headers are indistinguishable from the part headers? B. Or is it related to Pigeonhole not implementing yet the enclose extension, which do this the other way? I hope this message is not too hard to read with all the code/logs. Please tell me if there is a better way of doing it. And thanks in advance for any help, because I don't really know what to do and trying to take a (superficial) look at the Pigeonhole code didn't helped.

1 2