April 2026 - dovecot - dovecot.org

Panic in logs
by Kamil Jońca 26 Apr '26

26 Apr '26

Recently I found in my lda logs: 2025-12-30T07:55:14.717927+01:00 alfa dovecot: lda(kjonca): Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 i_syslog_fatal_handler[0x7f99a2351430] -> #3 i_panic[0x7f99a226d453] -> #4 [unw_get_proc_name() failed: -10] -> #5 [unw_get_proc_name() failed: -10] -> #6 [unw_get_proc_name() failed: -10] -> #7 buffer_append[0x7f99a2345270] -> #8 dregex_code_match_groups[0x7f99a233f1a0] -> #9 [unw_get_proc_name() failed: -10] -> #10 [unw_get_proc_name() failed: -10] -> #11 sieve_match_value[0x7f99a117f770] -> #12 sieve_match[0x7f99a117fa30] -> #13 [unw_get_proc_name() failed: -10] -> #14 sieve_interpreter_continue[0x7f99a117e100] -> #15 sieve_multiscript_run[0x7f99a1190330] -> #16 [unw_get_proc_name() failed: -10] -> #17 mail_deliver[0x7f99a27e54a0] -> #18 main[0x55e371c555e0] -> #19 __libc_start_call_main[0x7f99a1e29f00] -> #20 __libc_start_main_alias_2[0x7f99a1e29fa0] -> #21 _start[0x55e371c566a0] And sadly it seems, that mail is missing (it was passed to pipe program to further processing) KJ -- http://wolnelektury.pl/wesprzyj/teraz/ When you go out to buy, don't show your silver.

4 6

Incorrect ARC signature on emails
by Lafiel Elentari 25 Apr '26

25 Apr '26

Hello. On the mail server, I configured addition of the `Authentication-Results` header with authentication check results. I noticed that emails from the dovecot.org server have an incorrect ARC signature: Authentication-Results: ...; dkim=pass header.d=dovecot.org header.s=... header.b=...; dkim=fail ("body hash did not verify") header.d=... header.s=... header.b=...; arc=reject ("signature check failed: fail, {[1] = sig:dovecot.org:reject}"); spf=pass (...: domain of "dovecot-bounces+...=...(a)dovecot.org" designates ... as permitted sender) smtp.mailfrom="dovecot-bounces+...=...(a)dovecot.org"; dmarc=pass (policy=reject) header.from=dovecot.org ``` -- Best regards, Lafiel Elentari mailto:lafiel@elven.pw

2 2

mbox to maildir migration, same server?
by kjohnson＠eclypse.org 25 Apr '26

25 Apr '26

What is the recommended procedure to migrate from mbox to maildir on a server already running dovecot? Ideally, this procedure would convert messages in an existing mbox INBOX and in ~/mail mboxes (as defined in my dovecot configuration) to storage in a ~/Maildir. Some of the INBOXs are rather large -- 100's of MB (one of the reasons for migrating). What I have tried has not worked for me. Below, I describe what I tried, how I tested before I tried, what went wrong, and the current setup (pre-migration). What I tried: ============= stop exim4 service dovecot stop Make dovecot listen only locally, not to external connections. /etc/dovecot/local.conf protocol imap { listen = 127.0.0.1:143 ssl_listen = 127.0.0.1:993 } protocol pop3 { listen = 127.0.0.1:110 ssl_listen = 127.0.0.1:995 } Modify dovecot configuration for maildir: Watch capitalization! #in 10-mail.conf: mail_location = maildir:/home/%u/Maildir namespace inbox { separator = / } dovecot -n, to confirm results and perform limited syntax checking. service dovecot start for each user, in a bash script: dsync -v -u "$U" mirror "mbox:/home/$U/mail:INBOX=/var/mail/$U" (if the conversion worked for all users, then reconfigure exim to use maildir and restart it; reconfigure dovecot to listen to external interfaces and restart.) How I tested: ============= Before trying this on the real server, I set up a matching (same versions of Debian, Exim, and Dovecot) VM using mbox, with a couple of accounts. One using POP3, one using IMAP. The IMAP account was accessed from Claws and from Outlook. The test accounts had perhaps a dozen messages on the server. I tried the conversion procedure, and everything I tried worked flawlessly. (Yes, next time I will move some real inbox files from the live server). What went wrong: ================ I encountered two types of problems here. The first was several dsync warnings (username changed): dsync(example): Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID 21bfa11a81f11763ac150000d09efc50 (maybe it was just deleted?) As I understand it, this can result in some or all messages being downloaded again by clients. My understanding may be wrong. I also don't understand how the mailbox could have changed -- exim4 was stopped, dovecot is only listening on 127.0.0.1, and I am the only user who uses a local mail client on that system, and this was not my account. The second problem I encountered seems to match Debian Bug report logs - #1011238. In part of the discussion of that report, the reporter mentions adding -1 to the command, as shown: dsync -v -u "$U" mirror -1 "mbox:/home/$U/mail:INBOX=/var/mail/$U" While this seemed to eliminate the dsync panic of #1011238, as far as I can tell, no old messages were actually moved from the old mbox files to the new maildirs. At that point I restored the backup mbox files and undid the changes to dovecot and exim4. Current setup: ============== Debian 11.4 Exim 4.94.2-7 dovecot 1:2.3.13+dfsg1-2 The current setup with Dovecot was a successful migration from IMAP-UW in December 2020. Output from dovecot -n (the list of trusted networks has been removed) # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-16-686-pae i686 Debian 11.4 # Hostname: localhost auth_verbose = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } pop3_uidl_format = %08Xv%08Xu protocols = " imap pop3" ssl_cert = </etc/dovecot/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } Thank you to anyone who read this far. Ken

5 5

Is this a bug of `doveadm mailbox metadata set` with `-A` and `-s ""`
by Zhang Huangbin 24 Apr '26

24 Apr '26

Dear all, Recently i encountered an issue with `doveadm mailbox metadata set` (and `unset`) with either `-A` or `-F <path>`. When i run `doveadm mailbox metadata set` for single user, it correctly generates content in `dovecot-attributes` file: ``` doveadm mailbox metadata set -u <email> -s "" "/private/vendor/vendor.dovecot/http-notify" "user=all" ``` But if i run with `-A`, or `-F <path>`, Dovecot generates incorrect "path" and unreadable characters in `dovecot-attributes` file: ``` # doveadm mailbox metadata set -A -s "" "/private/vendor/vendor.dovecot/http-notify" "user=all" # for i in $(find . -name 'dovecot-attributes'); do echo $i; cat $i; done priv/4898662293abe1690d9a000063130d18/vendor/vendor.dovecot/pvt/server/?????? user=all priv/90e7b40fc8c1e9690924000063130d18/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify user=all priv/60ba353790c1e969f923000063130d18/vendor/vendor.dovecot/pvt/server/endor.dovecot/pvt/server/CV?? user=all ``` It's ok if i specify the mailbox in -s, for example: `-s "INBOX"`, `-s "Sent"`, but it's not what i want, because only emails delivered to specified mailbox will be pushed. Is this a bug?

1 1

[Bug Report] anvil panic: anvil-connection.c:727: unreached triggered by duplicate imap-login handshake with pid=-1
by Jeff Aitken 24 Apr '26

24 Apr '26

Environment: FreeBSD 14.4-RELEASE Dovecot 2.4.3 (e278b1e09b) Pigeonhole 2.4.3 (0bf9ee48) Postfix 3.11.1, rspamd 4.0.0 Description: The dovecot anvil process is crashing repeatedly with a panic in anvil-connection.c at line 727. The panic is triggered by i_unreached() in anvil_connection_destroy(). Total of ~18 crashes in the last 24 hours, happens to multiple users. The anvil process restarts successfully and works as expected other than the crashes. No other symptoms that I can see that appear related. Log messages: dovecot[87542]: anvil: Panic: file anvil-connection.c: line 727: unreached dovecot[87542]: anvil: Fatal: master: service(anvil): child 88408 killed with signal 6 (core not dumped) dovecot[87542]: anvil: Error: connect limit: disconnection for unknown (pid=88756, user=<username>, service=imap, ip=X.X.X.X, ...) dovecot[87542]: anvil: Warning: conn unix:anvil (uid=0): Handshake with duplicate service=imap-login pid=-1 - replacing the old connection Analysis (from claude): In anvil_connection_destroy(), when conn->added_to_hash is true, the code asserts that the connection must still be present in anvil_connections_hash. However, when a duplicate handshake is received for the same (service, pid) key, the old connection appears to be evicted from the hash table without clearing its added_to_hash flag. When the old connection is subsequently destroyed, hash_table_lookup_full() fails to find it, triggering i_unreached(). The pid=-1 in the duplicate handshake warning is also notable — this does not appear to be a valid process ID and may indicate that the handshake is being sent before the imap-login process has fully initialized. Workaround: Setting service_restart_request_count = unlimited and service_process_min_avail = 2 on the imap-login service seems to have reduces process turnover and appears to have reduced the frequency of the crash, but I’ve only got a couple of hours since that change so too early to say for sure. Suggested fix: When a duplicate handshake causes an existing connection to be evicted from anvil_connections_hash, the evicted connection's added_to_hash flag should be cleared to prevent the assertion failure in anvil_connection_destroy(). Appreciate any insight, and happy to provide additional info that would be helpful. —Jeff

1 0

Unable to get Dovecot 2.4 to allow unencrypted connection
by David Koski 24 Apr '26

24 Apr '26

Hello, In spite of: ssl = no auth_allow_cleartext = yes ..in a telnet session, I get: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS LOGINDISABLED AUTH=GSSAPI AUTH=CRAM-MD5] Dovecot (Debian) ready. a1 login ln(a)zample.com <super-secret> * BAD [ALERT] Plaintext authentication not allowed without SSL/TLS, but your client did it anyway. If anyone was listening, the password was exposed. a1 NO [PRIVACYREQUIRED] Plaintext authentication disallowed on non-secure (SSL/TLS) connections. I need to see the network traffic to troubleshoot the way Outlook 2019 handles IMAP folders. Regards, David Koski dkoski(a)sutinen.com

3 9

Re: large mbox files
by Joseph Tam 23 Apr '26

23 Apr '26

On Wed, 22 Apr 2026, Marc wrote: > How are messages deleted from large mbox files, are these files > completely rewritten? I can't really believe that as some are bigger > than the free disk space available. I think it's a little better than that: bytes are shuffled up to fill the deleted message hole. I gather this from noting the difference in operation time from deleting a message from the top vs bottom of a large mailbox. Joseph Tam <jtam.home(a)gmail.com>

1 0

large mbox files
by Marc 23 Apr '26

23 Apr '26

How are messages deleted from large mbox files, are these files completely rewritten? I can't really believe that as some are bigger than the free disk space available.

2 1

doveadm expunge silently ignores multiple -u flags instead of erroring or processing all users
by Robert Kretowicz 21 Apr '26

21 Apr '26

Hello, I would like to report what I believe is a bug in doveadm expunge argument handling. Summary When multiple -u flags are passed to doveadm expunge, for example: doveadm expunge -u user1 -u user2 -u user3 mailbox '*' BEFORE 2015-01-01 the command exits with code 0 (success) but only processes one of the specified users. The remaining users are silently skipped with no warning or error message produced. Why this is a bug This is a silent failure on a destructive, irreversible operation. An administrator has no indication that most users were not processed. Good CLI tools should either: Accept multiple -u flags and process all specified users (consistent with how -F file works), or Reject the command immediately with a clear error such as: Error: -u flag specified multiple times. Use -F <file> for multiple users. Silently accepting invalid input and doing something unpredictable is the worst possible outcome, especially for a mail expunge operation. Environment OS: Debian GNU/Linux 12 (Bookworm) Dovecot version: 2.3.x (from Debian package) doveconf -n output available on request — omitted due to containing internal domain names. Workaround I am currently using bashfor user in user1 user2 user3; do doveadm expunge -u "$user" mailbox '*' BEFORE 2015-01-01 done Thank you for your time. Robert Kretowicz

2 1

Master user login attempted without master passdbs
by horst.simon.aus＠gmail.com 21 Apr '26

21 Apr '26

Hi, I have dovecot version v2.3.21.1 and my users (username(a)domain.name) are in mysql, all can logon to imap and sending mail, but when I am trying to create and enable sieve scripts from an weblient (horde webmail) it fails with authentication errors. It tries to use master user authentication and the logs are showing following: A pr 15 10:34:51 auth: Debug: client in: AUTH 1 PLAIN service=sieve secured session=yTdN4nRPFcF/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=4190 rport=49429 resp=aG9yc3QAaG9yc3RAaGJzaW1vbi5uZXQAYXVnQDYmOXVzdA== (previous base64 data may contain sensitive data) Apr 15 10:34:51 auth: Info: plain(horst(a)hbsimon.net,127.0.0.1,<yTdN4nRPFcF/AAAB>): login user: Master user login attempted without master passdbs Apr 15 10:34:51 auth: Debug: auth(horst(a)hbsimon.net,127.0.0.1,<yTdN4nRPFcF/AAAB>): Auth request finished Apr 15 10:34:51 auth: Debug: auth client connected (pid=1478) Apr 15 10:34:53 auth: Debug: client passdb out: FAIL 1 user=horst(a)hbsimon.net Apr 15 10:34:53 managesieve-login: Info: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<horst(a)hbsimon.net>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<yTdN4nRPFcF/AAAB> Apr 15 10:35:06 auth: Debug: client in: AUTH 1 PLAIN service=sieve secured session=VEgr43RPGMF/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=4190 rport=49432 resp=aG9yc3QAaG9yc3RAaGJzaW1vbi5uZXQAYXVnQDYmOXVzdA== (previous base64 data may contain sensitive data) Apr 15 10:35:06 auth: Info: plain(horst(a)hbsimon.net,127.0.0.1,<VEgr43RPGMF/AAAB>): login user: Master user login attempted without master passdbs Apr 15 10:35:06 auth: Debug: auth(horst(a)hbsimon.net,127.0.0.1,<VEgr43RPGMF/AAAB>): Auth request finished Apr 15 10:35:06 auth: Debug: auth client connected (pid=1484) Apr 15 10:35:08 auth: Debug: client passdb out: FAIL 1 user=horst(a)hbsimon.net Apr 15 10:35:08 managesieve-login: Info: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<horst(a)hbsimon.net>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<VEgr43RPGMF/AAAB> How can I bypass the master user login and use the assigned user or what should the master user be and how to create it? Thanks and Regards, Horst

4 7