April 2026 - dovecot - dovecot.org

decode2text
by Joan Moreau 13 Apr '26

13 Apr '26

Hi I can't find decode2text.sh in the git Where is it maintained ? Thank you Joan Hi I can't find decode2text.sh in the git Where is it maintained ? Thank you Joan

2 3

Fwd: [EXT] In Yocto-Mailinglist, there were two version of dovecot 2.4.3 found?
by Martin Maurer 10 Apr '26

10 Apr '26

Hello, resent to get clarification, about different content of 2.4.3 release tar file Best regards, Martin -------- Weitergeleitete Nachricht -------- Betreff: Re: [EXT] In Yocto-Mailinglist, there were two version of dovecot 2.4.3 found? Datum: Fri, 10 Apr 2026 14:37:36 +0300 (EEST) Von: Aki Tuomi <aki.tuomi(a)open-xchange.com> An: Martin Maurer <martin.maurer(a)mmeacs.de> Kopie (CC): dovecot-owner(a)dovecot.org <dovecot-owner(a)dovecot.org> Please send mails to dovecot(a)dovecot.org, which is our public mailing list. Aki > On 10/04/2026 14:18 EEST Martin Maurer <martin.maurer(a)mmeacs.de> wrote: > > Hi, > > in Yocto mailing list there was found out, that two different version > of dovecot 2.4.3 seems to exist: > > > https://github.com/dovecot/core/releases/download/2.4.3/dovecot-2.4.3.tar.gz > > > sha256:e0b30330fe51e47ecfcf641bc16041184d91bdd0ac3db789b7cef54e3a75ac9b > > > https://dovecot.org/releases/2.4/dovecot-2.4.3.tar.gz > > SHA256: ff0be85228122f250627b19e67505fdb7fb2f72a702ef6bf35f27fce54c072e5 > > > When downloading both and comparing them: > > The doc/man directory seem to be different. > > When I had looked correctly, all others files seems to be identical. > > > Can you explain, what could have happened? > > In Yocto the SHA256 checksum is checked, and this seems to fail, when > the one or the other download place is used. > > Is this as planned or had an error happened? > > > Many thanks for the clarification! > > > Best regards, > > Martin Hello, resent to get clarification, about different content of 2.4.3 release tar file Best regards, Martin -------- Weitergeleitete Nachricht -------- Betreff: Re: [EXT] In Yocto-Mailinglist, there were two version of dovecot 2.4.3 found? Datum: Fri, 10 Apr 2026 14:37:36 +0300 (EEST) Von: Aki Tuomi [1]<aki.tuomi(a)open-xchange.com> An: Martin Maurer [2]<martin.maurer(a)mmeacs.de> Kopie (CC): [3]dovecot-owner(a)dovecot.org [4]<dovecot-owner(a)dovecot.org> Please send mails to [5]dovecot(a)dovecot.org, which is our public mailing list. Aki On 10/04/2026 14:18 EEST Martin Maurer [6]<martin.maurer(a)mmeacs.de> wrote: Hi, in Yocto mailing list there was found out, that two different version of dovecot 2.4.3 seems to exist: [7]https://github.com/dovecot/core/releases/download/2.4.3/dovecot-2.4.3.tar… sha256:e0b30330fe51e47ecfcf641bc16041184d91bdd0ac3db789b7cef54e3a75ac9b [8]https://dovecot.org/releases/2.4/dovecot-2.4.3.tar.gz SHA256: ff0be85228122f250627b19e67505fdb7fb2f72a702ef6bf35f27fce54c072e5 When downloading both and comparing them: The doc/man directory seem to be different. When I had looked correctly, all others files seems to be identical. Can you explain, what could have happened? In Yocto the SHA256 checksum is checked, and this seems to fail, when the one or the other download place is used. Is this as planned or had an error happened? Many thanks for the clarification! Best regards, Martin References Visible links 1. mailto:aki.tuomi@open-xchange.com 2. mailto:martin.maurer@mmeacs.de 3. mailto:dovecot-owner@dovecot.org 4. mailto:dovecot-owner@dovecot.org 5. mailto:dovecot@dovecot.org 6. mailto:martin.maurer@mmeacs.de 7. https://github.com/dovecot/core/releases/download/2.4.3/dovecot-2.4.3.tar.gz 8. https://dovecot.org/releases/2.4/dovecot-2.4.3.tar.gz

1 0

Source tarballs for dovecot 2.4.3 republished
by Aki Tuomi 10 Apr '26

10 Apr '26

Hi! We have republished the source tarballs for 2.4.3 due to missing man pages in the tarball. Regards, AKi

1 0

Dovecot Proxy with mysql passdb and oauth2 authentication: upgrade from 2.3.21 to 2.4.3 does not work
by Urban Loesch 07 Apr '26

07 Apr '26

Hi, I am running a Dovecot IMAP/POP3 proxy in my test environment using the latest version, 2.3.21, installed from the Dovecot repository. It functions as a pure IMAP/POP3 proxy for 7 different IMAP backends (currently always Dovecot 2.3.21). The proxy retrieves all its information from a MySQL database mainly the ip-address to which backend he should pass the connection and forwards all authentication information to the backend. This has always worked without any issues so far. Now I'm trying to upgrade the proxy from 2.3.21 to 2.4.3. I tried to convert my 2.3.21 configuration to 2.4.3 with your very helpfull tool from https://dovecot.org/upgrader/. But now when I try to start dovecot I get the followong error in my logs: ... 2026-04-07T12:00:57.692994+02:00 imap-dev dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth 2026-04-07T12:00:57.695908+02:00 imap-dev dovecot: auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_mysql.so 2026-04-07T12:00:57.696532+02:00 imap-dev dovecot: auth: Fatal: Cannot initialize oauth2: Missing oauth2_introspection_mode setting 2026-04-07T12:00:57.697569+02:00 imap-dev dovecot: master: Error: service(auth): command startup failed, throttling for 4.000 secs ... As I just said, the server only works as a proxy (no mailboxes hosted on itself, etc). Have you any idea how I can solve this issues? Below my current .deb packages installed and "doveconf -n" from 2.4.3. Many thanks in advance Urban ----------------------- # dpkg -l |grep dovecot ii dovecot-core 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - core files ii dovecot-imapd 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-ldap 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - LDAP support ii dovecot-lmtpd 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - LMTP server ii dovecot-managesieved 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - ManageSieve server ii dovecot-mysql 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - MySQL support ii dovecot-pop3d 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - POP3 daemon ii dovecot-sieve 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - Sieve filters support ------------------------ # 2.4.3-1+debian12 (c1b22ef978): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.3-1+debian12 (99939e07) # OS: Linux 6.1.0-31-amd64 x86_64 Debian 12.13 # Hostname: imap-dev.domain.com dovecot_config_version = 2.4.3 auth_cache_negative_ttl = 0 auth_cache_size = 128 M auth_cache_ttl = 0 auth_debug = yes auth_debug_passwords = yes auth_failure_delay = 5 secs auth_mechanisms = plain login oauthbearer xoauth2 auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_%@ auth_username_translation = %@ dovecot_storage_version = 2.4.0 login_log_format_elements = user=<%{user}> method=%{mechanism} rip=%{remote_ip} lip=%{local_ip} mpid=%{mail_pid} %{secured} %{ssl_security} managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext protocols = imap sieve sql_driver = mysql ssl_min_protocol = TLSv1 verbose_proctitle = yes namespace inbox { inbox = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } mailbox Trash { special_use = "\\Trash" } } passdb sql { default_password_scheme = PLAIN query = SELECT NULL AS password, 'y' AS nodb, SUBSTRING_INDEX(SUBSTRING_INDEX(param, '[', -1), ']', 1) AS host, '%{user}' AS destuser, 'Y' AS nologin, 'Y' AS nopassword, 'Y' AS proxy, '%{mechanism}' AS proxy_mech FROM mail_username WHERE user = '%{user}' AND allow_login = 'y' AND ('%{protocol}' = 'imap' OR '%{protocol}' = 'sieve'); } mysql devdb1.domain.com { dbname = mailconfig_dev password = # hidden, use -P to show it user = imap-dev } sieve_script personal { driver = file path = ~/sieve } service imap-login { process_min_avail = 2 restart_request_count = unlimited vsz_limit = 512 M } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { process_min_avail = 2 restart_request_count = unlimited vsz_limit = 256 M } service tcpwrap { unix_listener login/tcpwrap { group = $SET:default_login_user mode = 0600 user = $SET:default_login_user } } ssl_server { cert_file = /etc/letsencrypt/live/domain.com/fullchain.pem dh_file = /etc/dovecot/dh.pem key_file = /etc/letsencrypt/live/domain.com/privkey.pem prefer_ciphers = server } protocol imap { imap_capability = IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE login_greeting = Domain-Dev IMAP Server ready. } protocol pop3 { login_greeting = Domain-Dev POP3 Server ready. pop3_enable_last = yes pop3_uidl_format = %{uid | substr(0, 8)}%{uidvalidity | substr(0, 8)} }

1 0

Dovecot and Pigeonhole v2.4.3 released
by Aki Tuomi 07 Apr '26

07 Apr '26

Hi! We are happy to publish version 2.4.3 of Dovecot and Pigeonhole. These contain several CVEs, discovered by external researches. The majority of these have been discovered with help of automated code analysis tools like claude code security, which is why some of these are rather old, missed bugs. No new supported distros have been added or old removed, no new dependencies have been added. Note that there are experimental features in 2.4, one is enabled with `--enable-experimental-mail-utf8`, and another with `--enable-experimental-imap4rev2`, and you also need to set mail_utf8_extensions=yes and imap4rev2_enabled=yes to enable them in config. https://dovecot.org/releases/2.4/dovecot-2.4.3.tar.gz https://dovecot.org/releases/2.4/dovecot-2.4.3.tar.gz.sig https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.3.tar.gz https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.3.tar.gz… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot --- * CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins. * CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing. Fixed by dropping the script. * CVE-2026-24031: SQL injection possible if auth_username_chars is configured empty. Fixed escaping to always happen. v2.4 regression. * CVE-2026-27859: Excessive RFC 2231 MIME parameters in email would cause excessive CPU usage. Fixed by limiting number of parameters to process. * CVE-2026-27860: LDAP query injection possible if auth_username_chars is configured empty. Fixed escaping to always happen. v2.4 regression. * CVE-2026-27857: Sending excessive parenthesis causes imap-login to use excessive memory. * CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function. * CVE-2026-27855: OTP driver vulnerable to replay attack. * Remove default service/*/service_extra_groups=$SET:default_internal_group. They are now replaced by default mail_access_groups=$SET:default_internal_group. * The version file has been renamed as version.txt to avoid clash with C++ headers. * auth: oauth2 - Do not export token automatically, must be exported using fields. * config: Don't accept 0 as meaning unlimited anymore for last_valid_uid, last_valid_gid, mail_cache_max_headers_count, mail_cache_max_header_name_length, mail_vsize_bg_after_count, mail_sort_max_read_count, message_max_size, submission_max_recipients and quota_mail_size. * imap, pop3: Don't autoexpunge if Dovecot is shutting down or process is killed. * imap: LIST - Handle invalid mUTF-7 mailbox names as never matching anything * lazy-expunge: Change lazy_expunge_only_last_instance default to yes. * lda: Use EX_TEMPFAIL (75) if configuration is invalid instead of 89. v2.4 regression. * lib-master: Increase ANVIL_DEFAULT_LOOKUP_TIMEOUT_MSECS from 5s to 30s * lib: crc32 - Use zlib's built-in CRC32 function + Improve UTF-8 support for mail storage. + auth: Add default auth-token UNIX socket for token-based authentication. + doc: solr-config-9.xml - Make it compatible with Solr 9.8.0 + doveadm: dsync - Search mails when exporting to reduce number of mails exported by dsync-server. + dovecot-sysreport: Add -D|--destdir support. + imap, imap-hibernate: Use DOVECOT-TOKEN authentication for unhibernation. Default imap-master socket permissioms have been changed due to this. + imap: Add APPENDLIMIT capability when configured with quota_mail_size. + imap: Support STATUS (DELETED) for IMAP4rev2. + imapc: Add support for SEARCH MIMEPART + imapc: Improve error forwarding. + imapc: Support SORT and ESORT extensions. + imapc: Support STATUS (DELETED) for IMAP4rev2. + lib-sql: Support parameterized queries. + lib-test: Add new test-dir API for better temporary test directory handling. + lmtp: Advertize SIZE capability when configured with quota_mail_size. + lmtp: Support XCLIENT DESTADDR and DESTPORT + pop3-login: proxy - Add support for XCLIENT DESTIP and DESTPORT + submission-login: proxy - Add support for XCLIENT DESTIP and DESTPORT + Various optimizations have been made to the code. - Fix building dovecot with BSD, Solaris and macOS. - auth: Crash would occur if users were iterated but userdb_ldap_iterate_fields was not set. - auth: Fix request leak when client authenticates with unsupported mechanism. - auth: Some passdbs would default to PLAIN instead of CRYPT scheme. - config: Section and setting names could have been intermixed, resulting in the setting being silently ignored. - configure: Fix checking if BUILD_IMAP_HIBERNATE is set - doveadm: dsync - -e parameter was handled wrong with dsync-server. - fts-flatcurve: Mailbox leak would occur if mailbox failed to open. - imap: Fix potential issues with unhibernation and process state handling. - imapc: SEARCH failure handling was done wrong. - imapc: UID STORE commands included extra comma in uidset. - lib-auth-client: auth-master - Fix panic when reconnecting after handshake timeout. - lib-compression: Lz4 algorithm would assert-crash with malicious data. - lib-dcrypt: Fix digest algorithm handling. - lib-dict: Escape username paths to prevent traversal issues with dict-fs. - lib-http: Fix HTTP parsing edge cases and state handling. - lib-iostream: Disallow empty ssl_min_protocol. - lib-json: Fix incorrect character handling logic. - lib-ldap: Fix various TLS related bugs. - lib-mail: Fix charset translation and MIME parsing edge cases. - lib-mail: Fix multiple bounds checks and parsing issues in message handling. - lib-var-expand: Multiple fixes and improvements for expansion handling. - lib: Fix punycode decoding out-of-bounds reads. - lib: Fix unicode normalization edge cases causing crashes. - lib-http: Chunked transfer trailer size was not limited. - login-common: Improve logging and internal error handling. - login-common: login_log_format_elements was split by spaces naively, which could break variable expansion. Use template aware splitting now. - master: Dovecot would fail to start if listen directive was used and dovenull or dovecot user was missing. - pop3c: Connection might've hung with SSL. - util: Fix handling of environment variables containing control characters. - Many other bugs have been fixed. --- * CVE-2026-27858: managesieve-login can allocate large amount of memory during authentication. * CVE-2025-59032: ManageSieve panic occurs with sieve-connect as a client. * lib-sieve: Don't accept 0 as meaning unlimited anymore for sieve_quota_script_count and sieve_quota_storage_size. * managesieve-login: If mail_max_userip_connections is reached, return LIMIT/CONNECTIONS resp-code. * managesieve-login: proxy - Return unexpected backend failures as TRYLATER/NORETRY resp-code. * managesieve: Remove default service_extra_groups=$SET:default_internal_group. + managesieve-login: proxy - Add support for XCLIENT DESTIP and DESTPORT. - imapsieve: Fix panic occurring upon implicit flag changes. - lib-sieve: include-extension - Fix crash occurring when previous global command has no arguments. - lib-sieve: Fix erroneous attempt to read active script for non-personal storage. - lib-sieve: ldap: Fix linking non-shared LIBDOVECOT.

8 11

Bug report: filter `default` in LDAP context does not suppress error logging
by Johannes Nohl 07 Apr '26

07 Apr '26

Bug report: Expanding variables with filter `default` in LDAP context does not suppress error logging if LDAP attribute is missing. Expected behaviour: Missing LDAP attribute does not throw an error. Example `nologin = %{ldap:missingAttribute | default}` Details: Please note: The missing attribute is called `shadowInactive` in reality. There might be another issue, the field nologin is boolean and set true if any value is assigned -- while default without parameter returns empty (thus, you cannot use default with nologin without workaround). The intended behaviour is documented clearly, however due to a bug in rendering you need to look into the doc sources (my PR for that was accepted already: https://doc.dovecot.org/2.4.2/core/config/auth/databases/ldap.html#ldap-spe… https://github.com/dovecot/documentation/pull/1478#pullrequestreview-403461… Full context: passdb ldap { driver = ldap ldap_filter = (&(objectClass=posixAccount)(mail=%{user})) fields { user = %{ldap:uid} nologin = %{ldap:shadowInactive | default} reason = The account for this email address is disabled. } } The same error was reported already a year ago, although among others, see point 4: https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/TLJ2O… Please excuse my first attempt of 31-03-2026. It was unreadable. Aki already tried to help but was - I guess - distracted from the main point. I found a workaround for the missing attribute translation to boolean fields (if someone is interested) https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/67Z4C… I tested with dovecot 2.4.2 and 2.4.3 (openSUSE repos) against local LDAP. The check for disabled users throws permanently errors in the log file, whenever the user is missing the ldap attribute for disabled. Thus, for each login of all enabled users (you will probably agree that this not acceptable). This results in the following log line: 2026-03-31T00:46:31.102690+02:00 mailserver dovecot: auth(test,ipv4,sasl:plain)<YE81n0VOVuofEeSD>: Error: ldap: auth_passdb_post settings: Failed to parse configuration: Failed to expand passdb_fields/nologin setting variables: ldap: No such attribute 'shadowinactive' Thank you Johannes -- Johannes Nohl postmaster(a)i-t-cloud.de

2 3

[Dovecot] migration from IMAP/POP3 courier server to a remote dovecot server
by nik600 06 Apr '26

06 Apr '26

Dear all i'm planning a transparent migration from a courier server that provides both IMAP and POP3 access to users to a remote dovecot server with both IMAP and POP3 access. I have to migrate about 2500 users for 250 GB of space. I'm using dovecot 2.2.5.4 on debian6 squeeze. To make a transparent migration i have to maintain old IMAP UIDs and POP3 UIDs, so i've read http://wiki2.dovecot.org/Migration and http://wiki2.dovecot.org/Migration/Courier and http://wiki2.dovecot.org/Migration/Dsync And decided that probably the best tool to use is Dsync, as the courier-dovecot-migrate.pl<http://www.dovecot.org/tools/courier-dovecot-migrate.pl> script works only locally. I've tested the dsync following instructions reported above but after the migration of one test-account the client re-download messages. If i want to keep both IMAP UIDs and POP3 UIDs i have to sync both imapc and pop3c with two commands? doveadm -o imapc_user=foo -o pop3c_user=foo -o imapc_password=bar -o pop3c_password=bar backup -R -u user@domain imapc: doveadm -o imapc_user=foo -o pop3c_user=foo -o imapc_password=bar -o pop3c_password=bar backup -R -u user@domain pop3c: Or imapc is enough? Do you have any suggestion? Thanks -- /*************/ nik600 http://www.kumbe.it

2 3

oath-toolkit pam authentication with dovecot
by "Tóth Attila" 04 Apr '26

04 Apr '26

Anybody has experience in deploying oath-toolkit totp authentication for dovecot? It works for ssh in a challenge response fashion, but I have concernes against concatenating the password with the totp digits, because I have difficulties even with su+oath_toolkit... Thx: Dw. -- dr Tóth Attila, Radiológus, 06-20-825-8057 Attila Toth MD, Radiologist, +36-20-825-8057

2 1

enabling fts_flatcurve on debian
by Stefan G. Weichinger 03 Apr '26

03 Apr '26

Which xapian-related packages do I need? I have issues enabling the plugin ... pls advise

2 6

2.4 upgrade : INBOX does not exist
by Stefan G. Weichinger 02 Apr '26

02 Apr '26

Today I upgraded a server at a customer. I modified the config I had built over the last week, with the help of this list. So far nearly everything works, but thunderbird complains about non-existing mailboxes like INBOX. But we can access it, it's a bit strange. In the filesystem it looks like: # ls -la /home/vmail/our.tld/user\(a)our.tld/ insgesamt 7096 drwx------ 69 vmail vmail 4096 2. Apr 19:00 . drwx------ 129 vmail vmail 12288 2. Apr 18:56 .. drwx------ 5 vmail vmail 4096 8. Jun 2021 .Administrator drwx------ 5 vmail vmail 4096 2. Apr 18:40 .Administrator.Archiv drwx------ 5 vmail vmail 4096 2. Apr 18:40 '.Administrator.Domainwechsel AquaCC' drwx------ 5 vmail vmail 4096 11. Mai 2025 .Archives drwx------ 5 vmail vmail 4096 2. Apr 18:40 .Archives.2001 drwx------ 5 vmail vmail 4096 2. Apr 18:40 .Archives.2002 drwx------ 5 vmail vmail 4096 2. Apr 18:40 .Archives.2003 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2004 drwx------ 5 vmail vmail 4096 2. Apr 18:40 .Archives.2005 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2006 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2007 drwx------ 5 vmail vmail 4096 10. Feb 18:17 .Archives.2008 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2009 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2010 drwx------ 5 vmail vmail 4096 10. Feb 18:10 .Archives.2011 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2012 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2013 drwx------ 5 vmail vmail 4096 10. Feb 18:09 .Archives.2014 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2015 drwx------ 5 vmail vmail 4096 2. Apr 17:51 .Archives.2016 drwx------ 5 vmail vmail 4096 11. Feb 11:57 .Archives.2017 drwx------ 5 vmail vmail 4096 10. Jun 2025 .Archives.2018 drwx------ 5 vmail vmail 4096 11. Feb 11:57 .Archives.2019 drwx------ 5 vmail vmail 4096 10. Feb 18:23 .Archives.2020 drwx------ 5 vmail vmail 4096 1. Apr 20:18 .Archives.2021 drwx------ 5 vmail vmail 4096 30. Mär 09:37 .Archives.2022 drwx------ 5 vmail vmail 4096 1. Apr 20:18 .Archives.2023 drwx------ 5 vmail vmail 4096 1. Apr 20:18 .Archives.2024 drwx------ 5 vmail vmail 4096 2. Apr 17:48 .Archives.2025 drwx------ 5 vmail vmail 4096 2. Apr 17:59 .Archives.2026 drwx------ 2 vmail vmail 323584 2. Apr 19:00 cur -rw------- 1 vmail vmail 0 2. Aug 2021 dovecot-acl-list -rw------- 1 vmail vmail 70712 2. Apr 18:37 dovecot.index -rw------- 1 vmail vmail 6266860 2. Apr 19:01 dovecot.index.cache -rw------- 1 vmail vmail 32160 2. Apr 19:00 dovecot.index.log -rw------- 1 vmail vmail 46940 2. Apr 06:20 dovecot.index.log.2 -rw------- 1 vmail vmail 91 18. Aug 2020 dovecot-keywords -rw------- 1 vmail vmail 65 2. Apr 18:37 .dovecot.lda-dupes drwx------ 5 vmail vmail 4096 2. Apr 18:37 .dovecot.lda-dupes.locks -rw------- 1 vmail vmail 6504 2. Apr 18:49 dovecot.list.index -rw------- 1 vmail vmail 3356 2. Apr 19:02 dovecot.list.index.log -rw------- 1 vmail vmail 2904 7. Jän 13:53 dovecot.mailbox.log -rw------- 1 vmail vmail 186894 2. Apr 18:59 dovecot-uidlist -rw------- 1 vmail vmail 8 7. Jän 13:53 dovecot-uidvalidity -r--r--r-- 1 vmail vmail 0 21. Apr 2020 dovecot-uidvalidity.5e9efc52 drwx------ 5 vmail vmail 4096 2. Apr 12:02 .Drafts drwx------ 5 vmail vmail 4096 12. Jun 2025 '.Entw&APw-rfe' drwx------ 5 vmail vmail 4096 6. Mai 2020 .Gesendet drwx------ 5 vmail vmail 4096 2. Apr 18:22 .INBOX.Administrator drwx------ 5 vmail vmail 4096 2. Apr 18:21 .INBOX.Alerts [..] We have mail_home = /home/vmail/%{user | domain}/%{user} I tried mail_home = /home/vmail/%{user | domain}/%{user | username} but that breaks things completely. In 2.3 we had these namespaces: namespace { type = private separator = / prefix = #location defaults to mail_location. inbox = yes } namespace { type = public separator = / prefix = Oeffentlich/ location = maildir:/home/vmail/oeffentlich subscriptions = yes } I tried "prefix = INBOX/" ... not good. I share the config, a little bit anonymized, acls removed ... # doveconf -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.74+deb13+1-amd64 x86_64 Debian 13.4 # Hostname: xxxx dovecot_config_version = 2.4.1 auth_allow_weak_schemes = yes auth_cache_size = 4M auth_debug = yes auth_mechanisms = plain login auth_verbose = yes default_process_limit = 300 dovecot_storage_version = 2.4.0 import_environment { CORE_ERROR = %{env:CORE_ERROR} CORE_OUTOFMEM = %{env:CORE_OUTOFMEM} LISTEN_FDS = %{env:LISTEN_FDS} LISTEN_PID = %{env:LISTEN_PID} MALLOC_MMAP_THRESHOLD_ = 131072 NOTIFY_SOCKET = %{env:NOTIFY_SOCKET} PATH = %{env:PATH} TZ = :/etc/localtime } info_log_path = /var/log/dovecot.info listen = * [::] log_path = /var/log/dovecot.log mail_debug = yes mail_driver = maildir mail_gid = 5000 mail_home = /home/vmail/%{user | domain}/%{user} mail_path = ~ mail_plugins { acl = yes notify = yes quota = no } mail_uid = 5000 protocols = imap sieve lmtp sieve_extensions { fileinto = yes reject = yes envelope = yes encoded-character = yes vacation = yes subaddress = yes comparator-i;ascii-numeric = yes relational = yes regex = yes imap4flags = yes copy = yes include = yes body = yes variables = yes enotify = yes environment = yes mailbox = yes date = yes index = yes ihave = yes duplicate = yes mime = yes foreverypart = yes extracttext = yes editheader = yes mboxmetadata = yes servermetadata = yes spamtest = yes spamtestplus = yes virustest = yes } sieve_global_extensions { vnd.dovecot.debug = yes vnd.dovecot.environment = yes vnd.dovecot.pipe = yes } sieve_pipe_bin_dir = /usr/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_spamtest_score_max_value = 15 sieve_spamtest_status_header = X-Spamd-Result: .*? \[([[:digit:]]+\.[[:digit:]]+) / [[:digit:]]+\.[[:digit:]]+\]; sql_driver = mysql ssl = required verbose_proctitle = yes mysql /var/run/mysqld/mysqld.sock { dbname = postfix_db password = # hidden, use -P to show it user = postfix_user } passdb sql { default_password_scheme = MD5-CRYPT query = SELECT username as user, password FROM mailbox WHERE ((username = '%{user | username}(a)domain1.at') OR (username = '%{user | username}(a)domain2.at')) AND active = '1' } userdb sql { iterate_query = SELECT userid AS username, domain FROM users query = SELECT username as user FROM mailbox WHERE ((username = '%{user | username}(a)domain1.at') OR (username = '%{user | username}(a)domain2.at') ) AND active = '1' } namespace inbox { inbox = yes prefix = separator = / type = private } namespace oeffentlich { mail_path = /home/vmail/oeffentlich prefix = Oeffentlich/ separator = / subscriptions = yes type = public mailbox Oeffentlich { acl [DELETED for now] } service imap-login { process_min_avail = 8 inet_listener imap { port = 0 ssl = no listen = } inet_listener imaps { port = 993 ssl = yes listen = } } service lmtp { extra_groups = $SET:default_internal_group user = vmail unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service imap { } service auth { client_limit = 1200 user = root unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-client { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0660 } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/letsencrypt/pfsense/cloud_imap_mail_smtp_LE_cert.fullchain key_file = /etc/letsencrypt/pfsense/cloud_imap_mail_smtp_LE_cert.key } protocol lda { mail_plugins = sieve } protocol imap { imap_idle_notify_interval = 29 mins mail_max_userip_connections = 50 mail_plugins { imap_acl = yes imap_quota = no imap_sieve = yes } } protocol lmtp { mail_plugins = sieve postmaster_address = logs(a)xunil.at } service managesieve-login { inet_listener sieve { port = 4190 } } service managesieve { } protocol sieve { managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave } sieve_script personal { active_path = /home/vmail/%{user | domain}/%{user}/sieve/scripts/.dovecot.sieve driver = file path = /home/vmail/%{user | domain}/%{user}/sieve/scripts } sieve_script before-0 { driver = file path = /usr/lib/dovecot/sieve/global-spam.sieve type = before } service anvil { unix_listener anvil { group = $SET:default_internal_group mode = 0660 } } I assume I am not far from full success, I'd just like to get rid of these errors because tomorrow dozens of users will access their mailboxes ... Thanks for any pointers!

1 1