June 2026 - dovecot - dovecot.org

sieve-test (Pigeonhole) on Ubuntu: PCRE support and address test restrictions on Return-Path
by michael.merz＠wtnet.de 11 Jul '26

11 Jul '26

Hello, I've been evaluating sieve-test (Pigeonhole, dovecot-sieve package, version 2.3.21, as shipped with Ubuntu 24.04 LTS) as an offline testing tool for a personal Sieve ruleset that currently runs on a Cyrus IMAPd/CMU Sieve 3.0 backend. I'd like to ask for some clarification on two points, in case I'm missing a configuration option. 1) PCRE support My ruleset makes extensive use of the `(?i)` inline case-insensitivity flag within :regex tests, which is valid under PCRE (as used by Cyrus). When running sieve-test, I get: error: invalid regular expression '(?i)...' for regex match: invalid preceding regular expression. Checking `dovecot --build-options` shows no PCRE entry, which suggests the Ubuntu-packaged binary was compiled without --with-pcre and falls back to POSIX extended regex. Question: Is PCRE support in Pigeonhole's regex extension purely a compile-time decision (i.e. something that would need to be addressed at the distribution packaging level, not via runtime configuration), or is there a runtime way to enable PCRE matching that I might have missed (e.g. via -o, sieve_extensions, or similar)? 2) Return-Path in the `address` test Several of my rules use: address :domain :is "return-path" "..." Cyrus accepts this. Pigeonhole's sieve-test rejects it with: error: specified header 'return-path' is not allowed for the address test. I understand this is likely an RFC 5228 strictness difference (Cyrus being more permissive than the RFC requires). Is there a recommended alternative within Sieve itself to achieve the same effect (testing the address portion of Return-Path) while staying within what Pigeonhole accepts - e.g. via the `header` test combined with some address-parsing approach, or via the envelope test instead? For context: I'm not running a Dovecot mail server myself. I'm using sieve-test purely as an offline syntax/behaviour verification tool before deploying ruleset changes to a separate Cyrus-based production system. I understand this is a bit of an unusual use case, so any guidance on whether Pigeonhole is well suited for this kind of cross-implementation testing at all would also be appreciated. Thank you for your time and for maintaining Pigeonhole. Best regards, Michael Merz Hello, I've been evaluating sieve-test (Pigeonhole, dovecot-sieve package, version 2.3.21, as shipped with Ubuntu 24.04 LTS) as an offline testing tool for a personal Sieve ruleset that currently runs on a Cyrus IMAPd/CMU Sieve 3.0 backend. I'd like to ask for some clarification on two points, in case I'm missing a configuration option. 1) PCRE support My ruleset makes extensive use of the `(?i)` inline case-insensitivity flag within :regex tests, which is valid under PCRE (as used by Cyrus). When running sieve-test, I get: error: invalid regular expression '(?i)...' for regex match: invalid preceding regular expression. Checking `dovecot --build-options` shows no PCRE entry, which suggests the Ubuntu-packaged binary was compiled without --with-pcre and falls back to POSIX extended regex. Question: Is PCRE support in Pigeonhole's regex extension purely a compile-time decision (i.e. something that would need to be addressed at the distribution packaging level, not via runtime configuration), or is there a runtime way to enable PCRE matching that I might have missed (e.g. via -o, sieve_extensions, or similar)? 2) Return-Path in the `address` test Several of my rules use: address :domain :is "return-path" "..." Cyrus accepts this. Pigeonhole's sieve-test rejects it with: error: specified header 'return-path' is not allowed for the address test. I understand this is likely an RFC 5228 strictness difference (Cyrus being more permissive than the RFC requires). Is there a recommended alternative within Sieve itself to achieve the same effect (testing the address portion of Return-Path) while staying within what Pigeonhole accepts -- e.g. via the `header` test combined with some address-parsing approach, or via the envelope test instead? For context: I'm not running a Dovecot mail server myself. I'm using sieve-test purely as an offline syntax/behaviour verification tool before deploying ruleset changes to a separate Cyrus-based production system. I understand this is a bit of an unusual use case, so any guidance on whether Pigeonhole is well suited for this kind of cross-implementation testing at all would also be appreciated. Thank you for your time and for maintaining Pigeonhole. Best regards, Michael Merz

4 13

The SORT extension in 2.4.4 over imapc never returns any UIDs
by inaugurator＠ya.ru 29 Jun '26

29 Jun '26

Hi guys! This is really annoying. On the command to dovecot over imapc from another one: "UID SEARCH ALL" I get my UIDs: "* SEARCH 1 2 3 4" But when sending: "UID SORT (REVERSE ARRIVAL) US-ASCII NOT DELETED" I get literally nothing: "* SORT" Sorry, but this is a bug. Thank you!

3 7

How to use two databases in two passdb sections
by Евгений 26 Jun '26

26 Jun '26

Hello everyone! In version 2.3.21, I used two databases where each passdb queried its own database. After upgrading to 2.4.4, I cannot figure out how to restore this functionality. Is it no longer possible to use two databases in a single configuration after upgrade? Thank you for the best MDA!

3 2

Issues with syncing of shared mailboxes
by fc26wuqa＠studserv.uni-leipzig.de 26 Jun '26

26 Jun '26

Hello, I have a two users, that have a personal mailbox and a shared mailbox. They have access to the same shared mailbox. Today they notified me, that a mail send to the shared mailbox exists for the one user but not the other. The user also notified me, that some mails are not being delivered. I haven't found anything in my log files and the postmaster has also no delivery failures. I relay my mails through another server I don't have access to though. My /etc/aliases only consists of `postmaster: root`. The relay owners said that I should change postfix' main.cf to `double_bounce_sender = postmaster` a while ago. I am also not sure if I am not getting any delivery failure notifications since then, since I don't have a `postmaster` account, but I thought this is not needed since I have the above line in `/etc/aliases`. I also tried forcing a resync of their shared and non-shared inboxes with: `doveadm force-resync -u user(a)emaildomain.com INBOX` as well as `doveadm force-resync -u user(a)emaildomain.com Shared` (as well as with `Shared\*` - I don't know if that makes a difference tbh). Here is the output of `dovecot -n`: https://bin.disroot.org/?4eac9ea90a72ff08#A2dim9VGqHAjjKcggF4ScFWpbGytePZjt… I am kind of lost where to start from here, because any other person I asked told me their mail worked fine ^^. I would highly appreciate some guidance :) Thank you. Best, Lucienne

1 0

Convert sqlite configuration from 2.3 to 2.4
by Horst B Simon 24 Jun '26

24 Jun '26

Hi, I succesful converted all configurations from dovecot 2.3 to 2.4, except for the sqlite configuration. I googled and all configuration are for mysql/mariadb and not for sqlite. The sqlite database is created with postfixadmin and my current configuration for dovecot 2.3 (dovecot-sql.conf.ext) is: driver = sqlite connect = /var/mail/postfixadmin.db default_pass_scheme = DES-CRYPT password_query = \ SELECT username as user, password, '/var/mail/%d/%n' as userdb_home, \ 'maildir:/var/mail/%n' as userdb_mail, 5000 as userdb_uid, 5000 as userdb_gid \ FROM mailbox WHERE username = '%u' AND active = '1' user_query = \ SELECT '/var/mail/%d/%n' as home, 'maildir:/var/mail/%n' as mail, \ 5000 AS uid, 5000 AS gid, printf('dirsize:storage=', quota) AS quota \ FROM mailbox WHERE username = '%u' AND active = '1' I tried the only converter, but it didn’t do any conversion. Any help appreciated. Thanks and Regards, Horst Hi, I succesful converted all configurations from dovecot 2.3 to 2.4, except for the sqlite configuration. I googled and all configuration are for mysql/mariadb and not for sqlite. The sqlite database is created with postfixadmin and my current configuration for dovecot 2.3 (dovecot-sql.conf.ext) is: driver = sqlite connect = /var/mail/postfixadmin.db default_pass_scheme = DES-CRYPT password_query = \ SELECT username as user, password, '/var/mail/%d/%n' as userdb_home, \ 'maildir:/var/mail/%n' as userdb_mail, 5000 as userdb_uid, 5000 as userdb_gid \ FROM mailbox WHERE username = '%u' AND active = '1' user_query = \ SELECT '/var/mail/%d/%n' as home, 'maildir:/var/mail/%n' as mail, \ 5000 AS uid, 5000 AS gid, printf('dirsize:storage=', quota) AS quota \ FROM mailbox WHERE username = '%u' AND active = '1' I tried the only converter, but it didn't do any conversion. Any help appreciated. Thanks and Regards, Horst

2 2

Incomplete Dovecot Log Entries
by Bryan Simmons 19 Jun '26

19 Jun '26

There are hundreds of dovecot “Disconnected: Connection closed” messages in the log file that do not have a corresponding connect record. Is this normal or are there configuration options that need to be modified? Note the user accounts listed, and other similar records, do not exist on this server. 2026-06-14T02:11:48.843517-04:00 mail dovecot: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<rantanplan_admin(a)nanomail.net>, method=PLAIN, rip=190.181.120.152, lip=10.0.1.211, TLS, session=<T8xvlDBUnNC+tXiY> 2026-06-14T02:12:16.614611-04:00 mail dovecot: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<rantanplan_admin>, method=PLAIN, rip=41.139.10.25, lip=10.0.1.211, TLS, session=<cvoGljBUS+YpiwoZ> 2026-06-14T03:23:55.523146-04:00 mail dovecot: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<rantanplan.info(a)nanomail.net>, method=PLAIN, rip=103.69.9.148, lip=10.0.1.211, TLS, session=<SOBYljFUlsdnRQmU> Thanks, Bryan

1 0

Announcing nauthilus-director: a Nauthilus-backed mail protocol director
by Christian Rößner 17 Jun '26

17 Jun '26

Hi, I would like to announce `nauthilus-director` for the first time on this list. `nauthilus-director` is an open-source mail protocol director and transparent proxy for Nauthilus-backed mail deployments. It sits in front of stateful mail backends, authenticates frontend sessions through Nauthilus, resolves routing and placement inside the director, selects healthy backend services, keeps active user affinity in Redis, and then proxies the established connection to the selected backend. The current focus is on deployments where backend placement, maintenance, drains, user movement and session affinity need to be explicit, observable and controllable. The director is not a mailbox server and not a general-purpose load balancer; it owns the narrow director responsibilities between clients, Nauthilus and backend mail services. Current capabilities include: - IMAP/IMAPS, POP3/POP3S, LMTP/LMTPS and ManageSieve proxying - Nauthilus-backed authentication over HTTP or gRPC - director-owned routing and backend selection - Redis-backed session affinity and runtime coordination - backend health, maintenance, runtime drains and placement overrides - an OpenAPI-based REST control API and `nauthilus-directorctl` - metrics, structured logging and OpenTelemetry tracing The demo stack includes Dovecot backend shards and exercises real IMAP, LMTP, POP3 and ManageSieve paths, so feedback from Dovecot operators would be especially useful. Related to this, Nauthilus itself has recently been released as version 3.0.0. Nauthilus is the central authentication and policy engine in this setup: it provides centralized authentication and identity handling for mail and web workloads, LDAP-backed or Lua-driven policy decisions, OIDC/SAML IdP functionality, MFA support, and Redis-backed state handling. In the director architecture, Nauthilus remains the authentication and policy authority, while `nauthilus-director` owns concrete backend placement and proxy lifecycle decisions. Project links: - nauthilus-director: https://github.com/croessner/nauthilus-director - Nauthilus: https://github.com/croessner/nauthilus - Documentation / website: https://nauthilus.org The director is still young, so I would be interested in feedback from people running Dovecot-backed infrastructures, especially around operational workflows, backend maintenance, migration scenarios and protocol behavior. The director is still in beta. Best regards, Christian Rößner -- Rößner-Network-Solutions Zertifizierter ITSiBe / CISO Marburger Str. 70a, 36304 Alsfeld Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5 Hi, I would like to announce `nauthilus-director` for the first time on this list. `nauthilus-director` is an open-source mail protocol director and transparent proxy for Nauthilus-backed mail deployments. It sits in front of stateful mail backends, authenticates frontend sessions through Nauthilus, resolves routing and placement inside the director, selects healthy backend services, keeps active user affinity in Redis, and then proxies the established connection to the selected backend. The current focus is on deployments where backend placement, maintenance, drains, user movement and session affinity need to be explicit, observable and controllable. The director is not a mailbox server and not a general-purpose load balancer; it owns the narrow director responsibilities between clients, Nauthilus and backend mail services. Current capabilities include: - IMAP/IMAPS, POP3/POP3S, LMTP/LMTPS and ManageSieve proxying - Nauthilus-backed authentication over HTTP or gRPC - director-owned routing and backend selection - Redis-backed session affinity and runtime coordination - backend health, maintenance, runtime drains and placement overrides - an OpenAPI-based REST control API and `nauthilus-directorctl` - metrics, structured logging and OpenTelemetry tracing The demo stack includes Dovecot backend shards and exercises real IMAP, LMTP, POP3 and ManageSieve paths, so feedback from Dovecot operators would be especially useful. Related to this, Nauthilus itself has recently been released as version 3.0.0. Nauthilus is the central authentication and policy engine in this setup: it provides centralized authentication and identity handling for mail and web workloads, LDAP-backed or Lua-driven policy decisions, OIDC/SAML IdP functionality, MFA support, and Redis-backed state handling. In the director architecture, Nauthilus remains the authentication and policy authority, while `nauthilus-director` owns concrete backend placement and proxy lifecycle decisions. Project links: - nauthilus-director: https://github.com/croessner/nauthilus-director - Nauthilus: https://github.com/croessner/nauthilus - Documentation / website: https://nauthilus.org The director is still young, so I would be interested in feedback from people running Dovecot-backed infrastructures, especially around operational workflows, backend maintenance, migration scenarios and protocol behavior. The director is still in beta. Best regards, Christian Roessner -- Roessner-Network-Solutions Zertifizierter ITSiBe / CISO Marburger Str. 70a, 36304 Alsfeld Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5

3 3

Announcement: wormhole plugin, replication for Dovecot 2.4
by Patrick Cernko 12 Jun '26

12 Jun '26

Hello List, I am proud to announce my project "wormhole". This is an extension for Dovecot 2.4.1. It allows to continue the use of the replication feature of Dovecot that was removed with the 2.4 release. History: I started this project by forking the replication code of Dovecot 2.3.21.1 and porting it to 2.4. The first result was a patch for Dovecot 2.4.1. While working with the code, I realized that it is possible to provide the feature as a plugin / extension. In the first release of the plugin, I tried to integrate it with the existing dsync commands for doveadm. This required an API for access to the dsync commands, which I proposed to the Dovecot developers in https://github.com/dovecot/core/pull/249 . Unfortunately, my pull request was rejected, though I can understand the reasons for that. Without the required API, I had to switch to another approach: I forked the dsync code from doveadm to provide a new set of commands: "repl" and "repl-server". These commands work similar to "sync" and "dsync-server" but use additional functions required by the replication feature. This approach was released as version 0.3 of the plugin. With version 0.4 I renamed the project to wormhole. Before that it was just called dovecot-replication (see https://codeberg.org/errror/dovecot-replication) I thought that the project should have a more unique name. Currently I'm working on designing a test suite for wormhole. Doing unit tests of the components is not sufficient IMHO. The test suite should check the whole replication feature using two running dovecot instances that replicate the users' mailboxes. Having a sophisticated test suite will help in future development and bug tracking. The code can be found on my codeberg site at: https://codeberg.org/errror/wormhole There is also a web page on my personal homepage at: https://people.mpi-klsb.mpg.de/~pcernko/wormhole.shtml The project is still missing documentation. For the moment, configuration is similar to the existing Dovecot 2.3 documentation. Upgrading from 2.3: When using the included patch for Dovecot, the plugin should be 100% compatible with existing Dovecot 2.3 servers. This compatibility should allow uninterrupted upgrades of the service by replacing Dovecot on one server and then the other one. After the upgrade, the plugin can be reconfigured to work without the patch for Dovecot. Upgrading without the patch is also possible. During the upgrade (aka "while one server still runs 2.3") some aspects of the replication will not work or lack performance. Upgrading is not yet tested very well and missing documentation also. I will work on that soon. I hope to get some feedback, pull requests or bug reports via mail or at codeberg (preferred). -- Patrick Cernko <pcernko(a)mpi-klsb.mpg.de> +49 681 9325 5815 Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Softwaresysteme

4 4

New Backup Issue
by Doug Hardie 11 Jun '26

11 Jun '26

I have dovecot using maildir storage on the mail machine. I have an external drive directly connected to use a backup for the mailboxes. Doveadm backup works perfectly for this setup. I also have two external backup servers. Backup to those tends to fail with a variety of errors. I deleted the Maildir directory on the backup servers and created the original backups with doveadm backup. No issues were reported. However, the next backup generates errors: dsync-remote(jeanne)<HV6JE+i/KWo0NwAAq6l46g>: Warning: Deleting mailbox 'INBOX': UID=11166 GUID=1712570780.M604032P10319.mail,S=99689,W=101000 is missing locally dsync-remote(jeanne)<HV6JE+i/KWo0NwAAq6l46g>: Error: Couldn't delete mailbox INBOX: INBOX can't be deleted. dsync-local(jeanne)<HqU9Aei/KWoBMAAAZU03Dg>: Error: Remote command returned error 65: ssh sermons doveadm dsync-server -ujeanne -U dsync-remote(beneke)<eARRAem/KWpdNwAAq6l46g>: Warning: Deleting mailbox 'INBOX': UID=232 GUID=1641564460.M859673P8687.mail,S=5917,W=6035 is missing locally dsync-remote(beneke)<eARRAem/KWpdNwAAq6l46g>: Error: Couldn't delete mailbox INBOX: INBOX can't be deleted. dsync-local(beneke)<mw5bM+i/KWoJMAAAZU03Dg>: Error: Remote command returned error 65: ssh sermons doveadm dsync-server -ubeneke -U dsync-remote(doug)<6gmSJ+m/KWp7NwAAq6l46g>: Warning: Deleting mailbox 'INBOX': UID=92440 GUID=1465118975.V4eI7cfa32M232845.mail is missing locally dsync-remote(doug)<6gmSJ+m/KWp7NwAAq6l46g>: Error: Couldn't delete mailbox INBOX: INBOX can't be deleted. dsync-local(doug)<hwsCH+m/KWoNMAAAZU03Dg>: Error: Remote command returned error 65: ssh sermons doveadm dsync-server -udoug -U There is always one error per user, but they are different between the two backup machine. With the first error, I found the message 1712570780.M604032P10319.mail,S=99689,W=101000 in the mail server cur directory and deleted it. That messge did not exist in the backup server. I ran backup again and no issues. However, the next backup produced the following error: dsync-remote(jeanne)<dNWXGZbUKWoaOgAAq6l46g>: Warning: Deleting mailbox 'INBOX': UID=11167 GUID=1712574432.M425061P11306.mail,S=45149,W=45775 is missing locally dsync-remote(jeanne)<dNWXGZbUKWoaOgAAq6l46g>: Error: Couldn't delete mailbox INBOX: INBOX can't be deleted. dsync-local(jeanne)<Jg3tCZbUKWp5NQAAZU03Dg>: Error: Remote command returned error 65: ssh sermons doveadm dsync-server -ujeanne -U That message is in the cur directory on the mail server. It is not in the backup server. I don't understand the message that those files are missing locally (primary mail server I presume) when they are actually there and missing on the remote server. I don't know why they didn't get copied originally. The first email was recieved on Mon, 8 Apr 2024 so it can't be a timming issue. -- Doug

2 1

Replication performance question and environment variables sanitization
by Jesus Cea 10 Jun '26

10 Jun '26

Hi, there. I am using dovecot 2.3.21.1. I am experimenting with replication, currently doing it manually, using this: doveadm -Dv sync -u jcea ssh email doveadm dsync-server -u prueba_backup; echo $? It works fine so far, but I have a few hundreds of mailboxes in my imap4 account and an "empty" (no changes) sync takes 30 seconds, since apparently it compare every mailbox (according to the debug info printed). I am using "mdbox" storage in both sides. I would expect an event replication, where time is proportional to the volume of changes, not to the total data volume or number of mailboxes. Am I doing anything wrong?. It would be faster to use "replicator" + "mail_replica". Can I improve this in some way? Replication must be both ways, because in one server new emails are arriving and in the other imapserver I am doing my mail work. I want new email appearing in my work imapserver (living my own laptop) and my email processing to be replicated back to the server for backup/disaster recovery (lost laptop, broken HD) and access from a different laptop, phone, etc. Thanks. PS: By default dovecot sanitizes the environment and doesn't allow "SSH_AUTH_SOCK" for ssh-agent. Why?. That is very inconvenient. I am using this environment variable to overcome that: DOVECOT_PRESERVE_ENVS="HOME USER SSH_AUTH_SOCK SSH_AGENT_PID LOG_STDERR_TIMESTAMP TZ CORE_OUTOFMEM CORE_ERROR" Is this the right way to do this? -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - https://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz

2 3