August 2026 - dovecot

Quota messages warning
by Alberto 01 Nov '26

01 Nov '26

I have dovecot 2.4.5 in a Docker container and warning quota of message count isn't working. My quota config: quota "User quota" { driver = count quota_warning warn-espacio-95 { quota_storage_percentage = 95 execute quota-warning { args = espacio-95 %{user} } } quota_warning warn-mensajes-95 { quota_message_percentage = 95 execute quota-warning { args = cantidad-95 %{user} } } quota_warning warn-espacio-85 { quota_storage_percentage = 85 execute quota-warning { args = espacio-85 %{user} } } quota_warning warn-mensajes-85 { quota_message_percentage = 85 execute quota-warning { args = cantidad-85 %{user} } } quota_warning warn-espacio-75 { quota_storage_percentage = 75 execute quota-warning { args = espacio-75 %{user} } } quota_warning warn-mensajes-75 { quota_message_percentage = 75 execute quota-warning { args = cantidad-75 %{user} } } } In storage option works ok, but in case of messages no event success. Log not show anything and external script is not call, of course. Any idea? Best Regards, Alberto

4 15

deliver fails because of a permission issue with SSL private key file
by Markus Schönhaber 22 Oct '26

22 Oct '26

Hi, I'm trying to make Postfix hand incoming mail to Dovecot by using Dovecot's deliver. But this fails with a permission error: > Feb 17 15:50:12 debian13-cont postfix/pipe[13133]: 171C17206: to=<recipient(a)dest.examle.org>, relay=dovecot, delay=0.17, delays=0.1/0/0/0.07, dsn=5.3.0, status=bounced (Command died with status 89: "/usr/lib/dovecot/deliver". Command output: doveconf: Fatal: Error in configuration file /etc/dovecot/certs.conf line 3: key_file: open(/etc/ssl/private/ssl-cert-snakeoil.key) failed: Permission denied ) How can I solve this (short of making the private key file world readable, of course)? Regards mks I have this in Postfix' master.cf: > dovecot unix - n n - - pipe > flags=DROhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -e -f ${sender} -a ${recipient} -d ${user}@${domain} # LANG=C id vmail uid=501(vmail) gid=501(vmail) groups=501(vmail),104(ssl-cert) # LANG=C ls -l /etc/ssl/private/ total 4 -rw-r----- 1 root ssl-cert 1704 Feb 4 17:15 ssl-cert-snakeoil.key # doveconf -n # 2.4.2-2+debian13 (0962ed2104): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.2-2+debian13 (767418c3) # OS: Linux 6.19.0-2-MANJARO x86_64 Debian 13.3 btrfs # Hostname: debian13-cont dovecot_config_version = 2.4.2 dovecot_storage_version = 2.4.2 log_debug = category=sql mail_driver = sdbox mail_gid = vmail mail_home = /var/spool/vmail/home/%{user | domain}/%{user | username} mail_path = /var/spool/vmail/mail/%{user | domain}/%{user | username} mail_plugins { quota = yes } mail_uid = vmail protocols = imap lmtp sieve sql_driver = mysql mysql localhost { dbname = postfixadmin password = # hidden, use -P to show it user = postfixadmin } passdb sql { query = SELECT 'vmail' AS userdb_uid, 'vmail' AS userdb_gid, CONCAT('/var/spool/vmail/home/', maildir) AS userdb_home, CONCAT(quota, 'B') AS userdb_quota_storage_size, username AS user, password FROM mailbox WHERE username = '%{user}' AND active = '1'; } userdb prefetch { } userdb sql { iterate_query = SELECT username AS user FROM mailbox WHERE active = '1'; query = SELECT 'vmail' AS uid, 'vmail' AS gid, CONCAT('/var/spool/vmail/home/', maildir) AS home, CONCAT(quota, 'B') AS quota_storage_size, username AS user, password FROM mailbox WHERE username = '%{user}' AND active = '1'; } namespace inbox { inbox = yes separator = / mailbox Drafts { special_use = "\\Drafts" } mailbox Entwürfe { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox "Gelöschte Objekte" { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Gesendete Objekte" { special_use = "\\Sent" } } service auth { inet_listener tcp_auth { port = 12345 } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service auth-worker { } ssl_server { cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem key_file = /etc/ssl/private/ssl-cert-snakeoil.key } protocol imap { mail_plugins { imap_quota = yes } } quota "User quota" { } dict_server { dict mysql { driver = sql sql_driver = mysql dict_map priv/quota/messages { sql_table = quota username_field = username dict_map_value_field messages { } } dict_map priv/quota/storage { sql_table = quota username_field = username dict_map_value_field bytes { } } } } quota_clone { dict proxy { name = mysql } }

7 15

imap-sieve, question concerning "sieve_user_email" and variables, migration from 2.3 to 2.4
by Claus-Justus Heine 19 Oct '26

19 Oct '26

Hi there, I have a question concerning the configuration setting sieve_user_email In a v2.3 setup I had it set to sieve_user_email = %Ln(a)some.concrete.domain Now I am trying to migrate to v2.4 and thought the direct translation from the old variable expansion scheme to the new scheme deployed in v2.4 would be sieve_user_email = %{user|username|lower}(a)some.concrete.domain However, this does not work. Testing the documentation yields the following error: # dovecot -n -c dovecot.conf > /dev/null doveconf: Error: sieve: sieve settings: Failed to parse configuration: Failed to expand sieve_user_email setting variables: Unknown variable 'user' doveconf: Fatal: Error in configuration file dovecot.conf: Failed to initialize Sieve Setting "sieve_user_email" to something without variable expansion or just commenting it out yields a configuration which is accepted by "dovecot -n". Now I wonder: a) v2.3 did not complain. But perhaps just because it was using "%Ln" literally? b) In case it did work in v2.3, should it work in v2.4 also? And if so: what would be the correct syntax / variable names? c) Under which circumstances is this setting "sieve_user_email" used? The documentation states: https://doc.dovecot.org/main/core/summaries/settings.html#sieve_user_email > The primary e-mail address for the user. > > This is used as a default when no other appropriate address is available for sending messages. > > If this setting is not configured, either the postmaster or null <> address is used as a sender, depending on the action involved. > > This setting is important when there is no message envelope to extract addresses from, such as when the script is executed in IMAP. I thought that then it would make sense to use something which depends on the login-name of the IMAP-user? Or was this "sieve_user_email" intended to hold just one static email like "my_global_catch_all(a)some.concrete.domain"? Kind thanks for clarification, best regards Claus -- Claus-Justus Heine himself(a)claus-justus-heine.de http://www.claus-justus-heine.de/ Schatzmeister der Camerata Academica Freiburg e.V. --- www.cafev.de

2 6

Variable expansion syntax: Filter "default" throws error (unwanted)
by Johannes Nohl 20 Sep '26

20 Sep '26

I am using dovecot 2.4.2 (almost) with new config language and I have a working configuration. However, the check for disabled users throws permanently errors in the log file, whenever a user is missing the ldap attribute for disabled. This is - in my view - due to a misfunction of Filter "default". passdb ldap { driver = ldap ldap_bind = yes ldap_filter = (&(|(objectClass=posixAccount)(objectClass=mailAccount))(uid=%{user})) fields { user = %{ldap:uid} nologin = %{ldap:shadowInactive | default(null)} reason = The account for this email address is disabled. } } This results in the following log line: 2026-03-31T00:46:31.102690+02:00 mailserver dovecot: auth(test,ipv4,sasl:plain)<YE81n0VOVuofEeSD>: Error: ldap: auth_passdb_post settings: Failed to parse configuration: Failed to expand passdb_fields/nologin setting variables: ldap: No such attribute 'shadowinactive' The right behaviour would be no logging on login success. Because the Filter "default" is intended to suppress any errors ("When value is missing or empty, you can use the default filter to provide value. Missing variables will cause errors and must be negated with default. This does not apply to all providers, some providers return empty when value is missing."). https://doc.dovecot.org/2.4.2/core/settings/variables.html#variable-expansi… As you may have seen I had to borrow null-value from sql db config also to make nologin ignoring a non present attribute. This is undocumented obviously. Instead, a non-working tip is provided ("Changed: 2.4.0 Extra fields can now also be set to empty string, "). However, the following does not work: "nologin = {ldap:shadowinactive | default("")}". https://doc.dovecot.org/2.4.2/core/settings/variables.html Also, the documentation is missing/hiding the part which explains that "default()" can be used to avoid error logs. PR regarding the documentation source is sent already. See "Fails if the attribute is not present, unless the ` <missing part>" https://doc.dovecot.org/2.4.0/core/config/auth/databases/ldap.html#ldap-spe… Is there another way to verify if account is disabled? -- Johannes Nohl postmaster i-t-cloud -- Johannes Nohl postmaster(a)i-t-cloud.de I am using dovecot 2.4.2 (almost) with new config language and I have a working configuration. However, the check for disabled users throws permanently errors in the log file, whenever a user is missing the ldap attribute for disabled. This is - in my view - due to a misfunction of Filter "default". passdb ldap { driver = ldap ldap_bind = yes ldap_filter = (&(|(objectClass=posixAccount)(objectClass=mailAccount))(uid=%{user})) fields { user = %{ldap:uid} nologin = %{ldap:shadowInactive | default(null)} reason = The account for this email address is disabled. } } This results in the following log line: *2026-03-31T00:46:31.102690+02:00 mailserver dovecot: auth(test,ipv4,sasl:plain)<YE81n0VOVuofEeSD>: Error: ldap: auth_passdb_post settings: Failed to parse configuration: Failed to expand passdb_fields/nologin setting variables: ldap: No such attribute 'shadowinactive' The right behaviour would be no logging on login success. Because the Filter "default" is intended to suppress any errors ("When value is missing or empty, you can use the default filter to provide value. Missing variables will cause errors and must be negated with default. This does not apply to all providers, some providers return empty when value is missing."). https://doc.dovecot.org/2.4.2/core/settings/variables.html#variable-expansi… As you may have seen I had to borrow null-value from sql db config also to make nologin ignoring a non present attribute. This is undocumented obviously. Instead, a non-working tip is provided ("Changed: 2.4.0 Extra fields can now also be set to empty string, "). However, the following does not work: "nologin = {ldap:shadowinactive | default("")}". https://doc.dovecot.org/2.4.2/core/settings/variables.html Also, the documentation is missing/hiding the part which explains that "default()" can be used to avoid error logs. PR regarding the documentation source is sent already. See "Fails if the attribute is not present, unless the ` <missing part>" https://doc.dovecot.org/2.4.0/core/config/auth/databases/ldap.html#ldap-spe… Is there another way to verify if account is disabled? -- Johannes Nohl postmaster i-t-cloud -- Johannes Nohl postmaster(a)i-t-cloud.de

2 2

Dovecot and Pigeonhole v2.4.5 released
by Aki Tuomi 18 Sep '26

18 Sep '26

Hi! We are happy to publish version 2.4.5 of Dovecot and Pigeonhole. These contain CVEs, discovered by external researches. The majority of these have been discovered with help of automated code analysis tools like claude code security, which is why some of these are rather old, missed bugs. Distributions have changed - Jammy (Ubuntu 22.04) is no longer provided in repo.dovecot.org - Resolute Raccoon (Ubuntu 26.04) has been added to repo.dovecot.org No new dependencies have been added. Note that there are experimental features in 2.4, one is enabled with `--enable-experimental-mail-utf8`, and another with `--enable-experimental-imap4rev2`, and you also need to set mail_utf8_extensions=yes and imap4rev2_enabled=yes to enable them in config. https://dovecot.org/releases/2.4/dovecot-2.4.5.tar.gz https://dovecot.org/releases/2.4/dovecot-2.4.5.tar.gz.sig https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.5.tar.gz https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.5.tar.gz… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot --- * CVE-2026-27852: Messages with a huge number of From/To/Cc/etc email addresses could result in excessive memory usage. * CVE-2026-33263: Submission: Login service crashes with panic once mail_max_userip_connections limit is reached. * CVE-2026-33604: The SMTP outbound dot-stuffing mechanism does not properly escape dots following a bare \r in message bodies, potentially allowing spoofed emails via malicious end-of-DATA injection. * CVE-2026-33606: Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. * CVE-2026-33607: IMAP LIST command could be used to cause excessive CPU usage. * CVE-2026-40014: IMAP THREAD command could have used excessive amount of CPU processing a single email with a massive number of Message-IDs in References header. * CVE-2026-40015: Invalid IMAP command sent to imap-hibernate process might crash it. * CVE-2026-40017: IMAP THREAD command could have used excessive amount of CPU processing emails with a large number of specially crafted Message-IDs in References header. The fix requires a new dovecot.index.thread file format, which is enabled only after setting dovecot_storage_version or newer. This rebuilds the index, so it will cause some extra CPU usage and extra metacache disk IO usage. It shouldn't cause (much) extra object storage IO, because all the fields should be coming from dovecot.index.cache. * CVE-2026-40203: When IMAP COMPRESS=DEFLATE was enabled, an attacker could send mails into a victim's mailbox and observe network traffic to determine whether a secret message matched a known string by comparing compressed response sizes (a CRIME-style attack). The fix resets the compression dictionary after each IMAP command, preventing information from leaking between commands. * CVE-2026-40205: If multiple OAUTH scopes were required, then this could have been only partially enforced with certain configurations. * CVE-2026-4200: XCLIENT FORWARD allows to forward key only passdb fields without the "forward_" prefix which allows connections from trusted networks to set nopasswd field which allows to skip the authentication. * CVE-2026-42391: Pre-login IMAP ID command could have used excessive amount of memory, causing the process to become killed and disconnecting all the other IMAP connections being proxied by the process. Or alternatively it could have caused excessive CPU usage, slowing down all the other IMAP connections being proxied by the process. * CVE-2026-42392: If URLAUTH is enabled, sending an invalid IMAP URLFETCH can result in an untagged NO response containing uninitialized memory, potentially leaking sensitive data. * CVE-2026-42393: Doveadm password length or API key length could still be determined via timing based attacks. * CVE-2026-42395: XCLIENT FORWARD command from login_trusted_networks could have been used to cause login processes to crash. * CVE-2026-52681: Sieve resource usage (sieve_max_cpu_time) was tracked in the active Sieve binary. Switching to a different active binary could have been used to reset (bypass) the resource usage. * CVE-2026-52687: Using IMAP COMPRESS ZSTD command can cause excessive memory usage in imap-login process, possibly making it reach vsz_limit and kill all the connections being served by the process. Fixed by disabling COMPRESS command with all other compression algorithms than the standard DEFLATE. * CVE-2026-73208: In oauth2, scope/aud checking was done with JWT tokens. Now it requires all scopes. * CVE-2026-73209: Sending IMAP COMPRESS package containing zero-length frames crashes imap or imap-login process. * auth: SIGHUP no longer flushes the passdb cache and SIGUSR2 no longer logs cache statistics. Use "doveadm auth cache flush" and the new "doveadm auth cache status" instead. * auth: The OTP authentication mechanism, the {OTP} password scheme and the passdb set-credentials support have been removed. They were unmaintained and unused. This also drops the passdb_sql_update_query setting. * config: doveconf no longer prints a flat global setting when a top-level named filter overrides the same setting. * doveadm: The doveadm protocol has been bumped to v1.4. The server uses the newer multiplex stream format with clients supporting it. Older clients keep working unchanged. * imap: Change imap_compress_on_proxy default to yes. * lib-dict-extra: Increase dict client request timeout from 30s to 65s, so it stays above the SQL/Cassandra query timeout. * lib-http: HTTP requests are now parsed strictly: obsolete line folding (obs-fold) and a bare LF line terminator are rejected. Both are request desynchronization/smuggling risks. HTTP responses are still parsed leniently. * lib-storage: A '~' in a mailbox name is now escaped only when it is at the beginning of the mailbox name, not at the beginning of every hierarchy part. Directories written by older versions are migrated automatically while listing mailboxes. * lib-var-expand: Add %{time:unix} provider and the epoch, from_epoch, date, iso8601 and escape filters. Deprecates the old time providers. * lib-var-expand: The safe filter must now be the last filter in the chain. * master: Increase the timeout after config reload before killing still running old processes from 6s to 35s, so that lib-master can stop them gracefully first. + config: Support heredoc syntax for multi-line setting values: key = <<EOD ... EOD. doveconf now outputs inline SET_FILE contents (e.g. ssl_ca) using heredoc instead of the "inline:" prefix. The "inline:" form is still accepted. + configure: Build imap-hibernate also when only kqueue notify is available. + doveadm: Add "doveadm auth cache status" command, with --reset for clearing the counters. + doveadm: dump - List all supported dump types, and print the key type also for KEM and unsupported keys. + fts-flatcurve: Add support for phrase searching. This fixes false positives where the searched words existed, but not as a phrase. + fts-flatcurve: Delete the FTS index directory also when a Maildir mailbox is deleted. + imap: Add [THROTTLED] response code to tagged replies when a plugin has throttled the command. + last-login: Add last_login_dict_fields setting for updating multiple dictionary fields at login. + lib-dcrypt: Add ML-KEM-512/768/1024 support with OpenSSL 3. + lib-dcrypt: Support AEAD with Dovecot key encryption. + lib-settings: Expand %{variables} also in strlist and boollist keys. + lib-sql: sqlite - Add sqlite_busy_timeout setting, default 1s. + login-common: Log the destination also when a proxy connection fails. + quota: Update quota-clone also when "doveadm quota recalc" is run. - Fix building on systems with a signed 32-bit time_t. - Fix building with Lua when LUA_LIBS contains linker flags such as -L. - anvil: Fix busy loop eating CPU after an admin socket connection was disconnected. - auth: Fix authentication failing after a password change when the passdb cache entry was verified by an auth worker. - auth: Fix the credentials scheme of one passdb leaking into the next one during a multi-passdb lookup. - auth: oauth2 - Fix losing userdb_* fields during OAUTHBEARER authentication. - auth: passwd-file - Fix %{passdb:...} and %{userdb:...} expansion returning garbage or crashing. - config: Fix crash in "doveconf -f" for a filter that includes a @group. - config: Fix crash when including a default @group into a filter. - config: Fix hiding secrets in doveconf output. - config: Fix startup failures with some settings containing %{variables}. - configure: Fix BUILD_IMAP_HIBERNATE detection. - doc: solr-schema-9.xml - Add the mandatory tokenizer class attribute. - doveadm: compress-connect - Fix writing server input to a non-blocking stdout. - doveadm: fs delete - Fix crash with concurrent async deletes. - doveconf: Fix bogus "Multiple settings matched" error when stdout is redirected to a file that already has content. - dsync: Fix truncating a mailbox attribute value when it is compared to the local one, e.g. truncating a Sieve script. - dsync: backup - Mailbox attributes changed or created only in the destination are now reverted or deleted. - fts-flatcurve: Ignore index directory entries that vanish during iteration. - fts: Don't run FTS optimize on forced resync. - fts: build-mail - Fix accessing Content-Type header buffer out of bounds. - imap-login, pop3-login: Tolerate SASL continuations "+" without a trailing space when proxying authentication. - imap: Don't report FETCH output stream errors as "BUG: Unknown internal error". - imap: Fix hibernation always failing on FreeBSD. - imap: Fix panic on GETMETADATA with an invalid UTF-8 mailbox pattern. - imapc: Don't send SEEEN/UNSEEN to the remote server when private indexes are used. - imapc: Fix SEARCH results pointing at wrong messages after an untagged EXPUNGE. - imapc: Fix SORT returning an empty result when search criteria were used. - imapc: Fix crash when copying a mail that was already expunged in the source mailbox. - imapc: Fix stale SEARCH/SORT results after a STORE in the same session. - imapc: Honor imapc_features=no-search also for SORT. - imapc: Properly handle search criteria that can be sent to remote server. - lib-dcrypt: Don't panic on key algorithms the backend doesn't support. - lib-dcrypt: Fix x9.62 ECDSA signatures randomly failing verification. - lib-dict-backend: cdb - Fix use-after-free of the returned key. - lib-dns-client: Fix handling of a disconnect initiated by the dns-client service. - lib-fs: Fix panic in fs_write_stream_abort(), e.g. when the disk is full during FTS indexing. - lib-index: Fix "File is already open" error when appending to the transaction log while another process is rotating it. This showed up as "NO [SERVERBUG] Internal error occurred." without any logging. - lib-ldap: Fall back to system default CA paths, needed for OpenLDAP built against GnuTLS. - lib-mail: istream-binary-converter - Fix heap use-after-free with a bodyless MIME part. - lib-mail: message-parser - Fix out of bounds read with an empty preamble, fix skipping the epilogue boundary line, and degrade to a re-parse instead of panicking with an inconsistent cached MIME tree. - lib-master: Fix kick reason when the KICK-USER-SIGNAL command arrives late, which logged "Killed with signal 15" instead of "User kicked". - lib-oauth2: jwt - Fix use-after-realloc, guard against an empty body segment and percent-encode bare "." and ".." identifiers. - lib-program-client: Fix panic upon irregular termination. - lib-settings: Fix sorting of the settings history, which caused changed defaults and renames to be ignored once a plugin registered its own history, if dovecot_config_version has been set to greater than 2.4.0. - lib-smtp: Fix assert with an empty broken localpart. - lib-smtp: xclient - Reject an invalid HELO parameter with 501. - lib-sql: pgsql - Fix binary field values for rows after the first. This mainly affected dict-sql maps with hexblob fields. - lib-ssl-iostream: Fix crash at process exit with OpenSSL 4.0. - lib-storage: Don't log an error when the client resets the connection while saving a mail. - lib-storage: Fix crash when reverting a failed mailbox deletion. - lib-storage: Fix decoded size calculation for base64 attachments, which could delete the cache record of a mail with a detached attachment. - lib-storage: Fix handling escaped mailbox names in the mailbox list index. - lib-storage: Fix rewriting non-NFC subscriptions with mUTF-7 storage names, which caused repeated rename errors. - lib-storage: Fix searching flags when the view is not up to date. This broke e.g. a pipelined UID STORE +FLAGS \Deleted followed by UID EXPUNGE. - lib-storage: Fix the mailbox vsize header not being repaired when it is corrupted, causing wrong mailbox sizes to be reported. - lib-storage: thread - Fix panic when running IMAP THREAD in multiple connections in parallel. - lib-var-expand: Reject an empty separator in the index filter, which caused an infinite loop. - lib: Fix crash and out of bounds reads when decoding IDN addresses. Reachable only with the experimental mail UTF-8 support enabled. - lib: ioloop - Fix panic and delayed timeouts when time moves forwards. - lib: ostream-multiplex - Fix stalls, busy loops and a panic when streaming data through a multiplexed connection, e.g. IMAP FETCH through a login proxy or TLS connections. - login-common: Fix connection hanging if an ostream write failed. This happened at least with HAProxy health check connections. - login-common: Fix real_remote_ip being looked up incorrectly. - login-common: Reject proxy credentials with ASCII control characters. - login-proxy: Fix "doveadm kick" for proxied connections in high-security mode, and log "Kicked by admin" as the reason. - maildir: Fix random SEARCH failures when another session concurrently expunges mails. - quota: Fix maildir quota dropping to zero after IMAP MOVE or REPLACE. - submission-login: proxy - Fix crash and unbounded memory usage with a multi-line or malformed AUTH reply from the backend. --- * CVE-2026-33605: managesieve-login: Pre-auth crash. An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. * CVE-2026-40019: v2.4.3 regression: managesieve-login pre-auth infinite loop. An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. * CVE-2026-42007: sieve-editheader: An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer in the delivered mail. * lib-sieve: sieve_max_cpu_time now defaults to 30s globally, so the limit also applies to MDA delivery. Previously the global default was unlimited and only imap_sieve used 30s. The old defaults are kept for older dovecot_config_version values. * lib-sieve: enotify - The number of notify actions performed during a single script execution is now limited to 10 by default. See the new sieve_notify_max_notifications setting. * lib-sieve: enotify - A single "mailto:" notify action is now limited to 8 recipients and 16 additional headers by default. See the new sieve_notify_mailto_max_recipients and sieve_notify_mailto_max_headers settings. * imap-filter-sieve: FILTER SIEVE SCRIPT literals larger than sieve_max_script_size are now rejected before the script is read. - lib-sieve: Fix stack overflow occurring when a script requires the same extension repeatedly. - lib-sieve: encoded-character - Fix integer overflow parsing ${unicode:...} values with 9 or more hex digits. - lib-sieve: variables - Fix integer overflow parsing numeric variable index. - lib-sieve: regex - Fix panic occurring when more than 8 group values are matched. - lib-sieve: ldap - Fix LDAP settings missing from the LDAP storage plugin. - managesieve-login: Fix capability reporting when Sieve settings use %variables.

6 12

Problem email client iPhone ios18.2
by andrzej.milewski＠gmail.com 08 Sep '26

08 Sep '26

Hello, I have a fairly new installation of the Dovecot server version 2.3.19.1 on Debian 12.8. In general, the server works correctly. It sends and receives emails without issues. The clients primarily use Thunderbird on desktops and Gmail on Android. However, some clients are using iPhones with various hardware versions. Those with iOS below version 18 work correctly without any issues. Those who have updated their phones to version 18 and now even 18.2 are experiencing problems with mailbox synchronization. On version 18.2, the issue appears as follows: When you open the app, you can read several messages. They load correctly, but, for instance, attachments do not. If I wait for some time, the attachment eventually loads. During this time, I observe the server logs, and it shows that a certain session on the Dovecot server has ended. Dec 17 13:13:01 iredmail0 dovecot[408]: imap(xxx(a)xxx.com)<44785><1QGZCHcp/+3AqM2O>: Disconnected: Connection closed (UID SEARCH finished 92.295 secs ago) in=2972 out=6076956 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=36 body_bytes=6059064 Dec 18 08:40:41 iredmail0 dovecot[408]: imap(xxx(a)xxx.com)<177412>: Disconnected: Connection closed (UID FETCH finished 90.079 secs ago) in=5126 out=1304237 deleted=0 expunged=0 trashed=0 hdr_count=94 hdr_bytes=289688 body_count=89 body_bytes=969615 Dec 18 08:42:19 iredmail0 dovecot[408]: imap(xxx(a)xxx.com)<177410><D5mqU4cpZ+nAqM2O>: Disconnected: Connection closed (UID FETCH finished 95.051 secs ago) in=4475 out=1162785 deleted=0 expunged=0 trashed=0 hdr_count=95 hdr_bytes=281674 body_count=61 body_bytes=839545 Dec 18 08:44:17 iredmail0 dovecot[408]: imap(edyta.kowalewska(a)laktopol.com.pl)<177918>: Disconnected: Connection closed (UID FETCH finished 92.132 secs ago) in=29399 out=30266644 deleted=0 expunged=0 trashed=0 hdr_count=565 hdr_bytes=1726228 body_count=628 body_bytes=28109455 After the session is closed, the attachment loads immediately. From the logs and router analysis, it appears that the download happens in another previously opened session. After this incident, I go to another message with an attachment, and the situation repeats. There are also situations where the email body does not load, and the app waits for the server until the session closes and the content is fetched in another session. It does not matter whether I connect to the server via the internet or through a local network. On an iPhone 7 with iOS 15.8.3, everything works smoothly. Attachments open without issues. On iOS 18.1.1, attachments do not load, and the session does not close on its own. It takes forever unless the app is closed. In the Gmail app, everything works correctly without any issues. This is clearly a problem with the mail client on iPhone. However, is there anything I can adjust in my server settings to mitigate this issue for users? My dovecot configuration https://pastebin.com/UPNQ5dZz

26 60

History Assignment Writing Help – Expert Assistance
by Theo Wilson 05 Sep '26

05 Sep '26

Struggling with your history assignments? Our History Assignment Writing Help service offers expert guidance to help you craft well-researched, structured, and original assignments. Fill out this form to get personalized support from experienced writers and improve your grades with ease. https://www.newassignmenthelp.co.uk/history-assignment-help

2 1

Pay Someone to Take My Online Course?
by xotawa2329＠hapincy.com 05 Sep '26

05 Sep '26

Pay Someone to Take My Online Course? Different understudies who battle with reworking school, work, and family obligations select online class tutors to assist them with finishing their tests and complete their coursework. In any case, some solicitation the ethicality of this planning. While <a href="https://onlineclassservices.com/nurs-fpx-4040-assessment-4-attempt-1-inform…">NURS FPX 4040 Assessment 4</a>  has every one of the reserves of being enticing, it goes with two or three serious dangers. This article will examine a piece of the things you ought to remember going before enlisting an online class help association. It's clearly a fact that online classes can be truly troublesome, particularly for working professionals who have a clamoring plan. Oftentimes they are searching for someone to take a whole course or individual tasks for them, to assist with managing their grades and moderate their strain. Nonetheless, be wary of affiliations that guarantee too wonderful to be authentic. They could charge you enormous totals for their associations and end up not conveying. The best technique for guaranteeing that you are getting anything that would be fair is to use an online class tutor who offers an inadequate responsibility. Additionally, review that different schools consider paying someone to take an online class to swindle. Therefore, whenever got, you could go facing silly outcomes like besieging the course, scholarly suspension or even send off. To this end picking a fair relationship with a showed history is crucial. The association is clear: present your mentioning and survey offers from qualified educated authorities. Then enlist the one that is reasonable for yourself and store maintains in <a href="https://onlineclassservices.com/nurs-fpx-4050-assessment-1-attempt-3-prelim…">NURS FPX 4050 Assessment 1</a>  scrow until your assignment is finished. Online classes are eminent among understudies who need to save time on education and spotlight more on work or other private issues. These merge understudies who are taking courses while working and attempting to change family and profession responsibilities, military understudies on sending, and understudies with genuine inadequacies or sickness that make it pursuing for them to go to classes. Unfortunately, there are many tricks that confirmation to take online courses for you. These affiliations charge ridiculous totals and don't complete their obligations. They may also hand you over to your school. Tolerating that they do, you could be killed from your underwriting project or even suspended or removed from school. This isn't the very thing that you truly need for your business and future. Therefore, you genuinely need to track down serious areas of strength for a that offers a fair cost and mind blowing results. To this end you ought to search for a <a href="https://onlineclassservices.com/nurs-fpx-4050-assessment-2-attempt-1-ethica…">NURS FPX 4050 Assessment 2</a>  affiliation that has an inadequate responsibility and splendid customer association. Various individuals decide to use a professional to take their online class since they need the opportunity to go to it very close. They could be working the whole day, supervising family issues, or fighting disease and disappointments that log jam their review tendencies. These professionals can assist you with fulfilling time necessities, stay away from imaginative theft, and set free your nights to zero in on work or other unwinding works out. They may comparatively have the decision to help you with beating any learning handicaps you have. Copyright infringement suggests utilizing someone else's words and thoughts without their endorsement. It is viewed as a kind of cheating and can accomplish a delicate grade or even send off from school. It is difficult to ensure that a used professional won't phony. This is on the grounds that educational foundations don't have <a href="https://onlineclassservices.com/nurs-fpx-4900-assessment-1-assessing-the-pr…">NURS FPX 4900 Assessment 1 Assessing the Problem</a>  assets for check whether understudies are authentic or not. This truly expects that tolerant you are gotten, you will probably lose the cash you paid to have someone take your class. There's no veritable strategy for remaining caution assuming the solitary you enroll to take your online course will tell the truth and dependable. They probably won't be in a tantamount state as you. Moreover, they apparently won't be as dedicated to finishing the class for you as you are. They may very well be doing the base extent of work expected to get reviewed and a brief time frame later vanish. MORE <a href="https://dev.gajim.org/gajim/website/-/issues/35#note_211778">Facebook is a powerful tool for business</a> <a href="https://xtremepape.rs/members/horridhenry7860.397211/about">Mobile Application Development Services</a> <a href="https://xtremepape.rs/members/samfarrid4563.397213/about">best digital marketing agencies</a>

6 6

Lazy-Expunge plugin documentation incomplete?
by Randolf Richardson 04 Sep '26

04 Sep '26

One of the Dovecot repository maintainers on GitHub recommended sending an eMail to you regarding the issue I encountered: Documentation for lazy-expunge doesn't work https://github.com/dovecot/documentation/issues/1555 -------- I converted from Dovecot 2.3 to Dovecot 2.4.1, which was not a minor upgrade. Anyway, I can't get the lazy-expunge plugin to work in 2.4.1 now. Here's my configuration file from 2.3 -- how can I get this working in 2.4.1? Thanks. namespace inbox { mailbox EXPUNGED { autoexpunge = 32days autoexpunge_max_mails = 100000 #auto = create } } # Namespace for lazy_expunge plugin namespace { prefix = EXPUNGED/ hidden = yes list = no subscriptions = no separator = / location = maildir:~/Maildir.deleted:INDEX= } mail_plugins = $mail_plugins lazy_expunge acl plugin { # Move expunged messages into the .EXPUNGED namespace lazy_expunge = EXPUNGED/ # Only move to expunged storage if this is the last copy of the message in the user´s account lazy_expunge_only_last_instance = yes # Exclude Drafts from lazy expunging lazy_expunge_exclude = \Drafts # Copy of each message is done with hard links whenever possible maildir_copy_with_hardlinks = yes # Define ACL so that user cannot list the .EXPUNGED mailbox # Example entry: .EXPUNGED owner rwstipekxa acl = vfile:/etc/dovecot/dovecot.acl # dovecot.acl contains one line: EXPUNGED owner ip # Expunged messages most likely don't want to be included in quota: quota_rule = EXPUNGED:ignore } #lazy_expunge_mailbox = EXPUNGED Here's an example of someone else who encountered the same problem: https://www.dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thr ead/25BXSHQWGQQ3ACVZSYF3O3LC4WROTUCI/ Randolf Richardson, CNA - randolf(a)inter-corporate.com Inter-Corporate Computer & Network Services, Inc. Beautiful British Columbia, Canada https://www.inter-corporate.com/

2 4

Config parser bug?
by Pat Suwalski 03 Sep '26

03 Sep '26

Hello, I recently upgraded my servers from Debian Bullseye to Trixie (2.3 -> 2.4). I have a pretty basic config, though I use Maildir instead of Debian's default of mbox. In the process of getting things working correctly for the new config format, I believe I have stumbled on a bug. To make the inbox work correctly, I need the mail_inbox_path variable to be unset. This is because the default shipped 10-mail.conf file from Debian has: mail_driver = mbox mail_home = /home/%{user | username} mail_path = %{home}/mail mail_inbox_path = /var/mail/%{user} So, I overrode the mail_driver and mail_path in my local.conf. From the documentation, it seems like I should be able to set: mail_inbox_path = And that should clear it. Certainly, doveconf shows no mail_inbox_path variable set when that happens. However, no inbox! If I comment out mail_inbox_path from 10-mail.conf, doveconf output is identical, however the inbox works. My workaround is to make it the same as mail_path: mail_inbox_path = ~/Maildir However, I think the variable unsetting is buggy. This is dovecot 2.4.1. --Pat

3 10