- dovecot - dovecot.org

2.4.2 upgrade oddity
by Andy Baugh 06 Nov '25

06 Nov '25

Howdy y'all, I noticed something odd with the userdb/passdb processing past the 2.4.2 CVE fix, etc. -- namely that the prefixing you previously needed to do to userdb returns, etc. when you set a cache_key is no longer necessary and in fact harmful. It is worth mentioning, as after looking into this a bit and realizing that it "should have been obvious" to me that this would have been the case. That said I didn't make the logical leap till doveadm screamed at me about it during mailbox creation after upgrade (can't very well do `doveadm mailbox create -s -u user(a)domain.test INBOX.spam` when your userdb returns `${CACHE_KEY}_mailbox/INBOX/spam/...` for the relevant config values, etc.). TL;DR: disabling the cache = do NOT prefix any userdb/passdb returns in accordance with cache_key you set. This is true for lua passdb/authdb or any other authdb, not just passwd/oauth2. Cheers, -- Thomas "Andy" Baugh | Software Development Engineer IV andy.baugh(a)webpros.com www.webpros.com

2 2

doveadm sync issue
by Dan Whitehouse 06 Nov '25

06 Nov '25

Hi, I am running Dovecot on Debian trixie (dovecot-core/stable,now 1:2.4.1+dfsg1-6 amd64). Under the previous version, which I believe was 2.3, I was able to run a sync script with the following syntax: doveadm sync -u <user> remote:<user>@<host.tld> This worked very well and I was able to sync my mail. Having upgraded, this syntax produces the following error: dsync-server: invalid option -- ‘U' Error: doveadm: Unexpected or incomplete option: -U Even though my script doesn’t pass “-U” explicitly I believe that it is passed internally: https://github.com/dovecot/core/blob/main/src/doveadm/doveadm-settings.c#L1… core/src/doveadm/doveadm-settings.c at main · dovecot/core github.com Confusingly the online help still displays: doveadm dsync-server —help doveadm dsync-server [-r <rawlog path>] [-T <timeout secs>] [-U] Here we can see that the “-U” option (despite all the above) appears to have been removed from the code: https://github.com/dovecot/core/commit/4c04e4c30fd4817a8b0e11d04d9681173f69… global: Remove replicator · dovecot/core@4c04e4c github.com I have added the following to /etc/dovecot/local.conf: dsync_remote_cmd = "ssh -l%{login} %{host} doveadm dsync-server -u%{user}” (Note that I override the “-U”) and sync once again works properly. Many thanks for your attention, Dan Whitehouse

4 3

2.4.2 breaks user iterations for LDAP
by cpfeiffer＠rev-crew.info 06 Nov '25

06 Nov '25

Hello everyone, Due to the fix for CVE-2025-30189, routines like userdb_ldap_preinit() call auth_cache_parse_key_and_fields() unconditionally, with the eventually called auth_cache_parse_key_exclude() erroring if a cache key could not be constructed. It’s also noteworthy that this call happens regardless of whether use_cache is set or not, and as of such failing to construct a cache key would cause an error even if use_cache = no was set for that database. This is however an issue for user iteration with LDAP, as documented here LDAP | Dovecot CE <https://doc.dovecot.org/2.4.2/core/config/auth/databases/ldap.html#user-ite…> . Such a userdb only has iterate_filter fields that would inherently not be containing any user variables. The call to auth_cache_parse_key_and_fields() uses a combination of ldap_base and userdb_ldap_filter anyway (so whatever is in iterate_filter isn’t considered), and for an iteration userdb as described in the documentation, the latter would be empty. Alas, I ended up getting the rather confusing error * auth: Fatal: auth-cache: dc=rev-crew,dc=info: Cache key must contain at least one variable With dc=rev-crew,dc=info being my ldap_base setting for the iteration userdb. I’m not critically dependent on the user iteration, so I’ve commented the userdb out for now, but this would need fixing. Regards, Christian Pfeiffer Hello everyone, Due to the fix for CVE-2025-30189, routines like userdb_ldap_preinit() call auth_cache_parse_key_and_fields() unconditionally, with the eventually called auth_cache_parse_key_exclude() erroring if a cache key could not be constructed. It's also noteworthy that this call happens regardless of whether use_cache is set or not, and as of such failing to construct a cache key would cause an error even if use_cache = no was set for that database. This is however an issue for user iteration with LDAP, as documented here [1]LDAP | Dovecot CE. Such a userdb only has iterate_filter fields that would inherently not be containing any user variables. The call to auth_cache_parse_key_and_fields() uses a combination of ldap_base and userdb_ldap_filter anyway (so whatever is in iterate_filter isn't considered), and for an iteration userdb as described in the documentation, the latter would be empty. Alas, I ended up getting the rather confusing error o auth: Fatal: auth-cache: dc=rev-crew,dc=info: Cache key must contain at least one variable With dc=rev-crew,dc=info being my ldap_base setting for the iteration userdb. I'm not critically dependent on the user iteration, so I've commented the userdb out for now, but this would need fixing. Regards, Christian Pfeiffer References Visible links 1. https://doc.dovecot.org/2.4.2/core/config/auth/databases/ldap.html#user-ite…

2 2

Dovecot upgrade from 2.3.x to 2.4.x: and mailbox_alias plugin
by Gerhard Wiesinger 06 Nov '25

06 Nov '25

Hello, Regarding dovecot upgrade from 2.3.x to 2.4.x and mailbox_alias plugin: I've already converted my config and scripts but I'm still missing this config change: plugin { mailbox_alias_old = Spam mailbox_alias_new = Junk } I saw in the link https://doc.dovecot.org/2.4.0/installation/upgrade/2.3-to-2.4.html mailbox-alias plugin Depending on the use case, replacement may be the mailbox_special_use mailbox setting and/or Sieve filters. Any ideas what's the best alternative? Another question, is the following correct: mail_home = /home/vmail/%n mail_location = maildir:~/Maildir => mail_home = /home/vmail/%{user | username} mail_driver = maildir mail_path = ~/Maildir mail_inbox_path = ~/Maildir (Especially mail_inbox_path, I don't have a ".INBOX" directory currently, I guess .INBOX is now default. How to deal with this?) Thnx. Ciao, Gerhard

2 4

Build failure due to non-constant initializers in unicode-transform.c
by adesh＠backuply.com 05 Nov '25

05 Nov '25

When building Dovecot 2.4.2 on modern compilers (GCC ≥ 5, Clang, or any C99/C11-compliant environment), the build fails in src/lib/unicode-transform.c due to the use of non-constant initializers in static const global variables. The affected lines define Hangul composition constants using other const variables instead of compile-time constants, which is not allowed in standard C99 and later. error log: unicode-transform.c:211:1: error: initializer element is not constant static const size_t uni_hangul_n_count = uni_hangul_v_count * uni_hangul_t_count; ^ unicode-transform.c:212:1: error: initializer element is not constant static const uint16_t uni_hangul_l_end = uni_hangul_l_base + uni_hangul_l_count; ^ unicode-transform.c:213:1: error: initializer element is not constant static const uint16_t uni_hangul_v_end = uni_hangul_v_base + uni_hangul_v_count; ^ unicode-transform.c:214:1: error: initializer element is not constant static const uint16_t uni_hangul_t_end = uni_hangul_t_base + uni_hangul_t_count; ^ This issue prevents building Dovecot 2.4.x on modern systems without non-standard compiler flags, breaking out-of-the-box builds on up-to-date Linux distributions.

2 2

configuration fails at the last hurdle
by demo＠manx.net 04 Nov '25

04 Nov '25

as a newbie suddenly requiring a mail server the configuration of dovecot and postfix is proving elusive. if i get one element working another fails. i think it would help readers if i supply my status report and ask for suggestions as to how to ensure a remote client can access the mail just delivered from another remote in addition for mutt to see the mail on the sever. cat <<EOF > ~/mailserver-status.txt 📨 Mail Server Status – Ryzen2 (Ubuntu 25.10) Objective: To host email services independently, replacing Manx Telecom’s legacy offering. Rationale: Manx Telecom has been acquired by Jersey Telecom, with plans to charge £65 per annum per email address. This migration aims to preserve autonomy and reduce costs. ✅ Current Achievements - Mail Receipt Confirmed: Mail addressed to jsm(a)mckenzietrust.com (a domain owned by us) is successfully received via encrypted POP3S (port 995) using both Thunderbird and OpenSSL. - Maildir Workflow Operational: Messages arrive in Maildir/new and are moved every minute to Maildir/cur via a cron job. They are accessible locally using mutt. - SSL Layer Functional: POP3S handshake completes successfully, confirming certificate and encryption setup is sound. ⚠️ Known Issues - Remote Access Fails Silently: Thunderbird and OpenSSL clients connect but cannot retrieve messages from Maildir/cur or new. No errors are returned—access appears to die silently. - Dovecot Configuration Fragility: Any attempt to explicitly define mail_location in config files (e.g., 10-mail.conf) causes Dovecot to crash on startup. This behavior is consistent across both Ubuntu 25.04 and 25.10 builds. It is imperative not to attempt location overrides, as recovery requires reverting to a clean config state. - Post-Reboot Regression: Remote access was briefly functional but failed after a system reboot triggered by a firmware update. This suggests a state-dependent or ephemeral config success. 🧭 Configuration Notes - Dovecot and Postfix Versions: Packages from Ubuntu 25.04 were manually installed and locked to prevent auto-updates. This avoids compatibility issues with newer builds. - POP3S Listener Enabled: The following stanza is active in 10-master.conf: service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } - SSL Configuration: ssl = yes ssl_server_cert_file = /etc/dovecot/private/dovecot.pem ssl_server_key_file = /etc/dovecot/private/dovecot.key These paths are valid and readable by root. 🧱 Constraints and Priorities - No Urgency: At least one month is available for debugging and refinement. - Web Server Stability Is Critical: The live web server must remain uninterrupted, as it hosts the McKenzie Trust’s public-facing structure. - Outbound Mail Deliverability: The domain currently uses DDNS. Without a PTR record, outbound mail from Ryzen2 may be rejected. A fixed IP or relay forwarding will be required. 🧩 Next Steps - Investigate mailbox visibility for remote clients—likely a permissions or UID mapping issue. - Consider enabling auth-master socket for privileged access if needed. - Explore relay options or static IP acquisition to ensure outbound mail acceptance. EOF regards jsm

5 6

doveadm sync -1 -R only downloads Inbox but not Sent Items
by r.barclay＠habmalnefrage.de 02 Nov '25

02 Nov '25

Hi, When my free mail provider mailbox runs out of free space, I have my local Dovecot server one-way sync that free mail mailbox and then I delete the contents of the free mail mailbox. So I can archive my emails in an "offline archive". Initially, I used "doveadm backup", but later always used: doveadm -Dv sync -u offline(a)example.org -1 -f -R imapc: At large, this works. But only during the first "backup" the "Sent" folder was synced as well. Nowdays, it only downloads the Inbox, but not my Sent Items. I tried adding the "-N" parameter, but that said: "Fatal: -N parameter requires syncing with remote host" I'm on Debian 12 and Dovecot 2.3.x: 1:2.3.19.1+dfsg1-2.1+deb12u1 amd64. What could I check or try? And one more question: To better understand the debug output: What is "brain M" and "brain S"? Yours, Reg

1 0

"Synchronization corrupted index header" with mdbox: thousands of deleted e-mails reappeared in INBOX
by Ákos Szőts 01 Nov '25

01 Nov '25

Hi everyone, Suddenly, the following messages appeared in my Dovecot error log: master: Warning: Killed with signal 15 (by pid=0 uid=0 code=kill) Error: Mailbox Trash: Synchronization corrupted index header [...]/Trash/dbox-Mails/dovecot.index: uidvalidity=0, but next_uid=73 Warning: Mailbox Trash: fscking index file [...]/Trash/dbox-Mails/dovecot.index Warning: mdbox([...]/mail/storage): rebuilding indexes: Mailbox Trash index was fsck'd Warning: mdbox([...]/mail/storage): fscking index file [...]/index/inbox/storage/dovecot.map.index Error: Mailbox INBOX: [...]/INBOX/dbox-Mails/dovecot.index reset, view is now inconsistent The first message is because I restarted the container. Since then, Thunderbird shows thousands of previously deleted e-mails again in INBOX where all my messages are marked as unread. - Do you know what can cause it and how can I avoid to happen again? - Is the used mdbox storage engine that fragile? Is the fault tolerance of other engines better? I have a backup from some days ago. Is it possible to somehow revert back to it and sync the new e-mails on top of those? Version: 2.4.2. Thank you, Ákos

1 0

Dovecot 2.4.0: Error with Oauth2 login after successful introspection
by sukanyamorbale＠gmail.com 31 Oct '25

31 Oct '25

Hello, I upgraded Dovecot from version 2.3.21 to 2.4.0. In version 2.3.21, I encountered issues with OAuth2 authentication that had worked correctly in earlier releases. Specifically, the active_attribute check was failing, even though Keycloak was sending the active value as true. After upgrading to Dovecot 2.4.0, the active attribute is now validated successfully, and token introspection completes as expected. However, I am now encountering the following error: 2025-10-30 14:43:41.438 Oct 30 13:43:41 auth: Panic: file expansion-statement.c: line 30 (var_expand_execute_stmt): assertion failed: (value != NULL) 2025-10-30 14:43:41.444 Oct 30 13:43:41 auth-worker(354): Debug: conn unix:auth-worker (pid=113,uid=101): Disconnected: Connection closed (fd=-1) 2025-10-30 14:43:41.443 Oct 30 13:43:41 auth: Error: Raw backtrace: #0 test_subprocess_fork[0x7f03870fc510] -> #1 backtrace_append[0x7f03870fc7c0] -> #2 backtrace_get[0x7f03870fc960] -> #3 event_filter_match_iter_init[0x7f0387106bc0] -> #4 i_syslog_fatal_handler[0x7f0387106d00] -> #5 i_panic[0x7f0387033c8e] -> #6 [unw_get_proc_name() failed: -10] -> #7 var_expand_program_execute[0x7f0387070460] -> #8 settings_file_get[0x7f0387083550] -> #9 settings_parse_keyidx_value_nodup[0x7f0387085660] -> #10 settings_parse_keyidx_value_nodup[0x7f0387085d70] -> #11 settings_parse_keyidx_value_nodup[0x7f0387087180] -> #12 settings_get[0x7f03870877b0] -> #13 auth_worker_auth_request_new[0x558c60949050] -> #14 auth_worker_auth_request_new[0x558c609496e0] -> #15 oauth2_json_tree_build[0x7f03870432f0] -> #16 oauth2_json_tree_build[0x7f03870433d0] -> #17 oauth2_request_parse_json[0x7f03870435a0] -> #18 http_client_request_callback[0x7f0387091ee0] -> #19 http_client_connection_lost_peer[0x7f0387094850] -> #20 http_client_peer_connection_failure[0x7f038709a090] -> #21 io_loop_call_io[0x7f0387122780] -> #22 io_loop_handler_run_internal[0x7f0387123aa0] -> #23 io_loop_handler_run[0x7f0387123c40] -> #24 io_loop_run[0x7f0387123e40] -> #25 master_service_run[0x7f0387075720] -> #26 main[0x558c60931e80] -> #27 __libc_init_first[0x7f0386dc9150] -> #28 __libc_start_main[0x7f0386dc9200] -> #29 _start[0x558c609323d0] Here is my current dovecot.conf. dovecot_config_version = 2.4.0 dovecot_storage_version = 2.4.0 protocols = imap pop3 lmtp auth_mechanisms { oauthbearer = yes xoauth2 = yes } oauth2 { introspection_url = https://client-name:client-key@iam.keyclock-url.com/auth/realms/realm-name/… introspection_mode = post active_attribute = active active_value = true username_attribute = preferred_username } userdb static { fields { uid = vmail gid = vmail home = /home/vmail/%{user | domain}/%{user | username} } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { mode = 0600 user = postfix group = postfix } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 user = postfix group = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = dovecot } service auth-worker { user = vmail } log_debug = category=auth auth_verbose = yes auth_debug_passwords = yes mail_driver = maildir mail_home = /home/vmail/%{user | domain}/%{user | username} mail_path = ~ ssl_server_cert_file = /etc/ssl/private/vmail.crt ssl_server_key_file = /etc/ssl/private/vmail.key ssl_server_dh_file = /etc/dovecot/dh.pem mail_debug = yes log_path = /dev/stdout info_log_path = /dev/stdout debug_log_path = /dev/stdout Regards, Sukanya Morbale

1 0

Panic with FTS_BACKEND_FLAG_TOKENIZED_INPUT and virtual mailboxes: file index-search-result.c: line 132
by markus-dovecot＠doits.de 31 Oct '25

31 Oct '25

Originally posted and debugged here: https://github.com/slusarz/dovecot-fts-flatcurve/issues/66 I have to following panic with fts flatcurve enabled: ``` Panic: file index-search-result.c: line 132 (index_search_result_update_flags): assertion failed: (result->search_args->args == &search_arg) Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x46) [0x74e9890a2846] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x22) [0x74e9890a2962] -> /usr/lib/dovecot/libdovecot.so.0(+0x10d81b) [0x74e9890af81b] -> /usr/lib/dovecot/libdovecot.so.0(+0x10d8b7) [0x74e9890af8b7] -> /usr/lib/dovecot/libdovecot.so.0(+0x5e2e2) [0x74e9890002e2] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x518a4) [0x74e9891d38a4] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(virtual_storage_sync_init+0x274e) [0x74e988bf8a9e] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x5c) [0x74e9891eff9c] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync+0x39) [0x74e9891f0039] -> dovecot/imap(cmd_select_full+0x1df) [0x62354bd8326f] -> dovecot/imap(command_exec+0xa4) [0x62354bd8b444] -> dovecot/imap(+0x22392) [0x62354bd89392] -> dovecot/imap(+0x22444) [0x62354bd89444] -> dovecot/imap(client_handle_input+0x1bd) [0x62354bd8989d] -> dovecot/imap(client_input+0x74) [0x62354bd89e64] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6d) [0x74e9890c603d] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x13a) [0x74e9890c77aa] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x54) [0x74e9890c60e4] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x74e9890c62a0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x17) [0x74e989036ad7] -> dovecot/imap(main+0x570) [0x62354bd7ad20] -> /lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x74e988c29d90] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x74e988c29e40] -> dovecot/imap(_start+0x25) [0x62354bd7ade5] ``` It happens when accessing virtual folder with filters like this: ``` something-*/excep-dev* header x-abc-exception "1" ``` The error happens on subsequent access of the folder: - Removing dovecot.index{,.log} files allows to access the virtual folder again - dovecot.index gets recreated on access and the folder can be accessed multiple times - Marking an e-mail read triggers the error, though! Now each next access raises the error - Removing dovecot.index{,.log} restores access again and the e-mails are still marked as read (so this information is not lost), until the next e-mail is marked as read: then the folder cannot be accessed again Slusarz debugged the backtrace and wrote a detailed description at https://github.com/slusarz/dovecot-fts-flatcurve/issues/66#issuecomment-229… which I'll quote here: > This is not a flatcurve bug - it is a bug within Dovecot's indexing/fts handling. > > (Detailed debug below, so that core team can understand the problem.) > > As discussed above, this bug is triggered with virtual mailboxes on subsequent accesses. The initial access will work fine; the assert crash only happens when the Dovecot lib-storage index code reads the indexes created for the virtual mailboxes. > > `index_search_result_update_appends()` in lib-storage/index/index-search-result.c > > * Inside this function, a "temporary search parameter to limit the search only to the new messages" is added to the mail search args. Later, it is checked that the mail_search args points to this same search parameter after the search is executed. It is this assert check that is failing, because the mail args is changing during the course of the search. > > * `i_assert(result->search_args->args == &search_arg);` > > > The search args are being altered in plugins/fts/fts-search.args.c, `fts_search_args_expand()`. Specifically, in that function, either `fts_search_args_expand_language_top_level()` or `fts_search_args_expand_tree()` is being called, which can replace the current args parameter with a new pointer. > > `fts_search_args_expand()` is being called in plugins//fts/fts-search.c by `fts_search_try_lookup()` when the FTS backend has the FTS_BACKEND_FLAG_TOKENIZED_INPUT flag set. Flatcurve has this flag set. > > This flag is defined in plugins/fts/fts-api-private.h. Comments say: > > ``` > /* Tokenize all the input. update_build_more() will be called a single > directly indexable token at a time. Searching will modify the search > args so that lookup() sees only tokens that can be directly > searched. */ > ``` > > Thus, the comments explicitly say the search args will be modified if this flag is set. This modification is incompatible with the assert check in `index_search_result_update_appends()`, which requires that the search args not be modified. > > The core team will have to determine whether this behavior is correct, or if the assert check is invalid. You can find some more discussion at https://github.com/slusarz/dovecot-fts-flatcurve/issues/66, but I think the most important part (the very detailed analysis from Slusarz, thanks again!) might be enough to understand and maybe fix the problem. Relevant information about the mail system: ``` # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21 (f6cd4b8e) # OS: Linux 6.5.0-45-generic x86_64 Ubuntu 22.04.4 LTS [...] namespace { location = virtual:~/virtual:LAYOUT=maildir++ prefix = _/ separator = / } [...] plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/db/shared fts = flatcurve fts_autoindex = yes fts_filters = normalizer-icu snowball stopwords fts_filters_en = lowercase snowball stopwords fts_languages = de en fts_tokenizer_email_address = maxlen=100 fts_tokenizer_generic = algorithm=simple maxlen=30 fts_tokenizers = generic email-address sieve = file:~/sieve;active=~/.dovecot.sieve } [...] ``` I can provide more information if you need. Thanks for looking into it!

2 3