- dovecot - dovecot.org

How to let postfix use dovecot to check quotas for virtual aliases
by jerome＠jolimont.fr 04 Feb '26

04 Feb '26

Hi all. Receiving an email for an alias, I got those errors: <alias(a)domain.tld>Recipient address rejected: Unknown user; I realized this happened when postfix queries dovecot about user quota. Basically, what happens is that postfix queries dovecot using the virutal alias as name, not the virtual user. And since dovecot doesn't find a user under that name, it returns an error and postfix rejects the mail. ### Configuration I followed the docs at https://doc.dovecot.org/latest/core/plugins/quota.html when setting up the server. /etc/postfix/main.cf ``` smtpd_recipient_restrictions = check_policy_service unix:private/quota-status ``` /etc/dovecot/conf.d/90-quota.conf ``` service quota-status { executable = quota-status -p postfix unix_listener /var/spool/postfix/private/quota-status { user = postfix } client_limit = 1 } ``` /etc/dovecot/conf.d/auth-sql.conf.ext ``` userdb sql { query = SELECT '/var/mail/vmail/'||maildir AS home, 110 AS uid, 113 AS gid, quota || 'B' AS quota_storage_size FROM mailbox WHERE username = '%{user}' iterate_query = SELECT username FROM mailbox } ``` ### Solution 1: modify user query This issue was reported and analyzed here: https://dovecot.dovecot.narkive.com/FtjhqCuU/postfix-aliases-with-quota-sta… and there: https://github.com/docker-mailserver/docker-mailserver/issues/2091 A comment (https://dovecot.dovecot.narkive.com/FtjhqCuU/postfix-aliases-with-quota-sta…) suggests to modify the SQL query to also look for aliases. I modified my query like so: ``` query = SELECT '/var/mail/vmail/'||maildir AS home, 110 AS uid, 113 AS gid, quota || 'B' AS quota_storage_size FROM mailbox JOIN alias ON mailbox.username = alias.goto WHERE alias.address = '%{user}'; ``` and it seemed to work. I mean, I can query user quota with an alias: doveadm quota get -u alias(a)domain.tld but the iterate query ignores aliases so doveadm quota get -A only lists users, not aliases (which is what I want) and I can't IMAP login using aliases (which is also what I want) since I didn't modify the password query either. I find this configuration slightly inconsistent: the user query returns aliases, not the iterate query. Is the user query really meant to return aliases as well? Also, I realized this query is broken for alias to multiple addresses. I'd get the following error: Recipient address rejected: Unknown user Surprisingly, it seems to only affect messages from an external source to an alias pointing to an external mailbox. Messages submitted locally (and perhaps messages sent to an alias to local destinations only, I'm not sure) were not affected. ### Solution 2: ignore aliases, it will fail later anyway On another server, I had this configuration: /etc/dovecot/conf.d $ vi 90-quota.conf (Don't put this in `plugin` on dovecot 2.4+.) ``` plugin { quota_status_success = DUNNO quota_status_nouser = DUNNO quota_status_overquota = "552 5.2.2 Mailbox is full" } ``` The alias is unknown so the check returns DUNNO and postfix lets the message pass (postfix log read "delivered via spamassassin service") but then it fails at sieve stage when writing the message: sieve: msgid=<xxx>: failed to store into mailbox 'INBOX': Quota exceeded (mailbox for user is full) The result is what is expected: the message is rejected due to mailbox full. But I don't think it was intended to work this way. And since the message is quota-rejected at sieve stage, I could remove the `check_policy_service` line since it will be rejected for a virtual user (not alias) as well anyway. Right? ### Question What is the recommended configuration to let postfix use dovecot to check quotas for virtual aliases? I couldn't find documentation for this specific use case. Ideally, postfix would query using the resolved user, not the alias. Can this be achieved? Should I remove the check and rely on the fact that writing the message fails at a later step anyway? Thanks. (Question also posted on ServerFault: https://serverfault.com/questions/1197914/how-to-let-postfix-use-dovecot-to…)

3 3

Question about behavior I wound up patching 2.4 to fix
by Andy Baugh 03 Feb '26

03 Feb '26

Howdy, I had a complaint from RoundCube users that the maildir quotas weren't accurate when they logged in after something wound up deleting their maildirsize file on Dovecot 2.4. Since that does IMAP GETQUOTAROOT to fetch the info, I figured we're probably not triggering quota recalculation on maildir like we did on dovecot 2.3 (which doesn't seem to have this issue). Wound up writing a patch to src/plugins/imap-quota/imap-quota-plugin.c to add a hook into cmd_setquota which looks to see if imap_quota is enabled, and if so trigger maildir quota recalculation on IMAP login. This does work to solve the reported issue, but I'm ultimately more curious whether this could even be considered a regression, as per your own documentation for the quota plugin: > Once the maildirsize reaches 5120 bytes, the quota is recalculated and the file is recreated. This makes sure that if quota happens to be broken (e.g. externally deleted files) it won't stay that way forever. This suggests to me that the behavior I'm "fixing" a regression in is actually working "as designed." As such my question would be: Is there a good reason I *should not* be doing this? I would of course be happy to share this patch with the list, but I'm not going to bother if it's actually something the maintainers are not interested in due to it not being a good idea in the first place. Thanks, -- Thomas "Andy" Baugh | Software Development Engineer IV andy.baugh(a)webpros.com www.webpros.com

1 0

Unexpected Configuration Error `Unknown setting: ssl_server_cert_file`
by David Weingut 02 Feb '26

02 Feb '26

Hello, I upgraded from Debian 12 to 13 and thereby also from dovecot 2.3 to 2.4. Now I am facing a weird error in dovecot. The actual error is the following # doveconf -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 22: ssl_server_cert_file : Unknown setting: ssl_server_cert_file The corresponding entry in my config is ssl = yes ssl_server_cert_file = /etc/letsencrypt/live/example.com/fullchain.pem ssl_server_key_file = /etc/letsencrypt/live/example.com/privkey.pem I am sorry if I missed something in the archives but I did not find any similar posts. Is there something I am missing here and what would be further required to debug this? Best, David Hello, I upgraded from Debian 12 to 13 and thereby also from dovecot 2.3 to 2.4. Now I am facing a weird error in dovecot. The actual error is the following # doveconf -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 22: ssl_server_cert_file : Unknown setting: ssl_server_cert_file The corresponding entry in my config is ssl = yes ssl_server_cert_file = /etc/letsencrypt/live/example.com/fullchain.pem ssl_server_key_file = /etc/letsencrypt/live/example.com/privkey.pem I am sorry if I missed something in the archives but I did not find any similar posts. Is there something I am missing here and what would be further required to debug this? Best, David

2 3

Compiling Dovecot 2.4 on OpenBSD
by Joel Mawhorter 01 Feb '26

01 Feb '26

I'm writing to see if anyone has had success compiling Dovecot 2.4 on OpenBSD. I can't seem to find any documentation that lists prerequisites. At the moment, the 2.4.2 source tarball from the Dovecot site does not seem to compile on my OpenBSD 7.8 system and the error message is not very helpful. I'm unsure if this is just a problem of some required package not being installed. If anyone could point me to info to help move forward, I would appreciate that. Joel

6 19

How can these MBOX files on a Dovecot-based IMAP server be converted to PST for access in Outlook?
by Rawnie Dolgato 31 Jan '26

31 Jan '26

MBOX files stored on a Dovecot-based IMAP server cannot be accessed directly in Microsoft Outlook, because Outlook does not support the MBOX file format. Outlook works with PST files, so a conversion step is mandatory. While it is technically possible to convert MBOX files to EML and then import them into Outlook, this approach is impractical for real-world scenarios. It is time-consuming, difficult to manage, and not suitable when handling bulk mailboxes or large datasets, which is typically the case with server-level backups. For this reason, an MBOX to PST conversion tool (such as BitRecover MBOX to PST Converter) is recommended. It supports bulk MBOX data, preserves folder structure and metadata, and allows selective migration based on criteria like date, sender, or subject. The process runs 100% offline, ensuring data security, and works on Windows, macOS, and Linux, making it suitable for both single and multi-mailbox migrations.

2 1

Meaning of auth-worker disconnected message and relation to LMTP 451 errors on Ubuntu
by Kim Haverblad 31 Jan '26

31 Jan '26

Hi dovecot list, I’m troubleshooting an LMTP delivery issue with Dovecot and would appreciate clarification on the meaning and impact of the following log message, which appears repeatedly during delivery attempts: auth-worker(2961): Debug: conn unix:auth-worker (pid=2948,uid=107): Disconnected: Connection closed (fd=-1) *Environment* * OS: Ubuntu (latest LTS, fully up to date) * Dovecot: distribution package (current version for Ubuntu) * MTA: Postfix * Delivery: LMTP to Dovecot * User database: MySQL (userdb lookup succeeds) * Mail storage: Maildir * Quotas: enabled via userdb (quota_rule) *Context* * LMTP accepts the recipient and completes userdb lookup successfully. * The mailbox path, uid, gid, and quota are correctly returned. * Postfix later receives a 451 4.3.0 Temporary internal error after the DATA phase. * The above auth-worker ... Disconnected: Connection closed (fd=-1)message appears around the same time. *Questions* 1. Is this Disconnected: Connection closed (fd=-1) message expected/normal behavior for auth-worker processes once a lookup is complete? 2. Under what circumstances would this indicate a real problem versus a harmless connection teardown? 3. Could this message itself contribute to, or explain, LMTP 451 4.3.0 Temporary internal error responses? 4. Are there specific auth-worker, LMTP, or debug settings recommended to determine whether this disconnect is abnormal? So far, authentication and userdb lookups appear clean, and there are no explicit permission or quota errors logged, which makes it unclear whether this message is relevant to the delivery failure or simply informational. Any clarification on how to interpret this log entry — and how to confirm whether it is benign or problematic — would be greatly appreciated. Kind Regards, Kim Hi dovecot list, I'm troubleshooting an LMTP delivery issue with Dovecot and would appreciate clarification on the meaning and impact of the following log message, which appears repeatedly during delivery attempts: auth-worker(2961): Debug: conn unix:auth-worker (pid=2948,uid=107): Disconnected: Connection closed (fd=-1) Environment o OS: Ubuntu (latest LTS, fully up to date) o Dovecot: distribution package (current version for Ubuntu) o MTA: Postfix o Delivery: LMTP to Dovecot o User database: MySQL (userdb lookup succeeds) o Mail storage: Maildir o Quotas: enabled via userdb (quota_rule) Context o LMTP accepts the recipient and completes userdb lookup successfully. o The mailbox path, uid, gid, and quota are correctly returned. o Postfix later receives a 451 4.3.0 Temporary internal error after the DATA phase. o The above auth-worker ... Disconnected: Connection closed (fd=-1) message appears around the same time. Questions 1. Is this Disconnected: Connection closed (fd=-1) message expected/normal behavior for auth-worker processes once a lookup is complete? 2. Under what circumstances would this indicate a real problem versus a harmless connection teardown? 3. Could this message itself contribute to, or explain, LMTP 451 4.3.0 Temporary internal error responses? 4. Are there specific auth-worker, LMTP, or debug settings recommended to determine whether this disconnect is abnormal? So far, authentication and userdb lookups appear clean, and there are no explicit permission or quota errors logged, which makes it unclear whether this message is relevant to the delivery failure or simply informational. Any clarification on how to interpret this log entry -- and how to confirm whether it is benign or problematic -- would be greatly appreciated. Kind Regards, Kim

2 4

sieve auto-creation/subscription - Thunderbird cannot re-arrange folders
by listy 31 Jan '26

31 Jan '26

Hi guys. In Thunderbird auto-subscribed folders - in my case a path with sub-folders - cannot be moved around, meaning top-bottom order. Parent folders Thunderbird shows in cursive and sub-folders (targets for sieve fules) are shown "normal" It seems impossible to re-arrange top/parent folders - but every other folder, top or not, which is not auto created & auto subscribed, Thunderbird can move around as expected. Anybody seen, anybody knows this and knows a way to "fix" it? many thanks, L.

2 4

How can these MBOX files on a Dovecot-based IMAP server be accessed in Outlook?
by Rawnie Dolgato 31 Jan '26

31 Jan '26

MBOX files stored on a Dovecot-based IMAP server cannot be accessed directly in Microsoft Outlook, because Outlook does not support the MBOX file format. Outlook works with PST files, so a conversion step is mandatory. While it is technically possible to convert MBOX files to EML and then import them into Outlook, this approach is impractical for real-world scenarios. It is time-consuming, difficult to manage, and not suitable when handling bulk mailboxes or large datasets, which is typically the case with server-level backups. For this reason, an MBOX to PST conversion tool (such as BitRecover MBOX to PST Converter) is recommended. It supports bulk MBOX data, preserves folder structure and metadata, and allows selective migration based on criteria like date, sender, or subject. The process runs 100% offline, ensuring data security, and works on Windows, macOS, and Linux, making it suitable for both single and multi-mailbox migrations.

1 0

Subscriptions file broken in 2.4.x against 2.3.21 (V2)
by DaLiV 31 Jan '26

31 Jan '26

Hello! /eror at update from 2.3.21 to 2.4.2 / Maildir+ currently is broken. posix - so main hierarchy separator is "/" for file "subscriptions" in versions 2.4 lost possibility to recognize v2 format also as writes v1 instead with header V2 ... so all users will lost their subscriptions and must re-subscribe depsite in folder persist file in format V2 (tab separated) ... on subscribe that appends subscriptions delimeted with "/" namespace Public { type = public prefix = Public/ mail_driver = maildir mail_path = /var/mail/Public/%{auth_user|domain}/ mail_index_private_path = pvt.idx/Public mailbox_list_layout=fs separator = / subscriptions = no list = children } seems not taking in account separators and using "." instead of "/" slighlz debugged - in subsfile_set_subscribed - that gets on subscription for processing : "name"="Public/TEST" but "separator" = "." therefore splits not and decides that is version "0" ... so - somewhere deeper or possible need additional configuration Hello! eror at update from 2.3.21 to 2.4.2 Maildir+ currently is broken. posix - so main hierarchy separator is "/" for file "subscriptions" in versions 2.4 lost possibility to recognize v2 format also as writes v1 instead with header V2 ... so all users will lost their subscriptions and must re-subscribe depsite in folder persist file in format V2 (tab separated) ... on subscribe that appends subscriptions delimeted with "/" namespace Public { type = public prefix = Public/ mail_driver = maildir mail_path = /var/mail/Public/%{auth_user|domain}/ mail_index_private_path = pvt.idx/Public mailbox_list_layout=fs separator = / subscriptions = no list = children } seems not taking in account separators and using "." instead of "/" slighlz debugged - in subsfile_set_subscribed - that gets on subscription for processing : "name"="Public/TEST" but "separator" = "." therefore splits not and decides that is version "0" ... so - somewhere deeper or possible need additional configuration

1 0

New Member
by Jochen Becker 30 Jan '26

30 Jan '26

Hi all My name is Jochen and I have joined the list in order to get some first hand advice on my journey of migrating my SOHO mail server from 2.3 to 2.4. I set up my first server back in 2005 or so. OpenSuse and Cyrus IMAP. That went fine until all of a sudden, some 8 or 10 years ago, Suse no longer supported Cyrus directly. So I switched over to Dovecot and did not regret it. My current production server (OpenSuse Leap 16, Dovecot 2.4.2) is running fine after a recent migration. But the HW is ageing and disk usage is getting close to 80%. So I got new and larger HW. I run OpenSuse Leap 16.0 and Dovecot 2.4.2 on it. As I ran into unsurmountable problems there (could not move mail_path away from /var/mail), I decided to set up a test system under Ubuntu server 25.10. There I have got Dovecot running much better, but still, I ran into problems I could not solve for quite some time now. So here I am. I will start with questions about Dovecot on Ubuntu - my test system - because there I hope my mistakes are not as bad. Aki, thanks for taking me on board. Kind regards Jochen Mainz, Germany

2 1