- dovecot - dovecot.org

dovecot-core: dovecot imap attempts to rmdir the configured mail_inbox_path
by pelzi＠feldner-bv.de 29 Aug '25

29 Aug '25

Package: dovecot-core Version: 1:2.4.1+dfsg1-6 Severity: important Dear Maintainer, after upgrading to trixie, I reconfigure dovecot - starting with the maintainer's config files due to the complete change of config syntax - and got it working again serving the existing mailboxes. I again configured /var/mail/%{user | username} as mail_inbox_path, at a separate location from all other mailboxes at some directory at user's home. All mailboxes remain in mbox format as before. When I set up a mail inbox path in shared namespace, dovecot is attempting to delete the lexicographically first user "someotheruser" who is sharing their mailboxes, whenever a user "someuser" with read access to that mailboxes is updating the mailbox list: journalctl output with mail_inbox_path setup for shared namespace ----------------------------------------------------------------- Aug 16 16:43:59 somehost systemd[1]: Started dovecot.service - Dovecot IMAP/POP3 email server. Aug 16 16:44:05 somehost dovecot[65636]: imap-login: Login aborted: Logged out (no auth attempts in 0 secs) (no_auth_attempts): user=<>, rip=some::ipv6, lip=some::ipv6, session=<xojHiXw8zKP95iU4WzA7U7on6//+m0as> Aug 16 16:44:14 somehost auth[65647]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=someuser rhost=some::ipv6 user=someuser Aug 16 16:44:14 somehost dovecot[65636]: imap-login: Logged in: user=<someuser>, method=PLAIN, rip=some::ipv6, lip=some::ipv6, mpid=65651, TLS, session=<0klNinw8fJIqAgkIAbCIAAL////+ESJD> Aug 16 16:44:14 somehost dovecot[65636]: imap(someuser)<65651><0klNinw8fJIqAgkIAbCIAAL////+ESJD>: Disconnected: Logged out in=98 out=1253 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Aug 16 16:44:14 somehost auth[65647]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=someuser rhost=some::ipv6 user=someuser Aug 16 16:44:14 somehost dovecot[65636]: imap-login: Logged in: user=<someuser>, method=PLAIN, rip=some::ipv6, lip=some::ipv6, mpid=65656, TLS, session=<tE5Oinw8hpIqAgkIAbCIAAL////+ESJD> Aug 16 16:44:14 somehost dovecot[65636]: imap(someuser)<65656><tE5Oinw8hpIqAgkIAbCIAAL////+ESJD>: Error: rmdir(/var/mail/someotheruser) failed: Permission denied ----------------------------------------------------------------- (Note: the authentication failure listed here appears to come from a certain pam module that doesn't know someuser, but is cured by another pam module in the stack that can authenticate someuser) This otheruser's INBOX will _not_ be displayed in the folder list for someuser, whereas the INBOX of lexicographically following user is not attempted to rmdir, and _do_ show up for the authorized someuser. When, for testing purposes, I remove mail_inbox_path from the shared namespace's configuration, obviously all otheruser's INBOX'es disappear from the folder list of someuser. But now dovecat attempts to rmdir someuser's own inbox: journalctl output with no mail_inbox_path configured for shared namespace, but only for inbox namespace ---------------------------------------------------------------- Aug 16 16:34:48 mailserver systemd[1]: Started dovecot.service - Dovecot IMAP/POP3 email server. Aug 16 16:34:48 mailserver unix_chkpwd[65322]: password check failed for user (someuser) Aug 16 16:34:48 mailserver auth[65320]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=someuser rhost=some::ipv6 user=someuser Aug 16 16:34:48 mailserver dovecot[65315]: imap-login: Logged in: user=<someuser>, method=PLAIN, rip=some::ipv6 lip=some::ipv6, mpid=65324, TLS, session=<uViUaHw8psgqAgkIAbCIAAL////+ESJD> Aug 16 16:34:48 mailserver dovecot[65315]: imap(someuser)<65324><uViUaHw8psgqAgkIAbCIAAL////+ESJD>: Error: rmdir(/var/mail/someuser) failed: Permission denied ---------------------------------------------------------------- In this case, however someuser's INBOX remains in the folder list. *** Reporter, please consider answering these questions, where appropriate *** * What led up to the situation? The upgrade to version 2.4.1 combined with a complete new configuration. -- Package-specific info: dovecot configuration --------------------- ... mail_driver = mbox mail_gid = familie mail_home = /home/%{user | username} mail_inbox_path = /var/mail/%{user | username} mail_path = ~/IMail mail_plugins { acl = yes fts = yes fts_solr = yes } mail_privileged_group = mail ... mail_shared_explicit_inbox = yes protocols { imap = yes sieve = yes } passdb pam { } userdb passwd { } namespace inbox { mail_driver = mbox mail_inbox_path = /var/mail/%{user | username} mail_path = ~/IMail inbox = yes subscriptions = yes type = private mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } namespace shared { mail_driver = mbox # this following setting removed for 2nd test mail_inbox_path = /var/mail/%{owner_user | username } mail_index_private_path = ~/.dovecot-index/shared/%{owner_user} mail_path = %{owner_home}/IMail list = yes prefix = shared/$username/ separator = / subscriptions = no type = shared } acl_sharing_map { dict file { path = /var/lib/dovecot/db/shared-mailboxes.db } } protocol imap { mail_plugins { imap_acl = yes } } service imap-login { inet_listener imap { } inet_listener imaps { } } service lmtp { unix_listener lmtp { } } service imap { } service pop3 { } service auth { unix_listener auth-userdb { group = users mode = 0660 user = mail } unix_listener auth-exim { group = sasl mode = 0660 type = auth-legacy user = mail } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/letsencrypt/live/somedomain/fullchain.pem key_file = /etc/letsencrypt/live/somedomain/privkey.pem } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service managesieve { } language de { default = yes } language en { } fts solr { url = http://localhost:8983/solr/dovecot/ } -- System Information: Debian Release: 13.0 APT prefers stable-security APT policy: (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 6.12.41+deb13-amd64 (SMP w/4 CPU threads; PREEMPT) Kernel taint flags: TAINT_FIRMWARE_WORKAROUND, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) Versions of packages dovecot-core depends on: ii adduser 3.152 ii dovecot-sieve 1:2.4.1+dfsg1-6 ii init-system-helpers 1.68 ii libapparmor1 4.1.0-1 ii libbz2-1.0 1.0.8-6 ii libc6 2.41-12 ii libcap2 1:2.75-10+b1 ii libcrypt1 1:4.4.38-1 ii libexttextcat-2.0-0 3.4.7-1+b1 ii libicu76 76.1-4 ii liblua5.4-0 5.4.7-1+b2 ii liblz4-1 1.10.0-4 ii libpam-runtime 1.7.0-5 ii libpam0g 1.7.0-5 ii libsodium23 1.0.18-1+b2 ii libssl3t64 3.5.1-1 ii libstemmer0d 2.2.0-4+b2 ii libsystemd0 257.7-1 ii libtirpc3t64 1.3.6+ds-1 ii libunwind8 1.8.1-0.1 ii libzstd1 1.5.7+dfsg-1 ii openssl 3.5.1-1 ii ssl-cert 1.1.3 ii ucf 3.0052 ii zlib1g 1:1.3.dfsg+really1.3.1-1+b1 dovecot-core recommends no packages. Versions of packages dovecot-core suggests: pn dovecot-flatcurve <none> pn dovecot-gssapi <none> ii dovecot-imapd 1:2.4.1+dfsg1-6 pn dovecot-ldap <none> pn dovecot-lmtpd <none> ii dovecot-managesieved 1:2.4.1+dfsg1-6 pn dovecot-mysql <none> pn dovecot-pgsql <none> pn dovecot-pop3d <none> ii dovecot-solr 1:2.4.1+dfsg1-6 pn dovecot-sqlite <none> pn dovecot-submissiond <none> pn ntp <none> Versions of packages dovecot-core is related to: ii dovecot-core [dovecot-common] 1:2.4.1+dfsg1-6 pn dovecot-dev <none> pn dovecot-gssapi <none> ii dovecot-imapd 1:2.4.1+dfsg1-6 pn dovecot-ldap <none> pn dovecot-lmtpd <none> ii dovecot-managesieved 1:2.4.1+dfsg1-6 pn dovecot-mysql <none> pn dovecot-pgsql <none> pn dovecot-pop3d <none> ii dovecot-sieve 1:2.4.1+dfsg1-6 pn dovecot-sqlite <none> -- Configuration Files: /etc/default/dovecot changed: ENABLED=1 ALLOW_COREDUMPS=1 -- debconf information: dovecot-core/ssl-cert-name: localhost dovecot-core/create-ssl-cert: false * dovecot-core/ssl-cert-exists:

2 5

Debian 13 with Dovecot-2.3 from dovecot repos
by Stefan G. Weichinger 29 Aug '25

29 Aug '25

I have 2 servers with Debian, set up with postfixadmin back then. So far they ran on Debian-12.x (12.11) with this as external repo.list: https://repo.dovecot.org/ce-2.3-latest/debian/bullseye/ This gives me: dovecot-core 2.3.21.1-2+debian11 Fine. Now I upgraded one of these servers to debian-13 and did NOT remove or edit the repo.list. Now I have Debian-13.0.0 with still dovecot-core 2.3.21.1-2+debian11: apt-cache policy dovecot-core dovecot-core: Installed: 2:2.3.21.1-2+debian11 Candidate: 2:2.3.21.1-2+debian11 Version table: *** 2:2.3.21.1-2+debian11 500 500 https://repo.dovecot.org/ce-2.3-latest/debian/bullseye bullseye/main amd64 Packages 100 /var/lib/dpkg/status 1:2.4.1+dfsg1-6 500 500 http://ftp.at.debian.org/debian trixie/main amd64 Packages 500 http://deb.debian.org/debian trixie/main amd64 Packages I don't mind, it's OK for me, I still have to work through the config changes needed to upgrade to dovecot-2.4 Is this combination OK, is it problematic? (for me things work so far, I can mail quite fine) I consider doing it on a customer server this evening, and hope for a quick "it's fine!" from this ml ;-) thanks all, Stefan

5 10

RHEL 8 key import error
by Gioele Pannetto 28 Aug '25

28 Aug '25

Hi, I'm having issues while installing Dovecot 2.4 on a Rocky Linux 8.10 server. This server was running Dovecot 2.3 but I wanted to upgrade it to 2.4. This is my repo file: [dovecot-2.4-latest] name=Dovecot 2.4 RHEL $releasever - $basearch baseurl=https://repo.dovecot.org/ce-2.4-latest/rhel/$releasever/RPMS/$basea… gpgkey=https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4 gpgcheck=1 enabled=1 When I run dnf update I get a GPG error: Problem opening package dovecot-2.4.1-4.x86_64.rpm Problem opening package dovecot-lua-2.4.1-4.x86_64.rpm Problem opening package dovecot-mysql-2.4.1-4.x86_64.rpm The downloaded packages were saved in cache until the next successful transaction. You can remove cached packages by executing 'dnf clean packages'. Error: GPG check FAILED If I try to import the key manually with rpm --import https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4 I get: error: https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4: key 1 import failed. I also tried it on a fresh Rocky Linux 8.10 installation and I get the same exact error, but running it on Rocky Linux 9.6 works just fine. This is my gpg --version on RHEL 8.10: gpg (GnuPG) 2.2.20 libgcrypt 1.8.5 Copyright (C) 2020 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Home: /root/.gnupg Supported algorithms: Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256 Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224 Compression: Uncompressed, ZIP, ZLIB, BZIP2 Any help is appreciated. Thanks! -- Gioele Pannetto

1 0

Sieve Scripts via SQL Dicts in Dovecot 2.4 not working?
by Niklas Meyer 28 Aug '25

28 Aug '25

Hello everyone, I am currently working on porting the Dovecot 2.4 configuration from the latest 2.3 version. During this process, I encountered issues with the Sieve filters, particularly those related to SQL dict mappings. The previous (2.3) configuration looked like this and worked: |map { pattern = priv/sieve/name/$script_nametable = sieve_before username_field = username value_field = idfields { script_name = $script_name} } map { pattern = priv/sieve/data/$idtable = sieve_before username_field = username value_field = script_data fields { id= $id} } | This resulted in the following SQL queries on the MySQL server: |2025-08-1511:01:29.237511SELECTid FROMsieve_after WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'2025-08-1511:01:29.236416SELECTid FROMsieve_before WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'| As you can see, there are SQL mappings for |sieve_before| and |sieve_after|, alongside a local file loaded prior to the SQL settings, as they are user-based. In Dovecot 2.3, everything worked and the scripts were executed. In 2.4, however, they no longer run. I adapted the configuration for dict SQL mapping for Sieve filters according to the documentation: |dict_mappriv/sieve/name/$script_name{ sql_table= sieve_before username_field = username value_field id { } # The script name field in the table to querykey_fieldscript_name { value= $script_name} } dict_map priv/sieve/data/$id{ sql_table= sieve_before username_field = username value_field script_data { } key_fieldid { value= $id} } | This also results in the dict proxy querying the database with the same pattern as before: |2025-08-1511:11:47.175184SELECTid FROMsieve_after WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'2025-08-1511:11:47.172952SELECTid FROMsieve_before WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'2025-08-1511:11:47.155786SELECTid FROMsieve_after WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'2025-08-1511:11:47.136030SELECTid FROMsieve_before WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'| However, unlike in 2.3, it now queries the DB twice. In the Sieve debug logs, I see the following: https://pastebin.com/PTKkLsDQ Notably: |Aug 1512:22:2443664c142e0a dovecot: lmtp(frittenjonas(a)derlinkman.de)<2407><mPFNN2AKn2hnCQAAhwrv7A>: Debug: Localdelivery failed: Temporarily unable toaccessnecessary Sieve scripts | This line concerns me. Here are the current Sieve script declarations: |sieve_script before{ type= beforedriver = file path= /var/vmail/sieve/global_sieve_before.sieve } sieve_script before2 { type= beforedriver = dict name= active dict proxy { name= sieve_before sieve_script_bin_path = /var/vmail/sieve_before_bindir } } sieve_script after{ type= afterdriver = file path= /var/vmail/sieve/global_sieve_after.sieve } sieve_script after2 { type= afterdriver = dict name= active dict proxy { name= sieve_after sieve_script_bin_path = /var/vmail/sieve_after_bindir } } # Personal scripts sieve_script personal { type= personal driver = file path= ~/sieve active_path = ~/.dovecot.sieve } | The dict proxy configuration, pointing to the dict_map SQL query above, looks like this: |dict sieve_after { driver = sql!include/etc/dovecot/sql/dovecot-dict-sql-sieve_after.conf } dict sieve_before { driver = sql!include/etc/dovecot/sql/dovecot-dict-sql-sieve_before.conf } | Thanks for your guidance. Kind regards Niklas Meyer Maintainer of the mailcow project Hello everyone, I am currently working on porting the Dovecot 2.4 configuration from the latest 2.3 version. During this process, I encountered issues with the Sieve filters, particularly those related to SQL dict mappings. The previous (2.3) configuration looked like this and worked: map { pattern = priv/sieve/name/$script_name table = sieve_before username_field = username value_field = id fields { script_name = $script_name } } map { pattern = priv/sieve/data/$id table = sieve_before username_field = username value_field = script_data fields { id = $id } } This resulted in the following SQL queries on the MySQL server: 2025-08-15 11:01:29.237511 SELECT id FROM sieve_after WHERE script_name = 'active' AND username = '[1]frittenjonas(a)derlinkman.de' 2025-08-15 11:01:29.236416 SELECT id FROM sieve_before WHERE script_name = 'active' AND username = '[2]frittenjonas(a)derlinkman.de' As you can see, there are SQL mappings for sieve_before and sieve_after, alongside a local file loaded prior to the SQL settings, as they are user-based. In Dovecot 2.3, everything worked and the scripts were executed. In 2.4, however, they no longer run. I adapted the configuration for dict SQL mapping for Sieve filters according to the documentation: dict_map priv/sieve/name/$script_name { sql_table = sieve_before username_field = username value_field id { } # The script name field in the table to query key_field script_name { value = $script_name } } dict_map priv/sieve/data/$id { sql_table = sieve_before username_field = username value_field script_data { } key_field id { value = $id } } This also results in the dict proxy querying the database with the same pattern as before: 2025-08-15 11:11:47.175184 SELECT id FROM sieve_after WHERE script_name = 'active' AND username = '[3]frittenjonas(a)derlinkman.de' 2025-08-15 11:11:47.172952 SELECT id FROM sieve_before WHERE script_name = 'active' AND username = '[4]frittenjonas(a)derlinkman.de' 2025-08-15 11:11:47.155786 SELECT id FROM sieve_after WHERE script_name = 'active' AND username = '[5]frittenjonas(a)derlinkman.de' 2025-08-15 11:11:47.136030 SELECT id FROM sieve_before WHERE script_name = 'active' AND username = '[6]frittenjonas(a)derlinkman.de' However, unlike in 2.3, it now queries the DB twice. In the Sieve debug logs, I see the following: [7]https://pastebin.com/PTKkLsDQ Notably: Aug 15 12:22:24 43664c142e0a dovecot: lmtp([8]frittenjonas(a)derlinkman.de)<2407><mPFNN2AKn2hnCQAAhwrv7A>: Debug: Local delivery failed: Temporarily unable to access necessary Sieve scripts This line concerns me. Here are the current Sieve script declarations: sieve_script before { type = before driver = file path = /var/vmail/sieve/global_sieve_before.sieve } sieve_script before2 { type = before driver = dict name = active dict proxy { name = sieve_before sieve_script_bin_path = /var/vmail/sieve_before_bindir } } sieve_script after { type = after driver = file path = /var/vmail/sieve/global_sieve_after.sieve } sieve_script after2 { type = after driver = dict name = active dict proxy { name = sieve_after sieve_script_bin_path = /var/vmail/sieve_after_bindir } } # Personal scripts sieve_script personal { type = personal driver = file path = ~/sieve active_path = ~/.dovecot.sieve } The dict proxy configuration, pointing to the dict_map SQL query above, looks like this: dict sieve_after { driver = sql !include /etc/dovecot/sql/dovecot-dict-sql-sieve_after.conf } dict sieve_before { driver = sql !include /etc/dovecot/sql/dovecot-dict-sql-sieve_before.conf } Thanks for your guidance. Kind regards Niklas Meyer Maintainer of the mailcow project References Visible links 1. mailto:frittenjonas@derlinkman.de 2. mailto:frittenjonas@derlinkman.de 3. mailto:frittenjonas@derlinkman.de 4. mailto:frittenjonas@derlinkman.de 5. mailto:frittenjonas@derlinkman.de 6. mailto:frittenjonas@derlinkman.de 7. https://pastebin.com/PTKkLsDQ 8. mailto:frittenjonas@derlinkman.de

3 5

Public namespace - configuration help (new to Dovecot) - version 2.3.x
by daniel.botting＠codethink.co.uk 27 Aug '25

27 Aug '25

Hi all, I'm configuring a public namespace for an existing Dovecot install, I have the public namespace configured and working in a basic manner (it can be subscribed to in an MUA and mail can be moved into it for a specified user named in the dovecot-acl file). I've followed the official docs: - https://doc.dovecot.org/2.3/configuration_manual/shared_mailboxes/public_sh… When I configure the MUA (Thunderbird) I can see the public namespace and a subfolder that I've manually created underneath (with new/cur/tmp folders, parent public folders also has a new tmp cur directories, mail cannot be moved into public top level folder), but it is displayed as below when subscribed to: public^subfolder I've resolved this by changing the separator to a / , however as per my doveconf -n below I then received a separator conflict, which I resolved by changing the separator for the default namespace to also be a / . As the default namespace is already using period ( . ) on the production servers, I'd like to continue using this separator and not / separator. The existing install of a couple of hundred mailboxes and I'm concerned I'll break the mailboxes /any existing sieve filters. I would like the public folder to display with an empty prefix as below, but I understand you cannot have two 'prefix =' (empty prefixes) : subfolder doveconf -n output below: # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21.1 (49005e73) # OS: Linux 5.10.0-35-cloud-amd64 x86_64 Debian 11.11 # Hostname: imap-server.hostname.co.uk auth_verbose = yes default_vsz_limit = 0 doveadm_password = # hidden, use -P to show it first_valid_gid = 8 first_valid_uid = 8 last_valid_gid = 8 last_valid_uid = 8 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_gid = 8 mail_location = maildir:~/Maildir mail_plugins = " notify replication acl" mail_uid = 8 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapflags namespace { list = no location = maildir:/srv/vmail/public:INDEXPVT=~/Maildir/public prefix = Public/ separator = / subscriptions = no type = public } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / <--- I'd like this to be a . instead } namespace subscriptions { hidden = yes list = no location = prefix = subscriptions/ <--- had to put something here because inbox namespace was empty subscriptions = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile mail_replica = tcps:other-replica.domain.co.uk:port number sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/common.sieve sieve_dir = ~/sieve sieve_extensions = +editheader +imapflags } postmaster_address = postmaster(a)domain.co.uk protocols = " imap sieve pop3" replication_dsync_parameters = -d -N -l 15 -U -T 10 replication_max_conns = 24 service aggregator { fifo_listener replication-notify-fifo { user = mail } unix_listener replication-notify { user = mail } } service auth { unix_listener /var/run/dovecot-exim-bridge { mode = 0660 user = Debian-exim } } service doveadm { inet_listener { port = <replica port number> ssl = yes } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 512 process_min_avail = 4 service_count = 1 } service imap { process_limit = 1024 } service managesieve-login { inet_listener sieve { port = <port number> } process_min_avail = 1 service_count = 8 vsz_limit = 256 M } service managesieve { process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = <path/to/fullchain.pem ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap override_fields = home=/var/mail/%u uid=mail gid=mail } protocol lda { mail_plugins = " notify replication acl sieve" } protocol imap { mail_max_userip_connections = 32 mail_plugins = " notify replication acl acl" } protocol sieve { mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_line_length = 64 k } Also the public folder is not displayed in Roundcube webmail in folder sections to be subscribed to. doveadm mailbox list -u <username> I appreciate that replication does not work with public mailboxes, I'll have to look at that further. Many thanks Dan

2 3

Supporting both "username" to username@domain.com
by Alex 26 Aug '25

26 Aug '25

Hi, I'm using dovecot-2.3.21 on fedora40 and have configured it to use only usernames without domain when logging in. Now apparently the new Outlook (1.2025.617.000) no longer supports the ability to change username for IMAP. Now what? We have other users who are using older versions of Outlook and Thunderbird and webmail that still support this login method. How can I support both? Here is my dovecot info. # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: Linux 6.12.6-100.fc40.x86_64 x86_64 Fedora release 40 (Forty) btrfs auth_mechanisms = plain login default_client_limit = 3000 default_process_limit = 4000 default_vsz_limit = 1 G dict { sql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = 209.216.XXX.60, 127.0.0.1 mail_gid = users mail_location = maildir:/home/%u/Maildir mail_max_userip_connections = 100 mail_plugins = " listescape last_login" mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { last_login_dict = proxy::sql last_login_key = # hidden, use -P to show it last_login_precision = ms sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = pop3 imap lmtp service anvil { client_limit = 12003 } service auth-worker { client_limit = 20000 } service auth { client_limit = 20000 unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { port = 993 ssl = yes } process_min_avail = 20 service_count = 0 vsz_limit = 1 G } service lmtp { executable = lmtp -L inet_listener lmtp { address = 127.0.0.1 port = 24 } process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_ca = </var/www/example.com-443/ssl/DigiCertCA-2022.crt ssl_cert = </var/www/example.com-443/ssl/example-combined-2025.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol lda { info_log_path = /var/log/dovecot-lda.log log_path = /var/log/dovecot-lda-errors.log } protocol imap { mail_max_userip_connections = 100 } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } local_name example.com { ssl_cert = </var/www/example.com-443/ssl/example-combined-2025.crt ssl_key = # hidden, use -P to show it } local_name users.example1.com { ssl_cert = </etc/letsencrypt/example1-fullchain.pem ssl_key = # hidden, use -P to show it } We're also using postfix to support this basic sasl username when sending. smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $myhostname broken_sasl_auth_clients = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanonymous Hi, I'm using dovecot-2.3.21 on fedora40 and have configured it to use only usernames without domain when logging in. Now apparently the new Outlook (1.2025.617.000) no longer supports the ability to change username for IMAP. Now what? We have other users who are using older versions of Outlook and Thunderbird and webmail that still support this login method. How can I support both? Here is my dovecot info. # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: Linux 6.12.6-100.fc40.x86_64 x86_64 Fedora release 40 (Forty) btrfs auth_mechanisms = plain login default_client_limit = 3000 default_process_limit = 4000 default_vsz_limit = 1 G dict { sql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = 209.216.XXX.60, 127.0.0.1 mail_gid = users mail_location = maildir:/home/%u/Maildir mail_max_userip_connections = 100 mail_plugins = " listescape last_login" mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { last_login_dict = proxy::sql last_login_key = # hidden, use -P to show it last_login_precision = ms sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = pop3 imap lmtp service anvil { client_limit = 12003 } service auth-worker { client_limit = 20000 } service auth { client_limit = 20000 unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { port = 993 ssl = yes } process_min_avail = 20 service_count = 0 vsz_limit = 1 G } service lmtp { executable = lmtp -L inet_listener lmtp { address = 127.0.0.1 port = 24 } process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_ca = </var/www/example.com-443/ssl/DigiCertCA-2022.crt ssl_cert = </var/www/example.com-443/ssl/example-combined-2025.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol lda { info_log_path = /var/log/dovecot-lda.log log_path = /var/log/dovecot-lda-errors.log } protocol imap { mail_max_userip_connections = 100 } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } local_name [1]example.com { ssl_cert = </var/www/example.com-443/ssl/example-combined-2025.crt ssl_key = # hidden, use -P to show it } local_name [2]users.example1.com { ssl_cert = </etc/letsencrypt/example1-fullchain.pem ssl_key = # hidden, use -P to show it } We're also using postfix to support this basic sasl username when sending. smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $myhostname broken_sasl_auth_clients = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanonymous References Visible links 1. http://example.com/ 2. http://users.example1.com/

9 14

INBOX is not part of "*" in dovecot-virtual
by Ákos Szőts 26 Aug '25

26 Aug '25

Hi everyone, I noticed that if I specify the following pattern in dovecot-virtual for my Virtual/Unseen mailbox, mails in INBOX are excluded: * -Drafts -Trash -Junk -Sent -Virtual/* UNSEEN It returns with 23 mails: a EXAMINE Virtual/Unseen * 23 EXISTS * 23 RECENT * OK [UNSEEN 1] First unseen. But when I add INBOX additionally after "*", the number grows to 42: a EXAMINE Virtual/Unseen * 42 EXISTS * 42 RECENT * OK [UNSEEN 1] First unseen. Is it expected that "*" doesn't include INBOX by default? As I see, the rest of the mailboxes within the same root (/) namespace are included by default. Config: namespace inbox { separator = / inbox = yes mail_path = %{home}/mail mail_index_path = %{home}/index/inbox mailbox INBOX { auto = subscribe } mailbox Trash { special_use = \Trash auto = subscribe } [...] } Dovecot version: 2.4.1. Thank you, Ákos

2 1

What's the difference between "UNKEYWORD \Seen" and "UNSEEN"?
by Ákos Szőts 25 Aug '25

25 Aug '25

Hi everyone, These two IMAP search commands return different values: a SEARCH UNSEEN * SEARCH 38 61 62 63 65 69 74 75 76 82 86 87 102 120 121 141 142 143 144 145 146 158 159 160 a SEARCH UNKEYWORD \Seen * SEARCH [All email IDs in the mailbox] a SEARCH KEYWORD \Seen * SEARCH [Empty] According to RFC 3501 <https://datatracker.ietf.org/doc/html/rfc3501#section-6.4.4>, in my interpretation, these two should be equal: > UNSEEN > Messages that do not have the \Seen flag set. Can you tell me what is causing this difference? I also ran force-resync on all my mails, just to be sure. Ákos Hi everyone, These two IMAP search commands return different values: a SEARCH UNSEEN * SEARCH 38 61 62 63 65 69 74 75 76 82 86 87 102 120 121 141 142 143 144 145 146 158 159 160 a SEARCH UNKEYWORD \Seen * SEARCH [All email IDs in the mailbox] a SEARCH KEYWORD \Seen * SEARCH [Empty] According to [1]RFC 3501, in my interpretation, these two should be equal: > UNSEEN > Messages that do not have the \Seen flag set. Can you tell me what is causing this difference? I also ran force-resync on all my mails, just to be sure. Akos References Visible links 1. https://datatracker.ietf.org/doc/html/rfc3501#section-6.4.4

2 2

Dovecot 2.4.1-4: Server SSL cert loaded in ssl_server_settings_check but lost in openssl_iostream_use_certificate_error
by Louis Villedieu 25 Aug '25

25 Aug '25

Dear dovecot mailing list, Maybe you'll have an idea. I upgraded from Debian bookworm to trixie this morning. Along with this upgrade, dovecot went to 2.4.1 . I adapted the configuration files. The server starts but the clients cannot retrieve emails. The error message in the logs is: dovecot: pop3-login: Error: Failed to initialize SSL connection: Couldn't initialize SSL server context: Can't load SSL certificate (ssl_server_cert_file setting): The certificate is empty In iostream-openssl-context.c:ssl_iostream_context_set(), I adapted this error message to see whether a path could be found for this server cert file: t_strdup_printf( "Can't load SSL certificate (%s setting with path '%s'): %s", ctx->client_ctx ? "ssl_client_cert_file" : "ssl_server_cert_file", set->cert.cert.path, openssl_iostream_use_certificate_error(set->cert.cert.content) The outcome was that the path is empty as well:dovecot: pop3-login: Error: Failed to initialize SSL connection: Couldn't initialize SSL server context: Can't load SSL certificate (ssl_server_cert_file setting with path ''): The certificate is empty Then, I adapted ssl-settings.c:ssl_server_settings_check() to show the content of the server certificate file at that stage (with stdio):FILE *file_ptr;file_ptr=fopen("/tmp/output.txt","a");if(file_ptr!=NULL){fprintf(file_ptr,"server check %s\n",set->ssl_server_cert_file);fclose(file_ptr);} The outcome was that the file is not empty at this stage: server check /etc/letsencrypt/live/<MY_SERVER>/fullchain.pem -----BEGIN CERTIFICATE----- <MY_CERT> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- <MY_CERT> -----END CERTIFICATE----- Is there any potential reason for this disappearance between the calls? Thanks! Louis. Dear dovecot mailing list, Maybe you'll have an idea. I upgraded from Debian bookworm to trixie this morning. Along with this upgrade, dovecot went to 2.4.1 . I adapted the configuration files. The server starts but the clients cannot retrieve emails. The error message in the logs is: dovecot: pop3-login: Error: Failed to initialize SSL connection: Couldn't initialize SSL server context: Can't load SSL certificate (ssl_server_cert_file setting): The certificate is empty In iostream-openssl-context.c:ssl_iostream_context_set(), I adapted this error message to see whether a path could be found for this server cert file: t_strdup_printf( "Can't load SSL certificate (%s setting with path '%s'): %s", ctx->client_ctx ? "ssl_client_cert_file" : "ssl_server_cert_file", set->cert.cert.path, openssl_iostream_use_certificate_error(set->cert.cert.content) The outcome was that the path is empty as well: dovecot: pop3-login: Error: Failed to initialize SSL connection: Couldn't initialize SSL server context: Can't load SSL certificate (ssl_server_cert_file setting with path ''): The certificate is empty Then, I adapted ssl-settings.c:ssl_server_settings_check() to show the content of the server certificate file at that stage (with stdio): FILE *file_ptr;file_ptr=fopen("/tmp/output.txt","a");if(file_ptr!=NULL){fprintf(file_ptr,"server check %s\n",set->ssl_server_cert_file);fclose(file_ptr);} The outcome was that the file is not empty at this stage: server check /etc/letsencrypt/live/<MY_SERVER>/fullchain.pem -----BEGIN CERTIFICATE----- <MY_CERT> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- <MY_CERT> -----END CERTIFICATE----- Is there any potential reason for this disappearance between the calls? Thanks! Louis.

3 2

Re: Dovecot 2.4.1-4: Server SSL cert loaded in ssl_server_settings_check but lost in openssl_iostream_use_certificate_error
by Rory Campbell-Lange 24 Aug '25

24 Aug '25

On 24/08/25, louis.villedieu(a)yahoo.com (louis.villedieu(a)yahoo.com) wrote: > I tried yesterday all the options you proposed in terms of configuration. > > I don't think the configuration has an issue since the settings are loaded > successfully but not kept. > > I presume this can be due to an incompatibility of 2.4.1 with my system. That seems a bit odd. Are you sure you have cut out the "<" symbols relating to ssl certificate/key paths, and that the certificates are the full-chain certs? Anyhow, with reference to https://github.com/rorycl/dovecot-config, you can easily debug your issue with Dovecot 2.4.1's official docker image. Simply edit the provided dovecot.conf to include your ssl settings and the debugging log to stderr should quickly show you where your issue is in a safe environment. Be aware that if you run docker from the local directory with your dovecot.conf etc to load into docker you need to use the --volume/v or --mount options to put that directory at /etc/dovecot in the container: docker run -p 1143:143 -p 1993:993 \ -v ./:/etc/dovecot \ dovecot/dovecot:latest If you have specified ssl files at, for example, /etc/dovecot/ssl, you need to put your ssl certificates and keys in an ssl directory of the current directory, or make another -v / --mount mount.

1 0

Virtual inbox in imap with dovecot 2.4
by aholiveira＠gmail.com 24 Aug '25

24 Aug '25

Hello, I've recently upgraded to debian 13 (trixie), from debian 12 (bookworm). In bookworm I had the following setup working like perfection: - All mail is sorted to some mailbox folder through sieve (either a "specialized" one, or a generic folder under the inbox name like year.month - 2025.08). - No email whatsoever was ever reaching the inbox. - Then I had a virtual inbox which would get me all the "unread" or "flagged" messages This way I had all my email sorted out from the delivery and my inbox cleared itself once I had read an email. For this I was using the stock debian dovecot packages, and now, after the upgrade to debian 13 I'm also using the stock debian packages. However, this whole neat setup broke and I can't get it to work again. I've searched dovecot's manual, asked two different AIs, did a number of web searches and adapted the new configuration files to the new syntax but dovecot refuses to list the emails in my INBOX folder. I've spent already several hours around this, to no avail. Unfortunately I didn't keep a copy of the config files from debian 12 so now I can't really compare but I did manually change the dovecot config files after the upgrade so that what I had running in debian 12 should work as before (it was refusing to start after the upgrade). Here is the output of dovecot -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.41+deb13-amd64 x86_64 Debian 13.0 # Hostname: myhost # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_mechanisms = plain login dovecot_storage_version = 2.4.0 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_driver = maildir mail_inbox_path = ~/Maildir mail_path = ~/Maildir mail_plugins { notify = yes mail_log = yes virtual = yes } mail_privileged_group = mail namespace_subscriptions = no protocols { imap = yes sieve = yes } passdb pam { } userdb passwd { } namespace inbox { inbox = yes prefix = separator = . subscriptions = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service submission-login { inet_listener submission { port = 587 } inet_listener submissions { } } service lmtp { unix_listener lmtp { } } service imap { executable = imap imap-postlogin } service pop3 { } service submission { } service auth { unix_listener auth-userdb { } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/dovecot/private/dovecot.pem dh_file = /usr/share/dovecot/dh.pem key_file = /etc/dovecot/private/dovecot.key } protocol lda { mail_plugins { sieve = yes } } protocol imap { mail_max_userip_connections = 40 } service managesieve-login { inet_listener sieve { port = 4190 } } namespace 00-virtual { mail_driver = virtual mail_path = ~/Maildir/virtual hidden = no inbox = no list = yes prefix = 00-virtual. separator = . } namespace virtual { mail_driver = virtual mail_path = ~/Maildir/virtual hidden = no inbox = no list = yes prefix = virtual. separator = . } namespace real { hidden = yes inbox = no list = no prefix = real. separator = . subscriptions = no } service imap-postlogin { executable = script-login /usr/local/bin/dovecot-postlogin.sh unix_listener imap-postlogin { } } passdb deny { deny = yes driver = passwd-file passwd_file_path = /etc/dovecot/deny-users } This is /usr/local/bin/dovecot-postlogin.sh #!/bin/sh VIRTUAL=$HOME/Maildir/virtual # AUTOMATICALLY VIRTUALIZE INBOX # # If the user creates a virtual/INBOX/dovecot-virtual, # switch the inbox to the virtual namespace. if [ -d "${VIRTUAL}/INBOX" ]; then export USERDB_KEYS="$USERDB_KEYS NAMESPACE/VIRTUAL/INBOX NAMESPACE/INBOX/INBOX" logger -p mail.debug "$USERDB_KEYS $VIRTUAL $@" /usr/bin/env USERDB_KEYS="$USERDB_KEYS" NAMESPACE/VIRTUAL/INBOX=yes NAMESPACE/INBOX/INBOX=no "$@" else exec "$@" fi This is the content of $HOME/Maildir/virtual/INBOX/dovecot-virtual real.* OR UNSEEN FLAGGED I'm also getting this message anytime that I login with a mail client: 2025-08-22T21:52:29.466584+01:00 ****** dovecot: imap(***)<316863><svBRYvo8+pXAqFoB>: Error: Mailbox INBOX: Failed to autocreate mailbox: Can't create virtual mailboxes Note that the 00-virtual namespace was added just as a temporary check and I want to delete it once this is working again. I have also a file under $HOME/Maildir/virtual/Flagged/dovecot-virtual with the exact same contents as the INBOX one above which get's me a virtual folder that works correctly (getting all my unread and flagged email in a single folder), so the filter works. Just changing the INBOX from the real to the virtual one fails and I can't understand what am I doing wrong or what am I missing. Can someone please help me? I'm completely lost and frustrated on this. Thank you very much.

4 5

2.4 config nightmares
by Dharma Mati 24 Aug '25

24 Aug '25

I have been trying for weeks to make it work.But I simply cant. Would you plz kindly tell me how it should be? : doveconf -n # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: Linux 6.1.67-gentoo x86_64 Gentoo Base System release 2.17 ext4 # Hostname: .................. auth_mechanisms = cram-md5 plain login disable_plaintext_auth = no listen = * mail_location = maildir:/home/vmail/%d/%n/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = * driver = pam } passdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } ssl_cert = </etc/ssl/private/server.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } userdb { args = uid=vmail gid=vmail home=/home/vmail/%d/%n driver = static } local_name asl.dynu.net { ssl_cert = </etc/letsencrypt/live/asl.dynu.net/fullchain.pem ssl_key = # hidden, use -P to show it } local_name { ssl_cert = </etc/letsencrypt/live//fullchain.pem ssl_key = # hidden, use -P to show it } etc. Plz help me.And kindly consider creating a migration tool.Thanks a lot Andreas I have been trying for weeks to make it work.But I simply cant. Would you plz kindly tell me how it should be? : doveconf -n # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: Linux 6.1.67-gentoo x86_64 Gentoo Base System release 2.17 ext4 # Hostname: .................. auth_mechanisms = cram-md5 plain login disable_plaintext_auth = no listen = * mail_location = maildir:/home/vmail/%d/%n/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = * driver = pam } passdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } ssl_cert = </etc/ssl/private/server.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } userdb { args = uid=vmail gid=vmail home=/home/vmail/%d/%n driver = static } local_name [1]asl.dynu.net { ssl_cert = </etc/letsencrypt/live/[2]asl.dynu.net/fullchain.pem ssl_key = # hidden, use -P to show it } local_name { ssl_cert = </etc/letsencrypt/live//fullchain.pem ssl_key = # hidden, use -P to show it } etc. Plz help me.And kindly consider creating a migration tool.Thanks a lot Andreas References Visible links 1. http://asl.dynu.net/ 2. http://asl.dynu.net/fullchain.pem

8 9

IMAPSieve filters don't run on virtual mailboxes
by Ákos Szőts 24 Aug '25

24 Aug '25

Hi everyone, In the following configuration my IMAPSieve script doesn't run on the configured "copy" action when I assign it to a virtual mailbox. However, using the very same config snippet on a regular mailbox, the script suddenly starts to work. Move direction: from virtual to virtual (INBOX/Primary to INBOX/Notification). Do you know how to assign IMAPSieve to virtual mailboxes? Virtual config: namespace virtual-classification { prefix = "INBOX/" separator = / mail_driver = virtual mail_path = /var/lib/dovecot/virtual/classification/en mail_index_path = %{home}/index/virtual/classification/en namespace_subscriptions = no mailbox Notification { auto = subscribe sieve_script classification-move1 { type = before cause = copy append path = /var/lib/dovecot/sieve/imapsieve.d/classification-move.sieve } } mailbox Primary { [...] } } Sieve script: require ["vnd.dovecot.debug"]; debug_log "IMAPSIEVE SCRIPT WAS CALLED!"; Virtual file: virtual/classification/en/Notification/dovecot-virtual: !INBOX KEYWORD classification-notification The same result with "!INBOX" and "INBOX". Inbox namespace (working example): namespace inbox { separator = / inbox = yes mail_path = %{home}/mail mail_index_path = %{home}/index/inbox mailbox "Archive" { special_use = \Archive auto = subscribe sieve_script classification-move1 { type = before cause = copy append path = /var/lib/dovecot/sieve/imapsieve.d/classification-move.sieve } } } In the latter case the script is called properly and I see the debug message in info.log. But in the virtual case, the script doesn't run. Debug logs of failing case: Mailbox INBOX: Mailbox opened Mailbox INBOX/Primary: Mailbox opened Mailbox INBOX: Mailbox opened Namespace inbox: Using permissions from /var/spool/mail/[...]//mail: mode=0700 gid=default Mailbox INBOX: Mailbox opened Mailbox INBOX: imapsieve: MOVE event Mailbox INBOX: UID 2147: Expunge requested Mailbox INBOX/Primary: UID 47: Expunge requested dict(file): dict created (driver=file) dict(file): Looking up 'shared/90b3ed0066c4fe670a000000b7545530/imapsieve/script' dict(file): Lookup finished for 'shared/90b3ed0066c4fe670a000000b7545530/imapsieve/script': not found Mailbox INBOX: imapsieve: Mailbox attribute /shared/imapsieve/script not found dict(file): Looking up 'shared/90b3ed0066c4fe670a000000b7545530/vendor/vendor.dovecot/pvt/server/imapsieve/script' dict(file): Lookup finished for 'shared/90b3ed0066c4fe670a000000b7545530/vendor/vendor.dovecot/pvt/server/imapsieve/script': not found Mailbox INBOX: imapsieve: Server attribute /shared/imapsieve/script not found duplicate db: Initialize sieve: Pigeonhole version 2.4.1-4 (0a86619f) initializing Loading modules from directory: /usr/lib64/dovecot/modules/sieve Module loaded: /usr/lib64/dovecot/modules/sieve/lib90_sieve_extprograms_plugin.so Module loaded: /usr/lib64/dovecot/modules/sieve/lib90_sieve_imapsieve_plugin.so sieve: Sieve Extprograms plugin for Pigeonhole version 2.4.1-4 (0a86619f) loaded sieve: Sieve imapsieve plugin for Pigeonhole version 2.4.1-4 (0a86619f) loaded fts-flatcurve: fts-flatcurve(INBOX): Expunge uid=2147 fts-flatcurve: fts-flatcurve(INBOX): Opened DB (RO) messages=136 version=1 shards=2 fts-flatcurve: fts-flatcurve(INBOX): Opened DB (RW, current.1755771145431021) messages=48 version=1 Mailbox INBOX: UID 2147: Mail expunged fts-flatcurve: fts-flatcurve(INBOX): Committed 1 changes to DB (RW, current.1755771145431021) in 0.003 secs fts-flatcurve: fts-flatcurve: Update transaction completed in 0.004 secs Mailbox INBOX/Primary: Backend mailbox INBOX changed: UIDNEXT changed: 2277 -> 2278 IMAPSieve config seems to work (based on the successful regular mailbox example), so I don't paste the whole sieve config (but in case it's necessary, I'll do it). Ákos

1 0

How to offer different translations for virtual namespaces with userdb?
by Ákos Szőts 23 Aug '25

23 Aug '25

Hi everyone, I'd like to configure a feature that, based on userdb locale settings, returns with differently translated string for the same virtual namespace mailbox name. This is where I ended up so far: group @namespaces virtual-virtual-english { mailbox All { auto = no special_use = \All } } group @namespaces virtual-virtual-hungarian { mailbox "Összes levél" { auto = no special_use = \All } } namespace virtual-virtual { prefix = Virtual/ separator = / mail_driver = virtual mail_path = /var/lib/dovecot/virtual/virtual mail_index_path = %{home}/index/virtual/virtual namespace_subscriptions = no list = children hidden = no } UserDB query works: Debug: Added setting via userdb: namespace/virtual-virtual/@namespaces=virtual-virtual-hungarian I had to create symlinks in the virtual/virtual directory (otherwise the Hungarian version wouldn't work): # virtual/virtual All &ANY-sszes lev&AOk-l -> All/ When I list the mailboxes, however, I get back all of them, not just the matching-language elements: * LIST (\Noselect \HasChildren) "/" Virtual * LIST (\HasNoChildren) "/" "Virtual/&ANY-sszes lev&AOk-l" * LIST (\HasNoChildren \All) "/" Virtual/All "list", "hidden", and "prefix" are seemingly not allowed within a group. How can I offer different translations for different users in my home setup? Is it possible to translate the namespace prefix? Dovecot version: 2.4.1. Thank you, Ákos

2 2

Missing IMAP METADATA Plugin
by Adam Miller 23 Aug '25

23 Aug '25

OS: Ubuntu 22.04.1 Dovecot: 2.3.16 (7e2e900c1a) When trying to enable the “imap_metadata” plugin, I get the following error: Plugin 'imap_metadata' not found from directory /usr/lib/dovecot/modules I have searched high and low via Google, StackOverflow and even ChatGPT (haha) but I cannot seem to find the package that provides the plugin. Does Dovecot have to be built from source for this plugin to be included? Any help is appreciated. Thank you!

8 8

getpwnam() failed: Resource temporarily unavailable
by Hauke Fath 22 Aug '25

22 Aug '25

Hi, I see a very peculiar Dovecot (2.3.21.1) authentication failure that concerns exactly one user: Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Debug: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: Handling PASSV request Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Debug: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: passwd(REDACTED_UID,84.136.89.217,<yZxQxMA8uL1UiFnZ>): Performing passdb lookup Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Debug: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: passwd(REDACTED_UID,84.136.89.217,<yZxQxMA8uL1UiFnZ>): lookup Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Error: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: passwd(REDACTED_UID,84.136.89.217,<yZxQxMA8uL1UiFnZ>): getpwnam() failed: Resource temporarily unavailable Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Debug: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: passwd(REDACTED_UID,84.136.89.217,<yZxQxMA8uL1UiFnZ>): Finished passdb lookup Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Debug: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: Finished: internal_failure This used to work, until a few months ago it stopped. The user can still authenticate to send mail through the same server. Changing the password didn't make a difference. Any ideas? Cheerio, Hauke -- The ASCII Ribbon Campaign Hauke Fath () No HTML/RTF in email Institut für Nachrichtentechnik /\ No Word docs in email TU Darmstadt Respect for open standards Ruf +49-6151-16-21344

3 3

How to remove non-existent virtual mailbox from index
by Ákos Szőts 21 Aug '25

21 Aug '25

Hi everyone, During experimentation I created a "Test1" mailbox under a virtual namespace: mailbox "Test1" { auto = no special_use = \All } I commented it out before restarting Dovecot, and it's never been subscribed to either. I see the Test1 directory is still within my "index" directory and there's a "dovecot.index.log" in it. When I try to force resync all my virtual mailboxes, doveadm complains about it: $ doveadm -D force-resync -A Virtual/* Debug: Namespace virtual-virtual: [...]/virtual/Test1 doesn't exist yet, using default permissions Debug: Namespace virtual-virtual: Using permissions from [...]/virtual: mode=0755 gid=default Error: Mailbox Virtual/Test1: mkdir_parents([...]/virtual/Virtual/Test1) failed: Permission denied Error: Mailbox Virtual/Test1: Failed to create path: [...]/virtual/Virtual/Test1 for mailbox Virtual/Test1: mkdir_parents([...]/virtual/Virtual/Test1) failed: Permission denied What is the proper command to remove it from the index? I tried "cache purge", but that fails, too. I can "rm -rf" the whole index directory and that solves this issue. However, I think there should be a more gentle solution. Thank you, Ákos

1 0

"imap-login" crashes at lib-ssl-iostream/iostream-ssl.c:55
by Ákos Szőts 21 Aug '25

21 Aug '25

Hi all, When I start "imap-login" without arguments, it crashes: gdb -ex run --args /usr/lib/dovecot/imap-login (gdb) thread apply all bt full Thread 1 (Thread 0x7f5bd50c6740 (LWP 625) "imap-login"): #0 0x00007f5bd545fe97in io_stream_ssl_global_init(set=0x56205ca355c8, error_r=0x7ffdf0e669a8) at ../lib-ssl-iostream/iostream-ssl.c:55 No locals. #1 0x00007f5bd558d15bin login_ssl_init() at /usr/src/debug/dovecot-2.4.1-4/src/login-common/main.c:343 ssl_set= 0x56205ca355c8 error= 0xc00000<error: Cannot access memory at address 0xc00000> #2 main_preinit() at /usr/src/debug/dovecot-2.4.1-4/src/login-common/main.c:355 max_fds= <optimized out> __func__= <optimized out> #3 login_binary_run(binary=<optimized out>, argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/dovecot-2.4.1-4/src/login-common/main.c:528 service_flags= <optimized out> login_socket= 0x7f5bd5590b66"login" error= 0x1000000<error: Cannot access memory at address 0x1000000> c= <optimized out> input= {config_path= 0x0, config_fd= 0, preserve_environment= false, preserve_user= false, preserve_home= false, no_service_filter= false, check_full_config= false, hide_obsol ete_warnings= false, no_protocol_filter= false, no_key_validation= false, reload_config= false, never_exec= false, always_exec= false, return_config_fd= false, use_sysexits= false, pr otocol= 0x562033d837ac"imap"} output= {specific_protocols= 0x56205ca15398, config_fd= -1, permission_denied= false} #4 0x00007f5bd51662aein __libc_start_call_main() from /lib64/libc.so.6 No symbol table info available. #5 0x00007f5bd5166379in __libc_start_main_impl() from /lib64/libc.so.6 No symbol table info available. #6 0x0000562033d79885in _start() at ../sysdeps/x86_64/start.S:115 No locals. Probably "ssl_vfuncs->[...]" is a NULL dereference? I'm debugging a crash within Dovecot and this was one of my findings. Dovecot version: 2.4.1. Ákos

1 1

dovecot RHEL 10 packages
by burnzerog＠gmail.com 19 Aug '25

19 Aug '25

Hi, I see only RHEL 8 and 9 packages but not for RHEL 10 in repo.dovecot.org. Do you think it can be released soon? Thank you.

3 2

quota_clone + dict_file_path wound up being somewhat cumbersome on 2.4
by Andy Baugh 19 Aug '25

19 Aug '25

The quota_clone syntax is rather cumbersome in comparison to 2.3 when using a flat file dictionary. I found I needed to make a "bogus" config block first: quota_clone { dict file { path = ${userdb:mail_path}/dovecot-quota } } Bogus, as the code path which actually deals with that doesn't have the ${userdb:*} vars available (visible by stracing the dovecot process, and seeing it fail to make /dovecotquota for obvious reasons). That said, if you don't include *some* value, it will explode even when you provide the *correct* value via userdb unless you initialize quota clone earlier there in the config. In this case for the 'luser' user: quota_clone/dict/file/path: /home/luser/mail/dovecot-quota wound up being the param I needed in order to get that logged in the right place for that specific user. None of how to format this properly was remotely clear to me from the documentation when looking at the quota_clone page: https://doc.dovecot.org/main/core/config/dict.html#flat-files As such I made an educated guess after reading the quota_clone code and testing a few things out. This actually works, so I'm happy with it for now. Not sure what this means RE the documentation, as even though it's not exactly obvious, I clearly was able to piece it together for the most part just by reading other documentation pages which mentioned things like separating namespaces by slashes, etc. I don't know how to properly convey "hey here's the list of where all these vars are actually able to be set and not set," as there's clearly some context there that's missing unless you go digging in the code. Cheers, -- Thomas "Andy" Baugh | Software Development Engineer IV 713-384-8831 andy.baugh(a)webpros.com www.webpros.com

1 0

On Dovecot 2.4, auth-legacy setting for the auth service appears to be no-op when using lua passdb
by Andy Baugh 19 Aug '25

19 Aug '25

So, I used https://doc.dovecot.org/main/installation/upgrade/2.3-to-2.4.html#exim-auth… to ensure exim still worked. Unfortunately, that doesn't seem to be the case. Sender verification, auth, etc. *will* fail until you specifically start sending back those old params as well as the updated ones. I am using lua for the passdb/userdb however, so presumably it's just not documented that this is an "exercise for the reader" when using lua. In particular you need to deliver the 'mail' and 'quota' fields as they previously existed (colon separated) alongside the new dovecot params. Hope this helps someone else out there. Cheers, -- Thomas "Andy" Baugh | Software Development Engineer IV andy.baugh(a)webpros.com www.webpros.com

2 2

'duplicate listener' on port 465
by William David Edwards 17 Aug '25

17 Aug '25

Hi, When configuring SMTPS as described on https://doc.dovecot.org/main/core/config/submission.html#smtps, Dovecot says there is a 'duplicate listener'. MRE: ``` root@dovecot24-test:/etc/dovecot/conf.d# doveconf -n # 2.4.1-4+debian12 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4+debian12 (0a86619f) # OS: Linux 6.1.0-29-amd64 x86_64 Debian 12.11 # Hostname: dovecot24-test.cyberfusion.nl # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 dovecot_storage_version = 2.4.0 protocols = submission service submission-login { inet_listener submission_465 { port = 465 } } doveconf: Error: duplicate listener: 465:* doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf: duplicate listener: 465:* ``` Can anyone help me understand why this listener would be 'duplicate'? This setup worked on 2.3.21.1. Thanks! William David Edwards

2 1

github: minimal dovecot 2.4 setup for testing in docker
by Rory Campbell-Lange 15 Aug '25

15 Aug '25

Hi Everyone I've made a simple dovecot.conf and accompanying users.db file suitable for running in Docker. At the moment this simply shows how to force the default domain using the "auth_default_domain" setting. I'm hoping this will be a helpful jumping off point if you need to upgrade your Dovecot config ... and want to test outside of production. Instructions and the minimal conf and db file are here: https://github.com/rorycl/dovecot-config Feel free to improve the setup by submitting a PR. If you'd like to add some other scenarios please also submit PRs. My suggested arrangement for that is in a directory named by feature, with a README.md, minimal conf file, support files (only if necessary) and log.txt showing the expected output. Cheers Rory

1 0

doveadm sync issue
by Dan Whitehouse 15 Aug '25

15 Aug '25

Hi, I am running Dovecot on Debian trixie (dovecot-core/stable,now 1:2.4.1+dfsg1-6 amd64). Under the previous version, which I believe was 2.3, I was able to run a sync script with the following syntax: doveadm sync -u <user> remote:<user>@<host.tld> This worked very well and I was able to sync my mail. Having upgraded, this syntax produces the following error: dsync-server: invalid option -- ‘U' Error: doveadm: Unexpected or incomplete option: -U Even though my script doesn’t pass “-U” explicitly I believe that it is passed internally: https://github.com/dovecot/core/blob/main/src/doveadm/doveadm-settings.c#L1… core/src/doveadm/doveadm-settings.c at main · dovecot/core github.com Confusingly the online help still displays: doveadm dsync-server —help doveadm dsync-server [-r <rawlog path>] [-T <timeout secs>] [-U] Here we can see that the “-U” option (despite all the above) appears to have been removed from the code: https://github.com/dovecot/core/commit/4c04e4c30fd4817a8b0e11d04d9681173f69… global: Remove replicator · dovecot/core@4c04e4c github.com I have added the following to /etc/dovecot/local.conf: dsync_remote_cmd = "ssh -l%{login} %{host} doveadm dsync-server -u%{user}” (Note that I override the “-U”) and sync once again works properly. Many thanks for your attention, Dan Whitehouse

1 0

Lots of problems with Dovecot 2.4
by sev+dovecot＠sev.monster 14 Aug '25

14 Aug '25

Hello all, I am trying to get Dovecot 2.4 running on Alpine Edge x86-64. But a myriad of problems have occurred that make it impossible to do so. First of all was the recent off-by-one bug that was recently fixed, which caused an unavoidable segfault on start under musl libc, which Alpine uses: https://gitlab.alpinelinux.org/alpine/aports/-/issues/17050 Then, I saw that the shadow driver was removed, which necessitated the installation of PAM and my learning about it... I haven't needed it before, so I'd never used it. I guess I understand why the decision was made to use PAM, though I still don't like it. After resolving those issue, I've run into new ones: 1. The passwd userdb does not seem to work correctly. It is able to get the first user and its information correctly, but any attempts to look up any user after that will seemingly always use the information from the first matched user. Setting max auths to 1 so that the auth process is discarded afterwards does not seem to help. For example, if the first user to log in to Dovecot is bob, and then user joe logs in, the information returned from the passwd userdb will all be that of user bob, not joe. This continues for all subsequent userdb lookups until Dovecot is restarted, and a new userdb lookup is persisted. Changing to passwd-file instead works and does not experience this problem. 2. Why is the only available username field for the passwd driver %{passwd:system_groups_user}? I understand what the purpose of the field is based on the docs, but shouldn't more than this be exposed? The fields available through passwd are also not documented, and I had to read the source to find them out. This should either be documented or a more standard username field be additionally exposed as with other drivers. Can this field even be relied on to use as the username, if the driver otherwise worked? 3. It seems the Exim auth driver is no longer able to successfully authenticate with Dovecot 2.4 against Exim 4.98.2. It works fine in the last version of 2.3.21.1. Has the authentication framework changed along with the other modifications that 2.4 underwent? Has any effort been made with the Exim team to resolve any incompatibilities? Can I somehow diagnose this issue if it's otherwise supposed to work? 4. The ldap driver can no longer look up missing fields from LDAP users. Some (but not all) of my users have the rfc2307bis schema posixAccount supplemental objectClass, and as such contain the posixHome, uidNumber, and gidNumber attributes—but even if I specify a default value, if one of the attributes is not queryable for the returned user, the lookup errors out and the login fails. This is a regression/undocumented change from 2.3.x, where instead of erroring out, the default_fields value would be used. Based on my interpretation of the design goals for 2.4, I would imagine the default filter would ignore the missing attribute error and set the default value like default_fields used to, no? Or am I missing something? 5. passdb_ldap_filter is always required for the ldap passdb driver, even if passdb_ldap_bind is enabled. Not only does this go against the docs, but the value is unused and it doesn't matter what it's set to. This is a regression from 2.3.x. Overall I am very unimpressed by 2.4. It clearly needed a lot more time in the oven and much more thorough testing. Relevant minimal config from my working 2.3.21.1 install: auth_username_format = %Ln auth_mechanisms = plain login passdb { driver = shadow } userdb { driver = passwd override_fields = gid=mail home=/var/mail/%Ln } passdb { driver = ldap args = /etc/dovecot/ldap-passdb.conf.ext #uris = ldapi://%2frun%2fopenldap%2fslapd.sock #base = ou=accounts,dc=ldap #auth_bind = yes #auth_bind_userdn = uid=%Ln,ou=accounts,dc=ldap } userdb { driver = ldap default_fields = uid=mail gid=mail home=/var/mail/%Ln args = /etc/dovecot/ldap-userdb.conf.ext #uris = ldapi://%2frun%2fopenldap%2fslapd.sock #dn = cn=dovecot,dc=ldap #dnpass = "some pw" #base = ou=accounts,dc=ldap #iterate_filter = (objectClass=inetOrgPerson) #iterate_attrs = uid=username #user_filter = (&(objectClass=inetOrgPerson)(uid=%Ln)) #user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid } mail_location = maildir:/var/mail/%Ln mail_plugins = $mail_plugins virtual namespace inbox { inbox = yes mailbox INBOX { auto = subscribe } } namespace virtual { type = private separator = . prefix = "Search Folders." location = virtual:/etc/dovecot/virtual:INDEX=~/dovecot-virtual.cache:CONTROL=~/dovecot-virtual.cache:VOLATILEDIR=~/dovecot-virtual.cache # virtual/All/dovecot-virtual: #!INBOX #* #-Junk #-Junk* #-Spam #-Spam* #-Trash #-Trash* #-Deleted #-Deleted* #-Deleted Items #-Deleted Items* # all hidden = yes list = children subscriptions = no mailbox All { auto = subscribe special_use = \All comment = All messages, excluding Junk and Trash } } namespace virtual-user { type = private separator = . prefix = "User Search Folders." location = virtual:~/.virtual:INDEX=~/dovecot-virtual-user.cache:CONTROL=~/dovecot-virtual-user.cache:VOLATILEDIR=~/dovecot-virtual-user.cache:LAYOUT=maildir++ hidden = yes list = children subscriptions = no } service auth { unix_listener auth-userdb { # restrict userdb to dovecot user/group only instead of world read/write mode = 0660 user = $default_internal_user group = $default_internal_group } unix_listener auth-client { # give Exim access to native authentication mode = 0660 group = exim } } service auth-worker { # no need to run as root user = $default_internal_user # allow pam passdb to read /etc/shadow group = shadow } !include_try /usr/share/dovecot/protocols.d/*.conf protocol imap { mail_max_userip_connections = 25 } protocol pop3 { mail_max_userip_connections = 25 } Converted config for 2.4: dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 mail_home = /var/mail/%{user | username | lower } mail_driver = maildir mail_path = $SET:mail_home mail_plugins = virtual auth_username_format = %{user | username | lower } auth_mechanisms = plain login passdb pam { failure_show_msg = yes max_requests = 1 } userdb passwd-file { passwd_file_path = /etc/passwd fields { gid = mail } } # BUG: doesn't work right #userdb passwd { # fields { # gid = mail # } #} passdb ldap { ldap_uris = ldapi://%2frun%2fopenldap%2fslapd.sock ldap_connection_group = login ldap_base = ou=accounts,dc=ldap ldap_bind = yes ldap_bind_userdn = uid=%{user | username | lower },ou=accounts,dc=ldap # XXX: thought this wasnt needed with bind? ldap_filter = z } userdb ldap { ldap_uris = ldapi://%2frun%2fopenldap%2fslapd.sock ldap_auth_dn = cn=dovecot,dc=ldap ldap_auth_dn_password = "some pw" ldap_base = ou=accounts,dc=ldap ldap_filter = (&(objectClass=inetOrgPerson)(uid=%{user | username | lower })) fields { username = %{ldap:uid} # BUG: causes errors if rfc2307bis posixAccount objectClass is not set home = %{ldap:homeDirectory | default($SET:mail_home)} uid = %{ldap:uidNumber | default(mail)} gid = %{ldap:gidNumber | default(mail)} } ldap_iterate_filter = (objectClass=inetOrgPerson) iterate_fields { username = %{ldap:uid} } } namespace inbox { inbox = yes mailbox INBOX { auto = subscribe } } namespace virtual { type = private separator = . prefix = "Search Folders." mail_driver = virtual mail_path = /etc/dovecot/virtual # virtual/All/dovecot-virtual: #!INBOX #* #-Junk #-Junk* #-Spam #-Spam* #-Trash #-Trash* #-Deleted #-Deleted* #-Deleted Items #-Deleted Items* # all mail_index_path = ~/dovecot-virtual.cache mail_control_path = ~/dovecot-virtual.cache mail_volatile_path = ~/dovecot-virtual.cache hidden = yes list = children subscriptions = no mailbox All { auto = subscribe special_use = \All comment = All messages, excluding Junk and Trash } } namespace virtual-user { type = private separator = . prefix = "User Search Folders." mail_driver = virtual mail_path = ~/dovecot-virtual-user mail_index_path = ~/dovecot-virtual-user.cache mail_control_path = ~/dovecot-virtual-user.cache mail_volatile_path = ~/dovecot-virtual-user.cache mailbox_list_layout = Maildir++ hidden = yes list = children subscriptions = no } service auth { unix_listener auth-userdb { # restrict userdb to dovecot user/group only instead of world read/write mode = 0660 } unix_listener auth-client { # give Exim access to native authentication mode = 0660 group = exim } } service auth-worker { # no need to run as root user = $SET:default_internal_user # allow pam passdb to read /etc/shadow group = shadow } protocols = imap pop3 protocol imap { mail_max_userip_connections = 25 } protocol pop3 { mail_max_userip_connections = 25 } In addition to help with the noted issues, I'd also love if anyone more knowledgeable on Dovecot 2.4 could give any pointers on my config and if I could improve the translation in any way, given I have been fumbling around with it for weeks and am not really sure if my various decisions are correct. Best regards.

7 8

function 'dovecot_lua_notify_event_message_new' in my lua script when I use push_notification_lua_driver
by 3825634＠qq.com 14 Aug '25

14 Aug '25

I need to push a message notification to external system when they receive new emails from their mailbox，so I used the push_notification_lua plugin. My dovecot configuration file is as follows： plugin {     ....     push_notification_driver = dlog     push_notification_driver2 = lua:file=/etc/dovecot/custom-lua/push-notification.lua     push_lua_url = http://localhost:10421/internal/dovecot/email-notification/receive } protocol lda {     mail_plugins = $mail_plugins sieve last_login push_notification mail_lua push_notification_lua     .... } ============= I print the 'event' param's value log in function 'dovecot_lua_notify_event_message_new' in my lua script: function dovecot_lua_notify_event_message_new(ctx, event)   dovecot.i_info("lua-push: event=" .. cjson.encode(event)) end However, when I send a mail with multiple recivers, the notification event info seems to work abnormally. Sender: wangzx(a)hxtmailtest.avicnet.cn Receivers: zhaoqb(a)hxtmailtest.avicnet.cn , wangzx7110(a)hxtmailtest.avicnet.cn I found the two event object's field 'to_address' and 'to_display_name' value are same in /var/log/dovecot/lda.log. Please help me confirm if this is a bug? The log in /var/log/dovecot/lda.log like bellow: 2025-08-06T09:38:11.383536+08:00 hxtmailtest-server dovecot: lda(wangzx7110(a)hxtmailtest.avicnet.cn)<548522><EkAeFgOykmiqXggAfhwsfQ>: lua-push: event={"snippet":"test!!","date":1754444290,"keywords":{},"to_display_name":"Zhaoqb","uid":19,"subject":"test","from_display_name":"","to_address":"zhaoqb(a)hxtmailtest.avicnet.cn","tz":480,"mailbox":"INBOX","to":"Zhaoqb <zhaoqb(a)hxtmailtest.avicnet.cn>, Wangzx7110\n <wangzx7110(a)hxtmailtest.avicnet.cn>","from":"wangzx(a)hxtmailtest.avicnet.cn","message_id":"<6e3a1265476c8197372afb7a1ac5ebbb(a)hxtmailtest.avicnet.cn>","uid_validity":1752827738,"flags":{},"from_address":"wangzx(a)hxtmailtest.avicnet.cn","name":"MessageNew"} 2025-08-06T09:38:11.423272+08:00 hxtmailtest-server dovecot: lda(zhaoqb(a)hxtmailtest.avicnet.cn)<548524><znZfFwOykmisXggAfhwsfQ>: lua-push: event={"subject":"test","mailbox":"INBOX","flags":{},"snippet":"test!!","from":"wangzx(a)hxtmailtest.avicnet.cn","date":1754444290,"from_address":"wangzx(a)hxtmailtest.avicnet.cn","keywords":{},"uid_validity":1752634929,"to_display_name":"Zhaoqb","to":"Zhaoqb <zhaoqb(a)hxtmailtest.avicnet.cn>, Wangzx7110\n <wangzx7110(a)hxtmailtest.avicnet.cn>","name":"MessageNew","from_display_name":"","tz":480,"to_address":"zhaoqb(a)hxtmailtest.avicnet.cn","uid":39,"message_id":"<6e3a1265476c8197372afb7a1ac5ebbb(a)hxtmailtest.avicnet.cn>"} Thanks! 3825634(a)qq.com 3825634(a)qq.com I need to push a message notification to external system when they receive new emails from their mailbox**so I used the push_notification_lua plugin. My dovecot configuration file is as follows** plugin { .... push_notification_driver = dlog push_notification_driver2 = lua:file=/etc/dovecot/custom-lua/push-notification.lua push_lua_url = http://localhost:10421/internal/dovecot/email-notification/receive } protocol lda { mail_plugins = $mail_plugins sieve last_login push_notification mail_lua push_notification_lua .... } ============= I print the 'event' param's value log in function 'dovecot_lua_notify_event_message_new' in my lua script: function dovecot_lua_notify_event_message_new(ctx, event) dovecot.i_info("lua-push: event=" .. cjson.encode(event)) end However, when I send a mail with multiple recivers, the notification event info seems to work abnormally. Sender: wangzx(a)hxtmailtest.avicnet.cn Receivers: zhaoqb(a)hxtmailtest.avicnet.cn , wangzx7110(a)hxtmailtest.avicnet.cn I found the two event object's field 'to_address' and 'to_display_name' value are same in /var/log/dovecot/lda.log. Please help me confirm if this is a bug? The log in /var/log/dovecot/lda.log like bellow: 2025-08-06T09:38:11.383536+08:00 hxtmailtest-server dovecot: lda(wangzx7110(a)hxtmailtest.avicnet.cn)<548522><EkAeFgOykmiqXggAfhwsfQ>: lua-push: event={"snippet":"test!!","date":1754444290,"keywords":{},"to_display_name":"Zhaoqb","uid":19,"subject":"test","from_display_name":"","to_address":"zhaoqb(a)hxtmailtest.avicnet.cn","tz":480,"mailbox":"INBOX","to":"Zhaoqb <zhaoqb(a)hxtmailtest.avicnet.cn>, Wangzx7110\n <wangzx7110(a)hxtmailtest.avicnet.cn>","from":"wangzx(a)hxtmailtest.avicnet.cn","message_id":"<6e3a1265476c8197372afb7a1ac5ebbb(a)hxtmailtest.avicnet.cn>","uid_validity":1752827738,"flags":{},"from_address":"wangzx(a)hxtmailtest.avicnet.cn","name":"MessageNew"} 2025-08-06T09:38:11.423272+08:00 hxtmailtest-server dovecot: lda(zhaoqb(a)hxtmailtest.avicnet.cn)<548524><znZfFwOykmisXggAfhwsfQ>: lua-push: event={"subject":"test","mailbox":"INBOX","flags":{},"snippet":"test!!","from":"wangzx(a)hxtmailtest.avicnet.cn","date":1754444290,"from_address":"wangzx(a)hxtmailtest.avicnet.cn","keywords":{},"uid_validity":1752634929,"to_display_name":"Zhaoqb","to":"Zhaoqb <zhaoqb(a)hxtmailtest.avicnet.cn>, Wangzx7110\n <wangzx7110(a)hxtmailtest.avicnet.cn>","name":"MessageNew","from_display_name":"","tz":480,"to_address":"zhaoqb(a)hxtmailtest.avicnet.cn","uid":39,"message_id":"<6e3a1265476c8197372afb7a1ac5ebbb(a)hxtmailtest.avicnet.cn>"} Thanks! [1][IMG] [2]3825634(a)qq.com 3825634(a)qq.com References Visible links 1. https://wx.mail.qq.com/home/index?t=readmail_businesscard_midpage&nocheck=t… 2. https://wx.mail.qq.com/home/index?t=readmail_businesscard_midpage&nocheck=t…

2 4

Re: Fw: upgrade mail paths (Debian 1:2.4.1)
by Rory Campbell-Lange 12 Aug '25

12 Aug '25

On 12/08/25, Andy Baugh (andy.baugh(a)webpros.com) wrote: > Colon separated vars need to be exploded into different params, sadly. This gets more complicated when dealing with things that are not mail opts. > > In your case you'll want to break down what used to be positional args thusly: > > mail_driver:mail_path:mail_inbox_path:mail_index_path > > Of course the "INBOX="/"INDEX=" part is assumed by the named param now, so can be left off the value. > > For example, with what used to be dsync or with quotas, things become rather painful to convert: ... Thank you very much for the confirmation, Andy. Exploding the configuration as you suggest works fine, although I had to quickly change my SQL table to suit. Fortunately I don't use quotas or dsync. I'm very grateful for your research into the configuration changes (which sound extensive) -- thanks again for sharing your insights. Let's hope the Debian stable upgrade doesn't cause too much pain. Best wishes, Rory

1 0

upgrade mail paths (Debian 1:2.4.1)
by rory＠campbell-lange.net 12 Aug '25

12 Aug '25

Dear Dovecot Users I guess there may be a storm of questions from users of Dovecot on Debian who are upgrading to the latest Debian stable, which uses Dovecot 1:2.4.1 [1] with the concomitant configuration changes. The issue I have encountered a problem translating my previous configuration for "mail_location" to "mail_path". The mail_location string returned from my database was mbox:/home/<user>/Mail/:INBOX=/var/mail/<user>:INDEX=/home/<domain>/Mailindexes/<user> Reading the mail location docs [2] I'm unclear if the colon separated configuration still works or if the configuration items should be separated into separate fields, presumably: mail_path mail_inbox_path mail_index_path Thanks for any insight. Regards, Rory [1] https://packages.debian.org/trixie/dovecot-core [2] https://doc.dovecot.org/main/core/config/mail_location.html

1 0

dovecot-sieve failed large mail
by Benoît PELISSIER 12 Aug '25

12 Aug '25

Hi, I noticed errors in the incoming emails with large attachments (>10MB). Its only with sieve filters enables. I use dovecot-lda and exim. Logs error : Error: program exec:/usr/sbin/sendmail (1295385): Execution timed out (> 30000 msecs) Error: program exec:/usr/sbin/sendmail (1295385): Failed to send SIGTERM signal to program Error: sieve: msgid=<**@**>: redirect action: failed to redirect message to <**@**>: Failed to execute sendmail (temporary failure) Error: sieve: Execution of script **/.dovecot.sieve was aborted due to temporary failure (user logfile **/.dovecot.sieve.log may reveal additional details) * i replaced private data by ** Regards, Benoît dovecot --version 2.3.13 (89f716dc2)

4 7

[Patch] Allow sieve redirects to specified domains only
by Kadlecsik József 10 Aug '25

10 Aug '25

Hello, The use case is simple: we have to forbid sieve redirects to outside, but should be able to redirect inside. The patch below adds a new sieve configuration option sieve_allowed_redirects to list the domains to which redirects are permitted and otherwise are not allowed. Please consider it. diff --git a/pigeonhole/doc/example-config/conf.d/90-sieve.conf b/pigeonhole/doc/example-config/conf.d/90-sieve.conf index 238bcf4..3b4ac65 100644 --- a/pigeonhole/doc/example-config/conf.d/90-sieve.conf +++ b/pigeonhole/doc/example-config/conf.d/90-sieve.conf @@ -126,6 +126,10 @@ plugin { # script execution. If set to 0, no redirect actions are allowed. #sieve_max_redirects = 4 + # The comma/space separated list of email domains where redirection is allowed. + # If the list is empty, there is no restriction. + sieve_allowed_redirects = + # The maximum number of personal Sieve scripts a single user can have. If set # to 0, no limit on the number of scripts is enforced. # (Currently only relevant for ManageSieve) diff --git a/pigeonhole/src/lib-sieve/cmd-redirect.c b/pigeonhole/src/lib-sieve/cmd-redirect.c index 6a3b0a4..17e9031 100644 --- a/pigeonhole/src/lib-sieve/cmd-redirect.c +++ b/pigeonhole/src/lib-sieve/cmd-redirect.c @@ -107,6 +107,24 @@ const struct sieve_action_def act_redirect = { .commit = act_redirect_commit, }; +static bool +cmd_redirect_allowed(struct sieve_instance *svinst, + const struct smtp_address *to_address) +{ + const char **domain; + bool result = TRUE; + + if (!svinst->allowed_redirects) + return TRUE; + for (domain = svinst->allowed_redirects; *domain != NULL; ++domain) { + if (strcasecmp(*domain, to_address->domain) == 0) { + return TRUE; + } + result = FALSE; + } + return result; +} + /* * Validation */ @@ -127,6 +145,12 @@ cmd_redirect_validate(struct sieve_validator *validator, if (!sieve_validator_argument_activate(validator, cmd, arg, FALSE)) return FALSE; + if (svinst->max_redirects == 0) { + sieve_command_validate_error(validator, cmd, + "local policy prohibits the use of a redirect action"); + return FALSE; + } + /* We can only assess the validity of the outgoing address when it is * a string literal. For runtime-generated strings this needs to be * done at runtime. @@ -148,14 +172,17 @@ cmd_redirect_validate(struct sieve_validator *validator, } } T_END; + if (!result && + !cmd_redirect_allowed(svinst, + sieve_address_parse_str(raw_address, &error))) { + sieve_command_validate_error(validator, cmd, + "local policy prohibits the use of a redirect action"); + return FALSE; + } + return result; } - if (svinst->max_redirects == 0) { - sieve_command_validate_error(validator, cmd, - "local policy prohibits the use of a redirect action"); - return FALSE; - } return TRUE; } @@ -238,6 +265,11 @@ cmd_redirect_operation_execute(const struct sieve_runtime_env *renv, "local policy prohibits the use of a redirect action"); return SIEVE_EXEC_FAILURE; } + if (!cmd_redirect_allowed(svinst, to_address)) { + sieve_runtime_error(renv, NULL, + "local policy prohibits the use of a redirect action"); + return SIEVE_EXEC_FAILURE; + } if (sieve_runtime_trace_active(renv, SIEVE_TRLVL_ACTIONS)) { sieve_runtime_trace(renv, 0, "redirect action"); diff --git a/pigeonhole/src/lib-sieve/sieve-common.h b/pigeonhole/src/lib-sieve/sieve-common.h index e79fb4d..d980c9d 100644 --- a/pigeonhole/src/lib-sieve/sieve-common.h +++ b/pigeonhole/src/lib-sieve/sieve-common.h @@ -209,6 +209,7 @@ struct sieve_instance { const struct smtp_address *user_email, *user_email_implicit; struct sieve_address_source redirect_from; unsigned int redirect_duplicate_period; + const char **allowed_redirects; }; /* diff --git a/pigeonhole/src/lib-sieve/sieve-settings.c b/pigeonhole/src/lib-sieve/sieve-settings.c index 47f70da..70addc7 100644 --- a/pigeonhole/src/lib-sieve/sieve-settings.c +++ b/pigeonhole/src/lib-sieve/sieve-settings.c @@ -267,4 +267,10 @@ void sieve_settings_load(struct sieve_instance *svinst) svinst->user_email = address; } } + svinst->allowed_redirects = NULL; + str_setting = sieve_setting_get(svinst, "sieve_allowed_redirects"); + if (str_setting != NULL && *str_setting != '\0') { + svinst->allowed_redirects = + (const char **)p_strsplit_spaces(svinst->pool, str_setting, ", "); + } } Best regards, Jozsef -- E-mail : kadlecsik.jozsef(a)wigner.hun-ren.hu PGP key: https://wigner.hu/~kadlec/pgp_public_key.txt Address: Wigner Research Centre for Physics H-1525 Budapest 114, POB. 49, Hungary

2 1

Empty "from:" on certain sieve rule
by Ciprian M. Vizitiu [FDT] 10 Aug '25

10 Aug '25

Hello everyone, Running a Dovecot 2.3.13 (Debian 11 native package) configured to deliver to Postfix lmtp and using dovecot-sieve. Setting-up a simple vacation responder works as expected but trying to catch a missing header e.g. if allof (not exists "X-GitLab-NotificationReason") { vacation :days 1 :addresses"SOME-NOTIFICATION(a)example.com" :subject "Message sent to an automated address " :from"some-sender(a)example.com" text: Hello, This is an automated reply to let you know thatSOME-NOTIFICATION(a)example.com is an automated address and is not read by a human operator. If you're trying to contact EXAMPLECOM please send your emails toexample(a)example.com . ; } ... will result in an empty "from:" field instead of the required "some-sender(a)example.com" e.g. Aug 06 09:41:45 email-001.example.com postfix/smtpd[1974551]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 Aug 06 09:41:45 email-001.example.com dovecot[1174421]: lmtp(some-notification(a)email.example.com)<1974562><uTh/ITkHk2giIR4AdMz+wA>: sieve: msgid=<941c2ff0-56f1-493f-973e-871f446e060b(a)anotherexample.com>: vacation action: sent vacation response to <some.user(a)anotherexample.com> Aug 06 09:41:45 email-001.example.com postfix/pickup[1956559]: B7BF8207C9: uid=18018 from=<> Aug 06 09:41:45 email-001.example.com postfix/cleanup[1974554]: B7BF8207C9: message-id=<dovecot-sieve-1754466105-562992-0(a)email-001.example.com> Aug 06 09:41:45 email-001.example.com postfix/qmgr[1171599]: B7BF8207C9: from=<>, size=979, nrcpt=2 (queue active) Aug 06 09:41:45 email-001.example.com postfix/smtp[1974565]: B7BF8207C9: to=<some.user(a)anotherexample.com>, relay=smtpconnector.upper.relay[192.168.2.14]:25, delay=0.12, delays=0.06/0.01/0.03/0.02, dsn=5.7.1, status=bounced (host smtpconnector.upper.relay[192.168.2.14] said: 554 5.7.1 <>: Sender address rejected: Access denied (in reply to RCPT TO command)) I tried forcing sieve_user_email = some-sender(a)example.com ... but to no avail. I'm well aware that I could try and fix the problem at Postfix level but blindly catching ALL mails with an empty "from:" field feels bad: one miss-configured daemon and we spam everyone plus we already do some intricate rewriting. Any ideas? Hello everyone, Running a Dovecot 2.3.13 (Debian 11 native package) configured to deliver to Postfix lmtp and using dovecot-sieve. Setting-up a simple vacation responder works as expected but trying to catch a missing header e.g. if allof (not exists "X-GitLab-NotificationReason") { vacation :days 1 :addresses [1]"SOME-NOTIFICATION(a)example.com" :subject "Message sent to an automated address " :from [2]"some-sender(a)example.com" text: Hello, This is an automated reply to let you know that [3]SOME-NOTIFICATION(a)example.com is an automated address and is not read by a human operator. If you're trying to contact EXAMPLECOM please send your emails to [4]example(a)example.com . ; } ... will result in an empty "from:" field instead of the required [5]"some-sender(a)example.com" e.g. Aug 06 09:41:45 email-001.example.com postfix/smtpd[1974551]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 Aug 06 09:41:45 email-001.example.com dovecot[1174421]: lmtp([6]some-notification(a)email.example.com)<1974562><uTh/ITkHk2giIR4AdMz+wA>: sieve: msgid=[7]<941c2ff0-56f1-493f-973e-871f446e060b(a)anotherexample.com>: vacation action: sent vacation response to [8]<some.user(a)anotherexample.com> Aug 06 09:41:45 email-001.example.com postfix/pickup[1956559]: B7BF8207C9: uid=18018 from=<> Aug 06 09:41:45 email-001.example.com postfix/cleanup[1974554]: B7BF8207C9: message-id=[9]<dovecot-sieve-1754466105-562992-0(a)email-001.example.com> Aug 06 09:41:45 email-001.example.com postfix/qmgr[1171599]: B7BF8207C9: from=<>, size=979, nrcpt=2 (queue active) Aug 06 09:41:45 email-001.example.com postfix/smtp[1974565]: B7BF8207C9: to=[10]<some.user(a)anotherexample.com>, relay=smtpconnector.upper.relay[192.168.2.14]:25, delay=0.12, delays=0.06/0.01/0.03/0.02, dsn=5.7.1, status=bounced (host smtpconnector.upper.relay[192.168.2.14] said: 554 5.7.1 <>: Sender address rejected: Access denied (in reply to RCPT TO command)) I tried forcing sieve_user_email = [11]some-sender(a)example.com ... but to no avail. I'm well aware that I could try and fix the problem at Postfix level but blindly catching ALL mails with an empty "from:" field feels bad: one miss-configured daemon and we spam everyone plus we already do some intricate rewriting. Any ideas? References Visible links 1. mailto:SOME-NOTIFICATION@example.com 2. mailto:some-sender@example.com 3. mailto:SOME-NOTIFICATION@example.com 4. mailto:example@example.com 5. mailto:some-sender@example.com 6. mailto:some-notification@email.example.com 7. mailto:941c2ff0-56f1-493f-973e-871f446e060b@anotherexample.com 8. mailto:some.user@anotherexample.com 9. mailto:dovecot-sieve-1754466105-562992-0@email-001.example.com 10. mailto:some.user@anotherexample.com 11. mailto:some-sender@example.com

2 1

Unable to specify home directory for mail_location
by jrmu＠ircnow.org 05 Aug '25

05 Aug '25

Greetings Dovecot team/users, I am trying to use Dovecot to serve Maildir files. The users' email is located in ~/Maildir (in each user's home directory). I tried specifying mail_location = maildir:~/Maildir but I get this error: Aug 4 00:06:34 ch dovecot: imap(username): Error: Relative home directory paths not supported: 0 Are relative home directory paths not supported? Here is the output of dovecot -n: # dovecot -n # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: OpenBSD 7.7 amd64 # Hostname: ch.ircnow.org auth_debug = yes auth_debug_passwords = yes auth_verbose = yes auth_verbose_passwords = sha1 first_valid_uid = 1000 listen = 104.244.78.185, 2605:6400:c8b7::1 mail_debug = yes mail_location = maildir:~/Maildir mbox_write_locks = fcntl mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=blf-crypt username_format=%u /etc/dovecot/passwd driver = passwd-file } ssl_cert = </etc/ssl/ch.ircnow.org.crt ssl_key = # hidden, use -P to show it userdb { args = username_format=%u /etc/dovecot/passwd default_fields = quota_rule=*:storage=1G driver = passwd-file } verbose_ssl = yes 1375 bytes received in 0.00 seconds (5.18 MB/s) -- Aaron Lin jrmu(a)ircnow.org IRCNow (https://ircnow.org)

3 5

Dovecot fails to "initialize SSL server context"
by jaap＠jbril.net 04 Aug '25

04 Aug '25

I am configuring a new mailserver. Postfix works and is getting configured according to our wishes. Dovecot is more stubborn: for some reason I'm not able to understand, it refuses to "initialize SSL server context". complaining that "Can't load SSl Certificate". I believe I have configured the same certificate (and accompanying key) for imap-login that I use for https. But dovecot does not agree. I looked at error:14187180. All I found were errors on the configuration for the Certs cq Keys which I think I am avoiding . Two questions: Please correct me if I'm wrong. Can you clarify dovecot's error message? Jaap Server: * Rocky Linux 9.6 kernel 5.14.0-570.28.1 * Dovecot 2.3.21.1 * Openssl 3.2.2 * Certbot 3.1.0 Https is functioning as expected: ssl-config: * Include /etc/letsencrypt/options-ssl-apache.conf * SSLCertificateFile /etc/letsencrypt/live/radicale.camelopardus.nl/fullchain.pem * SSLCertificateKeyFile /etc/letsencrypt/live/radicale.camelopardus.nl/privkey.pem * ssl_cert = </etc/letsencrypt/live/iris.camelopardus.nl/fullchain.pem test from client: openssl s_client -connect radicale.camelopardus.nl:https reply: *CONNECTED(00000003)* *depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1* *verify return:1* *depth=1 C = US, O = Let’s Encrypt, CN = E6* *verify return:1* *depth=0 CN = radicale.camelopardus.nl* *verify return:1* Dovecot responds differently (for Thunderbird as well as) for openssl: conf.d/10-ssl.conf: * ssl_cert = </etc/letsencrypt/live/radicale.camelopardus.nl/fullchain.pem * ssl_key = </etc/letsencrypt/live/radicale.camelopardus.nl/privkey.pem test: openssl s_client -connect radicale.camelopardus.nl:imaps reply: CONNECTED(00000003) write:errno=104 no peer certificate available For both there is the same error in dovecot's log: imap-login: Error: Failed to initialize SSL server context: Can't load SSL certificate (ssl_cert setting): error:14187180: SSL routines:ssl_do_config:bad value: section=system_default, cmd=Groups, arg=X25519:secp256r1:X448:secp521r1:secp384r1:ffdhe2048:ffdhe3072:ffdhe4096:ffdhe6144:ffdhe8192: user=<>, rip=2a10:3781:5ab:1:ff51:cbd1:4d54:fb7b, lip=2a10:3781:5ab:10::aaf,

4 4

migrate to virtual mailboxes before upgrading to 2.4
by roughnecks 04 Aug '25

04 Aug '25

Hello, I was thinking about, maybe, migrating my postfix/dovecot server to virtual mailboxes, before upgrading Debian to Trixie. So, atm, I have system users with ~/Maildir but it's not so convenient anymore. I am looking for some documentation/guide on how to migrate everything to virtual mailboxes. Of course I searched by myself, but didn't find many results. Thanks -- roughnecks

2 1

sieve script is not exescuted
by Kamil Jońca 30 Jul '25

30 Jul '25

I have scripts in 2 places: sieve_script personal { path = ~/.dovecot.sieve } sieve_script before { path = /etc/dovecot/sieve } /etc/dovecot/sieve is directory with (currently) one script. This script add header to message. And it seems, that "before" script is not executed. Any hints? KJ -- http://wolnelektury.pl/wesprzyj/teraz/ "Linux: the operating system with a CLUE... Command Line User Environment". (seen in a posting in comp.software.testing)

6 11

doveadm force-resync crashes at list/mailbox-list-fs-iter.c:507
by Ákos Szőts 29 Jul '25

29 Jul '25

Hi All, In Dovecot 2.4.1 if I start doveadm force-resync with a non-existent mailbox that ends in a slash, the command crashes: gdb -ex run --args doveadm force-resync -A test/ Thread 1 (Thread 0x7f9e5cc4a980 (LWP 442) "doveadm"): #0 fs_list_next_root(ctx=ctx@entry=0x55d248df6898) at list/mailbox-list-fs-iter.c:507 roots= <error reading variable roots (Cannot access memory at address 0x0)> count= <error reading variable count (Cannot access memory at address 0x8)> __func__= "fs_list_next_root" #1 0x00007f9e5dc417c2in fs_list_iter_reset(ctx=0x55d248df6898) at list/mailbox-list-fs-iter.c:830 __func__= <optimized out> #2 fs_list_iter_next(_ctx=0x55d248df6898) at list/mailbox-list-fs-iter.c:912 ctx= <optimized out> ret= 0 __func__= "fs_list_iter_next" #3 0x00007f9e5dc4f8ddin mailbox_list_iter_next_call(ctx=0x55d248df6898) at list/mailbox-list-iter.c:1009 info= <optimized out> set= 0x148d86ee0 ret= <optimized out> #4 mailbox_list_iter_next(ctx=0x55d248df6898) at list/mailbox-list-iter.c:1098 _data_stack_cur_id= 5 info= <optimized out> #5 0x00007f9e5dc50899in mailbox_list_ns_iter_try_next(_ctx=0x55d248df6488, info_r=<synthetic pointer>) at list/mailbox-list-iter.c:616 ctx= 0x55d248df6488 ns= <optimized out> info= <optimized out> suffix= <optimized out> has_children= <optimized out> __func__= <optimized out> #6 mailbox_list_ns_iter_next(_ctx=0x55d248df6488) at list/mailbox-list-iter.c:678 info= 0x0 #7 0x00007f9e5dc4f8ddin mailbox_list_iter_next_call(ctx=0x55d248df6488) at list/mailbox-list-iter.c:1009 info= <optimized out> set= 0x2fffffffd0 ret= <optimized out> #8 mailbox_list_iter_next(ctx=0x55d248df6488) at list/mailbox-list-iter.c:1098 _data_stack_cur_id= 4 info= <optimized out> #9 0x000055d20bc81a20in cmd_force_resync_run(_ctx=0x55d248db57a8, user=0x55d248dc6318) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:369 ctx= 0x55d248db57a8 iter_flags= (MAILBOX_LIST_ITER_RAW_LIST| MAILBOX_LIST_ITER_NO_AUTO_BOXES| MAILBOX_LIST_ITER_STAR_WITHIN_NS| MAILBOX_LIST_ITER_RETURN_NO_FLAGS| MAILBOX_LIST_ITER_FORCE_RESYNC) ns_mask= (MAIL_NAMESPACE_TYPE_PRIVATE| MAIL_NAMESPACE_TYPE_SHARED| MAIL_NAMESPACE_TYPE_PUBLIC) iter= 0x55d248df6488 info= <optimized out> ret= <optimized out> patterns= {0x55d248db5300"test/", 0x0} #10 0x000055d20bc856c2in doveadm_mail_next_user(ctx=ctx@entry=0x55d248db57a8, error_r=error_r@entry=0x7ffdbc3f0778) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:506 _data_stack_cur_id= 3 cctx= 0x55d248db39b8 input= {event_parent= 0x0, service= 0x55d20bcbd810"doveadm", protocol= 0x0, username= 0x55d248db81a0"akos(a)szots.dev", session_id= 0x0, session_id_prefix= 0x0, session_create_ time= 0, local_ip= {family= 0, u= {ip6= {__in6_u= {__u6_addr8= '\000' <repeats 15 times>, __u6_addr16= {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32= {0, 0, 0, 0}}}, ip4= {s_addr= 0}}, sco pe_id= 0}, remote_ip= {family= 0, u= {ip6= {__in6_u= {__u6_addr8= '\000' <repeats 15 times>, __u6_addr16= {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32= {0, 0, 0, 0}}}, ip4= {s_addr= 0}}, scope_id= 0}, local_port= 0, remote_port= 0, local_name= 0x0, userdb_fields= 0x0, code_override_fields= 0x0, forward_fields= 0x0, set_instance= 0x0, flags_override_add= 0, flags_over ride_remove= 0, no_userdb_lookup= false, debug= false, end_client_tls_secured= false, autocreated= false, no_free_init_failure= false} error= 0x0 ip= <optimized out> ret= <optimized out> dropping_privs= true cur_uid= 0 cur_cwd= 0x55d248d86df8"/" cur_ctx= 0x55d248dc2c80 reason= 0x55d248df57f0 __func__= "doveadm_mail_next_user" #11 0x000055d20bc87525in doveadm_mail_all_users(ctx=0x55d248db57a8, wildcard_user=0x55d20bcc015d "*") at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:584 _data_stack_cur_id= 2 cctx= 0x55d248db39b8 user_idx= 0 ip= <optimized out> user= 0x55d248db81a0"akos(a)szots.dev" error= 0x55d248d8e7d8"\t\350\330H\322U" ret= 1 #12 doveadm_mail_cmd_exec(ctx=0x55d248db57a8, wildcard_user=0x55d20bcc015d "*") at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:721 cctx= <optimized out> cli= <optimized out> ret= <optimized out> error= 0x55d248d8e7d8"\t\350\330H\322U" #13 doveadm_cmd_ver2_to_mail_cmd_wrapper(cctx=<optimized out>) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:1039 mctx= 0x55d248db57a8 mail_cmd= {alloc= 0x55d20bc803f0<cmd_force_resync_alloc>, name= 0x55d20bcbe92d"force-resync", usage_args= 0x55d20bcc5008"[-u <user>|-A] [-S <socket_path>] [-f] <mailbox mask>"} wildcard_user= 0x55d20bcc015d"*" #14 0x000055d20bc9ba77in doveadm_cmdline_run(argc=<optimized out>, argv=0x55d248d8e7c8, cctx=cctx@entry=0x55d248db39b8) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-cmd-parse.c:451 prefix= <optimized out> pargv= {arr= {buffer= 0x55d248db4388, element_size= 112}, v= 0x55d248db4388, v_modifiable= 0x55d248db4388} pargc= 8 pool= 0x55d248db4350 ptr_count= <optimized out> ptr= <optimized out> ptr_end= <optimized out> ptr_last_non_kv= <optimized out> #15 0x000055d20bc9bc2cin doveadm_cmdline_try_run(cmd_name=cmd_name@entry=0x55d248d8e7f9 "force-resync", argc=<optimized out>, argv=<optimized out>, cctx=cctx@entry=0x55d248db39b8) at /usr/s rc/debug/dovecot-2.4.1-4/src/doveadm/doveadm-cmd.c:160 cmd= <optimized out> #16 0x000055d20bc74fdein main(argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm.c:386 service_flags= <optimized out> cmd_name= 0x55d248d8e7f9"force-resync" i= <optimized out> quick_init= false c= <optimized out> longopts= {{name= 0x7f9e5dadb7a8"help", has_arg= 0, flag= 0x0, val= 0}, {name= 0x0, has_arg= 0, flag= 0x0, val= 0}} help_requested= <optimized out> longopt= 0x0 cctx= 0x55d248db39b8 Ákos Hi All, In Dovecot 2.4.1 if I start doveadm force-resync with a non-existent mailbox that ends in a slash, the command crashes: gdb -ex run --args doveadm force-resync -A test/ Thread 1 (Thread 0x7f9e5cc4a980 (LWP 442) "doveadm"): #0 fs_list_next_root (ctx=ctx@entry=0x55d248df6898) at list/mailbox-list-fs-iter.c:507 roots = <error reading variable roots (Cannot access memory at address 0x0)> count = <error reading variable count (Cannot access memory at address 0x8)> __func__ = "fs_list_next_root" #1 0x00007f9e5dc417c2 in fs_list_iter_reset (ctx=0x55d248df6898) at list/mailbox-list-fs-iter.c:830 __func__ = <optimized out> #2 fs_list_iter_next (_ctx=0x55d248df6898) at list/mailbox-list-fs-iter.c:912 ctx = <optimized out> ret = 0 __func__ = "fs_list_iter_next" #3 0x00007f9e5dc4f8dd in mailbox_list_iter_next_call (ctx=0x55d248df6898) at list/mailbox-list-iter.c:1009 info = <optimized out> set = 0x148d86ee0 ret = <optimized out> #4 mailbox_list_iter_next (ctx=0x55d248df6898) at list/mailbox-list-iter.c:1098 _data_stack_cur_id = 5 info = <optimized out> #5 0x00007f9e5dc50899 in mailbox_list_ns_iter_try_next (_ctx=0x55d248df6488, info_r=<synthetic pointer>) at list/mailbox-list-iter.c:616 ctx = 0x55d248df6488 ns = <optimized out> info = <optimized out> suffix = <optimized out> has_children = <optimized out> __func__ = <optimized out> #6 mailbox_list_ns_iter_next (_ctx=0x55d248df6488) at list/mailbox-list-iter.c:678 info = 0x0 #7 0x00007f9e5dc4f8dd in mailbox_list_iter_next_call (ctx=0x55d248df6488) at list/mailbox-list-iter.c:1009 info = <optimized out> set = 0x2fffffffd0 ret = <optimized out> #8 mailbox_list_iter_next (ctx=0x55d248df6488) at list/mailbox-list-iter.c:1098 _data_stack_cur_id = 4 info = <optimized out> #9 0x000055d20bc81a20 in cmd_force_resync_run (_ctx=0x55d248db57a8, user=0x55d248dc6318) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:369 ctx = 0x55d248db57a8 iter_flags = (MAILBOX_LIST_ITER_RAW_LIST | MAILBOX_LIST_ITER_NO_AUTO_BOXES | MAILBOX_LIST_ITER_STAR_WITHIN_NS | MAILBOX_LIST_ITER_RETURN_NO_FLAGS | MAILBOX_LIST_ITER_FORCE_RESYNC) ns_mask = (MAIL_NAMESPACE_TYPE_PRIVATE | MAIL_NAMESPACE_TYPE_SHARED | MAIL_NAMESPACE_TYPE_PUBLIC) iter = 0x55d248df6488 info = <optimized out> ret = <optimized out> patterns = {0x55d248db5300 "test/", 0x0} #10 0x000055d20bc856c2 in doveadm_mail_next_user (ctx=ctx@entry=0x55d248db57a8, error_r=error_r@entry=0x7ffdbc3f0778) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:506 _data_stack_cur_id = 3 cctx = 0x55d248db39b8 input = {event_parent = 0x0, service = 0x55d20bcbd810 "doveadm", protocol = 0x0, username = 0x55d248db81a0 [1]"akos(a)szots.dev", session_id = 0x0, session_id_prefix = 0x0, session_create_ time = 0, local_ip = {family = 0, u = {ip6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}, sco pe_id = 0}, remote_ip = {family = 0, u = {ip6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}, scope_id = 0}, local_port = 0, remote_port = 0, local_name = 0x0, userdb_fields = 0x0, code_override_fields = 0x0, forward_fields = 0x0, set_instance = 0x0, flags_override_add = 0, flags_over ride_remove = 0, no_userdb_lookup = false, debug = false, end_client_tls_secured = false, autocreated = false, no_free_init_failure = false} error = 0x0 ip = <optimized out> ret = <optimized out> dropping_privs = true cur_uid = 0 cur_cwd = 0x55d248d86df8 "/" cur_ctx = 0x55d248dc2c80 reason = 0x55d248df57f0 __func__ = "doveadm_mail_next_user" #11 0x000055d20bc87525 in doveadm_mail_all_users (ctx=0x55d248db57a8, wildcard_user=0x55d20bcc015d "*") at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:584 _data_stack_cur_id = 2 cctx = 0x55d248db39b8 user_idx = 0 ip = <optimized out> user = 0x55d248db81a0 [2]"akos(a)szots.dev" error = 0x55d248d8e7d8 "\t\350\330H\322U" ret = 1 #12 doveadm_mail_cmd_exec (ctx=0x55d248db57a8, wildcard_user=0x55d20bcc015d "*") at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:721 cctx = <optimized out> cli = <optimized out> ret = <optimized out> error = 0x55d248d8e7d8 "\t\350\330H\322U" #13 doveadm_cmd_ver2_to_mail_cmd_wrapper (cctx=<optimized out>) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:1039 mctx = 0x55d248db57a8 mail_cmd = {alloc = 0x55d20bc803f0 <cmd_force_resync_alloc>, name = 0x55d20bcbe92d "force-resync", usage_args = 0x55d20bcc5008 "[-u <user>|-A] [-S <socket_path>] [-f] <mailbox mask>"} wildcard_user = 0x55d20bcc015d "*" #14 0x000055d20bc9ba77 in doveadm_cmdline_run (argc=<optimized out>, argv=0x55d248d8e7c8, cctx=cctx@entry=0x55d248db39b8) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-cmd-parse.c:451 prefix = <optimized out> pargv = {arr = {buffer = 0x55d248db4388, element_size = 112}, v = 0x55d248db4388, v_modifiable = 0x55d248db4388} pargc = 8 pool = 0x55d248db4350 ptr_count = <optimized out> ptr = <optimized out> ptr_end = <optimized out> ptr_last_non_kv = <optimized out> #15 0x000055d20bc9bc2c in doveadm_cmdline_try_run (cmd_name=cmd_name@entry=0x55d248d8e7f9 "force-resync", argc=<optimized out>, argv=<optimized out>, cctx=cctx@entry=0x55d248db39b8) at /usr/s rc/debug/dovecot-2.4.1-4/src/doveadm/doveadm-cmd.c:160 cmd = <optimized out> #16 0x000055d20bc74fde in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm.c:386 service_flags = <optimized out> cmd_name = 0x55d248d8e7f9 "force-resync" i = <optimized out> quick_init = false c = <optimized out> longopts = {{name = 0x7f9e5dadb7a8 "help", has_arg = 0, flag = 0x0, val = 0}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}} help_requested = <optimized out> longopt = 0x0 cctx = 0x55d248db39b8 Akos References Visible links 1. mailto:akos@szots.dev 2. mailto:akos@szots.dev

2 2

"lock/disable" user's mailbox
by roughnecks 29 Jul '25

29 Jul '25

Hello, not sure if relevant here, but I'm in need of disabling or locking down an user's mailbox, without completely removing the related system account. It would be nice if said account was not able to receive emails anymore, or "better", until it was re-enabled. Would also be cool if the sender received a warning back, upon the failed dispatch. Does that even make sense? :D I'm running postfix and dovecot on a debian bookworm VPS. Thanks -- roughnecks

2 2

When does dovecot use sendmail_path?
by Joseph Tam 29 Jul '25

29 Jul '25

I'm trying to plug up all the holes where local mail leaves our mail system without a DKIM signature. One avenue is bounce messages. I wrote a small sendmail wrapper to add DKIM signatures, and defined it as the value for dovecot's sendmail_path. I presume Dovecot invokes this executable when it has to send a send message. Under what circumstances does this happen? I tried to provoke a mailout by sending messages to recipients with full quotas and permission locked mailbox files, but could not generate any mail back. Joseph Tam <jtam.home(a)gmail.com>

2 2

'doveadm' error
by Andreas Kossack 28 Jul '25

28 Jul '25

Hi, are there anywhere recommendations or 'best practices' for compiling dovecot-2.4.x at IBMs AIX7.3? With some own patches i can compile it, but one unexpected result is # /usr/local/bin/doveadm mailbox list -u <user> /usr/local/bin/doveconf: invalid option -- u What's wrong? -- Mit freundlichen Grüßen / Best regards / Salutations / Cordialmente ___________________________________________________________________ Brandenburgische Technische Universität Cottbus – Senftenberg E Andreas.Kossack(a)B-TU.De

1 0

one-off doveadm commands broken in 2.4.1 when using docker
by jlh 28 Jul '25

28 Jul '25

Hi all In 2.3, I could use doveadm from the docker image as a standalone tool, but this no longer works in 2.4: $ docker run --rm -ti dovecot/dovecot:2.3-latest doveadm usage: doveadm [-Dv] [-f <formatter>] <command> [<args>] altmove [-u <user>|-A] [-S <socket_path>] [-r] <search query> [...snip...] $ docker run --rm -ti dovecot/dovecot:latest-2.4 doveadm doveconf: Fatal: Cannot expand variable %{env:USER_PASSWORD This was useful for hashing passwords with "doveadm pw". I assume this wasn't an intentional change in how doveadm works. For now I'll just use the old image when hashing passwords. Thank you! Jean-Luc

2 1

siebe settings in 2.4.0
by Helmut K. C. Tessarek 23 Jul '25

23 Jul '25

I've been reading the docs and the migration docs for hours, but the sieve config is a mess. In 2.3.x I am using: plugin { sieve = ~/.sieve sieve_dir = ~/.sieve_storage } and this is how it looks in my home dir: $ ls -la .sie* lrwxrwxrwx 32 a b c d .sieve -> .sieve_storage/MailFilters.sieve .rw------- 0 a b c d .sieve.log .rw------- 17,414 a b c d 2025-07-08 03:00 .sieve.svbin So How do I do the same in 2.4.x? I've come so far as: sieve_script personal { driver = file } But then there are path, bin_path, active_path, name, and a bunch of other settings. Sorry to be a little bit frustrated, but my old settings are not out of the ordinary (2 freaking parameters), but there is no documentation on how to migrate these 2 very simple settings to the new format. The upgrade docs explain the new var expansion and a matrix with old and new parameters. But this info is completely missing for sieve. The doc only points to "script storage". Really? You couldn't have added these 2 parameters to the old-new matrix? I am not asking you to do this for every single sieve parameter, but at least for the 2 or 3 most used ones. Sorry for my rant, but I had to get it out there to not go insane. Cheers, K. C. -- regards Helmut K. C. Tessarek KeyID 0x172380A011EF4944 Key fingerprint = 8A55 70C1 BD85 D34E ADBC 386C 1723 80A0 11EF 4944 /* Thou shalt not follow the NULL pointer for chaos and madness await thee at its end. */

4 6

discarded vacation reply to own address <xxxx> (as specified using :addresses argument)
by Marc 23 Jul '25

23 Jul '25

Did I configure this? Or is this default behaviour of dovecot? How can I turn this off if this is a standard config?

2 1

Re: Strange mailq errors
by Xavier Humbert 23 Jul '25

23 Jul '25

Le 22/07/2025 16:28, Odhiambo Washington a écrit : > > > On Tue, Jul 22, 2025 at 4:42 PM Xavier Humbert via dovecot > <dovecot(a)dovecot.org> wrote: > > Hi, > > I recently experienced strange errors in mailq : > > [root@numenor ~]# mailq > -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- > 56BF31C9391 2320 Fri Jul 18 03:42:33 info(a)quora.com > (temporary failure. Command output: lda(postfix): Error: > net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission > denied) > postfix(a)groumpf.org > > All other messages are getting in without error. > Furthermore these are probably spam which shouldn't get in, since > postfix@ is not in the authorized recipients > > When it happens, it is always spam for postfix@ > > Any idea ? > > > Check your dovecot config for the permissions: Postfix user needs > access to /var/run/dovecot/stats-writer > > V2.4: > service stats { > unix_listener stats-writer { > mode = 0660 > user = ?? > } > } > > v2.3 > unix_listener stats-writer { > user = ?? > group = ?? > mode = 0660 > } > } > > > -- > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > In an Internet failure case, the #1 suspect is a constant: DNS. > "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) > [How to ask smart questions: > http://www.catb.org/~esr/faqs/smart-questions.html] Here is the relevant part of dovecot config : service stats { unix_listener stats-reader { user = $default_internal_user group = $default_internal_user mode = 0660 } unix_listener stats-writer { user = $default_internal_user group = $default_internal_user mode = 0660 } } All other mails get in without problem. I suspect it gets in, then confuses the mail system because of proxy:unix:passwd.byname in postfix config local_recipient_maps I don't need this btw. Xavier -- Xavier HUMBERT - Unix/Win/MacOSX Sysadmin/Network Engineer https://www.amdh.fr Le 22/07/2025 16:28, Odhiambo Washington a ecrit : On Tue, Jul 22, 2025 at 4:42PM Xavier Humbert via dovecot <[1]dovecot(a)dovecot.org> wrote: Hi, I recently experienced strange errors in mailq : [root@numenor ~]# mailq -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- 56BF31C9391 2320 Fri Jul 18 03:42:33 [2]info(a)quora.com (temporary failure. Command output: lda(postfix): Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission denied) [3]postfix(a)groumpf.org All other messages are getting in without error. Furthermore these are probably spam which shouldn't get in, since postfix@ is not in the authorized recipients When it happens, it is always spam for postfix@ Any idea ? Check your dovecot config for the permissions: Postfix user needs access to /var/run/dovecot/stats-writer V2.4: service stats { unix_listener stats-writer { mode = 0660 user = ?? } } v2.3 unix_listener stats-writer { user = ?? group = ?? mode = 0660 } } -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' -\_(Tu)_/- :-) [How to ask smart questions: [4]http://www.catb.org/~esr/faqs/smart-questions.html] Here is the relevant part of dovecot config : service stats { unix_listener stats-reader { user = $default_internal_user group = $default_internal_user mode = 0660 } unix_listener stats-writer { user = $default_internal_user group = $default_internal_user mode = 0660 } } All other mails get in without problem. I suspect it gets in, then confuses the mail system because of proxy:unix:passwd.byname in postfix config local_recipient_maps I don't need this btw. Xavier -- Xavier HUMBERT - Unix/Win/MacOSX Sysadmin/Network Engineer [5]https://www.amdh.fr References Visible links 1. mailto:dovecot@dovecot.org 2. mailto:info@quora.com 3. mailto:postfix@groumpf.org 4. http://www.catb.org/~esr/faqs/smart-questions.html 5. https://www.amdh.fr/

2 1

Anyone have working examples of how one might go about *debugging* a userdb/passdb LUA script for authentication?
by Andy Baugh 22 Jul '25

22 Jul '25

Howdy, I've been working on upgrading the version cPanel ships to Dovecot 2.4. It appears that the "dict" driver for passdb/authdb has been removed per your documentation, with a recommendation to use a lua script instead. As such I've followed the online documentation to do so and wound up with a userdb/passdb section that looks like so: passdb cpauthd { driver = lua lua_file = /usr/local/cpanel/etc/dovecot/cpauthd.lua lua_settings { socket = /usr/local/cpanel/var/cpdoveauthd.sock } result_internalfail = continue result_failure = return-fail } userdb cpauthd { driver = lua lua_file = /usr/local/cpanel/etc/dovecot/cpauthd.lua } My prospective lua script only takes from the socket arg passed in and reads from the socket, delivering back the same kind of answer we would have previously got from the auth dict driver (converting password_key/user_key to auth_passdb/userdb_get_cache_key in script as appears to be suggested). Unfortunately, I'm thinking that this entire setup is being ignored, as when I do: doveadm -D -o auth_debug=yes auth lookup for a user I know to be valid on the system with the previous 2.3 setup, I don't even see any indication that the lua authentication database is even consulted. Jul 18 12:32:30 Debug: auth-master: passdb lookup(zippy(a)cptest.local): Started passdb lookup Jul 18 12:32:30 Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting Jul 18 12:32:30 Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=800187,uid=0): Client connected (fd=9) Jul 18 12:32:30 Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=800187,uid=0): auth input: Jul 18 12:32:30 Error: auth-master: passdb lookup(zippy(a)cptest.local): Auth PASS lookup failed Jul 18 12:32:30 Debug: auth-master: passdb lookup(zippy(a)cptest.local): auth PASS input: Jul 18 12:32:30 Debug: auth-master: passdb lookup(zippy(a)cptest.local): Passdb lookup failed Jul 18 12:32:30 Error: cmd auth lookup: passdb lookup failed for zippy(a)cptest.local Jul 18 12:32:30 Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=800187,uid=0): Disconnected: Connection closed (fd=9) Similarly, in my lua script, I try to use the "dovecot.auth.log_debug/log_info" etc. functions in documentation within the scope of auth_passdb_lookup or auth_userdb_lookup, yet I never see any debug prints even if I add a debug line to the start of the function to indicate entry. What I would like to know is whether there is some debug flag I'm missing to see the routing from config -> lua script. Does this actually exist? I didn't see anything enlightening in the man pages or online documentation. Hopefully I'm just missing something simple. Cheers, -- Thomas "Andy" Baugh | Software Development Engineer IV andy.baugh(a)webpros.com www.webpros.com

1 1

Strange mailq errors
by Xavier Humbert 22 Jul '25

22 Jul '25

Hi, I recently experienced strange errors in mailq : [root@numenor ~]# mailq -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- 56BF31C9391 2320 Fri Jul 18 03:42:33 info(a)quora.com (temporary failure. Command output: lda(postfix): Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission denied) postfix(a)groumpf.org All other messages are getting in without error. Furthermore these are probably spam which shouldn't get in, since postfix@ is not in the authorized recipients When it happens, it is always spam for postfix@ Any idea ? Regards, Xavier -- Xavier HUMBERT - Unix/Win/MacOSX Sysadmin/Network Engineer https://www.amdh.fr

1 0

dovecot internal auth cache expires soon
by Burn Zero 21 Jul '25

21 Jul '25

Hi, I am new to dovecot and I am trying to prepare a POC environment. I have dovecot installed with postfix to perform SASL authentication. I'm using postgresql as auth backend which is working fine. But I am facing an issue with dovecot's internal auth cache. The internal auth cache just expires in 5 minutes. There is only one login (it's me testing) and there are no other logins. OS version: Almalinux 10 Postfix: postfix-3.8.5-8.el10.x86_64 system memory: 4 GB CPU: 2 auth_cache_size = 10M auth_cache_ttl = 1800secs auth_cache_negative_ttl = 300secs ( I have tried this setting to 0 but it does not change anything ) Here's the dovecot -n: # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf # OS: Linux 6.12.0-55.9.1.el10_0.x86_64 x86_64 AlmaLinux release 10.0 (Purple Lion) # Hostname: localhostvm auth_cache_size = 10 M auth_cache_verify_password_with_worker = yes auth_debug = yes auth_mechanisms = plain login auth_verbose = yes login_log_format = %$: %s %f passdb { args = /etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } protocols = service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = prefetch } Here's the cache hit log: Jul 14 11:53:35 localhostvm postfix/submission/smtpd[107852]: connect from remote-server Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client in: AUTH#0112#011LOGIN#011service=smtp#011nologin#011lip=192.168.100.12#011rip=192.168.100.25 Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client passdb out: CONT#0112#011VXNlcm5hbWU6 Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client in: CONT<hidden> Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client passdb out: CONT#0112#011UGFzc3dvcmQ6 Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client in: CONT<hidden> Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: sql(user(a)tld,192.168.100.25): Performing passdb lookup Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: sql(user(a)tld,192.168.100.25): cache hit: <hidden>#011user=user@tld Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: sql(user(a)tld,192.168.100.25): cache: validating password on worker Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: Loading modules from directory: /usr/lib64/dovecot/auth Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_pgsql.so Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: sqlpool(pgsql): Creating new connection Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: sqlpool(pgsql): Creating new connection Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: conn unix:auth-worker (pid=107856,uid=97): Server accepted connection (fd=15) Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: conn unix:auth-worker (pid=107856,uid=97): Sending version handshake Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: conn unix:auth-worker (pid=107856,uid=97): auth-worker<1>: Handling PASSW request Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: conn unix:auth-worker (pid=107856,uid=97): auth-worker<1>: Finished Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: sql(user(a)tld,192.168.100.25): Finished passdb lookup Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: auth(user(a)tld,192.168.100.25): Auth request finished Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client passdb out: OK#0112#011user=user@tld Jul 14 11:53:37 localhostvm postfix/submission/smtpd[107852]: 81GFE2083CH9: client=remote-server[192.168.100.25], sasl_method=LOGIN, sasl_username=user@tld I am not sure what is causing the cache to disappear in 5 min although I have set it to 1800s. Thank you.

3 2

GhettoForge is Moving
by Peter 20 Jul '25

20 Jul '25

For those of you who get dovecot from the GhettoForge repository please note that GhettoForge is moving to a new domain, GhettoForge.net. You will need to take some action in order to continue to receive dovecot updates from GhetttoForge. For further information please see: http://www.ghettoforge.net/index.php/Moving Peter

1 0

Building failures with 2.4.0 and 2.4.1 on MacOS: var_expand_crypt
by rmfuhrer＠optonline.net 18 Jul '25

18 Jul '25

I'm trying to build dovecot, both at tags 2.4.0 and 2.4.1, both failing with the same undefined-symbols link error. I've pulled the source from GitHub onto an Apple M2 Ultra Mac Studio running Sonoma 14.6.1. FWIW, I'm picking up various dependencies as packages from Homebrew via the CFLAGS and LDFLAGS args below. The prep steps before "make": $ ./autogen.sh $ CFLAGS="-I/opt/homebrew/include" LDFLAGS="-L/opt/homebrew/lib" ./configure --prefix=/opt/homebrew --with-bzlib --with-ldap --with-mysql --with-pam --with-sqlite --without-icu $ PATH="/opt/homebrew/opt/bison/bin:$PATH" make ... N.B.: The PATH tweak is solely intended to pick up a usable version (3.8.2) of bison, since the Xcode-supplied binary is too old (v2.3), and doesn't recognize certain cmdline flags. Also, getting even this far with 2.4.0 requires the "touch build-aux/config.rpath" workaround, and the 2-line patch to src/lib-http/http-server.h suggested on this thread: https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/MFHSI…. Anyway, here's an excerpt of the build stdout/stderr. $ PATH="/opt/homebrew/opt/bison/bin:$PATH" make ... CCLD var_expand_crypt.la Undefined symbols for architecture arm64: "_binary_to_hex_append", referenced from: _var_expand_encrypt in var-expand-crypt.o _var_expand_encrypt in var-expand-crypt.o "_buffer_append", referenced from: _var_expand_crypt_settings in var-expand-crypt.o _var_expand_crypt_settings in var-expand-crypt.o "_buffer_append_c", referenced from: _str_append_c in var-expand-crypt.o ... ld: symbol(s) not found for architecture arm64 clang: error: linker command failed with exit code 1 (use -v to see invocation) make[3]: *** [var_expand_crypt.la] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 $ Hopefully this is enough info to go on, but LMK if not.

3 6

Endless cycle of delete/expunge Outlook flagged messages.
by Mart Pirita 18 Jul '25

18 Jul '25

Hi, Suddenly I have a strange problem with the latest Outlook 365 (version 2506, build 16.0.1.18925.20076 64-bit) clients. When a user flags a message, they cannot remove the flag because Outlook gives an error message "The action cannot be performed because the message has been modified". One solution is to make the message unread and then remove the flag. However, since the moment a user flags a message for the first time, the maillog contains delete/expunge loop endlessly, for example: Jul 18 09:50:25 server dovecot: imap(user): delete: box=INBOX.Euro Brand, uid=2108, msgid=<GV1P195MB16414FAC3D4BAC6326F956048351A(a)GV1P195MB1641.EURP195.PROD.OUTLOOK.COM>, size=7597602, vsize=7698181, from="Masked User" <masked.user(a)somedomain.com>, subject=testing Jul 18 09:50:25 server dovecot: imap(user): expunge: box=INBOX.Euro Brand, uid=2108, msgid=<GV1P195MB16414FAC3D4BAC6326F956048351A(a)GV1P195MB1641.EURP195.PROD.OUTLOOK.COM>, size=7597602, vsize=7698181, from="Masked User" <masked.user(a)somedomain.com>, subject=testing Jul 18 09:50:27 server dovecot: imap(user): delete: box=INBOX.Euro Brand, uid=2109, msgid=<GV1P195MB16414FAC3D4BAC6326F956048351A(a)GV1P195MB1641.EURP195.PROD.OUTLOOK.COM>, size=7597628, vsize=7698214, from="Masked User" <masked.user(a)somedomain.com>, subject=testing Jul 18 09:50:27 server dovecot: imap(user): expunge: box=INBOX.Euro Brand, uid=2109, msgid=<GV1P195MB16414FAC3D4BAC6326F956048351A(a)GV1P195MB1641.EURP195.PROD.OUTLOOK.COM>, size=7597628, vsize=7698214, from="Masked User" <masked.user(a)somedomain.com>, subject=testing Jul 18 09:50:28 server dovecot: imap(user): delete: box=INBOX.Euro Brand, uid=2110, msgid=<GV1P195MB16414FAC3D4BAC6326F956048351A(a)GV1P195MB1641.EURP195.PROD.OUTLOOK.COM>, size=7597654, vsize=7698247, from="Masked User" <masked.user(a)somedomain.com>, subject=testing Jul 18 09:50:28 server dovecot: imap(user): expunge: box=INBOX.Euro Brand, uid=2110, msgid=<GV1P195MB16414FAC3D4BAC6326F956048351A(a)GV1P195MB1641.EURP195.PROD.OUTLOOK.COM>, size=7597654, vsize=7698247, from="Masked User" <masked.user(a)somedomain.com>, subject=testing ... So the message UID will change indefinitely forever. Is there any way to fix this with dovecot configuration? ### dovecot -n # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf auth_cache_size = 1 k auth_failure_delay = 1 mins auth_mechanisms = plain login base_dir = /var/run/dovecot/ default_client_limit = 2000 default_process_limit = 500 disable_plaintext_auth = no dsync_features = no-header-hashes import_environment = TZ CORE_OUTOFMEM CORE_ERROR TZ=:/etc/localtime MALLOC_MMAP_THRESHOLD_=131072 listen = * login_greeting = login_log_format_elements = %u %r %m %c %k mail_location = maildir:~/Maildir mail_log_prefix = "%s(%u): " mail_plugins = " mail_log notify" mail_sort_max_read_count = 100 mailbox_list_index_very_dirty_syncs = yes maildir_very_dirty_syncs = yes passdb { args = dovecot driver = pam } plugin { autocreate2 = Sent Items autosubscribe2 = Sent Items mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size from subject vsize } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 1 } service imap { process_limit = 2048 vsz_limit = 1 G } ssl_ca = </etc/ssl/certs/mail.ca.crt ssl_cert = </etc/ssl/certs/mail.fullchain.cer ssl_cipher_list = kEECDH:+kEECDH+SHA:kEDH:+kEDH+SHA:+kEDH+CAMELLIA:kECDH:+kECDH+SHA:kRSA:+kRSA+SHA:+kRSA+CAMELLIA:!aNULL:!eNULL:!SSLv2:!RC4:!MD5:!DES:!EXP:!SEED:!IDEA:!3DES ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1 ssl_prefer_server_ciphers = yes state_dir = /var/run/dovecot userdb { driver = passwd } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags delay-newmail imap_idle_notify_interval = 15 mins imap_logout_format = %{rip}, bytes=%i/%o, del=%{deleted} mail_max_userip_connections = 500 } -- Mart

1 0

Message Duplication
by Doug Hardie 17 Jul '25

17 Jul '25

I have a persistent, but infrequent situation where a message from a mail list will appear in the list of messages twice. The IDs are identical between the copies. There is only one copy of the email in the mailbox. It appears that there are two entries in some index. Apple's mail gets confused by this. If I delete the first entry, the second remains but is tagged as found in mailbox NULL. It cannot easily be deleted. My first thought was that sieve was saving two copies. So I pulled a copy of the original email and ran sieve-test on it. It is only saved once to the proper mailbox. I have not been able to determine if the problem is in Dovecot or Apple's mail app. From what I see, it could be either. I would appreciate any ideas on how to diagnose this further. Thanks, -- Doug

1 0