- dovecot - dovecot.org

Message duplication in Sent folder after upgrade
by Oliver Welter 03 Oct '25

03 Oct '25

Hi All, I have migrated my mailserver (from dovecot 2.2 on debian 10 to dovecot 2.3 provided by the mailcow-dockerized project) by coping over the mailstorage directory "as is". There is now a single mailbox where I have an issue with duplicated mails - the "Sent" folder had approx 400 mails upon migration, it now has 4500 mails with each mail duplicated several times. Below are the header lines of one message, besides the Message-Id the header is exactly the same on all copies. I tried "doveadm force-resync" on the mailbox and the mailbox was removed and recreated from scratch on the mail app but we still get additional copies added - anybody has an idea what is going on here and how to fix this? Oliver From: "presse(a)example.com" <presse(a)example.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_451F3D0B-155E-46EF-9BFB-B8034A7E2AE1" Mime-Version: 1.0 (Mac OS X Mail 16.0 $3826.300.87.4.3$) Subject: Re: EXTERN: Re: Example Mail X-Universally-Unique-Identifier: 6CD82CDA-138B-412E-8D4D-74C8C82B72ED Date: Mon, 13 Jan 2025 11:17:09 +0100 References: <DB3PR05MB100724231A87B9AE130C0EE0C853A2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <DB3PR05MB100725A1F1367C304AC417A9585002(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <DB3PR05MB1007220945CC70CDACDDBA5D685022(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <DB3PR05MB100724A5040FA029A29E625D1850D2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <09B63703-8BC4-484F-905A-899BA9A72139(a)example.com> <DB3PR05MB10072F836F9FCE2F9F626392D85142(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <BA8A1660-FC7D-4478-9F5F-E8B062B39115(a)example.com> <005d01db659c$cf2a48c0$6d7eda40$@John.Doe@t-online.de> To: John Doe <John.Doe(a)t-online.de> In-Reply-To: <005d01db659c$cf2a48c0$6d7eda40$@Jon.Doe@t-online.de> Message-Id: <A03E3B7A-638A-4482-83D8-C5B297D9953E(a)example.com> -- Protect your environment - close windows and adopt a penguin! Hi All, I have migrated my mailserver (from dovecot 2.2 on debian 10 to dovecot 2.3 provided by the mailcow-dockerized project) by coping over the mailstorage directory "as is". There is now a single mailbox where I have an issue with duplicated mails - the "Sent" folder had approx 400 mails upon migration, it now has 4500 mails with each mail duplicated several times. Below are the header lines of one message, besides the Message-Id the header is exactly the same on all copies. I tried "doveadm force-resync" on the mailbox and the mailbox was removed and recreated from scratch on the mail app but we still get additional copies added - anybody has an idea what is going on here and how to fix this? Oliver From: [1]"presse(a)example.com" [2]<presse(a)example.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_451F3D0B-155E-46EF-9BFB-B8034A7E2AE1" Mime-Version: 1.0 (Mac OS X Mail 16.0 $3826.300.87.4.3$) Subject: Re: EXTERN: Re: Example Mail X-Universally-Unique-Identifier: 6CD82CDA-138B-412E-8D4D-74C8C82B72ED Date: Mon, 13 Jan 2025 11:17:09 +0100 References: [3]<DB3PR05MB100724231A87B9AE130C0EE0C853A2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [4]<DB3PR05MB100725A1F1367C304AC417A9585002(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [5]<DB3PR05MB1007220945CC70CDACDDBA5D685022(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [6]<DB3PR05MB100724A5040FA029A29E625D1850D2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [7]<09B63703-8BC4-484F-905A-899BA9A72139(a)example.com> [8]<DB3PR05MB10072F836F9FCE2F9F626392D85142(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [9]<BA8A1660-FC7D-4478-9F5F-E8B062B39115(a)example.com> [10]<005d01db659c$cf2a48c0$6d7eda40$@John.Doe@t-online.de> To: John Doe [11]<John.Doe(a)t-online.de> In-Reply-To: [12]<005d01db659c$cf2a48c0$6d7eda40$@Jon.Doe@t-online.de> Message-Id: [13]<A03E3B7A-638A-4482-83D8-C5B297D9953E(a)example.com> -- Protect your environment - close windows and adopt a penguin! References Visible links 1. mailto:presse@example.com 2. mailto:presse@example.com 3. mailto:DB3PR05MB100724231A87B9AE130C0EE0C853A2@db3pr05mb10072.eurprd05.prod.outlook.com 4. mailto:DB3PR05MB100725A1F1367C304AC417A9585002@db3pr05mb10072.eurprd05.prod.outlook.com 5. mailto:DB3PR05MB1007220945CC70CDACDDBA5D685022@db3pr05mb10072.eurprd05.prod.outlook.com 6. mailto:DB3PR05MB100724A5040FA029A29E625D1850D2@db3pr05mb10072.eurprd05.prod.outlook.com 7. mailto:09B63703-8BC4-484F-905A-899BA9A72139@example.com 8. mailto:DB3PR05MB10072F836F9FCE2F9F626392D85142@db3pr05mb10072.eurprd05.prod.outlook.com 9. mailto:BA8A1660-FC7D-4478-9F5F-E8B062B39115@example.com 10. mailto:005d01db659c$cf2a48c0$6d7eda40$@John.Doe@t-online.de 11. mailto:John.Doe@t-online.de 12. mailto:005d01db659c$cf2a48c0$6d7eda40$@Jon.Doe@t-online.de 13. mailto:A03E3B7A-638A-4482-83D8-C5B297D9953E@example.com

1 0

Dovecot 2.3.21 Fallback MOVE to COPY on read-only namespaces
by Maciej Milaszewski 02 Oct '25

02 Oct '25

Hi I’m running Dovecot 2.3.21 with additional namespaces that point to read-only maildir snapshots. The setup works fine for browsing and copying messages, but when using Roundcube Webmail 1.5.3, there is a problem with the IMAP MOVE command. - If I try to move a message from a read-only namespace, Roundcube issues UID MOVE, which fails (as expected, since MOVE = COPY + DELETE, and DELETE is impossible). - What I would need is a way for Roundcube to fallback to COPY when the source/destination namespace is read-only ? I already tested: - `imap_move = false` in Roundcube config - Overriding capabilities in Dovecot (`imap_capability`) to remove MOVE, but this does not fully work. - Using INDEX=MEMORY / CONTROL outside snapshot for namespaces. What I’m looking for: - workaround in Dovecot to hide MOVE capability only for specific namespaces. - or Roundcube plugin or patch that intercepts MOVE and replaces it with COPY for read-only namespaces.

1 0

How to share ONE mailbox with a single user in, and configure auto ACL inheritance and Thunderbird SETACL support, in Dovecot 2.4.1?
by publists＠emailgroups.net 02 Oct '25

02 Oct '25

Hi, I’m working with Dovecot 2.4.1 and the acl plugin. I'm trying to get per-mailbox shared namespace+acl configured and working dynamically. One owner (owner(a)example.com) has a real Maildir folder "TEST_SHARE" at the top level cd /mail/path/example.com/owner/Maildir ls -1 cur/ dovecot-acl-list Drafts/ Junk/ new/ Queue/ Sent/ shared/ TEST_SHARE/ <------------------------ tmp/ Trash/ The goal is to share that TEST_SHARE/ folder with exactly one other user (user(a)example.com) not globally or using the global shared/ namespace. My current config includes It looks like in acl config you can hardwire access for a specific mailbox. Reading the 2.4 docs, using acl global file is deprecated and we're supposed to use acl config. namespace inbox { inbox = yes type = private prefix = separator = / hidden = no list = yes subscriptions = yes mailbox TEST_SHARE { acl owner { rights = lrwstipekxa } acl user=user(a)example.com { rights = lrwstipekx } } } namespace shared { type=shared; prefix=shared/$domain/$username/ } mail_plugin { acl = yes } acl_driver = vfile acl_sharing_map { dict file { path = /etc/dovecot/shared.db } } With that config "user" can see and use "owner’s" TEST_SHARE folder in Thunderbird client. But if "owner" changes the tree in their view, like creates a subfolder under TEST_SHARE in TBird, it does not appear for "user". No dovecot-acl file or acl_sharing_map entry is auto-created for the new subfolder. Reading the acl docs, I think that's because these ACLs are only STATIC configs that are merged with vfile ACLs at runtime? It looks to me like there's no automatic ACL inheritance from the parent to child mailboxes. And the acl.conf ACLs don't seem to cause dovecot-acl files or the acl_sharing_map db to be created or updated. I think "IMAP SETACL" would be needed on the client side. Reading https://support.mozilla.org/en-US/kb/imap-synchronization I can't figure out if Thunderbird does that or not. Can Dovecot server-side be configured to automatically create or update those shared acls/maps? I'm looking for any guidance how to do this, either in Thunderbird or Dovecot 2.4. So that any change to TEST_SHARE by either the owner or the authorized user is immediately pushed and sync'd between both owner and user. Dave

1 0

How to use redis as authentication database on dovecot 2.4.1
by 东山 02 Oct '25

02 Oct '25

How to use redis as authentication database on dovecot 2.4.1 Sir, dovecot is great, thanks. I want to use redis as authentication database on dovecot 2.4.1, but failed. Dict key-value database (Redis, memcached, etc.) is listed on v2.3, but was removed on 2.4.1. As https://doc.dovecot.org/2.4.1/core/config/auth/databases/lua.html , I was trying to auth via lua, like -- local redis = require('redis') -- on a lua file, but dovecot reported - module redis not found. I was trying to apt install dovecot-lua lua5.3 luarocks luaredis , but not work. Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: passdb-lua: script_init() failed: lua_pcall(/etc/dovecot/conf.d/auth_redis.lua) failed: /etc/dovecot/conf.d/auth_redis.lua:1: module 'redis' not found: Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no field package.preload['redis'] Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/share/lua/5.4/redis.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/share/lua/5.4/redis/init.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/lib/lua/5.4/redis.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/lib/lua/5.4/redis/init.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/share/lua/5.4/redis.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/share/lua/5.4/redis/init.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file './redis.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file './redis/init.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/lib/lua/5.4/redis.so' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/lib/x86_64-linux-gnu/lua/5.4/redis.so' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/lib/lua/5.4/redis.so' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/lib/lua/5.4/loadall.so' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file './redis.so' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: stack traceback: Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: [C]: in function 'require' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: /etc/dovecot/conf.d/auth_redis.lua:1: in main chunk Oct 02 11:02:54 debian dovecot[43743]: master: Error: service(auth): command startup failed, throttling for 2.000 secs How to use redis as authentication database on dovecot 2.4.1? How to add redis.so to let dovecot's lua support redis connection? Thanks.

1 0

Re: Using MongoDB as a custom message store via plugin
by Andy Balholm 01 Oct '25

01 Oct '25

I wouldn't be surprised if it would actually be easier to write an IMAP server than to write a Dovecot plugin, especially if you have a good IMAP library to work with. You can do it in the language of your choice, and not need to worry about Dovecot's internals. The server you make can be pretty bare-bones, if you plan to run Dovecot in front of it as an "IMAPC" proxy to add more features. Dovecot lets you turn off a lot of IMAP features in the IMAPC configuration; if Dovecot will be your only client, you don't need to implement the ones that you turn off. (But note that IMAPC works a lot better if you implement the UIDPLUS IMAP extension.) Andy

1 0

[Dovecot] auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied
by mailing＠securitylabs.it 01 Oct '25

01 Oct '25

Hello, just upgraded one of my testing machine from dovecot 1.2.15 to 2.0.7. After some trouble with permissions now all seems working, but when I stop dovecot I have these errors in log: Nov 9 17:08:07 in dovecot: master: Warning: Killed with signal 15 (by pid=20362 uid=0 code=kill) Nov 9 17:08:07 in dovecot: pop3-login: Error: read(anvil) failed: EOF Nov 9 17:08:07 in dovecot: imap-login: Error: read(anvil) failed: EOF Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=410/59361 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=79/26605 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=802/55708 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=258/1242 Nov 9 17:08:07 in dovecot: auth: Error: read(anvil-auth-penalty) failed: EOF Nov 9 17:08:07 in dovecot: auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied dovecot -n: # 2.0.7: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-xen-686 i686 Debian squeeze/sid auth_cache_negative_ttl = 2 mins auth_cache_size = 1000 M auth_cache_ttl = 2 mins auth_master_user_separator = * auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@& disable_plaintext_auth = no dotlock_use_excl = yes first_valid_uid = 100 last_valid_uid = 105 lock_method = dotlock log_timestamp = "%Y-%m-%d %H:%M:%S " login_greeting = Server ready. mail_fsync = never mail_gid = Debian-exim mail_location = maildir:~/Maildir:INDEX=/var/indexes/%d/%n mail_privileged_group = Debian-exim mail_uid = Debian-exim managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date namespace { inbox = yes location = prefix = separator = / type = private } namespace { location = maildir:~/Maildir/expunged prefix = EXPUNGED/ separator = / type = private } namespace { location = maildir:~/Maildir/deleted prefix = DELETED/ separator = / type = private } namespace { location = maildir:~/Maildir/deleted/expunged prefix = DELETED/EXPUNGED/ separator = / type = private } passdb { args = /usr/local/etc/dovecot-sql.conf driver = sql } passdb { args = /usr/local/etc/passwd.masterusers driver = passwd-file master = yes pass = yes } plugin { lazy_expunge = EXPUNGED/ DELETED/ DELETED/EXPUNGED/ mail_log_events = delete expunge mail_log_group_events = quota = maildir quota_warning = storage=80%% /usr/local/bin/dovecot-quota-warning.sh 80 quota_warning2 = storage=90%% /usr/local/bin/dovecot-quota-warning.sh 90 sieve = ~/.dovecot.sieve } pop3_no_flag_updates = yes protocols = imap pop3 service auth { unix_listener auth-userdb { group = Debian-exim mode = 0600 user = Debian-exim } } service imap-login { client_limit = 256 process_limit = 128 process_min_avail = 3 service_count = 1 } service imap { drop_priv_before_exec = yes process_limit = 256 vsz_limit = 256 B } service pop3-login { client_limit = 256 process_limit = 128 process_min_avail = 3 service_count = 1 } service pop3 { drop_priv_before_exec = yes process_limit = 256 vsz_limit = 256 B } ssl_cert = </usr/local/etc/dovecot.crt ssl_key = </usr/local/etc/dovecot.key userdb { args = /usr/local/etc/dovecot-sql.conf driver = sql } protocol imap { mail_max_userip_connections = 10 mail_plugins = " notify quota imap_quota mail_log lazy_expunge" } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = " notify quota mail_log" pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = quota sieve postmaster_address = postmaster(a)securitylabs.it } My /usr/local/var/run/dovecot directory: 4 drwxr-sr-x 4 root staff 4096 Nov 9 17:08 . 4 drwxrwsrwx 3 root staff 4096 Nov 9 17:05 .. 0 srw------- 1 root staff 0 Nov 9 17:05 anvil 0 srw------- 1 root staff 0 Nov 9 17:05 anvil-auth-penalty 0 srw------- 1 root staff 0 Nov 9 17:05 auth-client 0 srw------- 1 dovecot staff 0 Nov 9 17:05 auth-login 0 srw------- 1 root staff 0 Nov 9 17:05 auth-master 0 srw------- 1 Debian-exim Debian-exim 0 Nov 9 17:05 auth-userdb 0 srw------- 1 dovecot staff 0 Nov 9 17:05 auth-worker 0 srw------- 1 root staff 0 Nov 9 17:05 config 0 srw------- 1 root staff 0 Nov 9 17:05 dict 0 srw------- 1 root staff 0 Nov 9 17:05 director-admin 0 srw-rw-rw- 1 root staff 0 Nov 9 17:05 dns-client 0 srw------- 1 root staff 0 Nov 9 17:05 doveadm-server 0 lrwxrwxrwx 1 root staff 35 Nov 9 17:05 dovecot.conf -> /usr/local/etc/dovecot/dovecot.conf 4 drwxr-xr-x 2 root root 4096 Nov 9 17:05 empty 4 drwxr-x--- 2 root dovenull 4096 Nov 9 17:05 login My emails are delivered as user Debian-exim and users are virtual in a MySQL DB. This system is behind a proxy (so the master user)

7 7

Dovecot 2.3 to 2.4 invalid Maildir settings
by User 01 Oct '25

01 Oct '25

Greetings, I am unable to completely migrate my Dovecot 2.3 config to 2.4.1 as I'm unable to get past the following error: Error: Namespace inbox: maildir: maildir settings: Failed to parse configuration: Failed to override configuration from userdb: Invalid maildir=${domain}/${user}/: Setting is a named filter, use 'maildir {' I found a similar encounter at https://www.mail-archive.com/dovecot@dovecot.org/msg90843.html that points to https://doc.dovecot.org/2.4.0/core/config/mailbox/mail_location.html#per-us… yet I still can't get my config to work. I've attached my doveconf at the end, including the ported 2.3 settings that used to work for me (commented out). I would appreciate any advise. # /etc/dovecot/dovecot.conf dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 sql_driver = mysql mysql /run/mysqld/mysqld.sock { user = mail password = mail dbname = mail } passdb sql { query = SELECT username AS user, \ password FROM mailbox WHERE username = '%{user}' AND active='1' default_password_scheme = ARGON2I } userdb sql { query = SELECT maildir, \ 600 AS uid, \ 600 AS gid \ FROM mailbox WHERE username = '%{user}' AND active='1' iterate_query = SELECT username AS user FROM mailbox } # previously: # passdb { # driver = sql # args = /etc/dovecot/dovecot-sql.conf.ext # } # userdb { # driver = sql # args = /etc/dovecot/dovecot-sql.conf.ext # } # disable_plaintext_auth = yes auth_username_format = %{user | lower} # previously: "auth_username_format = %Lu" auth_mechanisms = plain login auth_default_domain = mail.com # previously: "auth_default_realm = mail.com" auth_debug = yes auth_debug_passwords = yes mail_privileged_group = mail # previously: "mail_location = maildir:~/Maildir" mail_driver = maildir mail_path = %{home}/Maildir mail_home = /var/vmail/%{user | domain}/%{user | username} # previously: "mail_home = /var/vmail/%d/%n/" service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { mode = 0600 user = postfix group = postfix } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0660 user = postfix group = postfix } } service stats { unix_listener stats-reader { user = nginx group = nginx mode = 0660 } unix_listener stats-writer { user = nginx group = nginx mode = 0660 } } ssl = required ssl_min_protocol = TLSv1.2 ssl_server_prefer_ciphers = server # previously: "ssl_prefer_server_ciphers = yes" ssl_server { dh_file = /etc/ssl/dovecot/dh.pem cert_file = /etc/ssl/dovecot/tls.pem key_file = /etc/ssl/dovecot/tls.key } # previously: # ssl_dh = </etc/ssl/dovecot/dh.pem # ssl_cert = </etc/ssl/dovecot/tls.pem # ssl_key = </etc/ssl/dovecot/tls.key namespace inbox { inbox = yes mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } } protocols = imap lmtp # previously: /etc/dovecot/dovecot-sql.conf.ext driver = mysql connect = host=localhost dbname=mail user=mail password=mail default_pass_scheme = ARGON2I password_query = SELECT username AS user,password FROM mailbox WHERE username = '%u' AND active='1' user_query = SELECT maildir, 600 AS uid, 600 AS gid FROM mailbox WHERE username = '%u' AND active='1' iterate_query = SELECT username AS user FROM mailbox

5 7

Repository origin
by Christian Celler 01 Oct '25

01 Oct '25

Hi there, maybe this has been discussed on the list before, but a quick search found nothing on this topic. It would be really nice to have an "Origin" (and maybe a Label?) in the InRelease-file for the apt-repositories. Would it be possible to add this to the repositories on repo.dovecot.org, for easier, more comprehensive pinning and stuff? Best regards Christian Celler

1 0

2.3 to 2.4 /proc/self/io) failed: Permission denied
by Don Bowman 01 Oct '25

01 Oct '25

I have a dovecot system running in my kubernetes cluster that i use to gateway some emails to imap that are in turn used by systems that poll for email. No people are involved. Its been running for sometime on 2.3, i've now updated the base container to 2.4 and i have two problems, perhaps related, perhaps not. I'm assuming its related to my config changes for 2.4, but I'm kind of at my wits end. The first issue: Sep 06 15:05:31 imap(support)<443><YIobSSM+MMoKIAIr>: Debug: open(/proc/self/io) failed: Permission denied (euid=1001(support) egid=1001(support) missing +r perm: /proc/self/io) I am seeing errors like this. I can't figure why. I tried "doveadm force-resync -u support /home/support/Maildir/" and it returns no errors. The 2nd error, again, perhaps related, the user doing the poll for new email doesn't see it (despite I see the email delivered to the 'new' dir, it doesn't get picked up and moved to 'cur'). Below is my config file. In /home/support/Maildir i have the new, cur, tmp etc. There's no mention of 'INBOX', which i think my previous had (mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir was previous) Any advice? I'm not sure where to go from here. dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 auth_mechanisms = plain login auth_allow_cleartext = yes #disable_plaintext_auth = no mail_privileged_group = mail #mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir mail_driver = maildir mail_path = /var/mail/%{user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir userdb passwd { fields { home = /home/{%user | username} mail_driver = maildir mail_path = /var/mail/{%user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir } } passdb pam { service_name = dovecot } protocols = " imap" namespace inbox { inbox = yes mailbox Trash { auto = subscribe # autocreate and autosubscribe the Trash mailbox special_use = \Trash } mailbox Sent { auto = subscribe # autocreate and autosubscribe the Sent mailbox special_use = \Sent } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } ssl=yes ssl_server_cert_file = /run/ca/tls.crt ssl_server_key_file = /run/ca/tls.key log_path = /tmp/dc.log mail_debug = yes ssl_min_protocol = TLSv1.2 log_debug = category=email # verbose_ssl=yes #auth_verbose=yes #auth_debug=yes I have a dovecot system running in my kubernetes cluster that i use to gateway some emails to imap that are in turn used by systems that poll for email. No people are involved. Its been running for sometime on 2.3, i've now updated the base container to 2.4 and i have two problems, perhaps related, perhaps not. I'm assuming its related to my config changes for 2.4, but I'm kind of at my wits end. The first issue: Sep 06 15:05:31 imap(support)<443><YIobSSM+MMoKIAIr>: Debug: open(/proc/self/io) failed: Permission denied (euid=1001(support) egid=1001(support) missing +r perm: /proc/self/io) I am seeing errors like this. I can't figure why. I tried "doveadm force-resync -u support /home/support/Maildir/" and it returns no errors. The 2nd error, again, perhaps related, the user doing the poll for new email doesn't see it (despite I see the email delivered to the 'new' dir, it doesn't get picked up and moved to 'cur'). Below is my config file. In /home/support/Maildir i have the new, cur, tmp etc. There's no mention of 'INBOX', which i think my previous had (mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir was previous) Any advice? I'm not sure where to go from here. dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 auth_mechanisms = plain login auth_allow_cleartext = yes #disable_plaintext_auth = no mail_privileged_group = mail #mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir mail_driver = maildir mail_path = /var/mail/%{user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir userdb passwd { fields { home = /home/{%user | username} mail_driver = maildir mail_path = /var/mail/{%user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir } } passdb pam { service_name = dovecot } protocols = " imap" namespace inbox { inbox = yes mailbox Trash { auto = subscribe # autocreate and autosubscribe the Trash mailbox special_use = \Trash } mailbox Sent { auto = subscribe # autocreate and autosubscribe the Sent mailbox special_use = \Sent } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } ssl=yes ssl_server_cert_file = /run/ca/tls.crt ssl_server_key_file = /run/ca/tls.key log_path = /tmp/dc.log mail_debug = yes ssl_min_protocol = TLSv1.2 log_debug = category=email # verbose_ssl=yes #auth_verbose=yes #auth_debug=yes

4 3

Public namespace - configuration help (new to Dovecot) - version 2.3.x
by daniel.botting＠codethink.co.uk 01 Oct '25

01 Oct '25

Hi all, I'm configuring a public namespace for an existing Dovecot install, I have the public namespace configured and working in a basic manner (it can be subscribed to in an MUA and mail can be moved into it for a specified user named in the dovecot-acl file). I've followed the official docs: - https://doc.dovecot.org/2.3/configuration_manual/shared_mailboxes/public_sh… When I configure the MUA (Thunderbird) I can see the public namespace and a subfolder that I've manually created underneath (with new/cur/tmp folders, parent public folders also has a new tmp cur directories, mail cannot be moved into public top level folder), but it is displayed as below when subscribed to: public^subfolder I've resolved this by changing the separator to a / , however as per my doveconf -n below I then received a separator conflict, which I resolved by changing the separator for the default namespace to also be a / . As the default namespace is already using period ( . ) on the production servers, I'd like to continue using this separator and not / separator. The existing install of a couple of hundred mailboxes and I'm concerned I'll break the mailboxes /any existing sieve filters. I would like the public folder to display with an empty prefix as below, but I understand you cannot have two 'prefix =' (empty prefixes) : subfolder doveconf -n output below: # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21.1 (49005e73) # OS: Linux 5.10.0-35-cloud-amd64 x86_64 Debian 11.11 # Hostname: imap-server.hostname.co.uk auth_verbose = yes default_vsz_limit = 0 doveadm_password = # hidden, use -P to show it first_valid_gid = 8 first_valid_uid = 8 last_valid_gid = 8 last_valid_uid = 8 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_gid = 8 mail_location = maildir:~/Maildir mail_plugins = " notify replication acl" mail_uid = 8 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapflags namespace { list = no location = maildir:/srv/vmail/public:INDEXPVT=~/Maildir/public prefix = Public/ separator = / subscriptions = no type = public } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / <--- I'd like this to be a . instead } namespace subscriptions { hidden = yes list = no location = prefix = subscriptions/ <--- had to put something here because inbox namespace was empty subscriptions = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile mail_replica = tcps:other-replica.domain.co.uk:port number sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/common.sieve sieve_dir = ~/sieve sieve_extensions = +editheader +imapflags } postmaster_address = postmaster(a)domain.co.uk protocols = " imap sieve pop3" replication_dsync_parameters = -d -N -l 15 -U -T 10 replication_max_conns = 24 service aggregator { fifo_listener replication-notify-fifo { user = mail } unix_listener replication-notify { user = mail } } service auth { unix_listener /var/run/dovecot-exim-bridge { mode = 0660 user = Debian-exim } } service doveadm { inet_listener { port = <replica port number> ssl = yes } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 512 process_min_avail = 4 service_count = 1 } service imap { process_limit = 1024 } service managesieve-login { inet_listener sieve { port = <port number> } process_min_avail = 1 service_count = 8 vsz_limit = 256 M } service managesieve { process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = <path/to/fullchain.pem ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap override_fields = home=/var/mail/%u uid=mail gid=mail } protocol lda { mail_plugins = " notify replication acl sieve" } protocol imap { mail_max_userip_connections = 32 mail_plugins = " notify replication acl acl" } protocol sieve { mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_line_length = 64 k } Also the public folder is not displayed in Roundcube webmail in folder sections to be subscribed to. doveadm mailbox list -u <username> I appreciate that replication does not work with public mailboxes, I'll have to look at that further. Many thanks Dan

2 6

Using MongoDB as a custom message store via plugin
by The Sixth Serpent 30 Sep '25

30 Sep '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello Dovecot Community! I have recently written a NodeJS-based mail system that I hope to eventually open-source. The SMTP daemon (accepting inbound for delivery/relay) and queue processor (handing off messages to remote MTAs for relay messages) both use MongoDB (utilizing Mongoose Schema) to store/queue the messages (emails). All of this is in-place and working. Now, I turn my attention to making the emails accessible to the end user (i.e., webmail, POP3, and/or IMAP). I already have a working POP3+TLS daemon (NodeJS + Mongoose), though it is unlikely that I'll make the POP3 service available to my users. I'm hoping to make use of RoundCube or other open-source webmail clients. IMAP provides the interface between my message store and webmail/user's clients. I've chosen Dovecot (yay!) to provide this interface (as opposed to the nightmare of writing one from scratch) given that it's open source and it's extensibility via plugins. Does the idea of providing a MongoDB-based message store sound like something that can be done sole via plugins - or might this require modification of the actual Dovecot core? Is support for a MongoDB message store interesting to anyone beyond myself? I'd be happy to share my Mongoose schema (as the intent is to open source the entire project once I get it together). I'll also need Dovecot to authenticate against my MongoDB instance. I have a collection, called "mailboxes" that defines the username and password (hashed with ARGON2), among other things. I'm imagining that custom authentication is something that can be achieved via plugins alone? What does everyone think to be simpler/more appropriate: 1. authentication plugin that connects directly to MongoDB, fetches the authen creds, and verifies the password via ARGON2 2. authentication plugin that accesses a NodeJS-express API endpoint that provides a boolean result From my perspective, option (a) makes the most sense. I consider option (b) in case the plugin system doesn't support MongoDB, or doesn't support ARGON2, or .... Can anyone recommend any good docs/howtos on writing Dovecot plugins? Any plugins' whose source might be of interest to me (i.e., custom message store, custom auth, etc)? Thank you for taking the time to consider these questions! I appreciate any responses. I'll make available, or describe further, any aspect of my system if it will help. Regards, TJ Easter II -- "The Information Age offers much to mankind, and I would like to think that we will rise to the challenges it presents. But it is vital to remember that information - in the sense of raw data - is not knowledge; that knowledge is not wisdom; and that wisdom is not foresight. But information is the first essential step to all of these." -- Arthur C. Clarke; 12/2003 Sent with Proton Mail secure email. -----BEGIN PGP SIGNATURE----- Version: ProtonMail wsC5BAEBCgBtBYJo209sCRDKQ0X/3WTf3EUUAAAAAAAcACBzYWx0QG5vdGF0 aW9ucy5vcGVucGdwanMub3JnOD2KL5NSk5rYX75gCW+d8bYmHLJNP8m5nkVy wnHpCHMWIQTQAEbAbK1F7TqiE2jKQ0X/3WTf3AAAChQH/iXWnG3kBM3oQpfe Yd4Hv2TkN/iduzaXfOwWDBcUCP4Dc2YDnYR2W/6OI6hcFLaPw+RvEWe6FMvu aik7s5wypDdQv8bNugO7FkyyooA4UYDLoffRDNIHv+vTXviAmByjywU64Qor hNwajt+vXCuJZY21+vElXhk0Nnea62DrBhRjrVWjxEQAmj9dNSP0HG5woqcX mCYC/PufJLbQatcortFZV5Eiq0OQCfe7C7AEtPjA+isbx2lzqTpMhcmJ87qn 95FwmMoEUuQPoLiUfrzkbBcFECFRi9EZsMhPr4vwuZLlGr49vIyzzqMgI/gX /XJq4cu6mZ1j0Hp+N2zq1iDG55I= =6CWa -----END PGP SIGNATURE-----

1 0

ENV var expansions work mostly in 2.4, but not in some locations
by publists＠emailgroups.net 29 Sep '25

29 Sep '25

Hi, I'm trying to clean up my migrated v2.4 config. I'm still having a hard time with environment variable expansions :-( They work in most places. But so far for me not in mail_plugin_dir ssl_client_* or ssl_server_* listen= For example, this config using literal file paths works great ssl_server { ca_file = /path/to/CA.crt.pem ... } ssl_client { ca_file = /path/to/CA.crt.pem ... } protocol doveadm { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol imap { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol lmtp { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol sieve { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol submission { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } When I add an env var import_environment { CA_FILE=/path/to/CA.crt.pem } and change any of those /path/to/CA.crt.pem instances to this %{env:CA_FILE} OR this $ENV:CA_FILE I get errors os startup like dovecot[13660]: doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf: ssl_server_request_client_cert=yes, but ssl_server_ca_file not provided If I go back to literal paths, everything works OK. I've read these https://doc.dovecot.org/main/core/settings/variables.html https://doc.dovecot.org/main/core/settings/syntax.html#environment-variables https://doc.dovecot.org/main/core/settings/types.html#file and as far as I can tell this should work. Something's different about these that I'm not understanding. Or there's a list of keys that can't use these vars in values. How do you use ENV var expansion in ssl file paths, listen addresses, etc? Dave

1 0

Enforce LMTP auth with client certs
by rhi＠pengutronix.de 29 Sep '25

29 Sep '25

Hello, I'm trying to get TLS client cert authentication to work on the LMTP socket via TCP port 24 with Dovecot 2.4. I was already able to get TLS working on the LMTP socket, but if I connect to it via 'openssl s_client' from another machine, and type in a few LMTP commands, Dovecot accepts all mail without requesting a client cert from me. The server running Dovecot is behind a firewall, so LMTP connections should only be possible from the SMTP server in the same local network, not from the whole internet. However I want to guard against possible firewall misconfigs by enforcing client certs between the incoming SMTP server and Dovecot for mail delivery. Is there a way to do this in Dovecot? My /etc/dovecot/conf.d/20-lmtp.conf effectively looks like this: lmtp_save_to_detail_mailbox = yes lmtp_add_received_header = yes protocol lmtp { mail_plugins { sieve = yes } ssl = required ssl_server_ca_file = /etc/lmtp-ca/ca.crt ssl_server_cert_file = /etc/lmtp-ca/local.crt ssl_server_key_file = /etc/lmtp-ca/private/local.key ssl_server_request_client_cert = yes # TODO: this should enforce client certs, but it does not work... auth_ssl_require_client_cert = yes ssl_server_require_crl = no log_debug = category=ssl OR category=auth } … and /etc/dovecot/conf.d/10-master.conf has: service lmtp { #unix_listener lmtp { # mode = 0666 #} inet_listener lmtp { # Accept connections from anywhere, but 20-lmtp.conf configures LMTP to require client certs listen = * :: port = 24 inet_listener_ssl = yes # TODO: this should enforce client certs, but it does not work... auth_ssl_require_client_cert = yes } } I also tried enabling ssl_server_request_client_cert = yes and auth_ssl_require_client_cert = yes globally, but this did not make a difference. I already tried looking at the Dovecot source code, but didn't find anything yet. I'm happy for any pointers in the right direction. Thanks, - Roland

2 2

postfix alias and dovecot quota
by Alexandre Ellert 28 Sep '25

28 Sep '25

Hello, Can someone tell me if it’s possible to configure dovecot to answer quota information about real mailbox when I query a postfix alias mailbox (this information is actually in a mysql database) ? Example : doveadm quota get - u alias(a)domain.com doveadm(alias(a)domain.com): Fatal: User doesn't exist doveadm quota get - u realmailbox(a)domain.com Quota name Type Value Limit % user STORAGE 2048853 2048000 100 user MESSAGE 6783 - 0 I’d like to have this result : doveadm quota get - u alias(a)domain.com Quota name Type Value Limit % user STORAGE 2048853 2048000 100 user MESSAGE 6783 - 0 doveadm quota get - u realmailbox(a)domain.com Quota name Type Value Limit % user STORAGE 2048853 2048000 100 user MESSAGE 6783 - 0 Thanks for your help. Alexandre.

6 9

Dovecot 2.4.1 sieve
by Martin Brampton 28 Sep '25

28 Sep '25

Just upgraded mail server from Debian 12 to 13. Fixed a number of issues with changed Dovecot, but stuck getting sieve working. The server uses LMTP. I’ll post some configuration if it helps. But the messages in the log saying the plugin sieve_lmtpsieve is missing seems fundamental and relevant. I can’t find anything called that in the Debian repository. How is it installed? Or am I doing something fundamentally wrong? Martin Just upgraded mail server from Debian 12 to 13. Fixed a number of issues with changed Dovecot, but stuck getting sieve working. The server uses LMTP. I'll post some configuration if it helps. But the messages in the log saying the plugin sieve_lmtpsieve is missing seems fundamental and relevant. I can't find anything called that in the Debian repository. How is it installed? Or am I doing something fundamentally wrong? Martin

7 21

2.4.1 Config woes
by Anthony Mellor 27 Sep '25

27 Sep '25

Hi, greetings Do sing out please if this is the wrong place or style for this mailing list, please - and there's a community somewhere isn't there? spent days not succeeding with these configs. I'm a new install on Trixie and Dovecot 2.4.1 and going round in many circles with nano /etc/dovecot/dovecot.conf nano /etc/dovecot/conf.d/10-auth.conf nano /etc/dovecot/conf.d/auth-sql.conf.ext nano /etc/dovecot/conf.d/10-master.conf MariaDB having tried one million variations of this, so this is just one, being the latest suggestion # Declare named instances of passdb/userdb using the SQL driver passdb sql { } userdb sql { } # Passdb (authentication) SQL settings passdb_sql_driver = mysql # MariaDB uses "mysql" passdb_sql_host = 127.0.0.1 # or: /run/mysqld/mysqld.sock passdb_sql_port = 3306 passdb_sql_dbname = maildb passdb_sql_user = dovecot passdb_sql_password = CHANGEME # Choose the scheme to match your DB: # - MD5-CRYPT for $1$... hashes or {MD5-CRYPT} prefix # - PLAIN-MD5 for 32-hex unsalted MD5 passdb_sql_default_pass_scheme = MD5-CRYPT passdb_sql_password_query = \ SELECT username AS user, password \ FROM users \ WHERE username = '%u' (thought this is now changed) # Userdb (user lookup) SQL settings userdb_sql_driver = mysql userdb_sql_host = 127.0.0.1 userdb_sql_port = 3306 userdb_sql_dbname = maildb userdb_sql_user = dovecot userdb_sql_password = CHANGEME # Must return at least uid, gid and home or mail userdb_sql_user_query = \ SELECT \ 5000 AS uid, 5000 AS gid, \ home, \ CONCAT('maildir:', maildir) AS mail \ FROM users \ WHERE username = '%u' (thought this is now changed) I have never used Dovecot before this install ten days ago - any example files that work will be forever gratefully appreciated to give me a basic starting point. Very frustratingly at one 3am morning I did get it working and the lost it. a t b Anthony _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org

1 0

2.4.1 Config woes
by Anthony Mellor 27 Sep '25

27 Sep '25

Hi, greetings Do sing out please if this is the wrong place or style for this mailing list, please - and there's a community somewhere isn't there? spent days not succeeding with these configs. I'm a new install on Trixie and Dovecot 2.4.1 and going round in many circles with nano /etc/dovecot/dovecot.conf nano /etc/dovecot/conf.d/10-auth.conf nano /etc/dovecot/conf.d/auth-sql.conf.ext nano /etc/dovecot/conf.d/10-master.conf MariaDB having tried one million variations of this, so this is just one, being the latest suggestion # Declare named instances of passdb/userdb using the SQL driver passdb sql { } userdb sql { } # Passdb (authentication) SQL settings passdb_sql_driver = mysql # MariaDB uses "mysql" passdb_sql_host = 127.0.0.1 # or: /run/mysqld/mysqld.sock passdb_sql_port = 3306 passdb_sql_dbname = maildb passdb_sql_user = dovecot passdb_sql_password = CHANGEME # Choose the scheme to match your DB: # - MD5-CRYPT for $1$... hashes or {MD5-CRYPT} prefix # - PLAIN-MD5 for 32-hex unsalted MD5 passdb_sql_default_pass_scheme = MD5-CRYPT passdb_sql_password_query = \ SELECT username AS user, password \ FROM users \ WHERE username = '%u' (thought this is now changed) # Userdb (user lookup) SQL settings userdb_sql_driver = mysql userdb_sql_host = 127.0.0.1 userdb_sql_port = 3306 userdb_sql_dbname = maildb userdb_sql_user = dovecot userdb_sql_password = CHANGEME # Must return at least uid, gid and home or mail userdb_sql_user_query = \ SELECT \ 5000 AS uid, 5000 AS gid, \ home, \ CONCAT('maildir:', maildir) AS mail \ FROM users \ WHERE username = '%u' (thought this is now changed) I have never used Dovecot before this install ten days ago - any example files that work will be forever gratefully appreciated to give me a basic starting point. Very frustratingly at one 3am morning I did get it working and the lost it. a t b Anthony

1 0

Slow inbox
by Rupert Gallagher 26 Sep '25

26 Sep '25

Hello, I note the following problem. If the inbox holds many subfolders with mail, thunderbird spends a lot of time on startup. To mitigate the problem, I asked users to keep the inbox clear of subfolders. However, a user keeps ignoring the local policy while also lamenting the mail is slow. Please write instructions to enforce this local policy in dovecot, so that when users try to create an inbox subfolder, dovecot refuses the action. Thank you

6 12

Dovecot and iOS 26 Mail.app
by Florian Effenberger 25 Sep '25

25 Sep '25

Hello, with the release of iOS 26, I had a look again at the infamous issue regarding Apple‘s Mail.app with Dovecot, when folder content does not reliably sync or mail content is not fully loaded. Some made a workaround by disabling pipelining (I didn‘t), and some pointed out Stalwart implemented some changes to work around the issue. A year ago, this was also prominently featured at Heise at least. I am not sure this is still a recent issue, but I wanted to share my findings. I have two different mail accounts on two different servers which have also different configurations. At least with iOS 26 I discovered that once the secondary mail account is added, both accounts suffer from the same problem again. The mere fact that I have two accounts is not the issue, because the secondary account also doesn’t work when the primary is disabled, but the other way round things have been working fine for at least a few days now. I assume that hiccups on one account affect both somehow. I did not yet get to compare the system configuration as to why the secondary account has hiccups, but maybe it helps those who debug the issue to reproduce it. Florian

1 0

Permissions Issues with shared Mailboxes, Unix Permissions and ACL
by fc26wuqa＠studserv.uni-leipzig.de 24 Sep '25

24 Sep '25

Hi, I use pam_ldap.so to use LDAP to authenticate my users. I don't use virtual accounts, but every account is a unix account. I use a post login script to export the `ACL_GROUPS` variable to hold all unix groups the user belongs to. Each group corresponds to a shared mailbox, where UNIX group permission handle which user gets access to the mailbox. Recently I added acl files to the shared mailboxes that look like: `group=some_group kxeilprwts` The Permissions of the user Mailboxes are generally 0700 and 0770 for shared mailboxes. The namespace of the shared Mailboxes looks something like: `type=shared, prefix=Shared/%%u/ location= maildir:/somewhere/'%%d/%%n/Maildir:INDEX=/srv/mails/%d/%n/Maildir/shared/%%u` Everything works fine, except my log gets flooded with messages saying: `open(/path/to/shared/mailbox) failed: Permission denied` and `opendir(/path/to/shared) failed: Permission denied, missing +x perm, we're not in group`. The user should also not be in the group. This is also reproducible when I do `doveadm mailbox list -u some_unix_user`, where dovecot tries to list all of the mailboxes, even though the user does not have permissions to do so. Referenced here: https://doc.dovecot.org/main/core/config/shared_mailboxes.html it says "Dovecot assumes that it can access the other users' mailboxes". So should I just ignore the messages/write a syslog filter for them? How can I prevent dovecot from checking every shared mailbox, even though they don't have access to it?

2 1

lib-sieve segfaults
by Alexander Gerasiov 23 Sep '25

23 Sep '25

Hi there, Just found wrong error handling (null pointer dereference) in lib-sieve How to reproduce: Enable global storage and try to check (via manage sieve api) require ["include"]; include :global "non exist script"; Here is a fix: https://github.com/dovecot/pigeonhole/pull/17 -- Best regards, Alexander Gerasiov Contacts: e-mail: a(a)gerasiov.net WWW: https://gerasiov.net TG/Skype: gerasiov PGP fingerprint: 04B5 9D90 DF7C C2AB CD49 BAEA CA87 E9E8 2AAC 33F1

1 0

2.3 to 2.4 unusual config
by Laura Steynes 22 Sep '25

22 Sep '25

We have two main mail server system, our broadband users on one, and, our hosting clients on another, because of the large number of customers on both, we use the following formats, I am looking at adding one dovecot 2.4 front end to the farm to see how it will perform, but with a such a complete rewrite requiring variable entry like we are all C programmers who understand code, which we are not and do not, I'm having headaches getting my head around how to convert these to this new weird format Broadband Users: jcitizen(a)example.net = /vmail/example.net/j/c/i/jcitizen mail_location = maildir:/vmail/%Ld/%1Ln/%1.1Ln/%2.1Ln/%Ln/Maildir Hosting Clients: jcitizen(a)example.net = /vmail/e/x/a/example.net/jcitizen mail_location = maildir:/vmail/%1Ld/%1.1Ld/%2.1Ld/%Ld/%Ln/Maildir Any help appreciated, we have no intentions of moving from 2.3.x in any foreseeable future, but if the time comes we must, we want to be able to have a plan to enact. -Loz We have two main mail server system, our broadband users on one, and, our hosting clients on another, because of the large number of customers on both, we use the following formats, I am looking at adding one dovecot 2.4 front end to the farm to see how it will perform, but with a such a complete rewrite requiring variable entry like we are all C programmers who understand code, which we are not and do not, I'm having headaches getting my head around how to convert these to this new weird format Broadband Users: [1]jcitizen(a)example.net = /vmail/[2]example.net/j/c/i/jcitizen mail_location = maildir:/vmail/%Ld/%1Ln/%1.1Ln/%2.1Ln/%Ln/Maildir Hosting Clients: [3]jcitizen(a)example.net = /vmail/e/x/a/[4]example.net/jcitizen mail_location = maildir:/vmail/%1Ld/%1.1Ld/%2.1Ld/%Ld/%Ln/Maildir Any help appreciated, we have no intentions of moving from 2.3.x in any foreseeable future, but if the time comes we must, we want to be able to have a plan to enact. -Loz References Visible links 1. mailto:jcitizen@example.net 2. http://example.net/j/c/i/jcitizen 3. mailto:jcitizen@example.net 4. http://example.net/jcitizen

2 1

variable expansion allowed in 'listen' config not working
by publists＠emailgroups.net 20 Sep '25

20 Sep '25

Hi, In a new dovecot 2.4 config I'm setting up a inet_listener for a service. I want to use an env var in `listen` expansion, like service imap-login { inet_listener imaps { listen = %{env:LAN_IPv4}, 127.0.0.1 } } This https://doc.dovecot.org/2.4.1/core/settings/variables.html says "You can use special variables in several places: All settings, except of type String without variables." Reading https://doc.dovecot.org/2.4.1/core/summaries/settings.html#listen `listen` directive allows listen Default *, :: Value IP addresses Unlike, for example deliver_log_format Default msgid=%{msgid}: %{message} Value String without variables which would be disallowed for "String without variables" I CAN use env vars across almost all of my config. But launch systemctl start dovecot fails with dovecot[17358]: Fatal: service(imap-login) Can't resolve address %{env:LAN_IPv4}: Name or service not known OTOH replacing - listen = %{env:LAN_IPv4}, 127.0.0.1 + listen = 10.1.1.1, 127.0.0.1 solves the launch issue. Like I said it works in other stanzas. Am I configuring this right for `listen`? Thanks, Dave

2 4

dovecot and oauth2 on fedora42
by Alex 20 Sep '25

20 Sep '25

Hi, I have a fedora42 system with dovecot-2.3.21 and trying to configure oauth2 support for a client application called acymailing as part of joomla. I'm trying to follow the instructions here, but I don't understand why I would need to involve google as the provider. How do I create my own provider? I don't want to authenticate against google, but against my own user database inside of joomla. I can create a local user, if that makes it possible, but not sure how to create the local provider it seems to require. https://doc.dovecot.org/2.3/configuration_manual/authentication/oauth2/ Thanks, Alex Hi, I have a fedora42 system with dovecot-2.3.21 and trying to configure oauth2 support for a client application called acymailing as part of joomla. I'm trying to follow the instructions here, but I don't understand why I would need to involve google as the provider. How do I create my own provider? I don't want to authenticate against google, but against my own user database inside of joomla. I can create a local user, if that makes it possible, but not sure how to create the local provider it seems to require. [1]https://doc.dovecot.org/2.3/configuration_manual/authentication/oauth2/ Thanks, Alex References Visible links 1. https://doc.dovecot.org/2.3/configuration_manual/authentication/oauth2/

2 1

library error
by Mihai Badici 20 Sep '25

20 Sep '25

I try to configure a public folder with acl on debian trixie . 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.41+deb13-amd64 x86_64 Debian 13.1 If I don't enable imap_acl there are no acl's which seems legit. After enabling imap_acl ( mail_plugins = acl quota imap_acl) I can set acl's but I have this error: Fatal: Couldn't load required plugin /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so: dlopen() failed: /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so: undefined symbol: imap_list_return_flag_unregister I'm not sure if this can be a packaging error with the wrong version as it looks, a missing library or a bug... or maybe a missing parameter? If i run ldd on this .so there is no library missing: ldd /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so linux-vdso.so.1 (0x00007fcfbfab3000) lib01_acl_plugin.so => /usr/lib/dovecot/modules/lib01_acl_plugin.so (0x00007fcfbfa8a000) libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fcfbf88b000) /lib64/ld-linux-x86-64.so.2 (0x00007fcfbfab5000) Thanks, Mihai Bădici I try to configure a public folder with acl on debian trixie . 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.41+deb13-amd64 x86_64 Debian 13.1 If I don't enable imap_acl there are no acl's which seems legit. After enabling imap_acl ( mail_plugins = acl quota imap_acl) I can set acl's but I have this error: Fatal: Couldn't load required plugin /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so: dlopen() failed: /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so: undefined symbol: imap_list_return_flag_unregister I'm not sure if this can be a packaging error with the wrong version as it looks, a missing library or a bug... or maybe a missing parameter? If i run ldd on this .so there is no library missing: ldd /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so linux-vdso.so.1 (0x00007fcfbfab3000) lib01_acl_plugin.so => /usr/lib/dovecot/modules/lib01_acl_plugin.so (0x00007fcfbfa8a000) libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fcfbf88b000) /lib64/ld-linux-x86-64.so.2 (0x00007fcfbfab5000) Thanks, Mihai Badici

1 1

Re: [Dovecot] output of doveconf in conflict with order of settings in conf.d/*-*.conf files
by Marcos José Texeira 19 Sep '25

19 Sep '25

2 1

Mail not getting deleted physically
by Support Team 19 Sep '25

19 Sep '25

I am clearing the mail using roundcube and also deleting mail from trash and thus permenently deleting the mail. The mail quota changes. But mail is still present in INBOX.EXPUNGED.Trash and also with refcount 1. The physical disk usage remains the same and purge not deleting the mail physically, prob due to refcount. 1. Initial stage. 2 mails in inbox and around 14MB of usage. --- doveadm -f table quota get -u u.demo1(a)mydomain.net Quota name Type Value Limit % mdbox quota STORAGE 14017 512000 2 mdbox quota MESSAGE 2 10000 0 doveadm -f table mailbox status -u u.demo1(a)mydomain.net all INBOX mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX 2 0 3 1758288242 0 5 14352516 c61ef0307259cd684d18000079f6831d 1758288243 doveadm -f table mailbox status -u u.demo1(a)mydomain.net all INBOX.* mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX.Drafts 0 0 1 1758288245 0 1 0 c91ef0307259cd684d18000079f6831d never INBOX.Spam 0 0 1 1758288244 0 1 0 c81ef0307259cd684d18000079f6831d never INBOX.Trash 0 0 1 1758288243 0 1 0 c71ef0307259cd684d18000079f6831d never doveadm -f table mailbox status -u u.demo1(a)mydomain.net all INBOX.*.* mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved doveadm -f table fetch -u u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX all mailbox refcount user INBOX 1 u.demo1(a)mydomain.net INBOX 1 u.demo1(a)mydomain.net doveadm -f table fetch -u u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX.* all mailbox refcount user doveadm -f table fetch -u u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX.*.* all mailbox refcount user --- 2. Deleted mail from Inbox and also from Trash. Mail quota got reduced. But mail exist in INBOX.EXPUNGED.Trash with refcount 1 and using disk storage. --- doveadm -f table quota get -u u.demo1(a)mydomain.net Quota name Type Value Limit % mdbox quota STORAGE 0 512000 0 mdbox quota MESSAGE 0 10000 0 doveadm -f table mailbox status -u u.demo1(a)mydomain.net all INBOX mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX 0 0 3 1758288242 0 7 0 c61ef0307259cd684d18000079f6831d never doveadm -f table mailbox status -u u.demo1(a)mydomain.net all INBOX.* mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX.Drafts 0 0 1 1758288245 0 1 0 c91ef0307259cd684d18000079f6831d never INBOX.Spam 0 0 1 1758288244 0 1 0 c81ef0307259cd684d18000079f6831d never INBOX.Trash 0 0 3 1758288243 0 7 0 c71ef0307259cd684d18000079f6831d never doveadm -f table mailbox status -u u.demo1(a)mydomain.net all INBOX.*.* mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX.EXPUNGED.Trash 2 2 3 1758288246 0 3 14352516 c80d5b1f075ecd68eb4c000079f6831d 1758289415 doveadm -f table fetch -u u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX all mailbox refcount user doveadm -f table fetch -u u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX.* all mailbox refcount user doveadm -f table fetch -u u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX.*.* all mailbox refcount user INBOX.EXPUNGED.Trash 1 u.demo1(a)mydomain.net INBOX.EXPUNGED.Trash 1 u.demo1(a)mydomain.net --- The following options are checked in roundcube. Maintenance Clear Trash on logout Compact Inbox on logout Is there anything missing in roundcube settings? Why refcount still shows as 1? I am clearing the mail using roundcube and also deleting mail from trash and thus permenently deleting the mail. The mail quota changes. But mail is still present in INBOX.EXPUNGED.Trash and also with refcount 1. The physical disk usage remains the same and purge not deleting the mail physically, prob due to refcount. 1. Initial stage. 2 mails in inbox and around 14MB of usage. --- doveadm -f table quota get -u [1]u.demo1(a)mydomain.net Quota name Type Value Limit % mdbox quota STORAGE 14017 512000 2 mdbox quota MESSAGE 2 10000 0 doveadm -f table mailbox status -u [2]u.demo1(a)mydomain.net all INBOX mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX 2 0 3 1758288242 0 5 14352516 c61ef0307259cd684d18000079f6831d 1758288243 doveadm -f table mailbox status -u [3]u.demo1(a)mydomain.net all INBOX.* mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX.Drafts 0 0 1 1758288245 0 1 0 c91ef0307259cd684d18000079f6831d never INBOX.Spam 0 0 1 1758288244 0 1 0 c81ef0307259cd684d18000079f6831d never INBOX.Trash 0 0 1 1758288243 0 1 0 c71ef0307259cd684d18000079f6831d never doveadm -f table mailbox status -u [4]u.demo1(a)mydomain.net all INBOX.*.* mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved doveadm -f table fetch -u [5]u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX all mailbox refcount user INBOX 1 [6]u.demo1(a)mydomain.net INBOX 1 [7]u.demo1(a)mydomain.net doveadm -f table fetch -u [8]u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX.* all mailbox refcount user doveadm -f table fetch -u [9]u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX.*.* all mailbox refcount user --- 2. Deleted mail from Inbox and also from Trash. Mail quota got reduced. But mail exist in INBOX.EXPUNGED.Trash with refcount 1 and using disk storage. --- doveadm -f table quota get -u [10]u.demo1(a)mydomain.net Quota name Type Value Limit % mdbox quota STORAGE 0 512000 0 mdbox quota MESSAGE 0 10000 0 doveadm -f table mailbox status -u [11]u.demo1(a)mydomain.net all INBOX mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX 0 0 3 1758288242 0 7 0 c61ef0307259cd684d18000079f6831d never doveadm -f table mailbox status -u [12]u.demo1(a)mydomain.net all INBOX.* mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX.Drafts 0 0 1 1758288245 0 1 0 c91ef0307259cd684d18000079f6831d never INBOX.Spam 0 0 1 1758288244 0 1 0 c81ef0307259cd684d18000079f6831d never INBOX.Trash 0 0 3 1758288243 0 7 0 c71ef0307259cd684d18000079f6831d never doveadm -f table mailbox status -u [13]u.demo1(a)mydomain.net all INBOX.*.* mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX.EXPUNGED.Trash 2 2 3 1758288246 0 3 14352516 c80d5b1f075ecd68eb4c000079f6831d 1758289415 doveadm -f table fetch -u [14]u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX all mailbox refcount user doveadm -f table fetch -u [15]u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX.* all mailbox refcount user doveadm -f table fetch -u [16]u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX.*.* all mailbox refcount user INBOX.EXPUNGED.Trash 1 [17]u.demo1(a)mydomain.net INBOX.EXPUNGED.Trash 1 [18]u.demo1(a)mydomain.net --- The following options are checked in roundcube. Maintenance Clear Trash on logout Compact Inbox on logout Is there anything missing in roundcube settings? Why refcount still shows as 1? References Visible links 1. mailto:u.demo1@mydomain.net 2. mailto:u.demo1@mydomain.net 3. mailto:u.demo1@mydomain.net 4. mailto:u.demo1@mydomain.net 5. mailto:u.demo1@mydomain.net 6. mailto:u.demo1@mydomain.net 7. mailto:u.demo1@mydomain.net 8. mailto:u.demo1@mydomain.net 9. mailto:u.demo1@mydomain.net 10. mailto:u.demo1@mydomain.net 11. mailto:u.demo1@mydomain.net 12. mailto:u.demo1@mydomain.net 13. mailto:u.demo1@mydomain.net 14. mailto:u.demo1@mydomain.net 15. mailto:u.demo1@mydomain.net 16. mailto:u.demo1@mydomain.net 17. mailto:u.demo1@mydomain.net 18. mailto:u.demo1@mydomain.net

1 0

fts_flatcurve max_term_size config missing or broken in v2.4
by publists＠emailgroups.net 17 Sep '25

17 Sep '25

Hi, I'm working on migrating my v2.3 -> v2.4 configuration. From my 2.3 config I have ... fts flatcurve { commit_limit = 2000 29 max_term_size = 60 min_term_size = 3 substring_search = yes } ... From reading the current docs' "Configuration Example" https://doc.dovecot.org/2.4.1/core/plugins/fts_flatcurve.html#configuration… that looks OK for v2.4.1 too. But a config check fails, doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/50-fts.conf line 29: max_term_size: Unknown setting: max_term_size (fts_max_term_size or fts_flatcurve_max_term_size not found either.) There's no mention of "max_term_size" in https://doc.dovecot.org/2.4.1/installation/upgrade/2.3-to-2.4.html as a change. It's also NOT listed as a current setting at https://doc.dovecot.org/2.4.1/core/summaries/settings.html Checking in code sources cd dovecot git checkout release-2.4.1 Switched to branch 'release-2.4.1' Your branch is up to date with 'origin/release-2.4.1'. "min_term_size" is in use grep "min_term_size" * fts-backend-flatcurve.c: if (size < ctx->backend->fuser->set->min_term_size) fts-backend-flatcurve-xapian.cc: * smaller than min_term_size. Requires libicu in order to correctly handle fts-backend-flatcurve-xapian.cc: if (len < fuser->set->min_term_size) fts-backend-flatcurve-xapian.cc: if (len < fuser->set->min_term_size) fts-flatcurve-settings.c: DEF(UINT, min_term_size), fts-flatcurve-settings.c: .min_term_size = 2, fts-flatcurve-settings.h: unsigned int min_term_size; But no trace of "max_term_size" at all from grep "max_term_size" * Is "max_term_size" still valid config? Does code or documentation, or both, need to change? Or am I misreading the usage? Thanks, Dave

2 1

hidden / alias_for / sieve
by Erick Calder 11 Sep '25

11 Sep '25

hi. I'm running on Fedora 42 and want to hide the Deleted Messages folder (because I want to use Trash instead). unfortunately this fails: mailbox "Deleted Messages" { hidden = yes } which I understand depends on the "mailbox" plugin. however, when I look in /var/lib64/dovecot, I don't see any such plugin. I also cannot find in the repositories any RPM that provides it. I understand it may be baked into the core binary but if so, enabling it should work, and yet if I do enable it, I get the error below: Sep 11 10:06:01 mail dovecot[739762]: imap(ekkis): Error: Plugin 'mailbox' not found from directory /usr/lib64/dovecot I would also like to use the alias_for but that also fails. sigh. I'm also struggling to make Sieve work. I've produced a sysreport (see: https://arix.com/tmp/dovecot-sysreport-mail.arix.com-1757611127.tar.gz) and you'll find my config file below: please help? # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21.1 (49005e73) # OS: Linux 6.15.9-201.fc42.x86_64 x86_64 Fedora release 42 (Adams) # Hostname: mail.arix.com first_valid_uid = 1000 mail_debug = yes mail_location = maildir:~/mail:LAYOUT=fs managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;asc ii-numeric relational regex imap4flags copy include body enotify environment mailbox date index ihave duplicat e mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } prefix = INBOX/ separator = / } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/lib/dovecot/sieve/global sieve_execute_bin_dir = /usr/lib/dovecot/sieve-execute sieve_global_extensions = +vnd.dovecot.execute +vnd.dovecot.environment +variables sieve_plugins = sieve_extprograms sieve_trace_debug = yes sieve_trace_dir = /tmp/sieve sieve_trace_level = matching } protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { inet_listener lmtp { address = localhost port = 24 } ssl = required ssl_cert = </etc/letsencrypt/live/mail.arix.com/fullchain.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol sieve { mail_plugins = " sieve" } > On Sep 11, 2025, at 10:45, dovecot-request(a)dovecot.org wrote: > > Welcome to the "dovecot" mailing list! > > To post to this list, send your message to: > > dovecot(a)dovecot.org > > You can unsubscribe or make adjustments to your options via email by > sending a message to: > > dovecot-request(a)dovecot.org > > with the word 'help' in the subject or body (don't include the > quotes), and you will get back a message with instructions. You will > need your password to change your options, but for security purposes, > this password is not included here. If you have forgotten your > password you will need to reset it via the web UI. hi. I'm running on Fedora 42 and want to hide the Deleted Messages folder (because I want to use Trash instead). unfortunately this fails: mailbox "Deleted Messages" { hidden = yes } which I understand depends on the "mailbox" plugin. however, when I look in /var/lib64/dovecot, I don't see any such plugin. I also cannot find in the repositories any RPM that provides it. I understand it may be baked into the core binary but if so, enabling it should work, and yet if I do enable it, I get the error below: Sep 11 10:06:01 mail dovecot[739762]: imap(ekkis): Error: Plugin 'mailbox' not found from directory /usr/lib64/dovecot I would also like to use the alias_for but that also fails. sigh. I'm also struggling to make Sieve work. I've produced a sysreport (see: https://arix.com/tmp/dovecot-sysreport-mail.arix.com-1757611127.tar.gz) and you'll find my config file below: please help? # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21.1 (49005e73) # OS: Linux 6.15.9-201.fc42.x86_64 x86_64 Fedora release 42 (Adams) # Hostname: mail.arix.com first_valid_uid = 1000 mail_debug = yes mail_location = maildir:~/mail:LAYOUT=fs managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;asc ii-numeric relational regex imap4flags copy include body enotify environment mailbox date index ihave duplicat e mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } prefix = INBOX/ separator = / } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/lib/dovecot/sieve/global sieve_execute_bin_dir = /usr/lib/dovecot/sieve-execute sieve_global_extensions = +vnd.dovecot.execute +vnd.dovecot.environment +variables sieve_plugins = sieve_extprograms sieve_trace_debug = yes sieve_trace_dir = /tmp/sieve sieve_trace_level = matching } protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { inet_listener lmtp { address = localhost port = 24 } ssl = required ssl_cert = </etc/letsencrypt/live/mail.arix.com/fullchain.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol sieve { mail_plugins = " sieve" } On Sep 11, 2025, at 10:45, dovecot-request(a)dovecot.org wrote: Welcome to the "dovecot" mailing list! To post to this list, send your message to: dovecot(a)dovecot.org You can unsubscribe or make adjustments to your options via email by sending a message to: dovecot-request(a)dovecot.org with the word 'help' in the subject or body (don't include the quotes), and you will get back a message with instructions. You will need your password to change your options, but for security purposes, this password is not included here. If you have forgotten your password you will need to reset it via the web UI.

2 2

SMTPUTF8 - what's the status?
by Kamil Jońca 11 Sep '25

11 Sep '25

Does dovecot LMTP can process SMTPUTF8 emails? I guess not, but I want to confirm. KJ -- http://wolnelektury.pl/wesprzyj/teraz/ <kira> is a surgical war where you go give the foreign troops nose jobs?

2 1

Re: SMTPUTF8 - what's the status?
by Michael Slusarz 11 Sep '25

11 Sep '25

> On 09/11/2025 10:53 AM MDT Kamil Jońca via dovecot <dovecot(a)dovecot.org> wrote: > > Does dovecot LMTP can process SMTPUTF8 emails? > I guess not, but I want to confirm. https://doc.dovecot.org/2.4.1/core/summaries/settings.html#mail_utf8_extens… Requires --enable-experimental-mail-utf8 when compiling. michael

1 0

Sieve Scripts via SQL Dicts in Dovecot 2.4 not working?
by Niklas Meyer 10 Sep '25

10 Sep '25

Hello everyone, I am currently working on porting the Dovecot 2.4 configuration from the latest 2.3 version. During this process, I encountered issues with the Sieve filters, particularly those related to SQL dict mappings. The previous (2.3) configuration looked like this and worked: |map { pattern = priv/sieve/name/$script_nametable = sieve_before username_field = username value_field = idfields { script_name = $script_name} } map { pattern = priv/sieve/data/$idtable = sieve_before username_field = username value_field = script_data fields { id= $id} } | This resulted in the following SQL queries on the MySQL server: |2025-08-1511:01:29.237511SELECTid FROMsieve_after WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'2025-08-1511:01:29.236416SELECTid FROMsieve_before WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'| As you can see, there are SQL mappings for |sieve_before| and |sieve_after|, alongside a local file loaded prior to the SQL settings, as they are user-based. In Dovecot 2.3, everything worked and the scripts were executed. In 2.4, however, they no longer run. I adapted the configuration for dict SQL mapping for Sieve filters according to the documentation: |dict_mappriv/sieve/name/$script_name{ sql_table= sieve_before username_field = username value_field id { } # The script name field in the table to querykey_fieldscript_name { value= $script_name} } dict_map priv/sieve/data/$id{ sql_table= sieve_before username_field = username value_field script_data { } key_fieldid { value= $id} } | This also results in the dict proxy querying the database with the same pattern as before: |2025-08-1511:11:47.175184SELECTid FROMsieve_after WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'2025-08-1511:11:47.172952SELECTid FROMsieve_before WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'2025-08-1511:11:47.155786SELECTid FROMsieve_after WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'2025-08-1511:11:47.136030SELECTid FROMsieve_before WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'| However, unlike in 2.3, it now queries the DB twice. In the Sieve debug logs, I see the following: https://pastebin.com/PTKkLsDQ Notably: |Aug 1512:22:2443664c142e0a dovecot: lmtp(frittenjonas(a)derlinkman.de)<2407><mPFNN2AKn2hnCQAAhwrv7A>: Debug: Localdelivery failed: Temporarily unable toaccessnecessary Sieve scripts | This line concerns me. Here are the current Sieve script declarations: |sieve_script before{ type= beforedriver = file path= /var/vmail/sieve/global_sieve_before.sieve } sieve_script before2 { type= beforedriver = dict name= active dict proxy { name= sieve_before sieve_script_bin_path = /var/vmail/sieve_before_bindir } } sieve_script after{ type= afterdriver = file path= /var/vmail/sieve/global_sieve_after.sieve } sieve_script after2 { type= afterdriver = dict name= active dict proxy { name= sieve_after sieve_script_bin_path = /var/vmail/sieve_after_bindir } } # Personal scripts sieve_script personal { type= personal driver = file path= ~/sieve active_path = ~/.dovecot.sieve } | The dict proxy configuration, pointing to the dict_map SQL query above, looks like this: |dict sieve_after { driver = sql!include/etc/dovecot/sql/dovecot-dict-sql-sieve_after.conf } dict sieve_before { driver = sql!include/etc/dovecot/sql/dovecot-dict-sql-sieve_before.conf } | Thanks for your guidance. Kind regards Niklas Meyer Maintainer of the mailcow project Hello everyone, I am currently working on porting the Dovecot 2.4 configuration from the latest 2.3 version. During this process, I encountered issues with the Sieve filters, particularly those related to SQL dict mappings. The previous (2.3) configuration looked like this and worked: map { pattern = priv/sieve/name/$script_name table = sieve_before username_field = username value_field = id fields { script_name = $script_name } } map { pattern = priv/sieve/data/$id table = sieve_before username_field = username value_field = script_data fields { id = $id } } This resulted in the following SQL queries on the MySQL server: 2025-08-15 11:01:29.237511 SELECT id FROM sieve_after WHERE script_name = 'active' AND username = '[1]frittenjonas(a)derlinkman.de' 2025-08-15 11:01:29.236416 SELECT id FROM sieve_before WHERE script_name = 'active' AND username = '[2]frittenjonas(a)derlinkman.de' As you can see, there are SQL mappings for sieve_before and sieve_after, alongside a local file loaded prior to the SQL settings, as they are user-based. In Dovecot 2.3, everything worked and the scripts were executed. In 2.4, however, they no longer run. I adapted the configuration for dict SQL mapping for Sieve filters according to the documentation: dict_map priv/sieve/name/$script_name { sql_table = sieve_before username_field = username value_field id { } # The script name field in the table to query key_field script_name { value = $script_name } } dict_map priv/sieve/data/$id { sql_table = sieve_before username_field = username value_field script_data { } key_field id { value = $id } } This also results in the dict proxy querying the database with the same pattern as before: 2025-08-15 11:11:47.175184 SELECT id FROM sieve_after WHERE script_name = 'active' AND username = '[3]frittenjonas(a)derlinkman.de' 2025-08-15 11:11:47.172952 SELECT id FROM sieve_before WHERE script_name = 'active' AND username = '[4]frittenjonas(a)derlinkman.de' 2025-08-15 11:11:47.155786 SELECT id FROM sieve_after WHERE script_name = 'active' AND username = '[5]frittenjonas(a)derlinkman.de' 2025-08-15 11:11:47.136030 SELECT id FROM sieve_before WHERE script_name = 'active' AND username = '[6]frittenjonas(a)derlinkman.de' However, unlike in 2.3, it now queries the DB twice. In the Sieve debug logs, I see the following: [7]https://pastebin.com/PTKkLsDQ Notably: Aug 15 12:22:24 43664c142e0a dovecot: lmtp([8]frittenjonas(a)derlinkman.de)<2407><mPFNN2AKn2hnCQAAhwrv7A>: Debug: Local delivery failed: Temporarily unable to access necessary Sieve scripts This line concerns me. Here are the current Sieve script declarations: sieve_script before { type = before driver = file path = /var/vmail/sieve/global_sieve_before.sieve } sieve_script before2 { type = before driver = dict name = active dict proxy { name = sieve_before sieve_script_bin_path = /var/vmail/sieve_before_bindir } } sieve_script after { type = after driver = file path = /var/vmail/sieve/global_sieve_after.sieve } sieve_script after2 { type = after driver = dict name = active dict proxy { name = sieve_after sieve_script_bin_path = /var/vmail/sieve_after_bindir } } # Personal scripts sieve_script personal { type = personal driver = file path = ~/sieve active_path = ~/.dovecot.sieve } The dict proxy configuration, pointing to the dict_map SQL query above, looks like this: dict sieve_after { driver = sql !include /etc/dovecot/sql/dovecot-dict-sql-sieve_after.conf } dict sieve_before { driver = sql !include /etc/dovecot/sql/dovecot-dict-sql-sieve_before.conf } Thanks for your guidance. Kind regards Niklas Meyer Maintainer of the mailcow project References Visible links 1. mailto:frittenjonas@derlinkman.de 2. mailto:frittenjonas@derlinkman.de 3. mailto:frittenjonas@derlinkman.de 4. mailto:frittenjonas@derlinkman.de 5. mailto:frittenjonas@derlinkman.de 6. mailto:frittenjonas@derlinkman.de 7. https://pastebin.com/PTKkLsDQ 8. mailto:frittenjonas@derlinkman.de

4 8

Sample with spool file: .mbsyncrc, Isync, Information Lifecycle Management, dovecot, GMail, IMAP
by Philip Bondi 10 Sep '25

10 Sep '25

Hello to all: I wanted to offer my working .mbsyncrc to the community. I also have a spool file to share. In my opinion, 15 Gb on our Google accounts is no longer enough. Google Photos keeps prompting to enable backup. Most people are going to exceed this quota. In my opinion, this is manifestation of serious "platform decay". This is starting to affect all my immediate family members. In my opinion, one should have methodology to move GMail away of Google for Information Lifecycle Management. To achieve, I have setup Debian 12 virtual machine on QNAP running Dovecot. This setup is beyond the scope of this article. I setup Isync to sync gmail to my Debian 12 virtual machine. Then I wrote a script to move the gmail to local mbox. Isync will then purge the email from Gmail. https://www.snbforums.com/threads/sample-with-spool-file-mbsyncrc-isync-inf…

1 0

Red Hat Enterprise Linux 8 packages
by Aki Tuomi 08 Sep '25

08 Sep '25

Hi! Due to algorithm limitations, we have signed the RHEL8 packages for 2.4.1 with Dovecot 2.3 signing key. This should make it verifiable on RHEL8. Regards, Aki Tuomi Open-Xchange oy

1 0

RHEL 8 key import error
by Gioele Pannetto 08 Sep '25

08 Sep '25

Hi, I'm having issues while installing Dovecot 2.4 on a Rocky Linux 8.10 server. This server was running Dovecot 2.3 but I wanted to upgrade it to 2.4. This is my repo file: [dovecot-2.4-latest] name=Dovecot 2.4 RHEL $releasever - $basearch baseurl=https://repo.dovecot.org/ce-2.4-latest/rhel/$releasever/RPMS/$basea… gpgkey=https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4 gpgcheck=1 enabled=1 When I run dnf update I get a GPG error: Problem opening package dovecot-2.4.1-4.x86_64.rpm Problem opening package dovecot-lua-2.4.1-4.x86_64.rpm Problem opening package dovecot-mysql-2.4.1-4.x86_64.rpm The downloaded packages were saved in cache until the next successful transaction. You can remove cached packages by executing 'dnf clean packages'. Error: GPG check FAILED If I try to import the key manually with rpm --import https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4 I get: error: https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4: key 1 import failed. I also tried it on a fresh Rocky Linux 8.10 installation and I get the same exact error, but running it on Rocky Linux 9.6 works just fine. This is my gpg --version on RHEL 8.10: gpg (GnuPG) 2.2.20 libgcrypt 1.8.5 Copyright (C) 2020 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Home: /root/.gnupg Supported algorithms: Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256 Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224 Compression: Uncompressed, ZIP, ZLIB, BZIP2 Any help is appreciated. Thanks! -- Gioele Pannetto

6 8

Is it possible to use literal %2F inside a dovecot.http.client request url?
by hmmmz1000＠gmail.com 07 Sep '25

07 Sep '25

Hello, I'm using dovecot (2.3) lua with dovecot.http.client but I need the request url to have an url encoded slash (/) as %2F (or %2f) but if I enter for example https://test.com/%2F/test it looks like it changes it to a slash (https://test.com///test) in the http debug log (also the request fails as it's not %2F). I've also tried with %252F to encode the % but that doesn't change at all (keeps being %252F) & also tried with %%2F and \%2F but that gets the errors "Expecting hex digit after '%', but found '%'" for %%2F and "invalid escape sequence" for \%2F. Does anyone have an idea how to solve this or if it's even possible?

2 1

Help: Sharing IMAP folder from a mdbox mailbox to a maildir mailbox
by Zhang Huangbin 05 Sep '25

05 Sep '25

Dear all, I'm configuring Dovecot 2.4.1 with per-user mailbox format support, but cannot get user shared mailbox working between different mailbox formats. - Account mdbox(a)domain.com is a mdbox format mailbox, access with webmail is ok. - Account maildir(a)domain.com is a maildir format mailbox, access with webmail is ok. - mdbox@ shares its Sent folder to maildir@ with Roundcube webmail, grants all privileges (`akxeilprwts`). The result is maildir@ cannot see the shared folder. - No error reported in Dovecot log file. - mysql logs the queries performed to get user shared mailbox, i ran the query manually and it returns correct result like this: ``` MariaDB [vmail]> SELECT dummy,from_user FROM share_folder WHERE to_user = 'maildir(a)domain.com' \G *************************** 1. row *************************** dummy: 1 from_user: mdbox(a)domain.com ``` dovecot.conf snippet attached below. I think the "mail_*" parameters inside `namespace shared {}` block are incorrect to handle mixed mailbox formats because it hard-codes the mail_driver and mail_path, tried all possible parameters i can imagine, but failed. Thanks for helping. :) # ------------------------ mail_plugins { acl = yes ... } protocol imap { mail_plugins { imap_acl = yes ... } ... } mail_driver = %{userdb:mail_driver | default("maildir") | lower} mail_path = %{userdb:mail_path | default("~/Maildir")} sql_driver = mysql mysql 127.0.0.1 { port = ... dbname = ... user = ... password = ... } userdb sql { # ... omit other lines ... query = SELECT \ LOWER('%{user | lower}') AS master_user, \ LOWER(CONCAT(mailbox.storagebasedirectory, '/', mailbox.storagenode, '/', mailbox.maildir)) AS home, \ mailbox.mailboxformat AS mail_driver, \ CONCAT("~/", mailbox.mailboxfolder) AS mail_path, \ CONCAT('*:bytes=', mailbox.quota*1048576) AS quota_rule \ FROM ... } namespace shared { type = shared separator = / prefix = Shared/$user/ subscriptions = yes list = children mail_driver = maildir mail_path = %{owner_home}/Maildir mail_index_private_path = ~/Maildir/shared/%{owner_user} # not share the index files between users mail_index_path = ~/Maildir/shared/%{owner_user} } acl_driver = vfile acl_globals_only = no acl_sharing_map { dict proxy { name = acl } } dict_server { dict acl { driver = sql dict_map shared/shared-boxes/user/$to/$from { sql_table = share_folder value_field dummy { } key_field from_user { value = $from } key_field to_user { value = $to } } dict_map shared/shared-boxes/anyone/$from { sql_table = anyone_shares value_field dummy { } key_field from_user { value = $from } } } ... } # ------------------------

4 11

High Available (SoHo) dovecot setup using PVE+Ubuntu (+Docker)?
by Gerben Wierda 04 Sep '25

04 Sep '25

I currently run a HA postfix/dovecot setup that is failover behind a HAproxy. The two legs are a dovecot 2 on macOS (MacPorts) and a dovecot 2 on Ubuntu (PVE+Ubuntu+Docker), making the system somewhat antifragile. HA is realised via dovecot’s own syncing (which is not longer available in dovecot 3). This works OK. (In addition: there is rspamd as an important part of the setup, e.g. for DMARC). There are multiple virtual domains. Given that I have lost APNS (Apple Push Notification) as Apple has retired support for former Mac OS X Server users, there is not longer a reason to keep the macOS version running (apart from that antifragility thing, but that was more an added bonus). I am looking at moving to a different setup where the entire mail setup may move to a full Linux foundation. I am starting to look at future options (there is still time to actually create the setup somewhere the coming year or so. If I want to be future-dovecot proof, I need to move to HA for storage as dovecot syncing is deprecated. I wonder what my best way forward its, based on a 2 physical machine, PVE+Ubuntu+Docker setup. Build a HA NFSv4 cluster? Use Ceph? ZFS? Any tips, experiences, or ideas are welcome. Robustness/security/low-maintenance/own-your-own-data are my main objectives. I do not have high volumes, this is a setup for just a few users. G I currently run a HA postfix/dovecot setup that is failover behind a HAproxy. The two legs are a dovecot 2 on macOS (MacPorts) and a dovecot 2 on Ubuntu (PVE+Ubuntu+Docker), making the system somewhat antifragile. HA is realised via dovecot's own syncing (which is not longer available in dovecot 3). This works OK. (In addition: there is rspamd as an important part of the setup, e.g. for DMARC). There are multiple virtual domains. Given that I have lost APNS (Apple Push Notification) as Apple has retired support for former Mac OS X Server users, there is not longer a reason to keep the macOS version running (apart from that antifragility thing, but that was more an added bonus). I am looking at moving to a different setup where the entire mail setup may move to a full Linux foundation. I am starting to look at future options (there is still time to actually create the setup somewhere the coming year or so. If I want to be future-dovecot proof, I need to move to HA for storage as dovecot syncing is deprecated. I wonder what my best way forward its, based on a 2 physical machine, PVE+Ubuntu+Docker setup. Build a HA NFSv4 cluster? Use Ceph? ZFS? Any tips, experiences, or ideas are welcome. Robustness/security/low-maintenance/own-your-own-data are my main objectives. I do not have high volumes, this is a setup for just a few users. G

5 8

How to override mail_driver, mail_path, mail_index_path with SQL userdb
by Zhang Huangbin 04 Sep '25

04 Sep '25

Dear all, I'm migrating from Dovecot 2.3 to 2.4 on Debian 13, only one issue remains: How can i override global mail_driver, mail_path, mail_index_path parameters with a SQL userdb? I have these lines in dovecot.conf to use maildir format mailbox by default, also userdb and passdb with mariadb backend. We store mailbox format (e.g. "maildir", "mdbox", case insensitive) in SQL column `mailboxformat`, and mailbox folder name in `mailboxfolder` (e.g. "Maildir", "mdbox", case sensitive). I tried returning `mail_driver` + `mail_path`, or `userdb_mail_driver` + `userdb_mail_path`, neither works. So the question is, what should i return in userdb sql query to override global setting? Thanks for helping. :) # ------------------------------- mail_driver = maildir mail_path = ~/Maildir mail_index_path = ~/Maildir sql_driver = mysql mysql 127.0.0.1 { port = 3306 dbname = ... user = ... password = ... } userdb sql { iterate_query = ... query = SELECT \ LOWER('%{user | lower}') AS master_user, \ LOWER(CONCAT(mailbox.storagebasedirectory, '/', mailbox.storagenode, '/', mailbox.maildir)) AS home, \ LOWER(mailbox.mailboxformat) AS mail_driver, \ CONCAT("~/", mailbox.mailboxfolder) AS mail_path, \ CONCAT(LOWER(mailbox.mailboxformat), ":~/", mailbox.mailboxfolder) AS mail, \ CONCAT('*:bytes=', mailbox.quota*1048576) AS quota_rule \ FROM mailbox,domain \ WHERE ... } passdb sql { query = SELECT ... } # -------------------------------

1 1

Config Typos
by matthew1471＠matthew1471.co.uk 03 Sep '25

03 Sep '25

Hello, I submitted this issue to Debian with a patch https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1112667 But I since found a lot of them have actually come directly from Dovecot via https://github.com/dovecot/tools/blob/main/dovecot-2.4.0-example-config.tar… which itself is referenced via https://doc.dovecot.org/2.4.1/installation/upgrade/2.3-to-2.4.html I see on that page "It's not being kept up-to-date afterwards".. so is there any interest in receiving corrections and if so where best to provide (Patch file is on the Debian page)? These are just typos, nothing breaking (although "# auth_username_format=%u" in auth-passwdfile.conf.ext if uncommented is of course incorrect and only in the Dovecot tools version, it's not in the Debian version). As an aside, I found on my instance (Debian 2.4.1-4 (7d8c0e5759)): root@IMAP:~# doveconf -d | grep -i sieve "sieve_script_path =" But the docs (https://doc.dovecot.org/2.4.1/core/plugins/sieve.html#sieve_script_path) state the default should be "~/sieve" This led to some funky "Leaked settings" errors: Sep 01 00:06:54 IMAP dovecot[5112]: sieve(x(a)x.co.uk)<5123><GEGcT7E9lfnAqAAD>: Error: sieve: file storage: Storage path cannot be empty for write access Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Error: Failed to open Sieve storage. Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ext-duplicate-common.c:36 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ntfy-mailto.c:166 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ext-variables-common.c:61 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ext-include-common.c:87 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ext-subaddress.c:75 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ext-vacation-common.c:25 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: sieve.c:93 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Event 0x558e90507d38 leaked (parent=0x558e904ee688): sieve.c:84 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Event 0x558e904ee688 leaked (parent=0x558e904ed648): mail-user.c:90 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Event 0x558e904ed648 leaked (parent=0x558e904ec508): mail-storage-service.c:1088 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Event 0x558e904ec508 leaked (parent=(nil)): main.c:157 System is working well (and if the typos / inconsistencies aren't interesting then I completely understand), thank you for all your hard work. Kind Regards, Matthew

1 0

Segfault on dovecot reload
by Bogdan Vasilescu 03 Sep '25

03 Sep '25

Hi, While migrating my config from 2.3 to 2.4, I found out that if instance_name is set to any value (including the default 'dovecot') and I run "dovecot reload" twice, I get a segmentation fault. syslog: dovecot[18272]: segfault at 7fdd23b51442 ip 00007fdd237c4ac6 sp 00007ffd0420caa8 error 4 in libc-2.33.so[7fdd23742000+15e000] my config: # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 5.15.161-array x86_64 Slackware 15.0 # Hostname: my.host.name dovecot_config_version = 2.4.1 acl_defaults_from_inbox = yes acl_driver = vfile acl_globals_only = yes auth_cache_negative_ttl = 1 hour auth_cache_ttl = 1 hour auth_failure_delay = 3 secs auth_master_user_separator = * auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@* auth_verbose = yes base_dir = /var/run/dovecot/ debug_log_path = syslog default_client_limit = 640 default_process_limit = 128 default_vsz_limit = 256M deliver_log_format = %{message} [msgid=%{msgid}, size=%{size}] dovecot_storage_version = 2.4.1 first_valid_gid = 10000 first_valid_uid = 10000 imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags imap_logout_format = [session=<%{session}>, in=%{input}, out=%{output}] imap_max_line_length = 64k info_log_path = syslog last_valid_gid = 10999 last_valid_uid = 10999 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = * login_greeting = IMAP/POP3 daemon login_log_format = %{message} %{elements} login_log_format_elements = [user=<%{user}> rip=%{remote_ip} lip=%{local_ip} session=<%{session}> method=%{mechanism} %{secured}] mail_log_prefix = "%{service}(%{user}): " mail_temp_scan_interval = 1 week mailbox_list_index_very_dirty_syncs = yes pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_logout_format = [session=<%{session}>, in=%{input}, out=%{output}] pop3_uidl_duplicates = rename protocols = imap lmtp pop3 rejection_reason = Your message to <%t> was automatically rejected:%n%r rejection_subject = Rejected: %s sieve_execute_bin_dir = /var/lib/dovecot/sieve sieve_global_extensions { vnd.dovecot.pipe = yes vnd.dovecot.execute = yes } sieve_max_script_size = 1M sieve_pipe_bin_dir = /var/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_redirect_envelope_from = sender sql_driver = mysql ssl_min_protocol = TLSv1 verbose_proctitle = yes ssl_server { cert_file = /etc/ssl/certs/server.pem cert_username_field = commonName dh_file = /var/lib/dovecot/dh.pem key_file = /etc/ssl/private/server.key prefer_ciphers = client request_client_cert = no require_crl = yes } namespace inbox { mail_driver = maildir mail_inbox_path = /srv/vhosts/%{user | domain}/mail/%{user}/INBOX mail_path = /srv/vhosts/%{user | domain}/mail/%{user} mailbox_list_layout = fs hidden = no inbox = yes list = yes prefix = separator = / subscriptions = yes type = private mailbox INBOX/* { acl "user=sysadmin(a)my.host.name" { rights = lrwstipekxa } } } maildir { broken_filename_sizes = yes copy_with_hardlinks = yes empty_new = no stat_dirs = no very_dirty_syncs = no } mbox { dirty_syncs = yes dotlock_change_timeout = 2 mins lazy_writes = yes lock_timeout = 5 mins md5 = all min_index_size = 0 read_locks = fcntl very_dirty_syncs = no write_locks = dotlock fcntl } mdbox { preallocate_space = no rotate_interval = 0 rotate_size = 10M } service imap-login { process_min_avail = 0 restart_request_count = 1 user = $SET:default_login_user vsz_limit = 256M inet_listener imap { port = 143 listen = 127.0.0.1 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { process_min_avail = 0 restart_request_count = 1 user = $SET:default_login_user vsz_limit = 256M inet_listener pop3 { port = 110 listen = 127.0.0.1 } inet_listener pop3s { port = 995 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix } } service imap { process_limit = 256 vsz_limit = 256M } service pop3 { process_limit = 256 vsz_limit = 256M } service auth { client_limit = 640 user = $SET:default_internal_user unix_listener auth-userdb { mode = 0666 } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service auth-worker { user = $SET:default_internal_user } mysql 127.0.0.1 { dbname = vhosts password = # hidden, use -P to show it user = services } passdb sql { default_password_scheme = CRYPT driver = sql query = SELECT `u`.`password` AS `password`, '/srv/vhosts/%{user | domain }/mail/%{user}' AS `userdb_home`, `u`.`domain` AS `userdb_uid`, `u`.`domain` AS `userdb_gid` FROM `users` AS `u` LEFT JOIN `domains` AS `d` ON `u`.`domain` = `d`.`id` WHERE `u`.`user` = '%{user}' AND `u`.`enabled` = '1' AND FIND_IN_SET('U_%{protocol}', `u`.`permissions`) AND `d`.`enabled` = '1' AND FIND_IN_SET('U_%{protocol}', `d`.`permissions`) } passdb passwd:backup { auth_username_format = %{user} default_password_scheme = CRYPT driver = passwd-file passwd_file_path = /etc/dovecot/auth/passwd:backup } passdb passwd:master { auth_username_format = %{user} default_password_scheme = CRYPT driver = passwd-file master = yes result_success = continue passwd_file_path = /etc/dovecot/auth/passwd:master } userdb sql { driver = prefetch } userdb passwd:backup { auth_username_format = %{user} passwd_file_path = /etc/dovecot/auth/passwd:backup driver = passwd-file } userdb passwd:master { auth_username_format = %{user} passwd_file_path = /etc/dovecot/auth/passwd:master driver = passwd-file fields { master_user = %{user} } } protocol imap { mail_max_userip_connections = 10 mail_plugins { acl = yes } } protocol pop3 { mail_max_userip_connections = 10 mail_plugins { acl = yes } } protocol lda { mail_plugins { sieve = yes } } protocol lmtp { mail_plugins { sieve = yes } } sieve_script backup { driver = file path = /var/lib/dovecot/sieve/backup_%{user | username }.sieve type = personal } mailbox INBOX/Spam { sieve_script spam { cause = copy path = /var/lib/dovecot/sieve/learn_spam.sieve type = before } } imapsieve_from INBOX/Spam { sieve_script ham { cause = copy path = /var/lib/dovecot/sieve/learn_ham.sieve type = before } } mailbox INBOX/Junk { sieve_script spam { cause = copy path = /var/lib/dovecot/sieve/learn_spam.sieve type = before } } imapsieve_from INBOX/Junk { sieve_script ham { cause = copy path = /var/lib/dovecot/sieve/learn_ham.sieve type = before } } auth_policy { check_after_auth = no check_before_auth = yes hash_mech = sha256 hash_nonce = # hidden, use -P to show it hash_truncate = 12 log_only = no reject_on_fail = no report_after_auth = no request_attributes { device_id = %{client_id} fail_type = %{fail_type} login = %{requested_username} protocol = %{protocol} pwhash = %{hashed_password} remote = %{remote_ip} session_id = %{session} } server_url = http://127.0.0.1/authpolicy/ } Thanks, Bogdan

3 2

update-apt-xapian-index on trixie fails
by Graham Eddy 03 Sep '25

03 Sep '25

update-apt-xapian-index relies upon module ‘imp’ that was removed from python 3.12 onwards, so fails with dovecot on trixie. updating /usr/lib/python3/dist-packages/axi/indexer.py by replacing imp.load_module per https://docs.python.org/3/whatsnew/3.12.html#whatsnew312-removed-imp, plus installing module ’six’, seems to fix it. i look forward to the proper fix to xapian-index. cheers ⊣GE⊢ update-apt-xapian-index relies upon module `imp' that was removed from python 3.12 onwards, so fails with dovecot on trixie. updating /usr/lib/python3/dist-packages/axi/indexer.py by replacing imp.load_module per [1]https://docs.python.org/3/whatsnew/3.12.html#whatsnew312-removed-imp, plus installing module 'six', seems to fix it. i look forward to the proper fix to xapian-index. cheers *GE* References Visible links 1. https://docs.python.org/3/whatsnew/3.12.html#whatsnew312-removed-imp

2 1

Crash in dovecot snippet when using imapc
by John van der Kamp 03 Sep '25

03 Sep '25

Hello, I've found a crash in a very specific setup. A dovecot server with imapc connection needs to receive an email with no body contents for the intent of generating a preview/snippet. It crashes somewhere deep in the jungle of istream and snapshots. I've included a script which sets up the systems to reproduce the crash. I've tested this with several versions. 2.3.16 doesn't seem to be affected, but 2.3.20 and 2.3.21 are affect. For me it produces a traceback like this, using the ubuntu version from here: https://packages.ubuntu.com/noble/dovecot-core (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=140530132887360, signo=signo@entry=6) at ./nptl/pthread_kill.c:89 #3 0x00007fcfb8842476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #4 0x00007fcfb88287f3 in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007fcfb8b37fe5 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #6 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #7 0x00007fcfb8be50d7 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:879 #8 0x00007fcfb8b37eea in i_panic (format=0x7fcfb8c29020 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:530 #9 0x00007fcfb8b3387b in i_stream_header_filter_snapshot_free (_snapshot=<optimized out>) at ../lib-mail/istream-header-filter.c:663 #10 i_stream_header_filter_snapshot_free (_snapshot=0x55dabe297a60) at ../lib-mail/istream-header-filter.c:655 #11 0x00007fcfb8bf25ac in i_stream_snapshot_free (_snapshot=_snapshot@entry=0x55dabe29b0d0) at ../lib/istream.c:253 #12 0x00007fcfb8bf2654 in i_stream_unref (stream=0x7ffc16cc7fa0) at ../lib/istream.c:66 #13 0x00007fcfb8d96baa in index_mail_write_body_snippet (mail=0x55dabe292058) at index/index-mail.c:1151 #14 0x00007fcfb8d97e48 in index_mail_parse_bodystructure (mail=0x55dabe292058, field=MAIL_CACHE_BODY_SNIPPET) at index/index-mail.c:1551 #15 0x00007fcfb8d97fe2 in index_mail_fetch_body_snippet (value_r=0x7ffc16cc8050, mail=0x55dabe292058) at index/index-mail.c:1602 #16 index_mail_get_special (_mail=0x55dabe292058, field=<optimized out>, value_r=0x7ffc16cc8050) at index/index-mail.c:1730 #17 0x00007fcfb8d16ffe in mail_get_special (mail=mail@entry=0x55dabe292058, field=field@entry=MAIL_FETCH_BODY_SNIPPET, value_r=value_r@entry=0x7ffc16cc8050) at /home/ubuntu/dovecot/new/dovecot-2.3.21+dfsg1/src/lib-storage/mail.c:418 #18 0x000055dabc52645c in fetch_snippet (ctx=0x55dabe26e050, mail=0x55dabe292058, preview=0x55dabe28f1f8) at ./src/imap/imap-fetch-body.c:615 #19 0x000055dabc52b5cc in imap_fetch_more_int (ctx=0x55dabe26e050, cancel=false) at ./src/imap/imap-fetch.c:562 #20 0x000055dabc52b8ad in imap_fetch_more (ctx=0x55dabe26e050, cmd=0x55dabe26de98) at ./src/imap/imap-fetch.c:617 #21 0x000055dabc51fd07 in cmd_fetch (cmd=0x55dabe26de98) at ./src/imap/cmd-fetch.c:382 #22 0x000055dabc528af4 in command_exec (cmd=0x55dabe26de98) at ./src/imap/imap-commands.c:201 #23 0x000055dabc52e9e2 in client_command_input (cmd=<optimized out>) at ./src/imap/imap-client.c:1237 #24 0x000055dabc52ea96 in client_command_input (cmd=<optimized out>) at ./src/imap/imap-client.c:1307 #25 0x000055dabc52eeed in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1349 #26 client_handle_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1363 #27 0x000055dabc52f2c4 in client_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1407 #28 0x00007fcfb8bfe27d in io_loop_call_io (io=0x55dabe26e660) at ../lib/ioloop.c:737 #29 0x00007fcfb8bff81a in io_loop_handler_run_internal (ioloop=0x55dabe243fd0) at ../lib/ioloop-epoll.c:222 #30 0x00007fcfb8bff8d4 in io_loop_handler_run (ioloop=0x55dabe243fd0) at ../lib/ioloop.c:789 #31 0x00007fcfb8bffa90 in io_loop_run (ioloop=0x55dabe243fd0) at ../lib/ioloop.c:762 #32 0x00007fcfb8b6ce57 in master_service_run (service=0x55dabe243e20, callback=callback@entry=0x55dabc533210 <client_connected>) at ../lib-master/master-service.c:878 #33 0x000055dabc51ad37 in main (argc=<optimized out>, argv=<optimized out>) at ./src/imap/main.c:575 John Hello, I've found a crash in a very specific setup. A dovecot server with imapc connection needs to receive an email with no body contents for the intent of generating a preview/snippet. It crashes somewhere deep in the jungle of istream and snapshots. I've included a script which sets up the systems to reproduce the crash. I've tested this with several versions. 2.3.16 doesn't seem to be affected, but 2.3.20 and 2.3.21 are affect. For me it produces a traceback like this, using the ubuntu version from here: https://packages.ubuntu.com/noble/dovecot-core (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=140530132887360) at ./nptl/ pthread_kill.c:78 #2 __GI___pthread_kill (threadid=140530132887360, signo=signo@entry=6) at ./ nptl/pthread_kill.c:89 #3 0x00007fcfb8842476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/ raise.c:26 #4 0x00007fcfb88287f3 in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007fcfb8b37fe5 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #6 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #7 0x00007fcfb8be50d7 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:879 #8 0x00007fcfb8b37eea in i_panic (format=0x7fcfb8c29020 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:530 #9 0x00007fcfb8b3387b in i_stream_header_filter_snapshot_free (_snapshot=<optimized out>) at ../lib-mail/istream-header-filter.c:663 #10 i_stream_header_filter_snapshot_free (_snapshot=0x55dabe297a60) at ../lib- mail/istream-header-filter.c:655 #11 0x00007fcfb8bf25ac in i_stream_snapshot_free (_snapshot=_snapshot@entry=0x55dabe29b0d0) at ../lib/istream.c:253 #12 0x00007fcfb8bf2654 in i_stream_unref (stream=0x7ffc16cc7fa0) at ../lib/ istream.c:66 #13 0x00007fcfb8d96baa in index_mail_write_body_snippet (mail=0x55dabe292058) at index/index-mail.c:1151 #14 0x00007fcfb8d97e48 in index_mail_parse_bodystructure (mail=0x55dabe292058, field=MAIL_CACHE_BODY_SNIPPET) at index/index-mail.c:1551 #15 0x00007fcfb8d97fe2 in index_mail_fetch_body_snippet (value_r=0x7ffc16cc8050, mail=0x55dabe292058) at index/index-mail.c:1602 #16 index_mail_get_special (_mail=0x55dabe292058, field=<optimized out>, value_r=0x7ffc16cc8050) at index/index-mail.c:1730 #17 0x00007fcfb8d16ffe in mail_get_special (mail=mail@entry=0x55dabe292058, field=field@entry=MAIL_FETCH_BODY_SNIPPET, value_r=value_r@entry=0x7ffc16cc8050) at /home/ubuntu/dovecot/new/dovecot-2.3.21+dfsg1/src/lib-storage/mail.c:418 #18 0x000055dabc52645c in fetch_snippet (ctx=0x55dabe26e050, mail=0x55dabe292058, preview=0x55dabe28f1f8) at ./src/imap/imap-fetch-body.c: 615 #19 0x000055dabc52b5cc in imap_fetch_more_int (ctx=0x55dabe26e050, cancel=false) at ./src/imap/imap-fetch.c:562 #20 0x000055dabc52b8ad in imap_fetch_more (ctx=0x55dabe26e050, cmd=0x55dabe26de98) at ./src/imap/imap-fetch.c:617 #21 0x000055dabc51fd07 in cmd_fetch (cmd=0x55dabe26de98) at ./src/imap/cmd- fetch.c:382 #22 0x000055dabc528af4 in command_exec (cmd=0x55dabe26de98) at ./src/imap/imap- commands.c:201 #23 0x000055dabc52e9e2 in client_command_input (cmd=<optimized out>) at ./src/ imap/imap-client.c:1237 #24 0x000055dabc52ea96 in client_command_input (cmd=<optimized out>) at ./src/ imap/imap-client.c:1307 #25 0x000055dabc52eeed in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1349 #26 client_handle_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c: 1363 #27 0x000055dabc52f2c4 in client_input (client=0x55dabe26d2c8) at ./src/imap/ imap-client.c:1407 #28 0x00007fcfb8bfe27d in io_loop_call_io (io=0x55dabe26e660) at ../lib/ ioloop.c:737 #29 0x00007fcfb8bff81a in io_loop_handler_run_internal (ioloop=0x55dabe243fd0) at ../lib/ioloop-epoll.c:222 #30 0x00007fcfb8bff8d4 in io_loop_handler_run (ioloop=0x55dabe243fd0) at ../ lib/ioloop.c:789 #31 0x00007fcfb8bffa90 in io_loop_run (ioloop=0x55dabe243fd0) at ../lib/ ioloop.c:762 #32 0x00007fcfb8b6ce57 in master_service_run (service=0x55dabe243e20, callback=callback@entry=0x55dabc533210 <client_connected>) at ../lib-master/ master-service.c:878 #33 0x000055dabc51ad37 in main (argc=<optimized out>, argv=<optimized out>) at ./src/imap/main.c:575 John

2 7

Re: "MitM" account to bypass quota
by Nick Howitt 02 Sep '25

02 Sep '25

Please can you reply to list rather than directly do me? I just know of the tool and not how to use it. It doesn't look like it supports continually running it in the background, but you can always put it in a loop in a shell script, perhaps with a delay between iterations. If you use cron, you have to be careful that it is not already running when it gets fires again. Nick On 02/09/2025 20:08, Carlos Mogas da Silva wrote: > Can doveadm-sync be configured to keep running on the background? > Can't seem to find anything related to this... > > > On 2 September 2025 20:00:01 WEST, Nick Howitt via dovecot > <dovecot(a)dovecot.org> wrote: > > How about doveadm-sync > (https://doc.dovecot.org/main/core/man/doveadm-sync.1.html) or > imapsync? On 02/09/2025 19:26, Carlos Mogas da Silva via dovecot > wrote: > > Hi list. I have an email address hosted on a server not > controlled by me which enforces quota on the accounts. No > issues there. What I want to know, is how can I use my mail > server, or in this case, dovecot, to act as a "client" to that > imap server and download all the messages from it storing them > locally (in my server) in effect, bypassing the quota > restriction. If you can point me to some documentation or give > a general idea on how I could accomplish this it would be > nice. Thanks in advance! Carlos Mogas da Silva > ------------------------------------------------------------------------ > dovecot mailing list --dovecot(a)dovecot.org To unsubscribe send > an email todovecot-leave(a)dovecot.org > Please can you reply to list rather than directly do me? I just know of the tool and not how to use it. It doesn't look like it supports continually running it in the background, but you can always put it in a loop in a shell script, perhaps with a delay between iterations. If you use cron, you have to be careful that it is not already running when it gets fires again. Nick On 02/09/2025 20:08, Carlos Mogas da Silva wrote: Can doveadm-sync be configured to keep running on the background? Can't seem to find anything related to this... On 2 September 2025 20:00:01 WEST, Nick Howitt via dovecot [1]<dovecot(a)dovecot.org> wrote: How about doveadm-sync ([2]https://doc.dovecot.org/main/core/man/doveadm-sync.1.html) or imapsync? On 02/09/2025 19:26, Carlos Mogas da Silva via dovecot wrote: Hi list. I have an email address hosted on a server not controlled by me which enforces quota on the accounts. No issues there. What I want to know, is how can I use my mail server, or in this case, dovecot, to act as a "client" to that imap server and download all the messages from it storing them locally (in my server) in effect, bypassing the quota restriction. If you can point me to some documentation or give a general idea on how I could accomplish this it would be nice. Thanks in advance! Carlos Mogas da Silva -------------------------------------------------------------------------- dovecot mailing list --dovecot(a)dovecot.org To unsubscribe send an email [3]todovecot-leave(a)dovecot.org References Visible links 1. mailto:dovecot@dovecot.org 2. https://doc.dovecot.org/main/core/man/doveadm-sync.1.html 3. mailto:todovecot-leave@dovecot.org

5 8

"MitM" account to bypass quota
by Carlos Mogas da Silva 02 Sep '25

02 Sep '25

Hi list. I have an email address hosted on a server not controlled by me which enforces quota on the accounts. No issues there. What I want to know, is how can I use my mail server, or in this case, dovecot, to act as a "client" to that imap server and download all the messages from it storing them locally (in my server) in effect, bypassing the quota restriction. If you can point me to some documentation or give a general idea on how I could accomplish this it would be nice. Thanks in advance! Carlos Mogas da Silva Hi list. I have an email address hosted on a server not controlled by me which enforces quota on the accounts. No issues there. What I want to know, is how can I use my mail server, or in this case, dovecot, to act as a "client" to that imap server and download all the messages from it storing them locally (in my server) in effect, bypassing the quota restriction. If you can point me to some documentation or give a general idea on how I could accomplish this it would be nice. Thanks in advance! Carlos Mogas da Silva

3 2

Dovecot 2.4.1: Domain part of user gets dropped in userdb_sql_query
by Robert Czechowski 01 Sep '25

01 Sep '25

Hi, I stumbled upon a problem where documentation and logs no longer help me. After upgrading to Debian Trixie / Dovecot 2.4.1-4 I have run into the following problem after fixing up most of my configuration. I'm using a vmail setup with user information in a mysql database and mailboxes in maildir format. Apparently %{user | domain} will not get set in my SQL query when looking up users for lmtp transport: With the setting userdb_sql_query = SELECT 150 AS uid, 8 AS gid FROM users WHERE username = '%{user | username}' AND domain = '%{user | domain}' I get the following debug log: dovecot: lmtp(118509): Connect from local dovecot: lmtp(robert(a)czecho.de)<118509><hXWpLOzOtGjtzgEAp35xQg>: Debug: auth-master: userdb lookup(robert(a)czecho.de): Started userdb lookup dovecot: lmtp(robert(a)czecho.de)<118509><hXWpLOzOtGjtzgEAp35xQg>: Debug: auth-master: conn unix:/var/run/dovecot//auth-userdb: Connecting dovecot: lmtp(robert(a)czecho.de)<118509><hXWpLOzOtGjtzgEAp35xQg>: Debug: auth-master: conn unix:/var/run/dovecot//auth-userdb (pid=115443,uid=0): Client connected (fd=14) dovecot: auth: Debug: conn unix:/var/run/dovecot/auth-userdb (pid=118509,uid=150): Server accepted connection (fd=23) dovecot: auth: Debug: master in: USER#0111#011robert(a)czecho.de#011protocol=lmtp dovecot: auth(robert): Debug: sql: Performing userdb lookup dovecot: auth-worker(115838): Debug: conn unix:auth-worker (pid=115833,uid=109): auth-worker<7>: Handling USER request dovecot: auth-worker(robert)<115838>: request [7]: Debug: sql: Performing userdb lookup dovecot: auth-worker(robert)<115838>: request [7]: Debug: sql: SELECT 150 AS uid, 8 AS gid FROM users WHERE username = 'robert' AND domain = '' dovecot: auth-worker(115838): Debug: mysql(127.0.0.1): Finished query 'SELECT 150 AS uid, 8 AS gid FROM users WHERE username = 'robert' AND domain = ''' in 0 msecs dovecot: auth-worker(robert)<115838>: request [7]: sql: unknown user dovecot: auth-worker(robert)<115838>: request [7]: Debug: sql: Finished userdb lookup dovecot: auth-worker(115838): Debug: conn unix:auth-worker (pid=115833,uid=109): auth-worker<7>: Finished: user_unknown dovecot: auth(robert): Debug: sql: Finished userdb lookup dovecot: auth: Debug: userdb out: NOTFOUND#0111 Note the SELECT 150 AS uid, 8 AS gid FROM users WHERE username = 'robert' AND domain = '' Resulting in poostfix/lmtp[118495]: A7D6F5A0350: to=<robert(a)czecho.de>, relay=alyx.czecho.de[private/dovecot-lmtp], delay=0.11, delays=0.03/0.04/0.02/0.02, dsn=5.1.1, status=bounced (host alyx.czecho.de[private/dovecot-lmtp] said: 550 5.1.1 <robert(a)czecho.de> User doesn't exist: robert(a)czecho.de (in reply to RCPT TO command)) Apparently, somewhere, the domain part of the users gets lost. My current workaround is to use the query without the domain part: userdb_sql_query = SELECT 150 AS uid, 8 AS gid FROM users WHERE username = '%{user | username}' However this places the mail in the wrong maildir directory. I've worked around that by creating symlinks for all users, but it seems a bit more effort than necessary. Also this will break as soon as two domains have the same username. :( For completeness: # dovecot -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.41+deb13-amd64 x86_64 Debian 13.0 # Hostname: alyx.czecho.de # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_mechanisms = plain login auth_verbose = yes base_dir = /var/run/dovecot/ dovecot_storage_version = 2.4.0 first_valid_uid = 150 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes language_filters = normalizer-icu snowball stopwords language_tokenizers = generic email-address listen = * :: mail_debug = yes mail_driver = maildir mail_gid = mail mail_home = /var/vmail/%{user | domain}/%{user | username} mail_path = ~/mail mail_plugins { fts = yes fts_flatcurve = yes } mail_privileged_group = mail mail_uid = vmail protocols = imap lmtp namespace inbox { inbox = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { user = vmail unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service imap { } service pop3 { } service auth { unix_listener auth-userdb { group = mail mode = 0600 user = vmail } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/ssl/certs/letsencrypt/mail.scrt key_file = /etc/ssl/private/letsencrypt/mail.priv } protocol lmtp { auth_username_format = %{user | username} } language en { default = yes filters = lowercase snowball english-possessive stopwords } fts flatcurve { substring_search = yes } mysql 127.0.0.1 { dbname = vmail password = # hidden, use -P to show it user = vmail } passdb sql { default_password_scheme = SHA512-CRYPT query = SELECT username, domain, password FROM users WHERE username = '%{user | username}' AND domain = '%{user | domain}' sql_driver = mysql } userdb sql { sql_driver = mysql iterate_query = SELECT CONCAT(username, '@', domain) as user FROM users query = SELECT 150 AS uid, 8 AS gid FROM users WHERE username = '%{user | username}' }

2 2

dovecot-core: dovecot imap attempts to rmdir the configured mail_inbox_path
by pelzi＠feldner-bv.de 29 Aug '25

29 Aug '25

Package: dovecot-core Version: 1:2.4.1+dfsg1-6 Severity: important Dear Maintainer, after upgrading to trixie, I reconfigure dovecot - starting with the maintainer's config files due to the complete change of config syntax - and got it working again serving the existing mailboxes. I again configured /var/mail/%{user | username} as mail_inbox_path, at a separate location from all other mailboxes at some directory at user's home. All mailboxes remain in mbox format as before. When I set up a mail inbox path in shared namespace, dovecot is attempting to delete the lexicographically first user "someotheruser" who is sharing their mailboxes, whenever a user "someuser" with read access to that mailboxes is updating the mailbox list: journalctl output with mail_inbox_path setup for shared namespace ----------------------------------------------------------------- Aug 16 16:43:59 somehost systemd[1]: Started dovecot.service - Dovecot IMAP/POP3 email server. Aug 16 16:44:05 somehost dovecot[65636]: imap-login: Login aborted: Logged out (no auth attempts in 0 secs) (no_auth_attempts): user=<>, rip=some::ipv6, lip=some::ipv6, session=<xojHiXw8zKP95iU4WzA7U7on6//+m0as> Aug 16 16:44:14 somehost auth[65647]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=someuser rhost=some::ipv6 user=someuser Aug 16 16:44:14 somehost dovecot[65636]: imap-login: Logged in: user=<someuser>, method=PLAIN, rip=some::ipv6, lip=some::ipv6, mpid=65651, TLS, session=<0klNinw8fJIqAgkIAbCIAAL////+ESJD> Aug 16 16:44:14 somehost dovecot[65636]: imap(someuser)<65651><0klNinw8fJIqAgkIAbCIAAL////+ESJD>: Disconnected: Logged out in=98 out=1253 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Aug 16 16:44:14 somehost auth[65647]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=someuser rhost=some::ipv6 user=someuser Aug 16 16:44:14 somehost dovecot[65636]: imap-login: Logged in: user=<someuser>, method=PLAIN, rip=some::ipv6, lip=some::ipv6, mpid=65656, TLS, session=<tE5Oinw8hpIqAgkIAbCIAAL////+ESJD> Aug 16 16:44:14 somehost dovecot[65636]: imap(someuser)<65656><tE5Oinw8hpIqAgkIAbCIAAL////+ESJD>: Error: rmdir(/var/mail/someotheruser) failed: Permission denied ----------------------------------------------------------------- (Note: the authentication failure listed here appears to come from a certain pam module that doesn't know someuser, but is cured by another pam module in the stack that can authenticate someuser) This otheruser's INBOX will _not_ be displayed in the folder list for someuser, whereas the INBOX of lexicographically following user is not attempted to rmdir, and _do_ show up for the authorized someuser. When, for testing purposes, I remove mail_inbox_path from the shared namespace's configuration, obviously all otheruser's INBOX'es disappear from the folder list of someuser. But now dovecat attempts to rmdir someuser's own inbox: journalctl output with no mail_inbox_path configured for shared namespace, but only for inbox namespace ---------------------------------------------------------------- Aug 16 16:34:48 mailserver systemd[1]: Started dovecot.service - Dovecot IMAP/POP3 email server. Aug 16 16:34:48 mailserver unix_chkpwd[65322]: password check failed for user (someuser) Aug 16 16:34:48 mailserver auth[65320]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=someuser rhost=some::ipv6 user=someuser Aug 16 16:34:48 mailserver dovecot[65315]: imap-login: Logged in: user=<someuser>, method=PLAIN, rip=some::ipv6 lip=some::ipv6, mpid=65324, TLS, session=<uViUaHw8psgqAgkIAbCIAAL////+ESJD> Aug 16 16:34:48 mailserver dovecot[65315]: imap(someuser)<65324><uViUaHw8psgqAgkIAbCIAAL////+ESJD>: Error: rmdir(/var/mail/someuser) failed: Permission denied ---------------------------------------------------------------- In this case, however someuser's INBOX remains in the folder list. *** Reporter, please consider answering these questions, where appropriate *** * What led up to the situation? The upgrade to version 2.4.1 combined with a complete new configuration. -- Package-specific info: dovecot configuration --------------------- ... mail_driver = mbox mail_gid = familie mail_home = /home/%{user | username} mail_inbox_path = /var/mail/%{user | username} mail_path = ~/IMail mail_plugins { acl = yes fts = yes fts_solr = yes } mail_privileged_group = mail ... mail_shared_explicit_inbox = yes protocols { imap = yes sieve = yes } passdb pam { } userdb passwd { } namespace inbox { mail_driver = mbox mail_inbox_path = /var/mail/%{user | username} mail_path = ~/IMail inbox = yes subscriptions = yes type = private mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } namespace shared { mail_driver = mbox # this following setting removed for 2nd test mail_inbox_path = /var/mail/%{owner_user | username } mail_index_private_path = ~/.dovecot-index/shared/%{owner_user} mail_path = %{owner_home}/IMail list = yes prefix = shared/$username/ separator = / subscriptions = no type = shared } acl_sharing_map { dict file { path = /var/lib/dovecot/db/shared-mailboxes.db } } protocol imap { mail_plugins { imap_acl = yes } } service imap-login { inet_listener imap { } inet_listener imaps { } } service lmtp { unix_listener lmtp { } } service imap { } service pop3 { } service auth { unix_listener auth-userdb { group = users mode = 0660 user = mail } unix_listener auth-exim { group = sasl mode = 0660 type = auth-legacy user = mail } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/letsencrypt/live/somedomain/fullchain.pem key_file = /etc/letsencrypt/live/somedomain/privkey.pem } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service managesieve { } language de { default = yes } language en { } fts solr { url = http://localhost:8983/solr/dovecot/ } -- System Information: Debian Release: 13.0 APT prefers stable-security APT policy: (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 6.12.41+deb13-amd64 (SMP w/4 CPU threads; PREEMPT) Kernel taint flags: TAINT_FIRMWARE_WORKAROUND, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) Versions of packages dovecot-core depends on: ii adduser 3.152 ii dovecot-sieve 1:2.4.1+dfsg1-6 ii init-system-helpers 1.68 ii libapparmor1 4.1.0-1 ii libbz2-1.0 1.0.8-6 ii libc6 2.41-12 ii libcap2 1:2.75-10+b1 ii libcrypt1 1:4.4.38-1 ii libexttextcat-2.0-0 3.4.7-1+b1 ii libicu76 76.1-4 ii liblua5.4-0 5.4.7-1+b2 ii liblz4-1 1.10.0-4 ii libpam-runtime 1.7.0-5 ii libpam0g 1.7.0-5 ii libsodium23 1.0.18-1+b2 ii libssl3t64 3.5.1-1 ii libstemmer0d 2.2.0-4+b2 ii libsystemd0 257.7-1 ii libtirpc3t64 1.3.6+ds-1 ii libunwind8 1.8.1-0.1 ii libzstd1 1.5.7+dfsg-1 ii openssl 3.5.1-1 ii ssl-cert 1.1.3 ii ucf 3.0052 ii zlib1g 1:1.3.dfsg+really1.3.1-1+b1 dovecot-core recommends no packages. Versions of packages dovecot-core suggests: pn dovecot-flatcurve <none> pn dovecot-gssapi <none> ii dovecot-imapd 1:2.4.1+dfsg1-6 pn dovecot-ldap <none> pn dovecot-lmtpd <none> ii dovecot-managesieved 1:2.4.1+dfsg1-6 pn dovecot-mysql <none> pn dovecot-pgsql <none> pn dovecot-pop3d <none> ii dovecot-solr 1:2.4.1+dfsg1-6 pn dovecot-sqlite <none> pn dovecot-submissiond <none> pn ntp <none> Versions of packages dovecot-core is related to: ii dovecot-core [dovecot-common] 1:2.4.1+dfsg1-6 pn dovecot-dev <none> pn dovecot-gssapi <none> ii dovecot-imapd 1:2.4.1+dfsg1-6 pn dovecot-ldap <none> pn dovecot-lmtpd <none> ii dovecot-managesieved 1:2.4.1+dfsg1-6 pn dovecot-mysql <none> pn dovecot-pgsql <none> pn dovecot-pop3d <none> ii dovecot-sieve 1:2.4.1+dfsg1-6 pn dovecot-sqlite <none> -- Configuration Files: /etc/default/dovecot changed: ENABLED=1 ALLOW_COREDUMPS=1 -- debconf information: dovecot-core/ssl-cert-name: localhost dovecot-core/create-ssl-cert: false * dovecot-core/ssl-cert-exists:

2 5

Debian 13 with Dovecot-2.3 from dovecot repos
by Stefan G. Weichinger 29 Aug '25

29 Aug '25

I have 2 servers with Debian, set up with postfixadmin back then. So far they ran on Debian-12.x (12.11) with this as external repo.list: https://repo.dovecot.org/ce-2.3-latest/debian/bullseye/ This gives me: dovecot-core 2.3.21.1-2+debian11 Fine. Now I upgraded one of these servers to debian-13 and did NOT remove or edit the repo.list. Now I have Debian-13.0.0 with still dovecot-core 2.3.21.1-2+debian11: apt-cache policy dovecot-core dovecot-core: Installed: 2:2.3.21.1-2+debian11 Candidate: 2:2.3.21.1-2+debian11 Version table: *** 2:2.3.21.1-2+debian11 500 500 https://repo.dovecot.org/ce-2.3-latest/debian/bullseye bullseye/main amd64 Packages 100 /var/lib/dpkg/status 1:2.4.1+dfsg1-6 500 500 http://ftp.at.debian.org/debian trixie/main amd64 Packages 500 http://deb.debian.org/debian trixie/main amd64 Packages I don't mind, it's OK for me, I still have to work through the config changes needed to upgrade to dovecot-2.4 Is this combination OK, is it problematic? (for me things work so far, I can mail quite fine) I consider doing it on a customer server this evening, and hope for a quick "it's fine!" from this ml ;-) thanks all, Stefan

5 10

Supporting both "username" to username@domain.com
by Alex 26 Aug '25

26 Aug '25

Hi, I'm using dovecot-2.3.21 on fedora40 and have configured it to use only usernames without domain when logging in. Now apparently the new Outlook (1.2025.617.000) no longer supports the ability to change username for IMAP. Now what? We have other users who are using older versions of Outlook and Thunderbird and webmail that still support this login method. How can I support both? Here is my dovecot info. # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: Linux 6.12.6-100.fc40.x86_64 x86_64 Fedora release 40 (Forty) btrfs auth_mechanisms = plain login default_client_limit = 3000 default_process_limit = 4000 default_vsz_limit = 1 G dict { sql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = 209.216.XXX.60, 127.0.0.1 mail_gid = users mail_location = maildir:/home/%u/Maildir mail_max_userip_connections = 100 mail_plugins = " listescape last_login" mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { last_login_dict = proxy::sql last_login_key = # hidden, use -P to show it last_login_precision = ms sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = pop3 imap lmtp service anvil { client_limit = 12003 } service auth-worker { client_limit = 20000 } service auth { client_limit = 20000 unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { port = 993 ssl = yes } process_min_avail = 20 service_count = 0 vsz_limit = 1 G } service lmtp { executable = lmtp -L inet_listener lmtp { address = 127.0.0.1 port = 24 } process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_ca = </var/www/example.com-443/ssl/DigiCertCA-2022.crt ssl_cert = </var/www/example.com-443/ssl/example-combined-2025.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol lda { info_log_path = /var/log/dovecot-lda.log log_path = /var/log/dovecot-lda-errors.log } protocol imap { mail_max_userip_connections = 100 } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } local_name example.com { ssl_cert = </var/www/example.com-443/ssl/example-combined-2025.crt ssl_key = # hidden, use -P to show it } local_name users.example1.com { ssl_cert = </etc/letsencrypt/example1-fullchain.pem ssl_key = # hidden, use -P to show it } We're also using postfix to support this basic sasl username when sending. smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $myhostname broken_sasl_auth_clients = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanonymous Hi, I'm using dovecot-2.3.21 on fedora40 and have configured it to use only usernames without domain when logging in. Now apparently the new Outlook (1.2025.617.000) no longer supports the ability to change username for IMAP. Now what? We have other users who are using older versions of Outlook and Thunderbird and webmail that still support this login method. How can I support both? Here is my dovecot info. # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: Linux 6.12.6-100.fc40.x86_64 x86_64 Fedora release 40 (Forty) btrfs auth_mechanisms = plain login default_client_limit = 3000 default_process_limit = 4000 default_vsz_limit = 1 G dict { sql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = 209.216.XXX.60, 127.0.0.1 mail_gid = users mail_location = maildir:/home/%u/Maildir mail_max_userip_connections = 100 mail_plugins = " listescape last_login" mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { last_login_dict = proxy::sql last_login_key = # hidden, use -P to show it last_login_precision = ms sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = pop3 imap lmtp service anvil { client_limit = 12003 } service auth-worker { client_limit = 20000 } service auth { client_limit = 20000 unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { port = 993 ssl = yes } process_min_avail = 20 service_count = 0 vsz_limit = 1 G } service lmtp { executable = lmtp -L inet_listener lmtp { address = 127.0.0.1 port = 24 } process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_ca = </var/www/example.com-443/ssl/DigiCertCA-2022.crt ssl_cert = </var/www/example.com-443/ssl/example-combined-2025.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol lda { info_log_path = /var/log/dovecot-lda.log log_path = /var/log/dovecot-lda-errors.log } protocol imap { mail_max_userip_connections = 100 } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } local_name [1]example.com { ssl_cert = </var/www/example.com-443/ssl/example-combined-2025.crt ssl_key = # hidden, use -P to show it } local_name [2]users.example1.com { ssl_cert = </etc/letsencrypt/example1-fullchain.pem ssl_key = # hidden, use -P to show it } We're also using postfix to support this basic sasl username when sending. smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $myhostname broken_sasl_auth_clients = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanonymous References Visible links 1. http://example.com/ 2. http://users.example1.com/

9 14

INBOX is not part of "*" in dovecot-virtual
by Ákos Szőts 26 Aug '25

26 Aug '25

Hi everyone, I noticed that if I specify the following pattern in dovecot-virtual for my Virtual/Unseen mailbox, mails in INBOX are excluded: * -Drafts -Trash -Junk -Sent -Virtual/* UNSEEN It returns with 23 mails: a EXAMINE Virtual/Unseen * 23 EXISTS * 23 RECENT * OK [UNSEEN 1] First unseen. But when I add INBOX additionally after "*", the number grows to 42: a EXAMINE Virtual/Unseen * 42 EXISTS * 42 RECENT * OK [UNSEEN 1] First unseen. Is it expected that "*" doesn't include INBOX by default? As I see, the rest of the mailboxes within the same root (/) namespace are included by default. Config: namespace inbox { separator = / inbox = yes mail_path = %{home}/mail mail_index_path = %{home}/index/inbox mailbox INBOX { auto = subscribe } mailbox Trash { special_use = \Trash auto = subscribe } [...] } Dovecot version: 2.4.1. Thank you, Ákos

2 1