- dovecot - dovecot.org

Migrating a mailbox from v2.2 to v2.4, production server to pre-production server.
by Mike 23 Feb '26

23 Feb '26

I'm migrating a mailbox from dovecot v2.2 to v2.4. Not that it matters, I'm also changing from mbox to Maildir. As an initial test I used this command: sudo doveadm sync -1D -u theuser -m amailbox remote:theuser@destination.com I received this error: Error: doveadm: Unexpected or incomplete option: -U After changing the dsync_remote_cmd to: dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u I was able to transfer the mailbox without issue. Before changing it, the setting on the source server was: dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u -U I'm interested to discover what the -U was intended for since I couldn't find specific documentation to its use. I'll accept that it was a legacy thing and removing it won't cause any unintended consequences...but I do still have that curiosity about what it was for. Additionally, the subscription status doesn't seem to flow to the new server. When checking the source server with: doveconf -d | grep subscriptions doveconf -n | grep subscriptions No value is returned...So I'm wondering if I need to specifically set subscriptions = yes in the source server to make this happen properly. Maybe this is an artifact of using sync -1? Thanks for any insight you may provide. Mike

1 0

Localhost Dovecot server without ssl?
by Steve Litt 23 Feb '26

23 Feb '26

Hi all, I'd like your opinions to add to my own opinion. Bottom line question: If I trust everybody with physical access to my Daily Driver Desktop (DDD) computer, my Dovecot IMAP runs on my DDD, I access my Dovecot IMAP *exclusively* from my DDD, and I trust everybody with physical access to my DDD (that would be my wife), then if I serve out IMAP on localhost (127.0.0.1), am I being unduly risky using plain text auth (port 143)? Details: I use a Dovecot IMAP server, on my DDD, specifically to hold all my email messages. Therefore, I can use any IMAP aware email client, interchangeably, to view every email I've received since April 2001. People whose emails are held by their email clients are "locked in" to their email client unless they convert their email data. I can switch between Evolution and Claws-Mail, because one of the two is always doing something stupid. Bottom line: I use Dovecot IMAP exclusively to hold my emails and folders. Graphical description below: ISP ---> My --------> procmail --> Dovecot IMAP fetchmail Maildir | | V email <--- Dovecot client IMAP server For the time being, I don't need to access my Dovecot IMAP from any computer except my DDD, and therefore, I can serve Dovecot IMAP on 127.0.0.1. So here's my question. Assuming (and I know this is a big assumption) I'm not worried about somebody gaining physical possession of my DDD, is there any reason not to use plain text to access this server? Thanks, SteveT Steve Litt http://444domains.com

2 1

Copies/duplicates of Dovecot indices
by Joseph Tam 23 Feb '26

23 Feb '26

In my setup, I put mail indices outside the user's mailbox locations (user mailboxs are NFS, indices stored local attached storage). I notice that sometimes, there are 2 sets of indices representing the same mailbox: one at top level, one underneath .imap/. (They usually appear in the latter.) For example, if I have the configuration (Dovcot version 3.2.21) mail_location = mbox:~/mail:INBOX=/nfs/mail/%n:INDEX=/cache/%n I see for a particular user [1] drwx------ 5 user group 512 Feb 22 21:56 /cache/user/box [2] drwxr-xr-x 5 user group 512 Feb 22 21:46 /cache/user/.imap/box cooresponding to their mailbox in ~user/mail/box. Each of these have the dovecot.* index files. If I delete [1], it comes back. The timestamps are close to each other so both sets are being used, possibly by different clients. Another quirky discovery is 2 /.imap/ folders beneath each other e.g. /cache/user/.imap/folder1/folder2/.imap/box/dovecot.index What determines which index pathname gets created or used? Joseph Tam <jtam.home(a)gmail.com>

1 0

2.3 replication issue throwing errors
by Paul Kudla 22 Feb '26

22 Feb '26

shows same error on both servers Server 1 : # sync faye(a)scom.ca doveadm(faye(a)scom.ca)<90952><BJq9J2dHmGlIYwEA0dxyZQ>: Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID f982a82747469869ea0f0100cf58dcff (maybe it was just deleted?) Server 2: # sync faye(a)scom.ca doveadm(faye(a)scom.ca)<90952><BJq9J2dHmGlIYwEA0dxyZQ>: Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID f982a82747469869ea0f0100cf58dcff (maybe it was just deleted?) i am aware there is a mismatch on one of the servers but there does not seem to be a clear cut way to find the offending file to delete it or force a backwards sync ? How would i identify what GUID f982a82747469869ea0f0100cf58dcff means? same on both servers. doveadm force-resync -u faye(a)scom.ca '*' have tried reindex etc etc etc issue persists logs ?? mail18 02-20 06:45:24 {dovecot} [67632] (3014654310) doveadm(faye(a)scom.ca)<71073><hOl0ClRJmGmhFQEAz1jc/w>: Debug: open(/proc/self/stat) failed: No such file or directory mail18 02-20 06:45:24 {dovecot} [67632] (3014654311) doveadm(faye(a)scom.ca)<71073><hOl0ClRJmGmhFQEAz1jc/w>: Debug: open(/proc/self/io) failed: No such file or directory mail18 02-20 06:45:24 {dovecot} [67632] (3014654312) doveadm(faye(a)scom.ca)<71073><hOl0ClRJmGmhFQEAz1jc/w>: Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ any help would be appreciated -- Thanks - Paul Kudla (Manager SCOM.CA Internet Services Inc.) Have A Happy Friday AND Happy Sucessful 2026 ! Scom.ca Internet Services <http://www.scom.ca> 104-1009 Byron Street South Whitby, Ontario - Canada L1N 4S3 Toronto 416.642.7266 Main 1.866.411.7266 Fax 1.888.892.7266 Email paul(a)scom.ca

2 2

How do you use doveadm fetch -S
by Steve Litt 20 Feb '26

20 Feb '26

Hi all, I have a working plain text 127.0.0.1:143 Dovecot 2.4.2 on my Qemu VM guest. The following command displays the Receive date, From and Subject for every email in my golugTech mailbox, exactly like the docs say it should: =================================================== doveadm fetch -u slitt "date.received hdr.from hdr.subject" mailbox golugTech =================================================== But when I add the -S in order to specify the 127.0.0.1 listener at port 143, it throws the following error: =================================================== [slitt@mydesk ~]$ cat junk.jnk [root@dovecotvoid dovecot]# doveadm fetch -S 127.0.0.1:143 -u slitt "date.received hdr.from hdr.subject" mailbox golugTech doveadm(slitt): Error: conn 127.0.0.1:143 (127.0.0.1:143): doveadm server sent invalid handshake: * OK Waiting for authentication process to respond.. doveadm(slitt): Error: cmd fetch: 127.0.0.1:143: Command fetch failed for slitt: Connection closed [root@dovecotvoid dovecot]# [slitt@mydesk~]$ =================================================== The docs say -S is to specify the socket_path, and it should be expressed as hostname:port. For hostname, besides 127.0.0.1, I tried localhost and dovecotvoid, the latter of which should not work because dovecotvoid is not 127.0.0.1, it's 10.0.2.15. The docs say "This allows an administrator to execute doveadm(1) mail commands through the given socket." So I guess finding the server isn't the purpose of socket_path. My plain text 143 Dovecot 2.4.2 IMAP works just fine without the -S. Is there ever a case where doveadm fetch would need to know the specific address and port of the dovecot IMAP server, and if so, how would I specify it? Thanks, SteveT Steve Litt http://444domains.com

2 1

What replaced mail_home in 2.4.2?
by Steve Litt 20 Feb '26

20 Feb '26

Hi all, In my Dovecot 2.4.2 virtual machine guest I've used mail_home to indicate the value of ~ and presumably of ${home}. However, the only documentation I can find on mail_home is on https://doc.dovecot.org/main/core/summaries/settings.html#mail_home , which is NOT a 2.4.2 document. I find no reference to mail_home on any 2.4.2 documentation. Has something replace mail_home, and if so what's it called and can I put it outside of any {} blocks? Thanks, SteveT Steve Litt http://444domains.com

2 2

mail_utf8_extensions and IMAP Folder Naming
by max.wriedt＠rehost.eu 20 Feb '26

20 Feb '26

i just upgraded my 2.3 installation to 2.4. I like to be bleeding edge and i want to use SMTPUTF8. I came across problems with mailboxes that have german umlauts. when enabling "mail_utf8_extensions=yes" e.g. Microsoft Outlook gives me mUTF-7 encoded folder names. Also the folder names when list via openssl s_client are encoded in mUTF-7. Am i missing something or can i disable utf8 for IMAP (UTF8=ACCEPT) only, but keep for LMTP Transport/SMTPUTF8 from postfix to dovecot? I am using mdbox format as storage, if that matters. My namespace config (shortened): namespace inbox { inbox = yes type = private #mailbox_list_utf8 = yes # also tried this -> when folder didn't exist before it would create a new one with utf8, no matter mail_utf8_extensions is on or off mailbox Drafts { auto = no special_use = \Drafts } mailbox Entw&APw-rfe { special_use = \Drafts } mailbox Entw%26APw-rfe { special_use = \Drafts } mailbox Entw\&APw-rfe { special_use = \Drafts } mailbox Entwürfe { auto = create special_use = \Drafts } mailbox Trash { auto = no special_use = \Trash quota_storage_percentage = 110 } mailbox "Gel&APY-schte Elemente" { special_use = \Trash quota_storage_percentage = 110 } mailbox "Gelöschte Elemente" { auto = subscribe special_use = \Trash quota_storage_percentage = 110 } mailbox Sent { auto = no special_use = \Sent } mailbox Archiv { auto = subscribe special_use = \Archive } mailbox Spam { special_use = \Junk auto = no } }

3 4

2.4.2 breaks user iterations for LDAP
by cpfeiffer＠rev-crew.info 20 Feb '26

20 Feb '26

Hello everyone, Due to the fix for CVE-2025-30189, routines like userdb_ldap_preinit() call auth_cache_parse_key_and_fields() unconditionally, with the eventually called auth_cache_parse_key_exclude() erroring if a cache key could not be constructed. It’s also noteworthy that this call happens regardless of whether use_cache is set or not, and as of such failing to construct a cache key would cause an error even if use_cache = no was set for that database. This is however an issue for user iteration with LDAP, as documented here LDAP | Dovecot CE <https://doc.dovecot.org/2.4.2/core/config/auth/databases/ldap.html#user-ite…> . Such a userdb only has iterate_filter fields that would inherently not be containing any user variables. The call to auth_cache_parse_key_and_fields() uses a combination of ldap_base and userdb_ldap_filter anyway (so whatever is in iterate_filter isn’t considered), and for an iteration userdb as described in the documentation, the latter would be empty. Alas, I ended up getting the rather confusing error * auth: Fatal: auth-cache: dc=rev-crew,dc=info: Cache key must contain at least one variable With dc=rev-crew,dc=info being my ldap_base setting for the iteration userdb. I’m not critically dependent on the user iteration, so I’ve commented the userdb out for now, but this would need fixing. Regards, Christian Pfeiffer Hello everyone, Due to the fix for CVE-2025-30189, routines like userdb_ldap_preinit() call auth_cache_parse_key_and_fields() unconditionally, with the eventually called auth_cache_parse_key_exclude() erroring if a cache key could not be constructed. It's also noteworthy that this call happens regardless of whether use_cache is set or not, and as of such failing to construct a cache key would cause an error even if use_cache = no was set for that database. This is however an issue for user iteration with LDAP, as documented here [1]LDAP | Dovecot CE. Such a userdb only has iterate_filter fields that would inherently not be containing any user variables. The call to auth_cache_parse_key_and_fields() uses a combination of ldap_base and userdb_ldap_filter anyway (so whatever is in iterate_filter isn't considered), and for an iteration userdb as described in the documentation, the latter would be empty. Alas, I ended up getting the rather confusing error o auth: Fatal: auth-cache: dc=rev-crew,dc=info: Cache key must contain at least one variable With dc=rev-crew,dc=info being my ldap_base setting for the iteration userdb. I'm not critically dependent on the user iteration, so I've commented the userdb out for now, but this would need fixing. Regards, Christian Pfeiffer References Visible links 1. https://doc.dovecot.org/2.4.2/core/config/auth/databases/ldap.html#user-ite…

4 5

Search for missing To: header?
by Joseph Tam 20 Feb '26

20 Feb '26

Is there a proper way to torture doveadm search query to look for messages with a missing "To:" header? I played around with it and this seems to work: doveadm fetch -A text mailbox {box} NOT TO '' (Looking through a large spam corups: spam often exclude recipients in the headers as it gives the game away their personalized fraud was blasted to hundreds of addresses.) Joseph Tam <jtam.home(a)gmail.com>

1 0

More Dovecot 2.4 woes: LDAP cache bug and virtual autosubscribe
by sev monster 19 Feb '26

19 Feb '26

8 months ago I messaged this list communicating some of the issues I had with 2.4. Before I could even start testing 2.4 properly, 2 bugs had to be fixed—one that caused crashes on startup (https://gitlab.alpinelinux.org/alpine/aports/-/issues/17050) and one that caused passdb to use the same caching key for all connections and as such always have the same user log in. There was another bug, one that prevented me from using LDAP binds for passdb, but it had a workaround that mostly worked without side-eeffects. All of those have since been fixed, hurray! So in my infinite naïveté, I decided to give 2.4 another shake. And it, again, does not work. Surprise! I did manage to massage the configuration to allow me to at least run 2.4 without crashing and with users able to access (most of) their mailboxes, but there are still blockers to full functionality. I face the following issues: 1. Christian Pfeiffer back in November found a bug where auth caching with LDAP did not work, and due to how it's implemented, even turning caching off would still raise an error. I experienced the same issue for both userdb iteration and passdb bind logins. I had to comment out the userdb and use a static one instead (all my users, currently, use the same UID and easily composable path, so this wasn't a big deal) and start using a service account for LDAP binds. 2. Virtual mailbox autosubscribe does not work anymore. It throws an error about trying to create the virtual mailbox. This worked in 2.3. My virtual mailbox config: namespace virtual { type = private prefix = Search Folders. mail_driver = virtual mail_path = /etc/dovecot/virtual mail_index_path = ~/dovecot-virtual.cache mail_control_path = ~/dovecot-virtual.cache mail_volatile_path = ~/dovecot-virtual.cache hidden = yes list = children subscriptions = no mailbox All { auto = subscribe special_use = \All comment = All messages, excluding Junk and Trash } mailbox Unread { auto = subscribe special_use = \Important comment = All unread messages, excluding Junk and Trash } mailbox Flagged { auto = subscribe special_use = \Flagged comment = All flagged messages } } If there is something wrong with this config that might be responsible for my issue, please let me know. Otherwise, I believe this is a regression. I understand autosubscribe is documented to (and in other situations with non-virtual boxes) create mailboxes if missing, so if this is actually a fix to make the feature work as documented, we need a new option that allows for autosubscription without attempting to create the mailbox. Otherwise, my users will not know they even have these mailboxes—no one anymore knows or cares about mailbox (re: folder) subscription and won't know where to look to get them to show up in their client. With autosubscribe enabled, I can see the mailboxes in my mail client without explicitly subscribing, but attempting to open them will throw a server error. Removing the setting will make the mailbox disappear without going into settings and explicitly subscribing. Any ETA on the first bug being fixed, and any help with the second issue (bug or not) would be greatly appreciated. Best regards. P.S.: I wanted to spread this information that wasn't mentioned at all in the documentation. The shadow passdb was removed in the move to 2.4; why exactly is neither here nor there, though I will remark that I still don't know why it was done. I had believed at the time this necessitated enabling PAM for Dovecot, which it is not by default in my distro's package (Alpine), so if I wanted to continue allowing local users to log in, I would have to build Dovecot it myself and install PAM, neither of which I particularly wanted to do. I did play with passwd-file in the past, but there were issues with it that prevented me from using it—I don't remember what they were exactly, but I believe they have since been fixed, since in my testing now it does seem to work properly in the use-cases I tested. Anyway, while going over my config and getting ready to re-install PAM, I had a thought. /etc/shadow uses the same format for the first two fields as /etc/password, and Dovecot still (supposedly) allows for passwords to be used when reading /etc/password, so wouldn't it be possible to point the driver at the shadow file? Turns out, yes, it works! I am now able to authenticate local users from /etc/shadow again. Thanks to this, I no longer need to build with PAM support and don't need to install PAM on a PAM-less system. I hope this isn't considered a bug or something and support for this use-case is removed, because I really don't want to bother once again with adding PAM when I don't have to. :)

2 2