- dovecot - dovecot.org

What's the difference between "UNKEYWORD \Seen" and "UNSEEN"?
by Ákos Szőts 25 Aug '25

25 Aug '25

Hi everyone, These two IMAP search commands return different values: a SEARCH UNSEEN * SEARCH 38 61 62 63 65 69 74 75 76 82 86 87 102 120 121 141 142 143 144 145 146 158 159 160 a SEARCH UNKEYWORD \Seen * SEARCH [All email IDs in the mailbox] a SEARCH KEYWORD \Seen * SEARCH [Empty] According to RFC 3501 <https://datatracker.ietf.org/doc/html/rfc3501#section-6.4.4>, in my interpretation, these two should be equal: > UNSEEN > Messages that do not have the \Seen flag set. Can you tell me what is causing this difference? I also ran force-resync on all my mails, just to be sure. Ákos Hi everyone, These two IMAP search commands return different values: a SEARCH UNSEEN * SEARCH 38 61 62 63 65 69 74 75 76 82 86 87 102 120 121 141 142 143 144 145 146 158 159 160 a SEARCH UNKEYWORD \Seen * SEARCH [All email IDs in the mailbox] a SEARCH KEYWORD \Seen * SEARCH [Empty] According to [1]RFC 3501, in my interpretation, these two should be equal: > UNSEEN > Messages that do not have the \Seen flag set. Can you tell me what is causing this difference? I also ran force-resync on all my mails, just to be sure. Akos References Visible links 1. https://datatracker.ietf.org/doc/html/rfc3501#section-6.4.4

2 2

Dovecot 2.4.1-4: Server SSL cert loaded in ssl_server_settings_check but lost in openssl_iostream_use_certificate_error
by Louis Villedieu 25 Aug '25

25 Aug '25

Dear dovecot mailing list, Maybe you'll have an idea. I upgraded from Debian bookworm to trixie this morning. Along with this upgrade, dovecot went to 2.4.1 . I adapted the configuration files. The server starts but the clients cannot retrieve emails. The error message in the logs is: dovecot: pop3-login: Error: Failed to initialize SSL connection: Couldn't initialize SSL server context: Can't load SSL certificate (ssl_server_cert_file setting): The certificate is empty In iostream-openssl-context.c:ssl_iostream_context_set(), I adapted this error message to see whether a path could be found for this server cert file: t_strdup_printf( "Can't load SSL certificate (%s setting with path '%s'): %s", ctx->client_ctx ? "ssl_client_cert_file" : "ssl_server_cert_file", set->cert.cert.path, openssl_iostream_use_certificate_error(set->cert.cert.content) The outcome was that the path is empty as well:dovecot: pop3-login: Error: Failed to initialize SSL connection: Couldn't initialize SSL server context: Can't load SSL certificate (ssl_server_cert_file setting with path ''): The certificate is empty Then, I adapted ssl-settings.c:ssl_server_settings_check() to show the content of the server certificate file at that stage (with stdio):FILE *file_ptr;file_ptr=fopen("/tmp/output.txt","a");if(file_ptr!=NULL){fprintf(file_ptr,"server check %s\n",set->ssl_server_cert_file);fclose(file_ptr);} The outcome was that the file is not empty at this stage: server check /etc/letsencrypt/live/<MY_SERVER>/fullchain.pem -----BEGIN CERTIFICATE----- <MY_CERT> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- <MY_CERT> -----END CERTIFICATE----- Is there any potential reason for this disappearance between the calls? Thanks! Louis. Dear dovecot mailing list, Maybe you'll have an idea. I upgraded from Debian bookworm to trixie this morning. Along with this upgrade, dovecot went to 2.4.1 . I adapted the configuration files. The server starts but the clients cannot retrieve emails. The error message in the logs is: dovecot: pop3-login: Error: Failed to initialize SSL connection: Couldn't initialize SSL server context: Can't load SSL certificate (ssl_server_cert_file setting): The certificate is empty In iostream-openssl-context.c:ssl_iostream_context_set(), I adapted this error message to see whether a path could be found for this server cert file: t_strdup_printf( "Can't load SSL certificate (%s setting with path '%s'): %s", ctx->client_ctx ? "ssl_client_cert_file" : "ssl_server_cert_file", set->cert.cert.path, openssl_iostream_use_certificate_error(set->cert.cert.content) The outcome was that the path is empty as well: dovecot: pop3-login: Error: Failed to initialize SSL connection: Couldn't initialize SSL server context: Can't load SSL certificate (ssl_server_cert_file setting with path ''): The certificate is empty Then, I adapted ssl-settings.c:ssl_server_settings_check() to show the content of the server certificate file at that stage (with stdio): FILE *file_ptr;file_ptr=fopen("/tmp/output.txt","a");if(file_ptr!=NULL){fprintf(file_ptr,"server check %s\n",set->ssl_server_cert_file);fclose(file_ptr);} The outcome was that the file is not empty at this stage: server check /etc/letsencrypt/live/<MY_SERVER>/fullchain.pem -----BEGIN CERTIFICATE----- <MY_CERT> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- <MY_CERT> -----END CERTIFICATE----- Is there any potential reason for this disappearance between the calls? Thanks! Louis.

3 2

Re: Dovecot 2.4.1-4: Server SSL cert loaded in ssl_server_settings_check but lost in openssl_iostream_use_certificate_error
by Rory Campbell-Lange 24 Aug '25

24 Aug '25

On 24/08/25, louis.villedieu(a)yahoo.com (louis.villedieu(a)yahoo.com) wrote: > I tried yesterday all the options you proposed in terms of configuration. > > I don't think the configuration has an issue since the settings are loaded > successfully but not kept. > > I presume this can be due to an incompatibility of 2.4.1 with my system. That seems a bit odd. Are you sure you have cut out the "<" symbols relating to ssl certificate/key paths, and that the certificates are the full-chain certs? Anyhow, with reference to https://github.com/rorycl/dovecot-config, you can easily debug your issue with Dovecot 2.4.1's official docker image. Simply edit the provided dovecot.conf to include your ssl settings and the debugging log to stderr should quickly show you where your issue is in a safe environment. Be aware that if you run docker from the local directory with your dovecot.conf etc to load into docker you need to use the --volume/v or --mount options to put that directory at /etc/dovecot in the container: docker run -p 1143:143 -p 1993:993 \ -v ./:/etc/dovecot \ dovecot/dovecot:latest If you have specified ssl files at, for example, /etc/dovecot/ssl, you need to put your ssl certificates and keys in an ssl directory of the current directory, or make another -v / --mount mount.

1 0

Virtual inbox in imap with dovecot 2.4
by aholiveira＠gmail.com 24 Aug '25

24 Aug '25

Hello, I've recently upgraded to debian 13 (trixie), from debian 12 (bookworm). In bookworm I had the following setup working like perfection: - All mail is sorted to some mailbox folder through sieve (either a "specialized" one, or a generic folder under the inbox name like year.month - 2025.08). - No email whatsoever was ever reaching the inbox. - Then I had a virtual inbox which would get me all the "unread" or "flagged" messages This way I had all my email sorted out from the delivery and my inbox cleared itself once I had read an email. For this I was using the stock debian dovecot packages, and now, after the upgrade to debian 13 I'm also using the stock debian packages. However, this whole neat setup broke and I can't get it to work again. I've searched dovecot's manual, asked two different AIs, did a number of web searches and adapted the new configuration files to the new syntax but dovecot refuses to list the emails in my INBOX folder. I've spent already several hours around this, to no avail. Unfortunately I didn't keep a copy of the config files from debian 12 so now I can't really compare but I did manually change the dovecot config files after the upgrade so that what I had running in debian 12 should work as before (it was refusing to start after the upgrade). Here is the output of dovecot -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.41+deb13-amd64 x86_64 Debian 13.0 # Hostname: myhost # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_mechanisms = plain login dovecot_storage_version = 2.4.0 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_driver = maildir mail_inbox_path = ~/Maildir mail_path = ~/Maildir mail_plugins { notify = yes mail_log = yes virtual = yes } mail_privileged_group = mail namespace_subscriptions = no protocols { imap = yes sieve = yes } passdb pam { } userdb passwd { } namespace inbox { inbox = yes prefix = separator = . subscriptions = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service submission-login { inet_listener submission { port = 587 } inet_listener submissions { } } service lmtp { unix_listener lmtp { } } service imap { executable = imap imap-postlogin } service pop3 { } service submission { } service auth { unix_listener auth-userdb { } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/dovecot/private/dovecot.pem dh_file = /usr/share/dovecot/dh.pem key_file = /etc/dovecot/private/dovecot.key } protocol lda { mail_plugins { sieve = yes } } protocol imap { mail_max_userip_connections = 40 } service managesieve-login { inet_listener sieve { port = 4190 } } namespace 00-virtual { mail_driver = virtual mail_path = ~/Maildir/virtual hidden = no inbox = no list = yes prefix = 00-virtual. separator = . } namespace virtual { mail_driver = virtual mail_path = ~/Maildir/virtual hidden = no inbox = no list = yes prefix = virtual. separator = . } namespace real { hidden = yes inbox = no list = no prefix = real. separator = . subscriptions = no } service imap-postlogin { executable = script-login /usr/local/bin/dovecot-postlogin.sh unix_listener imap-postlogin { } } passdb deny { deny = yes driver = passwd-file passwd_file_path = /etc/dovecot/deny-users } This is /usr/local/bin/dovecot-postlogin.sh #!/bin/sh VIRTUAL=$HOME/Maildir/virtual # AUTOMATICALLY VIRTUALIZE INBOX # # If the user creates a virtual/INBOX/dovecot-virtual, # switch the inbox to the virtual namespace. if [ -d "${VIRTUAL}/INBOX" ]; then export USERDB_KEYS="$USERDB_KEYS NAMESPACE/VIRTUAL/INBOX NAMESPACE/INBOX/INBOX" logger -p mail.debug "$USERDB_KEYS $VIRTUAL $@" /usr/bin/env USERDB_KEYS="$USERDB_KEYS" NAMESPACE/VIRTUAL/INBOX=yes NAMESPACE/INBOX/INBOX=no "$@" else exec "$@" fi This is the content of $HOME/Maildir/virtual/INBOX/dovecot-virtual real.* OR UNSEEN FLAGGED I'm also getting this message anytime that I login with a mail client: 2025-08-22T21:52:29.466584+01:00 ****** dovecot: imap(***)<316863><svBRYvo8+pXAqFoB>: Error: Mailbox INBOX: Failed to autocreate mailbox: Can't create virtual mailboxes Note that the 00-virtual namespace was added just as a temporary check and I want to delete it once this is working again. I have also a file under $HOME/Maildir/virtual/Flagged/dovecot-virtual with the exact same contents as the INBOX one above which get's me a virtual folder that works correctly (getting all my unread and flagged email in a single folder), so the filter works. Just changing the INBOX from the real to the virtual one fails and I can't understand what am I doing wrong or what am I missing. Can someone please help me? I'm completely lost and frustrated on this. Thank you very much.

4 5

2.4 config nightmares
by Dharma Mati 24 Aug '25

24 Aug '25

I have been trying for weeks to make it work.But I simply cant. Would you plz kindly tell me how it should be? : doveconf -n # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: Linux 6.1.67-gentoo x86_64 Gentoo Base System release 2.17 ext4 # Hostname: .................. auth_mechanisms = cram-md5 plain login disable_plaintext_auth = no listen = * mail_location = maildir:/home/vmail/%d/%n/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = * driver = pam } passdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } ssl_cert = </etc/ssl/private/server.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } userdb { args = uid=vmail gid=vmail home=/home/vmail/%d/%n driver = static } local_name asl.dynu.net { ssl_cert = </etc/letsencrypt/live/asl.dynu.net/fullchain.pem ssl_key = # hidden, use -P to show it } local_name { ssl_cert = </etc/letsencrypt/live//fullchain.pem ssl_key = # hidden, use -P to show it } etc. Plz help me.And kindly consider creating a migration tool.Thanks a lot Andreas I have been trying for weeks to make it work.But I simply cant. Would you plz kindly tell me how it should be? : doveconf -n # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: Linux 6.1.67-gentoo x86_64 Gentoo Base System release 2.17 ext4 # Hostname: .................. auth_mechanisms = cram-md5 plain login disable_plaintext_auth = no listen = * mail_location = maildir:/home/vmail/%d/%n/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = * driver = pam } passdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } ssl_cert = </etc/ssl/private/server.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } userdb { args = uid=vmail gid=vmail home=/home/vmail/%d/%n driver = static } local_name [1]asl.dynu.net { ssl_cert = </etc/letsencrypt/live/[2]asl.dynu.net/fullchain.pem ssl_key = # hidden, use -P to show it } local_name { ssl_cert = </etc/letsencrypt/live//fullchain.pem ssl_key = # hidden, use -P to show it } etc. Plz help me.And kindly consider creating a migration tool.Thanks a lot Andreas References Visible links 1. http://asl.dynu.net/ 2. http://asl.dynu.net/fullchain.pem

8 9

How to offer different translations for virtual namespaces with userdb?
by Ákos Szőts 23 Aug '25

23 Aug '25

Hi everyone, I'd like to configure a feature that, based on userdb locale settings, returns with differently translated string for the same virtual namespace mailbox name. This is where I ended up so far: group @namespaces virtual-virtual-english { mailbox All { auto = no special_use = \All } } group @namespaces virtual-virtual-hungarian { mailbox "Összes levél" { auto = no special_use = \All } } namespace virtual-virtual { prefix = Virtual/ separator = / mail_driver = virtual mail_path = /var/lib/dovecot/virtual/virtual mail_index_path = %{home}/index/virtual/virtual namespace_subscriptions = no list = children hidden = no } UserDB query works: Debug: Added setting via userdb: namespace/virtual-virtual/@namespaces=virtual-virtual-hungarian I had to create symlinks in the virtual/virtual directory (otherwise the Hungarian version wouldn't work): # virtual/virtual All &ANY-sszes lev&AOk-l -> All/ When I list the mailboxes, however, I get back all of them, not just the matching-language elements: * LIST (\Noselect \HasChildren) "/" Virtual * LIST (\HasNoChildren) "/" "Virtual/&ANY-sszes lev&AOk-l" * LIST (\HasNoChildren \All) "/" Virtual/All "list", "hidden", and "prefix" are seemingly not allowed within a group. How can I offer different translations for different users in my home setup? Is it possible to translate the namespace prefix? Dovecot version: 2.4.1. Thank you, Ákos

2 2

Missing IMAP METADATA Plugin
by Adam Miller 23 Aug '25

23 Aug '25

OS: Ubuntu 22.04.1 Dovecot: 2.3.16 (7e2e900c1a) When trying to enable the “imap_metadata” plugin, I get the following error: Plugin 'imap_metadata' not found from directory /usr/lib/dovecot/modules I have searched high and low via Google, StackOverflow and even ChatGPT (haha) but I cannot seem to find the package that provides the plugin. Does Dovecot have to be built from source for this plugin to be included? Any help is appreciated. Thank you!

8 8

getpwnam() failed: Resource temporarily unavailable
by Hauke Fath 22 Aug '25

22 Aug '25

Hi, I see a very peculiar Dovecot (2.3.21.1) authentication failure that concerns exactly one user: Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Debug: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: Handling PASSV request Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Debug: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: passwd(REDACTED_UID,84.136.89.217,<yZxQxMA8uL1UiFnZ>): Performing passdb lookup Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Debug: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: passwd(REDACTED_UID,84.136.89.217,<yZxQxMA8uL1UiFnZ>): lookup Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Error: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: passwd(REDACTED_UID,84.136.89.217,<yZxQxMA8uL1UiFnZ>): getpwnam() failed: Resource temporarily unavailable Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Debug: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: passwd(REDACTED_UID,84.136.89.217,<yZxQxMA8uL1UiFnZ>): Finished passdb lookup Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Debug: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: Finished: internal_failure This used to work, until a few months ago it stopped. The user can still authenticate to send mail through the same server. Changing the password didn't make a difference. Any ideas? Cheerio, Hauke -- The ASCII Ribbon Campaign Hauke Fath () No HTML/RTF in email Institut für Nachrichtentechnik /\ No Word docs in email TU Darmstadt Respect for open standards Ruf +49-6151-16-21344

3 3

How to remove non-existent virtual mailbox from index
by Ákos Szőts 21 Aug '25

21 Aug '25

Hi everyone, During experimentation I created a "Test1" mailbox under a virtual namespace: mailbox "Test1" { auto = no special_use = \All } I commented it out before restarting Dovecot, and it's never been subscribed to either. I see the Test1 directory is still within my "index" directory and there's a "dovecot.index.log" in it. When I try to force resync all my virtual mailboxes, doveadm complains about it: $ doveadm -D force-resync -A Virtual/* Debug: Namespace virtual-virtual: [...]/virtual/Test1 doesn't exist yet, using default permissions Debug: Namespace virtual-virtual: Using permissions from [...]/virtual: mode=0755 gid=default Error: Mailbox Virtual/Test1: mkdir_parents([...]/virtual/Virtual/Test1) failed: Permission denied Error: Mailbox Virtual/Test1: Failed to create path: [...]/virtual/Virtual/Test1 for mailbox Virtual/Test1: mkdir_parents([...]/virtual/Virtual/Test1) failed: Permission denied What is the proper command to remove it from the index? I tried "cache purge", but that fails, too. I can "rm -rf" the whole index directory and that solves this issue. However, I think there should be a more gentle solution. Thank you, Ákos

1 0

"imap-login" crashes at lib-ssl-iostream/iostream-ssl.c:55
by Ákos Szőts 21 Aug '25

21 Aug '25

Hi all, When I start "imap-login" without arguments, it crashes: gdb -ex run --args /usr/lib/dovecot/imap-login (gdb) thread apply all bt full Thread 1 (Thread 0x7f5bd50c6740 (LWP 625) "imap-login"): #0 0x00007f5bd545fe97in io_stream_ssl_global_init(set=0x56205ca355c8, error_r=0x7ffdf0e669a8) at ../lib-ssl-iostream/iostream-ssl.c:55 No locals. #1 0x00007f5bd558d15bin login_ssl_init() at /usr/src/debug/dovecot-2.4.1-4/src/login-common/main.c:343 ssl_set= 0x56205ca355c8 error= 0xc00000<error: Cannot access memory at address 0xc00000> #2 main_preinit() at /usr/src/debug/dovecot-2.4.1-4/src/login-common/main.c:355 max_fds= <optimized out> __func__= <optimized out> #3 login_binary_run(binary=<optimized out>, argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/dovecot-2.4.1-4/src/login-common/main.c:528 service_flags= <optimized out> login_socket= 0x7f5bd5590b66"login" error= 0x1000000<error: Cannot access memory at address 0x1000000> c= <optimized out> input= {config_path= 0x0, config_fd= 0, preserve_environment= false, preserve_user= false, preserve_home= false, no_service_filter= false, check_full_config= false, hide_obsol ete_warnings= false, no_protocol_filter= false, no_key_validation= false, reload_config= false, never_exec= false, always_exec= false, return_config_fd= false, use_sysexits= false, pr otocol= 0x562033d837ac"imap"} output= {specific_protocols= 0x56205ca15398, config_fd= -1, permission_denied= false} #4 0x00007f5bd51662aein __libc_start_call_main() from /lib64/libc.so.6 No symbol table info available. #5 0x00007f5bd5166379in __libc_start_main_impl() from /lib64/libc.so.6 No symbol table info available. #6 0x0000562033d79885in _start() at ../sysdeps/x86_64/start.S:115 No locals. Probably "ssl_vfuncs->[...]" is a NULL dereference? I'm debugging a crash within Dovecot and this was one of my findings. Dovecot version: 2.4.1. Ákos

1 1