- dovecot - dovecot.org

Replication performance question and environment variables sanitization
by Jesus Cea 10 Jun '26

10 Jun '26

Hi, there. I am using dovecot 2.3.21.1. I am experimenting with replication, currently doing it manually, using this: doveadm -Dv sync -u jcea ssh email doveadm dsync-server -u prueba_backup; echo $? It works fine so far, but I have a few hundreds of mailboxes in my imap4 account and an "empty" (no changes) sync takes 30 seconds, since apparently it compare every mailbox (according to the debug info printed). I am using "mdbox" storage in both sides. I would expect an event replication, where time is proportional to the volume of changes, not to the total data volume or number of mailboxes. Am I doing anything wrong?. It would be faster to use "replicator" + "mail_replica". Can I improve this in some way? Replication must be both ways, because in one server new emails are arriving and in the other imapserver I am doing my mail work. I want new email appearing in my work imapserver (living my own laptop) and my email processing to be replicated back to the server for backup/disaster recovery (lost laptop, broken HD) and access from a different laptop, phone, etc. Thanks. PS: By default dovecot sanitizes the environment and doesn't allow "SSH_AUTH_SOCK" for ssh-agent. Why?. That is very inconvenient. I am using this environment variable to overcome that: DOVECOT_PRESERVE_ENVS="HOME USER SSH_AUTH_SOCK SSH_AGENT_PID LOG_STDERR_TIMESTAMP TZ CORE_OUTOFMEM CORE_ERROR" Is this the right way to do this? -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - https://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz

2 3

dovecot 2.4 and Outlook
by Jochen Bern 08 Jun '26

08 Jun '26

Since I don't remember seeing *this* mentioned here so far, but *do* remember people asking about Outlook-dovecot compatibility issues every now and then, here's a potential cause for seeing more of those in the immediate future: https://fedoramagazine.org/fedora-43-upgrade-revealed-20-years-old-outlook-… Kind regards, -- Jochen Bern Systemingenieur Binect GmbH

2 3

Using 2 LDAP sources for passdb
by Tom 03 Jun '26

03 Jun '26

I can't seem to find documentation that shows how to set up 2 LDAP passdb blocks. I can get each of them working properly, but only the second of the two works at any given time. I can't figure out the syntax needed to get both to work, even though I've been all over the Dovecot 2.4x official documentation. The docs seem to suggest settings that the server rejects. Anyone have any experience doing this, or know the correct syntax? Thanks in advance! passdb ldap { # works when standalone; fails when combined with 2nd block below #passdb_name = ldap1 #driver = ldap ldap_version = 3 bind = yes bind_userdn = %{user|username} ldap_auth_dn = cn=dovecot,ou=apps,dc=example,dc=com ldap_auth_dn_password = D0vec0t ldap_base = ou=apps,dc=foscore,dc=com ldap_uris = ldapi://%2Frun%2Fldapi filter = (&(objectClass=applicationProcess)(cn=%{user})) passdb_ldap_bind = yes passdb_ldap_bind_userdn = cn=%{user},ou=apps,dc=example,dc=com result_success = return-ok } passdb ldap { #driver = ldap #name = ldap_users ldap_version = 3 bind = yes bind_userdn = %{user|username} ldap_auth_dn = cn=dovecot,ou=apps,dc=example,dc=com ldap_auth_dn_password = D0vec0t ldap_base = ou=people,dc=example,dc=com ldap_uris = ldapi://%2Frun%2Fldapi filter = (&(objectClass=posixAccount)(uid=%{user|username})(memberOf=cn=mail,ou=%{user|domain},ou=groups,dc=example,dc=com)) passdb_ldap_bind = yes passdb_ldap_bind_userdn = uid=%{user|username},ou=people,dc=example,dc=com result_success = return-ok }

2 7

Building on FreeBSD 14.4
by Frank Volf 03 Jun '26

03 Jun '26

Hi, I'm trying to build dovecot-2.4.4 on FreeBSD 14.4 and I get a strange error message. What I did is download and extract dovecot-2.4.4.tar.gz and then run ./configure without any arguments. After typing make the build started without any problems until this point: .... Making all in auth CC test_auth_cache-auth-cache.o CC test_auth_cache-test-auth-cache.o CC auth-main.o CC auth-auth.o CC auth-auth-cache.o CC auth-auth-client-connection.o CC auth-auth-master-connection.o CC auth-auth-policy.o CC auth-auth-penalty.o CC auth-auth-request.o CC auth-auth-request-fields.o CC auth-auth-request-handler.o CC auth-auth-request-var-expand.o CC auth-auth-sasl-mech-apop.o CC auth-auth-sasl-mech-dovecot-token.o CC auth-auth-sasl-mech-oauth2.o CC auth-auth-sasl.o CC auth-auth-settings.o CC auth-auth-fields.o CC auth-auth-token.o CC auth-auth-worker-connection.o CC auth-auth-worker-server.o CC auth-db-oauth2.o CC auth-db-sql.o CC auth-db-passwd-file.o CC auth-passdb.o CC auth-passdb-blocking.o CC auth-passdb-bsdauth.o CC auth-passdb-cache.o CC auth-passdb-oauth2.o CC auth-passdb-passwd.o CC auth-passdb-passwd-file.o CC auth-passdb-pam.o CC auth-passdb-sql.o CC auth-passdb-static.o CC auth-userdb.o CC auth-userdb-blocking.o CC auth-userdb-passwd.o CC auth-userdb-passwd-file.o CC auth-userdb-prefetch.o CC auth-userdb-static.o CC auth-userdb-sql.o CC auth-db-ldap.o CC auth-db-ldap-sasl.o CC auth-db-ldap-settings.o CC auth-passdb-ldap.o CC auth-userdb-ldap.o CC auth-db-lua.o CC auth-passdb-lua.o CC auth-userdb-lua.o make[3]: don't know how to make -L/usr/local/lib. Stop make[3]: stopped making "all" in /home/volf/dovecot-2.4.4/src/auth *** Error code 1 So, apparently make is confused and thinks that the compiler/linker commandline option is an item to build. I'm at loss how to solve this. I would appreciate it, if somebody could give me a hint how to solve this. Kind regards, Frank Hi, I'm trying to build dovecot-2.4.4 on FreeBSD 14.4 and I get a strange error message. What I did is download and extract dovecot-2.4.4.tar.gz and then run ./configure without any arguments. After typing make the build started without any problems until this point: .... Making all in auth CC test_auth_cache-auth-cache.o CC test_auth_cache-test-auth-cache.o CC auth-main.o CC auth-auth.o CC auth-auth-cache.o CC auth-auth-client-connection.o CC auth-auth-master-connection.o CC auth-auth-policy.o CC auth-auth-penalty.o CC auth-auth-request.o CC auth-auth-request-fields.o CC auth-auth-request-handler.o CC auth-auth-request-var-expand.o CC auth-auth-sasl-mech-apop.o CC auth-auth-sasl-mech-dovecot-token.o CC auth-auth-sasl-mech-oauth2.o CC auth-auth-sasl.o CC auth-auth-settings.o CC auth-auth-fields.o CC auth-auth-token.o CC auth-auth-worker-connection.o CC auth-auth-worker-server.o CC auth-db-oauth2.o CC auth-db-sql.o CC auth-db-passwd-file.o CC auth-passdb.o CC auth-passdb-blocking.o CC auth-passdb-bsdauth.o CC auth-passdb-cache.o CC auth-passdb-oauth2.o CC auth-passdb-passwd.o CC auth-passdb-passwd-file.o CC auth-passdb-pam.o CC auth-passdb-sql.o CC auth-passdb-static.o CC auth-userdb.o CC auth-userdb-blocking.o CC auth-userdb-passwd.o CC auth-userdb-passwd-file.o CC auth-userdb-prefetch.o CC auth-userdb-static.o CC auth-userdb-sql.o CC auth-db-ldap.o CC auth-db-ldap-sasl.o CC auth-db-ldap-settings.o CC auth-passdb-ldap.o CC auth-userdb-ldap.o CC auth-db-lua.o CC auth-passdb-lua.o CC auth-userdb-lua.o make[3]: don't know how to make -L/usr/local/lib. Stop make[3]: stopped making "all" in /home/volf/dovecot-2.4.4/src/auth *** Error code 1 So, apparently make is confused and thinks that the compiler/linker commandline option is an item to build. I'm at loss how to solve this. I would appreciate it, if somebody could give me a hint how to solve this. Kind regards, Frank

6 14

Re: User authentication for shared mailbox
by Stéphane Veyret 31 May '26

31 May '26

I managed to make it work. In case some other people want to do the same, the trick was to use the master user concept, as suggested by Aki Tuomi, with a lua script to check if user can be master. My configuration looks like this: passdb pam_master { driver = pam master = yes result_success = continue } passdb pam { } passdb lua { lua_file = /etc/dovecot/master-auth.lua result_failure = return-fail result_internalfail = return-fail result_success = continue-ok } passdb ldap { ldap_base = ou=Group,dc=example,dc=com fields { password = {SHA1}IQ== user = %{ldap:cn} } filter = (cn=%{user | username}) } and the lua script: function script_init() return 0 end function auth_passdb_lookup(req) if req.master_user then req:log_info("Looking for groups for " .. tostring(req.master_user)) handle = io.popen("/bin/groups " .. tostring(req.master_user)) output = handle:read("*a") req:log_debug("Searching " .. tostring(req.user) .. " in found groups " .. output) for group in output:gmatch("%w+") do if group == req.user then return dovecot.auth.PASSDB_RESULT_OK, { password="!" } end end end return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN, "No such user" end -- Bien cordialement, / Plej kore, Stéphane Veyret I managed to make it work. In case some other people want to do the same, the trick was to use the master user concept, as suggested by Aki Tuomi, with a lua script to check if user can be master. My configuration looks like this: passdb pam_master { driver = pam master = yes result_success = continue } passdb pam { } passdb lua { lua_file = /etc/dovecot/master-auth.lua result_failure = return-fail result_internalfail = return-fail result_success = continue-ok } passdb ldap { ldap_base = ou=Group,dc=example,dc=com fields { password = {SHA1}IQ== user = %{ldap:cn} } filter = (cn=%{user | username}) } and the lua script: function script_init() return 0 end function auth_passdb_lookup(req) if req.master_user then req:log_info("Looking for groups for " .. tostring(req.master_user)) handle = io.popen("/bin/groups " .. tostring(req.master_user)) output = handle:read("*a") req:log_debug("Searching " .. tostring(req.user) .. " in found groups " .. output) for group in output:gmatch("%w+") do if group == req.user then return dovecot.auth.PASSDB_RESULT_OK, { password="!" } end end end return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN, "No such user" end -- Bien cordialement, / Plej kore, Stephane Veyret

1 0

dsync between 2.3.16 and 2.4.2
by Jean-Daniel Beaubien 28 May '26

28 May '26

Hi, I currently have a doveadm backup running my prod and backup server. Both are currently running 2.3.16, and the following command runs fine: sudo doveadm -v backup -u XXXX -P remote:XXXX@192.168.111.XX I am in the process of updating my servers to ubuntu 26.04 which runs dovecot 2.4.2 and I am running into problems trying to run this command. For some reason, it tries to delete the INBOX on the destination and I get the following error: dsync-remote(XXXX)<7hkbKDl6F2rlxQAArPp36Q>: Error: brain S: Mailbox INBOX sync: mailbox_delete failed: The /private/specialuse attribute cannot be changed doveadm(228686): Error: Remote command returned error 65: ssh -lXXXX 192.168.111.XX doveadm dsync-server -uXXXX I am not sure what/why this is happening. I read the docs and man page, but could not find a solution. Anyone knows what is happening, and how to solve this? Thanks, -JD ----- Addendum ----- Another thing that might help someone else: I had to add a line to the config file to avoid the -U problem: dsync_remote_cmd = "ssh -l%{login} %{host} doveadm dsync-server -u%{user}" This seems to already be solved ( https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/B3TQF…) but not yet in the ubuntu 26.04 release? Hi, I currently have a doveadm backup running my prod and backup server. Both are currently running 2.3.16, and the following command runs fine: sudo doveadm -v backup -u XXXX -P remote:XXXX@192.168.111.XX I am in the process of updating my servers to ubuntu 26.04 which runs dovecot 2.4.2 and I am running into problems trying to run this command. For some reason, it tries to delete the INBOX on the destination and I get the following error: dsync-remote(XXXX)<7hkbKDl6F2rlxQAArPp36Q>: Error: brain S: Mailbox INBOX sync: mailbox_delete failed: The /private/specialuse attribute cannot be changed doveadm(228686): Error: Remote command returned error 65: ssh -lXXXX 192.168.111.XX doveadm dsync-server -uXXXX I am not sure what/why this is happening. I read the docs and man page, but could not find a solution. Anyone knows what is happening, and how to solve this? Thanks, -JD ----- Addendum ----- Another thing that might help someone else: I had to add a line to the config file to avoid the -U problem: dsync_remote_cmd = "ssh -l%{login} %{host} doveadm dsync-server -u%{user}" This seems to already be solved ([1]https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/B3T…) but not yet in the ubuntu 26.04 release? References Visible links 1. https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/B3TQF…

2 1

I can't find up to date documentation about dovecot authentication process design
by kristoffermollerhoj＠gmail.com 27 May '26

27 May '26

Hi, I am currently about to port a legacy / custom authentication mechanism from 2.3 to 2.4. Many things have changed in this area, and I have unfortunately not been able to find any valid documentation about this topic. I have looked here: https://doc.dovecot.org/2.4.4/developers/design/auth_process.html but as far as I can see all the content is about the code design for dovecot 2.3, not 2.4. Just to mention a few examples: There is not anymore a struct named mech_module, there is no such file as mech.h, and also the API for the central callback functions such as auth_new() and auth_initial() seems to have changed a lot (both arguments and return types). Maybe a somewhat unfinished version of the documentation can be found on a specific branch? Thank you, Kristoffer Møllerhøj.

4 5

Sent, Junk and Drafts are not created
by Thomas Jensen 26 May '26

26 May '26

I have a new dovecot 2.4.2 setup. All seems to work fine, except Sent, Junk and Drafts are not created. In 15-mailboxes.conf I have: namespace inbox { # These mailboxes are widely used and could perhaps be created automatically: mailbox Drafts { auto = create special_use = \Drafts } mailbox Junk { auto = create special_use = \Junk } mailbox Trash { auto = create special_use = \Trash } # For \Sent mailboxes there are two widely used names. We'll mark both of # them as \Sent. User typically deletes one of them if duplicates are created. mailbox Sent { auto = create special_use = \Sent } mailbox "Sent Messages" { auto = create special_use = \Sent } } But nothing is created. And dovecot -n return this: (note the "\\") root@rpix:~# dovecot -n # 2.4.2 (0962ed2104): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.2 (767418c3) # OS: Linux 7.0.0-15-generic x86_64 Ubuntu 26.04 LTS # Hostname: rpix.dk # 9 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_default_domain = rpix.dk auth_mechanisms = plain login auth_username_format = %{user|lower} dovecot_storage_version = 2.4.0 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes mail_driver = maildir mail_home = /var/vmail/%{user | domain}/%{user | username} mail_path = ~/Maildir mail_privileged_group = mail protocols = imap lmtp sql_driver = mysql ssl = required passdb sql { default_password_scheme = ARGON2I query = SELECT username AS user,password FROM mailbox WHERE username = '%{user}' AND active='1' } userdb sql { iterate_query = SELECT username AS user FROM mailbox query = SELECT 2000 AS uid, 2000 AS gid FROM mailbox WHERE username = '%{user}' AND active='1' } mysql localhost { dbname = postfixadmin password = # hidden, use -P to show it user = postfixadmin } namespace inbox { inbox = yes mailbox Drafts { auto = create special_use = "\\Drafts" } mailbox Junk { auto = create special_use = "\\Junk" } mailbox Trash { auto = create special_use = "\\Trash" } mailbox Sent { auto = create special_use = "\\Sent" } mailbox "Sent Messages" { auto = create special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service submission-login { inet_listener submission { } inet_listener submissions { } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service imap { } service pop3 { } service submission { } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service auth-worker { } service dict { unix_listener dict { } } service stats { unix_listener stats-reader { group = www-data mode = 0660 user = www-data } unix_listener stats-writer { group = www-data mode = 0660 user = www-data } } ssl_server { cert_file = /etc/letsencrypt/live/mail/fullchain.pem key_file = /etc/letsencrypt/live/mail/privkey.pem prefer_ciphers = server } protocol lmtp { auth_username_format = %{user | lower} } What am I doing wrong? -- /Thomas Jensen, Denmark

3 3

Possible FTS language detection packaging issue in Dovecot 2.4.x Debian packages
by Jens Urban 26 May '26

26 May '26

Hello, Is anyone running Dovecot 2.4.4 with multilingual FTS flatcurve on Debian 12/13, using the packages from Dovecot.org? I suspect a packaging/build issue related to language detection. It looks like libexttextcat is not included in the Debian build. Simple reproduction with doveadm: doveadm fts tokenize -u localpart@domain 'This is the house. Das ist das Haus‘ —> Warning: Can't detect its language - assuming de …… My suspicion: If the "libexttextcat-dev" package was not installed during the "configure" step of the package creation process, then "HAVE_LANG_EXTTEXTCAT" will not be set. And if the define "HAVE_LANG_EXTTEXTCAT" is not set during the compilation of "src/lib-language/language.c", then "language_textcat_init" always returns "LANGUAGE_DETECT_RESULT_UNKNOWN;". Consequently, doveadm invariably translates this return value into the message: "Warning: Can't detect its language - assuming $DEFAULT-LANG". If I download the source code from Dovecot.org and build the dovecot vendor package myself, "language detection" works—provided that "libexttextcat-dev" has been installed beforehand. My simple test to check whether the installed version contains „libexttextcat“: (My build finds references to libexttextcat; the build from Dovecot.org finds none.) nm --print-file-name --dynamic --undefined-only /usr/lib/x86_64-linux-gnu/dovecot/* | grep textcat —> /usr/lib/x86_64-linux-gnu/dovecot/libdovecot-language.so.0.0.0: U special_textcat_Init —> /usr/lib/x86_64-linux-gnu/dovecot/libdovecot-storage.so.0.0.0: U textcat_ReleaseClassifyFullOutput Background: In my self-built package, exttextcat-related symbols appear in both libdovecot-language and libdovecot-storage; I assume this is expected due to the build/link layout. Regards, Jens Hello, Is anyone running Dovecot 2.4.4 with multilingual FTS flatcurve on Debian 12/13, using the packages from Dovecot.org? I suspect a packaging/build issue related to language detection. It looks like libexttextcat is not included in the Debian build. Simple reproduction with doveadm: doveadm fts tokenize -u localpart@domain 'This is the house. Das ist das HausaEUR~ aEUR"> Warning: Can't detect its language - assuming de aEUR|aEUR| My suspicion: If the "libexttextcat-dev" package was not installed during the "configure" step of the package creation process, then "HAVE_LANG_EXTTEXTCAT" will not be set. And if the define "HAVE_LANG_EXTTEXTCAT" is not set during the compilation of "src/lib-language/language.c", then "language_textcat_init" always returns "LANGUAGE_DETECT_RESULT_UNKNOWN;". Consequently, doveadm invariably translates this return value into the message: "Warning: Can't detect its language - assuming $DEFAULT-LANG". If I download the source code from Dovecot.org and build the dovecot vendor package myself, "language detection" worksaEUR"provided that "libexttextcat-dev" has been installed beforehand. My simple test to check whether the installed version contains aEURzlibexttextcataEURoe: (My build finds references to libexttextcat; the build from Dovecot.org finds none.) nm --print-file-name --dynamic --undefined-only /usr/lib/x86_64-linux-gnu/dovecot/* | grep textcat aEUR"> /usr/lib/x86_64-linux-gnu/dovecot/libdovecot-language.so.0.0.0: U special_textcat_Init aEUR"> /usr/lib/x86_64-linux-gnu/dovecot/libdovecot-storage.so.0.0.0: U textcat_ReleaseClassifyFullOutput Background: In my self-built package, exttextcat-related symbols appear in both libdovecot-language and libdovecot-storage; I assume this is expected due to the build/link layout. Regards, Jens

1 0

dovecot 2.4.4 community edition, bug in variables
by Terry Braun 23 May '26

23 May '26

I'm using this passdb sql to a postgres db passdb sql { query = SELECT NULL AS password, 'Y' as nopassword, userid AS user \ FROM users \ WHERE addr = '%{user}' AND password = '%{password}' } This succeed and the addr passed in as user is foo(a)example.com as expected I use this userdb sql userdb sql { query = SELECT home, uid, gid \ FROM users \ WHERE addr = '%{user}' # For using doveadm -A: # iterate_query = SELECT userid AS username, domain FROM users } This fails because postgres receives just "foo" not "foo(a)example.com" as user. maybe there is a bug in my stuff but I cannot see it. I can see the query in the postgres log where it clearly says: WHERE addr = 'foo' It also logs the passdb query: WHERE addr = 'foo(a)example.com' AND password='secret' thanks Terry

2 2