=== dsync(foobar@example.com): Error: imapc(foobar.example.com:993): dns_lookup(foobar.example.com) failed: read(/var/run/dovecot/dns-client) failed: read(size=512) failed: Connection reset by peer

dsync(foobar@example.com): Error: Failed to initialize user: imapc: Login to foobar.example.com failed: Disconnected from server

Initially I thought "oh no, not another AppArmor block".

But then surely the second message would not appear if the DNS lookup was not successful ?

Also "dig foobar.example.com" works fine.

How should I be troubleshooting this ? And if it is still likely to be AppArmor, what is calling it ? "doveadm" itself or something else ? What does "/var/run/dovecot/dns-client" do and why doesn't dovecot use standard OS calls like everyone else ?

So many questions !