- dovecot - dovecot.org

Convert sqlite configuration from 2.3 to 2.4
by Horst B Simon 23 Jun '26

23 Jun '26

Hi, I succesful converted all configurations from dovecot 2.3 to 2.4, except for the sqlite configuration. I googled and all configuration are for mysql/mariadb and not for sqlite. The sqlite database is created with postfixadmin and my current configuration for dovecot 2.3 (dovecot-sql.conf.ext) is: driver = sqlite connect = /var/mail/postfixadmin.db default_pass_scheme = DES-CRYPT password_query = \ SELECT username as user, password, '/var/mail/%d/%n' as userdb_home, \ 'maildir:/var/mail/%n' as userdb_mail, 5000 as userdb_uid, 5000 as userdb_gid \ FROM mailbox WHERE username = '%u' AND active = '1' user_query = \ SELECT '/var/mail/%d/%n' as home, 'maildir:/var/mail/%n' as mail, \ 5000 AS uid, 5000 AS gid, printf('dirsize:storage=', quota) AS quota \ FROM mailbox WHERE username = '%u' AND active = '1' I tried the only converter, but it didn’t do any conversion. Any help appreciated. Thanks and Regards, Horst Hi, I succesful converted all configurations from dovecot 2.3 to 2.4, except for the sqlite configuration. I googled and all configuration are for mysql/mariadb and not for sqlite. The sqlite database is created with postfixadmin and my current configuration for dovecot 2.3 (dovecot-sql.conf.ext) is: driver = sqlite connect = /var/mail/postfixadmin.db default_pass_scheme = DES-CRYPT password_query = \ SELECT username as user, password, '/var/mail/%d/%n' as userdb_home, \ 'maildir:/var/mail/%n' as userdb_mail, 5000 as userdb_uid, 5000 as userdb_gid \ FROM mailbox WHERE username = '%u' AND active = '1' user_query = \ SELECT '/var/mail/%d/%n' as home, 'maildir:/var/mail/%n' as mail, \ 5000 AS uid, 5000 AS gid, printf('dirsize:storage=', quota) AS quota \ FROM mailbox WHERE username = '%u' AND active = '1' I tried the only converter, but it didn't do any conversion. Any help appreciated. Thanks and Regards, Horst

2 1

Incomplete Dovecot Log Entries
by Bryan Simmons 20 Jun '26

20 Jun '26

There are hundreds of dovecot “Disconnected: Connection closed” messages in the log file that do not have a corresponding connect record. Is this normal or are there configuration options that need to be modified? Note the user accounts listed, and other similar records, do not exist on this server. 2026-06-14T02:11:48.843517-04:00 mail dovecot: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<rantanplan_admin(a)nanomail.net>, method=PLAIN, rip=190.181.120.152, lip=10.0.1.211, TLS, session=<T8xvlDBUnNC+tXiY> 2026-06-14T02:12:16.614611-04:00 mail dovecot: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<rantanplan_admin>, method=PLAIN, rip=41.139.10.25, lip=10.0.1.211, TLS, session=<cvoGljBUS+YpiwoZ> 2026-06-14T03:23:55.523146-04:00 mail dovecot: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<rantanplan.info(a)nanomail.net>, method=PLAIN, rip=103.69.9.148, lip=10.0.1.211, TLS, session=<SOBYljFUlsdnRQmU> Thanks, Bryan

1 0

Lazy-Expunge plugin documentation incomplete?
by Randolf Richardson 18 Jun '26

18 Jun '26

One of the Dovecot repository maintainers on GitHub recommended sending an eMail to you regarding the issue I encountered: Documentation for lazy-expunge doesn't work https://github.com/dovecot/documentation/issues/1555 -------- I converted from Dovecot 2.3 to Dovecot 2.4.1, which was not a minor upgrade. Anyway, I can't get the lazy-expunge plugin to work in 2.4.1 now. Here's my configuration file from 2.3 -- how can I get this working in 2.4.1? Thanks. namespace inbox { mailbox EXPUNGED { autoexpunge = 32days autoexpunge_max_mails = 100000 #auto = create } } # Namespace for lazy_expunge plugin namespace { prefix = EXPUNGED/ hidden = yes list = no subscriptions = no separator = / location = maildir:~/Maildir.deleted:INDEX= } mail_plugins = $mail_plugins lazy_expunge acl plugin { # Move expunged messages into the .EXPUNGED namespace lazy_expunge = EXPUNGED/ # Only move to expunged storage if this is the last copy of the message in the user´s account lazy_expunge_only_last_instance = yes # Exclude Drafts from lazy expunging lazy_expunge_exclude = \Drafts # Copy of each message is done with hard links whenever possible maildir_copy_with_hardlinks = yes # Define ACL so that user cannot list the .EXPUNGED mailbox # Example entry: .EXPUNGED owner rwstipekxa acl = vfile:/etc/dovecot/dovecot.acl # dovecot.acl contains one line: EXPUNGED owner ip # Expunged messages most likely don't want to be included in quota: quota_rule = EXPUNGED:ignore } #lazy_expunge_mailbox = EXPUNGED Here's an example of someone else who encountered the same problem: https://www.dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thr ead/25BXSHQWGQQ3ACVZSYF3O3LC4WROTUCI/ Randolf Richardson, CNA - randolf(a)inter-corporate.com Inter-Corporate Computer & Network Services, Inc. Beautiful British Columbia, Canada https://www.inter-corporate.com/

2 2

Announcing nauthilus-director: a Nauthilus-backed mail protocol director
by Christian Rößner 17 Jun '26

17 Jun '26

Hi, I would like to announce `nauthilus-director` for the first time on this list. `nauthilus-director` is an open-source mail protocol director and transparent proxy for Nauthilus-backed mail deployments. It sits in front of stateful mail backends, authenticates frontend sessions through Nauthilus, resolves routing and placement inside the director, selects healthy backend services, keeps active user affinity in Redis, and then proxies the established connection to the selected backend. The current focus is on deployments where backend placement, maintenance, drains, user movement and session affinity need to be explicit, observable and controllable. The director is not a mailbox server and not a general-purpose load balancer; it owns the narrow director responsibilities between clients, Nauthilus and backend mail services. Current capabilities include: - IMAP/IMAPS, POP3/POP3S, LMTP/LMTPS and ManageSieve proxying - Nauthilus-backed authentication over HTTP or gRPC - director-owned routing and backend selection - Redis-backed session affinity and runtime coordination - backend health, maintenance, runtime drains and placement overrides - an OpenAPI-based REST control API and `nauthilus-directorctl` - metrics, structured logging and OpenTelemetry tracing The demo stack includes Dovecot backend shards and exercises real IMAP, LMTP, POP3 and ManageSieve paths, so feedback from Dovecot operators would be especially useful. Related to this, Nauthilus itself has recently been released as version 3.0.0. Nauthilus is the central authentication and policy engine in this setup: it provides centralized authentication and identity handling for mail and web workloads, LDAP-backed or Lua-driven policy decisions, OIDC/SAML IdP functionality, MFA support, and Redis-backed state handling. In the director architecture, Nauthilus remains the authentication and policy authority, while `nauthilus-director` owns concrete backend placement and proxy lifecycle decisions. Project links: - nauthilus-director: https://github.com/croessner/nauthilus-director - Nauthilus: https://github.com/croessner/nauthilus - Documentation / website: https://nauthilus.org The director is still young, so I would be interested in feedback from people running Dovecot-backed infrastructures, especially around operational workflows, backend maintenance, migration scenarios and protocol behavior. The director is still in beta. Best regards, Christian Rößner -- Rößner-Network-Solutions Zertifizierter ITSiBe / CISO Marburger Str. 70a, 36304 Alsfeld Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5 Hi, I would like to announce `nauthilus-director` for the first time on this list. `nauthilus-director` is an open-source mail protocol director and transparent proxy for Nauthilus-backed mail deployments. It sits in front of stateful mail backends, authenticates frontend sessions through Nauthilus, resolves routing and placement inside the director, selects healthy backend services, keeps active user affinity in Redis, and then proxies the established connection to the selected backend. The current focus is on deployments where backend placement, maintenance, drains, user movement and session affinity need to be explicit, observable and controllable. The director is not a mailbox server and not a general-purpose load balancer; it owns the narrow director responsibilities between clients, Nauthilus and backend mail services. Current capabilities include: - IMAP/IMAPS, POP3/POP3S, LMTP/LMTPS and ManageSieve proxying - Nauthilus-backed authentication over HTTP or gRPC - director-owned routing and backend selection - Redis-backed session affinity and runtime coordination - backend health, maintenance, runtime drains and placement overrides - an OpenAPI-based REST control API and `nauthilus-directorctl` - metrics, structured logging and OpenTelemetry tracing The demo stack includes Dovecot backend shards and exercises real IMAP, LMTP, POP3 and ManageSieve paths, so feedback from Dovecot operators would be especially useful. Related to this, Nauthilus itself has recently been released as version 3.0.0. Nauthilus is the central authentication and policy engine in this setup: it provides centralized authentication and identity handling for mail and web workloads, LDAP-backed or Lua-driven policy decisions, OIDC/SAML IdP functionality, MFA support, and Redis-backed state handling. In the director architecture, Nauthilus remains the authentication and policy authority, while `nauthilus-director` owns concrete backend placement and proxy lifecycle decisions. Project links: - nauthilus-director: https://github.com/croessner/nauthilus-director - Nauthilus: https://github.com/croessner/nauthilus - Documentation / website: https://nauthilus.org The director is still young, so I would be interested in feedback from people running Dovecot-backed infrastructures, especially around operational workflows, backend maintenance, migration scenarios and protocol behavior. The director is still in beta. Best regards, Christian Roessner -- Roessner-Network-Solutions Zertifizierter ITSiBe / CISO Marburger Str. 70a, 36304 Alsfeld Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5

3 3

Announcement: wormhole plugin, replication for Dovecot 2.4
by Patrick Cernko 12 Jun '26

12 Jun '26

Hello List, I am proud to announce my project "wormhole". This is an extension for Dovecot 2.4.1. It allows to continue the use of the replication feature of Dovecot that was removed with the 2.4 release. History: I started this project by forking the replication code of Dovecot 2.3.21.1 and porting it to 2.4. The first result was a patch for Dovecot 2.4.1. While working with the code, I realized that it is possible to provide the feature as a plugin / extension. In the first release of the plugin, I tried to integrate it with the existing dsync commands for doveadm. This required an API for access to the dsync commands, which I proposed to the Dovecot developers in https://github.com/dovecot/core/pull/249 . Unfortunately, my pull request was rejected, though I can understand the reasons for that. Without the required API, I had to switch to another approach: I forked the dsync code from doveadm to provide a new set of commands: "repl" and "repl-server". These commands work similar to "sync" and "dsync-server" but use additional functions required by the replication feature. This approach was released as version 0.3 of the plugin. With version 0.4 I renamed the project to wormhole. Before that it was just called dovecot-replication (see https://codeberg.org/errror/dovecot-replication) I thought that the project should have a more unique name. Currently I'm working on designing a test suite for wormhole. Doing unit tests of the components is not sufficient IMHO. The test suite should check the whole replication feature using two running dovecot instances that replicate the users' mailboxes. Having a sophisticated test suite will help in future development and bug tracking. The code can be found on my codeberg site at: https://codeberg.org/errror/wormhole There is also a web page on my personal homepage at: https://people.mpi-klsb.mpg.de/~pcernko/wormhole.shtml The project is still missing documentation. For the moment, configuration is similar to the existing Dovecot 2.3 documentation. Upgrading from 2.3: When using the included patch for Dovecot, the plugin should be 100% compatible with existing Dovecot 2.3 servers. This compatibility should allow uninterrupted upgrades of the service by replacing Dovecot on one server and then the other one. After the upgrade, the plugin can be reconfigured to work without the patch for Dovecot. Upgrading without the patch is also possible. During the upgrade (aka "while one server still runs 2.3") some aspects of the replication will not work or lack performance. Upgrading is not yet tested very well and missing documentation also. I will work on that soon. I hope to get some feedback, pull requests or bug reports via mail or at codeberg (preferred). -- Patrick Cernko <pcernko(a)mpi-klsb.mpg.de> +49 681 9325 5815 Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Softwaresysteme

4 4

New Backup Issue
by Doug Hardie 11 Jun '26

11 Jun '26

I have dovecot using maildir storage on the mail machine. I have an external drive directly connected to use a backup for the mailboxes. Doveadm backup works perfectly for this setup. I also have two external backup servers. Backup to those tends to fail with a variety of errors. I deleted the Maildir directory on the backup servers and created the original backups with doveadm backup. No issues were reported. However, the next backup generates errors: dsync-remote(jeanne)<HV6JE+i/KWo0NwAAq6l46g>: Warning: Deleting mailbox 'INBOX': UID=11166 GUID=1712570780.M604032P10319.mail,S=99689,W=101000 is missing locally dsync-remote(jeanne)<HV6JE+i/KWo0NwAAq6l46g>: Error: Couldn't delete mailbox INBOX: INBOX can't be deleted. dsync-local(jeanne)<HqU9Aei/KWoBMAAAZU03Dg>: Error: Remote command returned error 65: ssh sermons doveadm dsync-server -ujeanne -U dsync-remote(beneke)<eARRAem/KWpdNwAAq6l46g>: Warning: Deleting mailbox 'INBOX': UID=232 GUID=1641564460.M859673P8687.mail,S=5917,W=6035 is missing locally dsync-remote(beneke)<eARRAem/KWpdNwAAq6l46g>: Error: Couldn't delete mailbox INBOX: INBOX can't be deleted. dsync-local(beneke)<mw5bM+i/KWoJMAAAZU03Dg>: Error: Remote command returned error 65: ssh sermons doveadm dsync-server -ubeneke -U dsync-remote(doug)<6gmSJ+m/KWp7NwAAq6l46g>: Warning: Deleting mailbox 'INBOX': UID=92440 GUID=1465118975.V4eI7cfa32M232845.mail is missing locally dsync-remote(doug)<6gmSJ+m/KWp7NwAAq6l46g>: Error: Couldn't delete mailbox INBOX: INBOX can't be deleted. dsync-local(doug)<hwsCH+m/KWoNMAAAZU03Dg>: Error: Remote command returned error 65: ssh sermons doveadm dsync-server -udoug -U There is always one error per user, but they are different between the two backup machine. With the first error, I found the message 1712570780.M604032P10319.mail,S=99689,W=101000 in the mail server cur directory and deleted it. That messge did not exist in the backup server. I ran backup again and no issues. However, the next backup produced the following error: dsync-remote(jeanne)<dNWXGZbUKWoaOgAAq6l46g>: Warning: Deleting mailbox 'INBOX': UID=11167 GUID=1712574432.M425061P11306.mail,S=45149,W=45775 is missing locally dsync-remote(jeanne)<dNWXGZbUKWoaOgAAq6l46g>: Error: Couldn't delete mailbox INBOX: INBOX can't be deleted. dsync-local(jeanne)<Jg3tCZbUKWp5NQAAZU03Dg>: Error: Remote command returned error 65: ssh sermons doveadm dsync-server -ujeanne -U That message is in the cur directory on the mail server. It is not in the backup server. I don't understand the message that those files are missing locally (primary mail server I presume) when they are actually there and missing on the remote server. I don't know why they didn't get copied originally. The first email was recieved on Mon, 8 Apr 2024 so it can't be a timming issue. -- Doug

2 1

Replication performance question and environment variables sanitization
by Jesus Cea 10 Jun '26

10 Jun '26

Hi, there. I am using dovecot 2.3.21.1. I am experimenting with replication, currently doing it manually, using this: doveadm -Dv sync -u jcea ssh email doveadm dsync-server -u prueba_backup; echo $? It works fine so far, but I have a few hundreds of mailboxes in my imap4 account and an "empty" (no changes) sync takes 30 seconds, since apparently it compare every mailbox (according to the debug info printed). I am using "mdbox" storage in both sides. I would expect an event replication, where time is proportional to the volume of changes, not to the total data volume or number of mailboxes. Am I doing anything wrong?. It would be faster to use "replicator" + "mail_replica". Can I improve this in some way? Replication must be both ways, because in one server new emails are arriving and in the other imapserver I am doing my mail work. I want new email appearing in my work imapserver (living my own laptop) and my email processing to be replicated back to the server for backup/disaster recovery (lost laptop, broken HD) and access from a different laptop, phone, etc. Thanks. PS: By default dovecot sanitizes the environment and doesn't allow "SSH_AUTH_SOCK" for ssh-agent. Why?. That is very inconvenient. I am using this environment variable to overcome that: DOVECOT_PRESERVE_ENVS="HOME USER SSH_AUTH_SOCK SSH_AGENT_PID LOG_STDERR_TIMESTAMP TZ CORE_OUTOFMEM CORE_ERROR" Is this the right way to do this? -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - https://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz

2 3

crash in sieve-filter with 2.4.4
by Noah Meyerhans 09 Jun '26

09 Jun '26

Forwarded from https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1139275 A certain poison pill message seems to crash sieve-filter. A reproducer script, email message, and sieve script are at https://salsa.debian.org/noahm/dovecot/-/tree/sieve-crash/debian/tests/siev… The problem is not reproducible with 2.4.1, so it seems to be a regression introduced since then. Coredump details follow: root@dovecot-test:/home/noahm/dovecot# coredumpctl info | cat PID: 110911 (sieve-filter) TID: 110911 (sieve-filter) UID: 65534 (nobody) GID: 65534 (nogroup) Signal: 6 (ABRT) Timestamp: Mon 2026-06-08 19:16:37 UTC (29s ago) Command Line: sieve-filter -u dep8 -e -W -D -C -v /srv/dovecot-dep8/test.sieve INBOX Executable: /usr/bin/sieve-filter Control Group: /user.slice/user-1000.slice/session-5.scope Unit: session-5.scope Slice: user-1000.slice Session: 5 Owner UID: 1000 (noahm) Boot ID: 46469969e01043559d913ef8ab625856 Machine ID: a497a098bd094c1c8f7c8ed02aa21853 Hostname: dovecot-test Storage: /var/lib/systemd/coredump/core.sieve-filter.65534.46469969e01043559d913ef8ab625856.110911.1780946197000000.zst (present) Size on Disk: 253.5K Message: Process 110911 (sieve-filter) of user 65534 dumped core. Module libgcc_s.so.1 from deb gcc-16-16.1.0-1.amd64 Module libstdc++.so.6 from deb gcc-16-16.1.0-1.amd64 Stack trace of thread 110911: #0 0x00007fe06b09fcfc n/a (libc.so.6 + 0x97cfc) #1 0x00007fe06b048d02 raise (libc.so.6 + 0x40d02) #2 0x00007fe06b0304b2 abort (libc.so.6 + 0x284b2) #3 0x00007fe06b26ed45 n/a (libdovecot.so.0 + 0x6ed45) #4 0x00007fe06b357597 default_fatal_handler (libdovecot.so.0 + 0x157597) #5 0x00007fe06b26ec72 i_panic (libdovecot.so.0 + 0x6ec72) #6 0x00007fe06b273b90 n/a (libdovecot.so.0 + 0x73b90) #7 0x00007fe06b3498fb n/a (libdovecot.so.0 + 0x1498fb) #8 0x00007fe06b34a784 n/a (libdovecot.so.0 + 0x14a784) #9 0x00007fe06b34a93b buffer_append (libdovecot.so.0 + 0x14a93b) #10 0x00007fe06b344cc6 dregex_code_match_groups (libdovecot.so.0 + 0x144cc6) #11 0x00007fe06b806a27 n/a (libdovecot-sieve.so.0 + 0x6da27) #12 0x00007fe06b806cd0 n/a (libdovecot-sieve.so.0 + 0x6dcd0) #13 0x00007fe06b7ee411 sieve_match_value (libdovecot-sieve.so.0 + 0x55411) #14 0x00007fe06b7ee711 sieve_match (libdovecot-sieve.so.0 + 0x55711) #15 0x00007fe06b7f5862 n/a (libdovecot-sieve.so.0 + 0x5c862) #16 0x00007fe06b7eccde sieve_interpreter_continue (libdovecot-sieve.so.0 + 0x53cde) #17 0x00007fe06b7fbfbe sieve_execute (libdovecot-sieve.so.0 + 0x62fbe) #18 0x00005638c0022fcf main (sieve-filter + 0x3fcf) #19 0x00007fe06b031f77 n/a (libc.so.6 + 0x29f77) #20 0x00007fe06b032027 __libc_start_main (libc.so.6 + 0x2a027) #21 0x00005638c0023791 _start (sieve-filter + 0x4791) ELF object binary architecture: AMD x86-64

1 0

dovecot 2.4 and Outlook
by Jochen Bern 08 Jun '26

08 Jun '26

Since I don't remember seeing *this* mentioned here so far, but *do* remember people asking about Outlook-dovecot compatibility issues every now and then, here's a potential cause for seeing more of those in the immediate future: https://fedoramagazine.org/fedora-43-upgrade-revealed-20-years-old-outlook-… Kind regards, -- Jochen Bern Systemingenieur Binect GmbH

2 3

Using 2 LDAP sources for passdb
by Tom 04 Jun '26

04 Jun '26

I can't seem to find documentation that shows how to set up 2 LDAP passdb blocks. I can get each of them working properly, but only the second of the two works at any given time. I can't figure out the syntax needed to get both to work, even though I've been all over the Dovecot 2.4x official documentation. The docs seem to suggest settings that the server rejects. Anyone have any experience doing this, or know the correct syntax? Thanks in advance! passdb ldap { # works when standalone; fails when combined with 2nd block below #passdb_name = ldap1 #driver = ldap ldap_version = 3 bind = yes bind_userdn = %{user|username} ldap_auth_dn = cn=dovecot,ou=apps,dc=example,dc=com ldap_auth_dn_password = D0vec0t ldap_base = ou=apps,dc=foscore,dc=com ldap_uris = ldapi://%2Frun%2Fldapi filter = (&(objectClass=applicationProcess)(cn=%{user})) passdb_ldap_bind = yes passdb_ldap_bind_userdn = cn=%{user},ou=apps,dc=example,dc=com result_success = return-ok } passdb ldap { #driver = ldap #name = ldap_users ldap_version = 3 bind = yes bind_userdn = %{user|username} ldap_auth_dn = cn=dovecot,ou=apps,dc=example,dc=com ldap_auth_dn_password = D0vec0t ldap_base = ou=people,dc=example,dc=com ldap_uris = ldapi://%2Frun%2Fldapi filter = (&(objectClass=posixAccount)(uid=%{user|username})(memberOf=cn=mail,ou=%{user|domain},ou=groups,dc=example,dc=com)) passdb_ldap_bind = yes passdb_ldap_bind_userdn = uid=%{user|username},ou=people,dc=example,dc=com result_success = return-ok }

2 7