- dovecot - dovecot.org

The SORT extension in 2.4.4 over imapc never returns any UIDs
by inaugurator＠ya.ru 29 Jun '26

29 Jun '26

Hi guys! This is really annoying. On the command to dovecot over imapc from another one: "UID SEARCH ALL" I get my UIDs: "* SEARCH 1 2 3 4" But when sending: "UID SORT (REVERSE ARRIVAL) US-ASCII NOT DELETED" I get literally nothing: "* SORT" Sorry, but this is a bug. Thank you!

3 7

sieve-test (Pigeonhole) on Ubuntu: PCRE support and address test restrictions on Return-Path
by michael.merz＠wtnet.de 29 Jun '26

29 Jun '26

Hello, I've been evaluating sieve-test (Pigeonhole, dovecot-sieve package, version 2.3.21, as shipped with Ubuntu 24.04 LTS) as an offline testing tool for a personal Sieve ruleset that currently runs on a Cyrus IMAPd/CMU Sieve 3.0 backend. I'd like to ask for some clarification on two points, in case I'm missing a configuration option. 1) PCRE support My ruleset makes extensive use of the `(?i)` inline case-insensitivity flag within :regex tests, which is valid under PCRE (as used by Cyrus). When running sieve-test, I get: error: invalid regular expression '(?i)...' for regex match: invalid preceding regular expression. Checking `dovecot --build-options` shows no PCRE entry, which suggests the Ubuntu-packaged binary was compiled without --with-pcre and falls back to POSIX extended regex. Question: Is PCRE support in Pigeonhole's regex extension purely a compile-time decision (i.e. something that would need to be addressed at the distribution packaging level, not via runtime configuration), or is there a runtime way to enable PCRE matching that I might have missed (e.g. via -o, sieve_extensions, or similar)? 2) Return-Path in the `address` test Several of my rules use: address :domain :is "return-path" "..." Cyrus accepts this. Pigeonhole's sieve-test rejects it with: error: specified header 'return-path' is not allowed for the address test. I understand this is likely an RFC 5228 strictness difference (Cyrus being more permissive than the RFC requires). Is there a recommended alternative within Sieve itself to achieve the same effect (testing the address portion of Return-Path) while staying within what Pigeonhole accepts - e.g. via the `header` test combined with some address-parsing approach, or via the envelope test instead? For context: I'm not running a Dovecot mail server myself. I'm using sieve-test purely as an offline syntax/behaviour verification tool before deploying ruleset changes to a separate Cyrus-based production system. I understand this is a bit of an unusual use case, so any guidance on whether Pigeonhole is well suited for this kind of cross-implementation testing at all would also be appreciated. Thank you for your time and for maintaining Pigeonhole. Best regards, Michael Merz Hello, I've been evaluating sieve-test (Pigeonhole, dovecot-sieve package, version 2.3.21, as shipped with Ubuntu 24.04 LTS) as an offline testing tool for a personal Sieve ruleset that currently runs on a Cyrus IMAPd/CMU Sieve 3.0 backend. I'd like to ask for some clarification on two points, in case I'm missing a configuration option. 1) PCRE support My ruleset makes extensive use of the `(?i)` inline case-insensitivity flag within :regex tests, which is valid under PCRE (as used by Cyrus). When running sieve-test, I get: error: invalid regular expression '(?i)...' for regex match: invalid preceding regular expression. Checking `dovecot --build-options` shows no PCRE entry, which suggests the Ubuntu-packaged binary was compiled without --with-pcre and falls back to POSIX extended regex. Question: Is PCRE support in Pigeonhole's regex extension purely a compile-time decision (i.e. something that would need to be addressed at the distribution packaging level, not via runtime configuration), or is there a runtime way to enable PCRE matching that I might have missed (e.g. via -o, sieve_extensions, or similar)? 2) Return-Path in the `address` test Several of my rules use: address :domain :is "return-path" "..." Cyrus accepts this. Pigeonhole's sieve-test rejects it with: error: specified header 'return-path' is not allowed for the address test. I understand this is likely an RFC 5228 strictness difference (Cyrus being more permissive than the RFC requires). Is there a recommended alternative within Sieve itself to achieve the same effect (testing the address portion of Return-Path) while staying within what Pigeonhole accepts -- e.g. via the `header` test combined with some address-parsing approach, or via the envelope test instead? For context: I'm not running a Dovecot mail server myself. I'm using sieve-test purely as an offline syntax/behaviour verification tool before deploying ruleset changes to a separate Cyrus-based production system. I understand this is a bit of an unusual use case, so any guidance on whether Pigeonhole is well suited for this kind of cross-implementation testing at all would also be appreciated. Thank you for your time and for maintaining Pigeonhole. Best regards, Michael Merz

1 0

dsync does not like sieve
by Stéphane Veyret 27 Jun '26

27 Jun '26

Hi, I’m using Dovecot for many years. My installation is configured to manage spam using sieve. In the same time, I have a backup server, connecting to the main server every night in order to backup emails (note that the main server is not pushing its data, but the backup server is pulling them). Dovecot v2.4 made me re-write the configuration files, so maybe I missed something, but since then, I cannot make both these service work in the same time. With my current configuration, the backup server is terminating in error with the following logs: dsync-remote(example(a)example.com)<HbkSGoKQG2o8+gEAGKlOPA>: Error: brain S: Exporting mailbox INBOX failed: Mailbox attribute iteration failed: Internal error occurred. Refer to server log for more information. [2026-05-31 03:36:03] (and there are no more logs anywhere). Because this message <https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/MGCGR…> was suggesting there could be a problem with sieve, I tried to modify the configuration. And indeed, when changing sieve configuration, the backup is working again. But then, my spam filter isn’t anymore. Here are the relevant parts of the configuration for managing sieve. Can someone help me saying what could be wrong? protocols { sieve = yes imap = yes lmtp = yes } sieve_extensions { fileinto = yes reject = yes envelope = yes encoded-character = yes vacation = yes subaddress = yes comparator-i;ascii-numeric = yes relational = yes regex = yes imap4flags = yes copy = yes include = yes body = yes variables = yes enotify = yes environment = yes mailbox = yes date = yes index = yes ihave = yes duplicate = yes mime = yes foreverypart = yes extracttext = yes vnd.dovecot.pipe = yes vnd.dovecot.environment = yes } sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_pipe_socket_dir = sieve-pipe sieve_plugins { sieve_imapsieve = yes sieve_extprograms = yes } service managesieve-login { inet_listener sieve { port = 4190 } } sieve_script personal { } sieve_script default { path = /etc/dovecot/sieve/spam.sieve } protocol imap { mail_plugins { acl = yes quota = yes imap_acl = yes imap_quota = yes imap_sieve = yes } } protocol lmtp { mail_plugins { acl = yes quota = yes sieve = yes } } namespace user { inbox = yes prefix = separator = / type = private mailbox * { sieve_script reportspam { cause = flag path = /etc/dovecot/sieve/report-spam.sieve type = before } } } Thank you. Stéphane -- Bien cordialement, / Plej kore, Stéphane Veyret Hi, I'm using Dovecot for many years. My installation is configured to manage spam using sieve. In the same time, I have a backup server, connecting to the main server every night in order to backup emails (note that the main server is not pushing its data, but the backup server is pulling them). Dovecot v2.4 made me re-write the configuration files, so maybe I missed something, but since then, I cannot make both these service work in the same time. With my current configuration, the backup server is terminating in error with the following logs: dsync-remote([1]example(a)example.com)<HbkSGoKQG2o8+gEAGKlOPA>: Error: brain S: Exporting mailbox INBOX failed: Mailbox attribute iteration failed: Internal error occurred. Refer to server log for more information. [2026-05-31 03:36:03] (and there are no more logs anywhere). Because [2]this message was suggesting there could be a problem with sieve, I tried to modify the configuration. And indeed, when changing sieve configuration, the backup is working again. But then, my spam filter isn't anymore. Here are the relevant parts of the configuration for managing sieve. Can someone help me saying what could be wrong? protocols { sieve = yes imap = yes lmtp = yes } sieve_extensions { fileinto = yes reject = yes envelope = yes encoded-character = yes vacation = yes subaddress = yes comparator-i;ascii-numeric = yes relational = yes regex = yes imap4flags = yes copy = yes include = yes body = yes variables = yes enotify = yes environment = yes mailbox = yes date = yes index = yes ihave = yes duplicate = yes mime = yes foreverypart = yes extracttext = yes vnd.dovecot.pipe = yes vnd.dovecot.environment = yes } sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_pipe_socket_dir = sieve-pipe sieve_plugins { sieve_imapsieve = yes sieve_extprograms = yes } service managesieve-login { inet_listener sieve { port = 4190 } } sieve_script personal { } sieve_script default { path = /etc/dovecot/sieve/spam.sieve } protocol imap { mail_plugins { acl = yes quota = yes imap_acl = yes imap_quota = yes imap_sieve = yes } } protocol lmtp { mail_plugins { acl = yes quota = yes sieve = yes } } namespace user { inbox = yes prefix = separator = / type = private mailbox * { sieve_script reportspam { cause = flag path = /etc/dovecot/sieve/report-spam.sieve type = before } } } Thank you. Stephane -- Bien cordialement, / Plej kore, Stephane Veyret References Visible links 1. mailto:example@example.com 2. https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/MGCGR…

3 2

How to use two databases in two passdb sections
by Евгений 26 Jun '26

26 Jun '26

Hello everyone! In version 2.3.21, I used two databases where each passdb queried its own database. After upgrading to 2.4.4, I cannot figure out how to restore this functionality. Is it no longer possible to use two databases in a single configuration after upgrade? Thank you for the best MDA!

3 2

Issues with syncing of shared mailboxes
by fc26wuqa＠studserv.uni-leipzig.de 26 Jun '26

26 Jun '26

Hello, I have a two users, that have a personal mailbox and a shared mailbox. They have access to the same shared mailbox. Today they notified me, that a mail send to the shared mailbox exists for the one user but not the other. The user also notified me, that some mails are not being delivered. I haven't found anything in my log files and the postmaster has also no delivery failures. I relay my mails through another server I don't have access to though. My /etc/aliases only consists of `postmaster: root`. The relay owners said that I should change postfix' main.cf to `double_bounce_sender = postmaster` a while ago. I am also not sure if I am not getting any delivery failure notifications since then, since I don't have a `postmaster` account, but I thought this is not needed since I have the above line in `/etc/aliases`. I also tried forcing a resync of their shared and non-shared inboxes with: `doveadm force-resync -u user(a)emaildomain.com INBOX` as well as `doveadm force-resync -u user(a)emaildomain.com Shared` (as well as with `Shared\*` - I don't know if that makes a difference tbh). Here is the output of `dovecot -n`: https://bin.disroot.org/?4eac9ea90a72ff08#A2dim9VGqHAjjKcggF4ScFWpbGytePZjt… I am kind of lost where to start from here, because any other person I asked told me their mail worked fine ^^. I would highly appreciate some guidance :) Thank you. Best, Lucienne

1 0

[BUG] IMAP hibernation fails on FreeBSD 15.x with "Invalid peer_dev_major value"
by Jordan Ostrev 25 Jun '26

25 Jun '26

Hi, IMAP hibernation compiles and attempts to run on FreeBSD 15.x (tested with Dovecot 2.4.4 and FreeBSD 15.1), but fails at runtime with: plain imap-hibernate: Error: conn unix:imap-hibernate (uid=125): Failed to parse client input: Invalid peer_dev_major value: 18446744073709551615 Jun 24 21:27:08 classic dovecot[36888]: imap-hibernate: Error: conn unix:imap-hibernate (uid=125): Failed to parse client input: Invalid peer_dev_major value: 18446744073709551615 Jun 24 21:27:08 classic dovecot[36888]: imap(jordan(a)ostreff.info)<37120><ExaV/gNVAdt/AAAB>: Error: Couldn't hibernate imap client: /var/run/dovecot/imap-hibernate returned failure: Failed to parse client input: Invalid peer_dev_major value: 18446744073709551615 Root cause: In src/imap/imap-client-hibernate.c, the code serializes peer_dev_major and peer_dev_minor using major() and minor() macros: c str_printfa(cmd, "\tpeer_dev_major=%lu\tpeer_dev_minor=%lu\tpeer_ino=%llu", (unsigned long)major(peer_st.st_dev), (unsigned long)minor(peer_st.st_dev), (unsigned long long)peer_st.st_ino); On FreeBSD, major() and minor() can return UINT64_MAX (18446744073709551615) for file descriptors that are not block/character devices (such as sockets on tmpfs/devfs). This value exceeds UINT_MAX and cannot be parsed by str_to_uint() in imap-master-client.c. Historical context: This was discussed on the Dovecot mailing list in July 2019 (thread: "Hibernation errors") but apparently never resolved upstream. The same failure mode persists in Dovecot 2.4.4. Impact: IMAP hibernation is effectively non-functional on FreeBSD 15.x Processes remain running indefinitely instead of being hibernated Documentation note: The Dovecot 2.4 documentation states that hibernation "is not supported on kqueue based systems currently, such as FreeBSD." However, the code still compiles and attempts to run, producing these errors rather than being disabled at compile time or gracefully skipped at runtime. Would it make sense to either: Disable hibernation at compile time for kqueue systems, or Add validation for major()/minor() return values before serialization? Thanks, Jordan Hi, IMAP hibernation compiles and attempts to run on FreeBSD 15.x (tested with Dovecot 2.4.4 and FreeBSD 15.1), but fails at runtime with: plain imap-hibernate: Error: conn unix:imap-hibernate (uid=125): Failed to parse client input: Invalid peer_dev_major value: 18446744073709551615 Jun 24 21:27:08 classic dovecot[36888]: imap-hibernate: Error: conn unix:imap-hibernate (uid=125): Failed to parse client input: Invalid peer_dev_major value: 18446744073709551615 Jun 24 21:27:08 classic dovecot[36888]: imap(jordan(a)ostreff.info)<37120><ExaV/gNVAdt/AAAB>: Error: Couldn't hibernate imap client: /var/run/dovecot/imap-hibernate returned failure: Failed to parse client input: Invalid peer_dev_major value: 18446744073709551615 Root cause: In src/imap/imap-client-hibernate.c, the code serializes peer_dev_major and peer_dev_minor using major() and minor() macros: c str_printfa(cmd, "\tpeer_dev_major=%lu\tpeer_dev_minor=%lu\tpeer_ino=%llu", (unsigned long)major(peer_st.st_dev), (unsigned long)minor(peer_st.st_dev), (unsigned long long)peer_st.st_ino); On FreeBSD, major() and minor() can return UINT64_MAX (18446744073709551615) for file descriptors that are not block/character devices (such as sockets on tmpfs/devfs). This value exceeds UINT_MAX and cannot be parsed by str_to_uint() in imap-master-client.c. Historical context: This was discussed on the Dovecot mailing list in July 2019 (thread: "Hibernation errors") but apparently never resolved upstream. The same failure mode persists in Dovecot 2.4.4. Impact: o IMAP hibernation is effectively non-functional on FreeBSD 15.x o Processes remain running indefinitely instead of being hibernated Documentation note: The Dovecot 2.4 documentation states that hibernation "is not supported on kqueue based systems currently, such as FreeBSD." However, the code still compiles and attempts to run, producing these errors rather than being disabled at compile time or gracefully skipped at runtime. Would it make sense to either: 1. Disable hibernation at compile time for kqueue systems, or 2. Add validation for major()/minor() return values before serialization? Thanks, Jordan

3 7

Convert sqlite configuration from 2.3 to 2.4
by Horst B Simon 24 Jun '26

24 Jun '26

Hi, I succesful converted all configurations from dovecot 2.3 to 2.4, except for the sqlite configuration. I googled and all configuration are for mysql/mariadb and not for sqlite. The sqlite database is created with postfixadmin and my current configuration for dovecot 2.3 (dovecot-sql.conf.ext) is: driver = sqlite connect = /var/mail/postfixadmin.db default_pass_scheme = DES-CRYPT password_query = \ SELECT username as user, password, '/var/mail/%d/%n' as userdb_home, \ 'maildir:/var/mail/%n' as userdb_mail, 5000 as userdb_uid, 5000 as userdb_gid \ FROM mailbox WHERE username = '%u' AND active = '1' user_query = \ SELECT '/var/mail/%d/%n' as home, 'maildir:/var/mail/%n' as mail, \ 5000 AS uid, 5000 AS gid, printf('dirsize:storage=', quota) AS quota \ FROM mailbox WHERE username = '%u' AND active = '1' I tried the only converter, but it didn’t do any conversion. Any help appreciated. Thanks and Regards, Horst Hi, I succesful converted all configurations from dovecot 2.3 to 2.4, except for the sqlite configuration. I googled and all configuration are for mysql/mariadb and not for sqlite. The sqlite database is created with postfixadmin and my current configuration for dovecot 2.3 (dovecot-sql.conf.ext) is: driver = sqlite connect = /var/mail/postfixadmin.db default_pass_scheme = DES-CRYPT password_query = \ SELECT username as user, password, '/var/mail/%d/%n' as userdb_home, \ 'maildir:/var/mail/%n' as userdb_mail, 5000 as userdb_uid, 5000 as userdb_gid \ FROM mailbox WHERE username = '%u' AND active = '1' user_query = \ SELECT '/var/mail/%d/%n' as home, 'maildir:/var/mail/%n' as mail, \ 5000 AS uid, 5000 AS gid, printf('dirsize:storage=', quota) AS quota \ FROM mailbox WHERE username = '%u' AND active = '1' I tried the only converter, but it didn't do any conversion. Any help appreciated. Thanks and Regards, Horst

2 2

Incomplete Dovecot Log Entries
by Bryan Simmons 19 Jun '26

19 Jun '26

There are hundreds of dovecot “Disconnected: Connection closed” messages in the log file that do not have a corresponding connect record. Is this normal or are there configuration options that need to be modified? Note the user accounts listed, and other similar records, do not exist on this server. 2026-06-14T02:11:48.843517-04:00 mail dovecot: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<rantanplan_admin(a)nanomail.net>, method=PLAIN, rip=190.181.120.152, lip=10.0.1.211, TLS, session=<T8xvlDBUnNC+tXiY> 2026-06-14T02:12:16.614611-04:00 mail dovecot: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<rantanplan_admin>, method=PLAIN, rip=41.139.10.25, lip=10.0.1.211, TLS, session=<cvoGljBUS+YpiwoZ> 2026-06-14T03:23:55.523146-04:00 mail dovecot: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<rantanplan.info(a)nanomail.net>, method=PLAIN, rip=103.69.9.148, lip=10.0.1.211, TLS, session=<SOBYljFUlsdnRQmU> Thanks, Bryan

1 0

Lazy-Expunge plugin documentation incomplete?
by Randolf Richardson 17 Jun '26

17 Jun '26

One of the Dovecot repository maintainers on GitHub recommended sending an eMail to you regarding the issue I encountered: Documentation for lazy-expunge doesn't work https://github.com/dovecot/documentation/issues/1555 -------- I converted from Dovecot 2.3 to Dovecot 2.4.1, which was not a minor upgrade. Anyway, I can't get the lazy-expunge plugin to work in 2.4.1 now. Here's my configuration file from 2.3 -- how can I get this working in 2.4.1? Thanks. namespace inbox { mailbox EXPUNGED { autoexpunge = 32days autoexpunge_max_mails = 100000 #auto = create } } # Namespace for lazy_expunge plugin namespace { prefix = EXPUNGED/ hidden = yes list = no subscriptions = no separator = / location = maildir:~/Maildir.deleted:INDEX= } mail_plugins = $mail_plugins lazy_expunge acl plugin { # Move expunged messages into the .EXPUNGED namespace lazy_expunge = EXPUNGED/ # Only move to expunged storage if this is the last copy of the message in the user´s account lazy_expunge_only_last_instance = yes # Exclude Drafts from lazy expunging lazy_expunge_exclude = \Drafts # Copy of each message is done with hard links whenever possible maildir_copy_with_hardlinks = yes # Define ACL so that user cannot list the .EXPUNGED mailbox # Example entry: .EXPUNGED owner rwstipekxa acl = vfile:/etc/dovecot/dovecot.acl # dovecot.acl contains one line: EXPUNGED owner ip # Expunged messages most likely don't want to be included in quota: quota_rule = EXPUNGED:ignore } #lazy_expunge_mailbox = EXPUNGED Here's an example of someone else who encountered the same problem: https://www.dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thr ead/25BXSHQWGQQ3ACVZSYF3O3LC4WROTUCI/ Randolf Richardson, CNA - randolf(a)inter-corporate.com Inter-Corporate Computer & Network Services, Inc. Beautiful British Columbia, Canada https://www.inter-corporate.com/

2 2

Announcing nauthilus-director: a Nauthilus-backed mail protocol director
by Christian Rößner 17 Jun '26

17 Jun '26

Hi, I would like to announce `nauthilus-director` for the first time on this list. `nauthilus-director` is an open-source mail protocol director and transparent proxy for Nauthilus-backed mail deployments. It sits in front of stateful mail backends, authenticates frontend sessions through Nauthilus, resolves routing and placement inside the director, selects healthy backend services, keeps active user affinity in Redis, and then proxies the established connection to the selected backend. The current focus is on deployments where backend placement, maintenance, drains, user movement and session affinity need to be explicit, observable and controllable. The director is not a mailbox server and not a general-purpose load balancer; it owns the narrow director responsibilities between clients, Nauthilus and backend mail services. Current capabilities include: - IMAP/IMAPS, POP3/POP3S, LMTP/LMTPS and ManageSieve proxying - Nauthilus-backed authentication over HTTP or gRPC - director-owned routing and backend selection - Redis-backed session affinity and runtime coordination - backend health, maintenance, runtime drains and placement overrides - an OpenAPI-based REST control API and `nauthilus-directorctl` - metrics, structured logging and OpenTelemetry tracing The demo stack includes Dovecot backend shards and exercises real IMAP, LMTP, POP3 and ManageSieve paths, so feedback from Dovecot operators would be especially useful. Related to this, Nauthilus itself has recently been released as version 3.0.0. Nauthilus is the central authentication and policy engine in this setup: it provides centralized authentication and identity handling for mail and web workloads, LDAP-backed or Lua-driven policy decisions, OIDC/SAML IdP functionality, MFA support, and Redis-backed state handling. In the director architecture, Nauthilus remains the authentication and policy authority, while `nauthilus-director` owns concrete backend placement and proxy lifecycle decisions. Project links: - nauthilus-director: https://github.com/croessner/nauthilus-director - Nauthilus: https://github.com/croessner/nauthilus - Documentation / website: https://nauthilus.org The director is still young, so I would be interested in feedback from people running Dovecot-backed infrastructures, especially around operational workflows, backend maintenance, migration scenarios and protocol behavior. The director is still in beta. Best regards, Christian Rößner -- Rößner-Network-Solutions Zertifizierter ITSiBe / CISO Marburger Str. 70a, 36304 Alsfeld Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5 Hi, I would like to announce `nauthilus-director` for the first time on this list. `nauthilus-director` is an open-source mail protocol director and transparent proxy for Nauthilus-backed mail deployments. It sits in front of stateful mail backends, authenticates frontend sessions through Nauthilus, resolves routing and placement inside the director, selects healthy backend services, keeps active user affinity in Redis, and then proxies the established connection to the selected backend. The current focus is on deployments where backend placement, maintenance, drains, user movement and session affinity need to be explicit, observable and controllable. The director is not a mailbox server and not a general-purpose load balancer; it owns the narrow director responsibilities between clients, Nauthilus and backend mail services. Current capabilities include: - IMAP/IMAPS, POP3/POP3S, LMTP/LMTPS and ManageSieve proxying - Nauthilus-backed authentication over HTTP or gRPC - director-owned routing and backend selection - Redis-backed session affinity and runtime coordination - backend health, maintenance, runtime drains and placement overrides - an OpenAPI-based REST control API and `nauthilus-directorctl` - metrics, structured logging and OpenTelemetry tracing The demo stack includes Dovecot backend shards and exercises real IMAP, LMTP, POP3 and ManageSieve paths, so feedback from Dovecot operators would be especially useful. Related to this, Nauthilus itself has recently been released as version 3.0.0. Nauthilus is the central authentication and policy engine in this setup: it provides centralized authentication and identity handling for mail and web workloads, LDAP-backed or Lua-driven policy decisions, OIDC/SAML IdP functionality, MFA support, and Redis-backed state handling. In the director architecture, Nauthilus remains the authentication and policy authority, while `nauthilus-director` owns concrete backend placement and proxy lifecycle decisions. Project links: - nauthilus-director: https://github.com/croessner/nauthilus-director - Nauthilus: https://github.com/croessner/nauthilus - Documentation / website: https://nauthilus.org The director is still young, so I would be interested in feedback from people running Dovecot-backed infrastructures, especially around operational workflows, backend maintenance, migration scenarios and protocol behavior. The director is still in beta. Best regards, Christian Roessner -- Roessner-Network-Solutions Zertifizierter ITSiBe / CISO Marburger Str. 70a, 36304 Alsfeld Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5

3 3