- dovecot - dovecot.org

Configuring for System and Virtual Users
by Mark Olbert 10 Oct '26

10 Oct '26

Hi! I am trying to configure postfix and dovecot 2.4.1 under Debian Trixie to handle both system and virtual users. Some of my virtual users have the same username part as system users (e.g., system account 'mark' and virtual user 'mark(a)jumpforjoysoftware.com'). I've been struggling with getting help from Claude Code and Gemini Pro for several days now, and still can't get everything working. From watching the logs, the problem appears to stem from the username part not being extracted from the FQ user before mail is handled off to lmtp for final delivery. Here are what I believe are the relevant sections of my dovecot.conf: # overall default, need to handle system accounts as exceptions auth_username_format = %{user | lower} # virtual users specified first so search will end when they are found passdb passwd-file { passwd_file_path = /etc/dovecot/passwd } userdb passwd-file { passwd_file_path = /etc/dovecot/passwd userdb_fields { uid = 5000 gid = 5000 home = /var/mail/vhosts/%{user | domain | lower }/%{user | username | lower } mail_driver = maildir mail_path = ~/Maildir } } # system users passdb pam { # apparently, this next line gets ignored auth_username_format = %{user | username | lower} service_name = dovecot } userdb passwd { # or maybe this line does auth_username_format = %{user | username | lower} userdb_fields { home = /home/%{user} mail_driver = maildir mail_path = ~/Maildir } } protocol lmtp { auth_username_format = %{user | username | lower} } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { mode = 0660 user = postfix group = postfix } } # not sure this is part of the problem, but... service auth { unix_listener /var/spool/postfix/private/auth { mode = 0660 user = postfix group = postfix } } I believe the relevant sections of my postfix main.cf file are: myhostname = mail.theboilingfrog.net mydomain = theboilingfrog.net myorigin = $mydomain mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain mailbox_transport = lmtp:unix:private/dovecot-lmtp virtual_transport = lmtp:unix:private/dovecot-lmtp My system hostname is theboilingfrog.net. This configuration fails to recognize mark@theboilingfrog.net...which is why I think the passdb pam block is ignoring the auth_username_format directive which should strip out the username portion. Claude Code finally got around to suggesting I cut dovecot out of the loop for delivery of emails to system users. I guess I could do that, but I'd love to know if it's possible to keep dovecot engaged with delivering system user emails and have it work property. Another thing is I could update all my email clients to use 'mark' rather than 'mark(a)theboilingfrog.net' to access their email. But, again, I'm curious if there's a way to configure things so I don't have to do that. If it turns out what I'm trying to do is not supported, please let me know. - Mark -

2 1

LMTP: advertise DSN so MTAs send ORCPT (it is already honoured)
by Dhaval Patel 09 Oct '26

09 Oct '26

Hello, When moving from dovecot-lda (deliver -a ${original_recipient}) to LMTP, the original envelope recipient is lost, even though Dovecot's LMTP already supports it. Setup - Dovecot 2.4.1-4 (Debian 13, 1:2.4.1+dfsg1-6+deb13u7), Pigeonhole sieve. - Postfix delivering with virtual_transport = lmtp:unix:private/dovecot-lmtp. - Aliases such as postmaster(a)example.com are expanded by Postfix to a real mailbox (user(a)example.com) before delivery. What happens 1. Dovecot's LHLO reply advertises 8BITMIME, CHUNKING, ENHANCEDSTATUSCODES, PIPELINING, STARTTLS, but not DSN. 2. Postfix only sends the ORCPT parameter (RFC 3461) to servers that advertise DSN, so it sends RCPT TO:<user(a)example.com> with no ORCPT. 3. Sieve's envelope "to" therefore sees only the final address. A rule that worked under dovecot-lda with -a stops matching: if envelope :localpart :is "to" "postmaster" { ... } But ORCPT is honoured when sent. Talking to the LMTP socket by hand: LHLO test MAIL FROM:<user(a)example.com> RCPT TO:<user(a)example.com> ORCPT=rfc822;postmaster(a)example.com DATA ... The message is accepted, and the sieve rule above matches, so the original recipient reaches sieve. The same message without ORCPT does not match. Request. Could LMTP advertise DSN in its LHLO reply, either always or behind a setting? Since ORCPT is already parsed and used, this looks like a small change, and MTAs would then pass the original recipient. That would make LMTP equivalent to deliver -a for sieve envelope tests, and presumably for lmtp_hdr_delivery_address = original. If there's an existing way to get this that I've missed, I'd be glad to hear it. Thanks, Dhaval Patel

1 0

Re: Dovecot 2.4.5 on macOS 27 ARM64: post-authentication IMAP connection closes
by George 05 Oct '26

05 Oct '26

Hello, I am comparing Dovecot 2.3.21.1 and 2.4.5 on the same arm64 macOS host. Apple Mail and Thunderbird work normally with 2.3.21.1, but both fail at the same post-authentication boundary with 2.4.5. The comparison keeps the client, mailbox data, TLS certificate, CRAM-MD5 credentials, public-IP/hairpin path, and base_dir=/var/run/dovecot the same. Only one Dovecot version is running at a time. With 2.4.5: - TLS and CRAM-MD5 succeed. - SQL passdb and static userdb succeed. - imap-login reports "Logged in". - The authenticated imap process loads its plugins, assumes uid/gid 350, and resolves the expected namespace and Maildir. - It then reports: Disconnected: Connection closed (No commands sent) in=0 out=502 Two Apple Mail attempts repeat the same result. There is no panic, fatal error, signal, or explicit anvil error in the captured interval. The /proc/self/stat and /proc/self/io debug messages also occur with the working 2.3 build on macOS. With 2.3.21.1, the same Apple Mail version proceeds immediately to open INBOX, Junk, and Sent, reads headers and complete messages, and logs out normally. Thunderbird likewise completes NAMESPACE, COMPRESS, ID, SELECT, LIST/FETCH, STATUS, and IDLE with 2.3. Under 2.4, its client trace shows NAMESPACE being sent immediately before the socket closes, while the server-side imap process records no command. One process-model difference is: 2.3: service imap { process_limit = 200 client_limit = 5 service_count = 0 } 2.4: service imap { client_limit = 1 } I understand that client_limit=1 is the recommended 2.4 setting, so I am not assuming this is misconfiguration; I mention it because the failure occurs at the post-login process/handoff boundary. The build already includes commit 5100f0fd576d0600c3f8ad7bb056ae08235cab11, so I do not believe the previously reported peer-PID/anvil fix is simply absent. Attached: 1. doveconf-2.4.5-sanitized.txt 2. dovecot-2.4.5-apple-mail-sanitized.txt I have also prepared a short paired 2.3/2.4 excerpt and can provide the complete sanitized Thunderbird client trace if useful. What additional master/anvil/process logging would best identify where the authenticated connection is being lost on macOS?

1 1

SEGV in fts_search_merge_scores_or in 2.4.5
by Patrick Cernko 05 Oct '26

05 Oct '26

Hi Devs, yesterday I had to SEGV from imap processes (2.4.5) which dumped core. The backtraces were similar: > #0 0x00007fdb234556b4 in fts_search_merge_scores_or (dest=0x7ffde96b1720, src=0x7ffde96b1680) at ./src/plugins/fts/fts-search.c:274 > 274 src_map[srci].uid < src2_map[src2i].uid) { > (gdb) bt > #0 0x00007fdb234556b4 in fts_search_merge_scores_or (dest=0x7ffde96b1720, src=0x7ffde96b1680) at ./src/plugins/fts/fts-search.c:274 > #1 fts_search_merge_scores_level (fctx=fctx@entry=0x55ce3f2347d0, args=0x55ce3f2fad10, idx=idx@entry=0x7ffde96b182c, and_args=false, scores=scores@entry=0x7ffde96b1720) > at ./src/plugins/fts/fts-search.c:329 > #2 0x00007fdb234555fa in fts_search_merge_scores_level (fctx=fctx@entry=0x55ce3f2347d0, args=0x55ce3f2fa878, idx=idx@entry=0x7ffde96b182c, and_args=true, scores=scores@entry=0x7ffde96b17c0) > at ./src/plugins/fts/fts-search.c:322 > #3 0x00007fdb234555fa in fts_search_merge_scores_level (fctx=fctx@entry=0x55ce3f2347d0, args=0x55ce3f22d458, idx=idx@entry=0x7ffde96b182c, and_args=and_args@entry=true, > scores=0x55ce3f2ffb68) at ./src/plugins/fts/fts-search.c:322 > #4 0x00007fdb2345b2ee in fts_search_merge_scores (fctx=0x55ce3f2347d0) at ./src/plugins/fts/fts-search.c:337 > #5 fts_search_try_lookup (fctx=0x55ce3f2347d0) at ./src/plugins/fts/fts-search.c:404 > #6 fts_search_lookup (fctx=fctx@entry=0x55ce3f2347d0) at ./src/plugins/fts/fts-search.c:414 > #7 0x00007fdb2345bc25 in fts_mailbox_search_init (t=<optimized out>, args=0x55ce3f22cd28, sort_program=<optimized out>, wanted_fields=0, wanted_headers=<optimized out>) > at ./src/plugins/fts/fts-storage.c:213 > #8 0x00007fdb266b7d99 in mailbox_search_init (t=0x55ce3f322fb0, args=args@entry=0x55ce3f22cd28, sort_program=sort_program@entry=0x0, wanted_fields=wanted_fields@entry=0, > wanted_headers=wanted_headers@entry=0x0) at ../lib-storage/mail-storage.c:2988 > #9 0x000055ce070d746c in imap_search_start (ctx=0x55ce3f1cb568, sargs=0x55ce3f22cd28, sort_program=0x0) at ./src/imap/imap-search.c:538 > #10 0x000055ce070c3702 in cmd_search (cmd=0x55ce3f1cb1a8) at ./src/imap/cmd-search.c:54 > #11 0x000055ce070c8394 in command_exec (cmd=cmd@entry=0x55ce3f1cb1a8) at ./src/imap/imap-commands.c:208 > #12 0x000055ce070cec20 in client_command_input (cmd=<optimized out>, cmd@entry=0x55ce3f1cb1a8) at ./src/imap/imap-client.c:1359 > #13 0x000055ce070cecb6 in client_command_input (cmd=<optimized out>, cmd@entry=0x55ce3f1cb1a8) at ./src/imap/imap-client.c:1429 > #14 0x000055ce070cef4d in client_command_input (cmd=<optimized out>) at ./src/imap/imap-client.c:1393 > #15 0x000055ce070cf135 in client_handle_next_command (client=0x55ce3f1c9788, remove_io_r=<synthetic pointer>) at ./src/imap/imap-client.c:1471 > #16 client_handle_input (client=client@entry=0x55ce3f1c9788) at ./src/imap/imap-client.c:1485 > #17 0x000055ce070cf527 in client_input (client=0x55ce3f1c9788) at ./src/imap/imap-client.c:1529 > #18 0x00007fdb26379cdb in io_loop_call_io (io=0x55ce3f1cb960) at ../lib/ioloop.c:749 > #19 0x00007fdb2637bb1b in io_loop_handler_run_internal (ioloop=ioloop@entry=0x55ce3f19b5c0) at ../lib/ioloop-epoll.c:222 > #20 0x00007fdb2637bbe4 in io_loop_handler_run (ioloop=ioloop@entry=0x55ce3f19b5c0) at ../lib/ioloop.c:803 > #21 0x00007fdb2637bde8 in io_loop_run (ioloop=0x55ce3f19b5c0) at ../lib/ioloop.c:774 > #22 0x00007fdb262c34be in master_service_run (service=0x55ce3f19ad10, callback=callback@entry=0x55ce070d3e30 <client_connected>) at ../lib-master/master-service.c:1280 > #23 0x000055ce070ba036 in main (argc=<optimized out>, argv=<optimized out>) at ./src/imap/main.c:588 in both cases the SEGV was caused by illegal access to `src_map[srci]`: > (gdb) print src_map[srci] > Cannot access memory at address 0x7fdb23091000 I can provide the coredumps to you (but not public) if you are interested. Best, -- Patrick Cernko <errror(a)errror.org>

2 1

Dovecot 2.4.5 on macOS 27 ARM64: post-authentication IMAP connection closes
by list2＠captainnet.net 05 Oct '26

05 Oct '26

I captured Thunderbird’s client-side IMAP protocol log against both Dovecot 2.3.21.1 and 2.4.5 on the same server, account and Maildir. With 2.3.21.1, CRAM-MD5 authentication succeeds and Thunderbird continues normally through NAMESPACE, COMPRESS, ID and SELECT: ```text <CRAM-MD5 exchange removed> OK [CAPABILITY ...] Logged in SendData: 4 namespace * NAMESPACE (("" "/")) NIL NIL 4 OK Namespace completed SendData: 5 COMPRESS DEFLATE 5 OK Begin compression SendData: 6 ID ("name" "Thunderbird" "version" "157.0.1") * ID ("name" "Dovecot" "version" "2.3.21.1") SendData: 7 select "INBOX" * 7 EXISTS 7 OK [READ-WRITE] Select completed ``` With 2.4.5, authentication also succeeds, but the connection closes immediately when Thunderbird sends its first post-authentication command: ```text <CRAM-MD5 exchange removed> OK [CAPABILITY ...] Logged in login succeeded SendData: 62 namespace CreateNewLineFromSocket: clearing IMAP_CONNECTION_IS_OPEN - rv = 80470002 TellThreadToDie: close socket connection CreateNewLineFromSocket: (null) SetConnectionStatus(0x80470002) ``` The same sequence repeats on the second parallel Thunderbird connection and on subsequent retries. Thunderbird receives no IMAP BAD, NO or BYE response. It never reaches ID, SELECT or mailbox discovery with 2.4.5. Commit 5100f0fd576d0600c3f8ad7bb056ae08235cab11 is already present in the source used for this Dovecot 2.4.5 build, so the observed failure occurs with that change included. The Thunderbird timestamps are UTC. The first 2.4 failure occurred at 2026-10-02 15:31:01 UTC, corresponding to 08:31:01 local server time. I can provide a sanitized longer Thunderbird trace and the corresponding Dovecot log interval if that would be useful.

2 1

the 32-bit issue with time offset is back in 2.4.5 was fixed in 2.4.4
by dovecot＠freakout.de 04 Oct '26

04 Oct '26

# Logs are flooded with messages "Warning: Time moved forward" # The function io_loop_get_wait_time in ioloop.c contains the line: # ioloop->next_max_time.tv_sec = (time_t)(((uint64_t)1 << TIME_T_MAX_BITS) - 1); #On 32-bit systems TIME_T_MAX_BITS is 31 such that the result of this calculation is 1073741823. Far from the #intended "infinity" and even before "now". This leads to problems in the function io_loop_handle_timeouts_real: #the calculation of the time difference between now and next_max_time is then something like -693628953 seconds #which confuses dovecot and floods the logs with these warnings: patch -b -p0 <<'EOF' --- src/lib/time-util.c 2026-08-26 12:00:29.000000000 +0200 +++ src/lib/time-util.c 2026-10-02 13:10:39.000000000 +0200 @@ -166,7 +166,7 @@ #else /* compute in uint64_t: with a 32-bit signed time_t TIME_T_MAX_BITS is 31 and (time_t)1 << 31 would overflow */ - return (time_t)(((uint64_t)1 << TIME_T_MAX_BITS) - 1); + return (time_t)(((uint64_t)1 << TIME_T_MAX_BITS-1) - 1); #endif } EOF

1 0

Mailbox doesn't exist
by Simon B 02 Oct '26

02 Oct '26

Hallo, I was preparing the upgrade to 2.4 and I shot myself in the foot. I am on 2.3.19.1, but I think my issue is not version dependent. I had a folder - created using Horde and showing in Horde and Thunderbird as - Auszüge But on the file system I noticed it was .Ausz%C3%BCge Well, my system is UTF8, so I renamed it... Now Horde still displays it as Auszüge, but does not show any emails in that folder. Thunderbird also displays it as Auszüge, and does show the emails, but neither client will put (move/copy) any new email into that folder.... doveadm mailbox list -u simon(a)myserver.net lists it. doveadm -f table mailbox status -u simon(a)myserver.net "messages vsize" Auszüge says doveadm(simon(a)myserver.net): Error: Mailbox Auszüge: Failed to lookup mailbox status: Mailbox doesn't exist: Auszüge doveadm -f table mailbox status -u simon(a)myserver.net "messages vsize" Ausz%C3%BCge says mailbox messages vsize i.e. shows no messages - but does not complain the Mailbox does not exist. How can I rescue this before proceeding with my upgrade? Thanks. Simon

2 2

Assessing an old Dovecot 2.2.13 for migration
by mercurialuser＠gmail.com 01 Oct '26

01 Oct '26

Actual situation: dovecot 2.2.13 on centos 6.5, previously it was a courier server MTA is exim and it used to drop the emails directly in the filesystem in Maildir format, and it still happens for some of the 80(ish) emails. I then moved to a LMTP delivery via Dovecot to use Dovecot compression. Thunderbird is used, and a imap webmail is also available. There is no quota, by design, biggest mailbox is 54 GB with ten over 30GB. By design, one user has all the mailboxes of its dept collegues available in Thunderbird. Users are defined in a test file with this parameter userdb_mail=maildir:/mailboxes/domains/%d/%n/Maildir In the Maildir the folders are in this format (they use . as separator) and some users are like this: .INBOX.00 IMPORTANT but other are without .INBOX: .00 IMPORTANT Probably the ones with .INBOX prefix were already present in Courier. doveconf namespace reports namespace inbox { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = ... (lines removed prefix = separator = subscriptions = yes type = private } To test dovecot tools since some of the emails are "read-only" (can't receive new emails) I tried to move from a Maildir mailbox to a mdbox (also to have a quicker rsync backup) a issued dovecot backup mdbox:/path/to/mdbox/storage that failed with this error message dsync(username): Error: Mail locations must use the same virtual mailbox hierarchy separator (specify separator for the default namespace) So I started to dig into the problem, discovering that some settings were not set (see doveconf output), that there are 2 different "separator" and that I may, presumably, keep them different on a per-user bases using LAYOUT=fs. I also noticed the .INBOX being present and not present. I'm looking for informations on how to proceed to have dovecot backup work without losing the mail on disk and have all the Maildirs share a common standard. I'd like to use dovecot tools, but an option is to creare a new server, create all the accounts, define the accounts in the user Thunderbirds, and do a "move" between the old and new server .... crossing fingers...

1 0

Making AI Feedback Part of a Supervised Writing Process
by harri.evans90＠protonmail.com 30 Sep '26

30 Sep '26

Begin with the Student’s Reasoning When assessing AI assistance in academic writing, I start with the decisions a student must make. A polished essay offers limited evidence of learning if the writer cannot explain its argument, defend its sources, or justify its revisions. My approach therefore places the student’s reasoning at the center of the writing process and evaluates assistance according to whether it strengthens that reasoning. I consider academic writing software most useful when its function is defined within a supervised workflow. When evaluating a resource such as https://essaysbot.com/, I would first consider how its use fits the assignment’s learning objectives and the instructor’s requirements. Artificial intelligence can help a writer examine an outline, identify unclear explanations, and reconsider paragraph structure. Its educational value depends on how the student interprets the feedback and applies it to the assignment. A writing assistant should create opportunities for analysis while keeping intellectual decisions with the student. The following consultation framework uses an illustrative undergraduate sociology essay about remote work and workplace inequality. I use this example to show how an educator can connect digital assistance with planning, research, and independent revision without treating generated language as evidence of understanding. Establish the Task Before Requesting Output I would begin the consultation by reviewing the assignment instructions with the student. Before opening a digital tool, the writer should identify the research question, intended audience, assessment criteria, citation style, word count, and deadline. These details determine the scope of the essay and give automated feedback a relevant context. For the sociology assignment, a broad question about whether remote work is beneficial would need refinement. A more manageable inquiry could examine how access to remote employment affects workers with different caring responsibilities. The student would then develop a provisional thesis statement after reviewing the assigned readings and locating suitable evidence. At this stage, I would ask the student to prepare an outline independently. A language model could subsequently examine whether the proposed sections overlap or whether an important counterargument remains unaddressed. A focused prompt might request questions about the relationship between employment flexibility and promotion opportunities. This preserves an investigative research process because the student must resolve those questions through reading. Course expectations also belong in this initial discussion. I would check the instructor’s requirements for responsible use, disclosure, and permitted assistance before recommending a particular activity. Academic integrity becomes easier to manage when expectations are translated into specific actions within the student workflow. Move from Feedback to Deliberate Revision My preferred revision cycle addresses one substantive concern at a time. Asking a system to improve an entire essay can produce extensive suggestions with unclear priorities. Asking whether each topic sentence advances the central claim gives the student a defined problem and a basis for evaluating the response. Consider a paragraph describing reduced commuting costs. Its information may be relevant, yet its connection to workplace inequality may remain unexplained. Automated feedback could flag that gap. The student must decide whether the paragraph needs additional evidence, a clearer explanation, or removal. Each option requires a different judgment about the argument. I would review the overall reasoning before sentence clarity, editing, and proofreading. A reverse outline can help: the student summarizes the actual purpose of each paragraph in the existing draft, then compares that sequence with the intended argument. Repetition, unsupported claims, and missing transitions become easier to locate when attention shifts from individual sentences to the essay’s organization. To make the feedback loop educational, I would request a brief revision rationale for major changes. The student should explain why a claim was narrowed, a section moved, or a suggestion rejected. This guided practice encourages critical thinking and gives the educator a clearer view of developing writing skills. It also allows feedback to remain useful when the model’s recommendation is inappropriate. Keep Evidence and Attribution Verifiable I separate source quality from fluent expression. A generated draft may present an explanation confidently without establishing that its supporting material is accurate or relevant. I would therefore require the student to verify factual claims against sources they have retrieved and read, including the context and limitations of the original research. In the sociology example, evidence about professional employees in one industry may not support conclusions about all workers. The writer must examine the study population, methods, and publication context before applying its findings. A tool can suggest verification questions, but the student remains responsible for answering them. Citation awareness should begin during note-taking. I recommend distinguishing direct quotations, paraphrases, and independent analysis before drafting. This practice supports originality and plagiarism awareness while preventing attribution problems from accumulating near the deadline. A system may help explain reference formatting or flag passages that appear to require a citation. Nevertheless, I would check each reference against the original publication and the required style guidance. Bibliographic accuracy includes both identifying a real source and confirming that it supports the associated claim. Assess Learning Through the Final Review During the final review, I would compare output quality with the rubric and ask the student to explain the essay’s reasoning in their own words. The conclusion should answer the research question within the limits of the evidence. Word count management should remove duplication while preserving necessary analysis, rather than reduce every section mechanically. For educators and academic consultants, instructional design should make these checkpoints visible. An outline, source notes, selected feedback, and a short revision explanation can provide useful evidence of the learning process without requiring an exhaustive record of every interaction. I judge AI-supported learning by the quality of the student’s decisions and their ability to apply the same principles independently. Learning support has achieved its purpose when the writer can recognize a weak explanation, investigate its cause, and choose a defensible revision. That capacity gives writing confidence a sound foundation and keeps authorship grounded in informed judgment.

1 0

Dovecot 2.4.5 on macOS 27 ARM64: anvil panic with imap-login pid=-1
by list2＠captainnet.net 30 Sep '26

30 Sep '26

Subject: Dovecot 2.4.5 on macOS 27 ARM64: anvil panic with imap-login pid=-1 I am testing Dovecot 2.4.5 on macOS 27 (Darwin 27.0.0), ARM64/Apple Silicon, migrating a working Dovecot 2.3.21.1 installation. IMAP itself appears to be functioning correctly. Authentication succeeds using CRAM-MD5, the userdb resolves the expected uid/gid/home, Maildir is opened correctly, and Roundcube can see all folders and messages. LMTP delivery also works. However, under multiple IMAP connections I repeatedly see anvil receive an imap-login connection with pid=-1: anvil: Warning: conn unix:anvil (uid=0): Handshake with duplicate service=imap-login pid=-1 - replacing the old connection This can then lead to: anvil: Panic: file anvil-connection.c: line 837: unreached anvil: Fatal: master: service(anvil): child ... killed with signal 6 followed by: anvil: Error: connect limit: disconnection for unknown (pid=..., user=testuser(a)example.com, service=imap, ...) With mail_debug=yes, the IMAP process itself looks healthy immediately around the failure. For example: Debug: Effective uid=350, gid=350, home=/private/var/mail/example.com/testuser@example.com Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes Debug: maildir++: root=/private/var/mail/example.com/testuser@example.com/Maildir, inbox=/private/var/mail/example.com/testuser@example.com/Maildir Apple Mail successfully establishes TLS and authenticates: imap-login: Info: Logged in: user=<testuser(a)example.com>, method=CRAM-MD5, rip=192.0.2.10, lip=192.0.2.20, TLS Dovecot's own mailbox tools confirm that the mailboxes and messages exist: # doveadm mailbox list -u testuser(a)example.com -s Sent Drafts Archive Trash Junk # doveadm mailbox status -u testuser(a)example.com \ messages uidvalidity uidnext INBOX Sent Sent messages=1 INBOX messages=7 I initially experimented with disabling the anvil-auth-penalty listener, but reverted that. The problem also occurs with the stock/default Dovecot 2.4.5 anvil configuration: service anvil { executable = anvil process_limit = 1 process_min_avail = 1 unix_listener anvil { group = $SET:default_internal_group mode = 0660 } unix_listener anvil-auth-penalty { group = $SET:default_internal_group mode = 0660 type = penalty } unix_listener anvil-connect-limit { group = $SET:default_internal_group mode = 0660 type = connect-limit } } The effective default is currently: mail_max_userip_connections = 10 Dovecot 2.3.21.1 on the same ARM64 Mac, using the same users/Maildirs, does not exhibit this problem. The particularly suspicious part seems to be the imap-login pid=-1 registration immediately preceding the anvil failure. Is this a known 2.4.x issue on macOS/ARM64, and is there a supported way in 2.4.5 to disable anvil connection tracking as a workaround while retaining IMAP service? I can provide the complete doveconf -n, full backtrace, and additional debug logging if useful.

2 1