- dovecot - dovecot.org

[BUG] 2.4.3 SIGSEGV in fts_solr
by Nick O'Connor 01 Apr '26

01 Apr '26

Dovecot 2.4.3 crashes with SIGSEGV in indexer-worker and lmtp during FTS Solr indexing. The crash is a use-after-free triggered when the HTTP client does a DNS lookup for the Solr host. Environment: - Dovecot 2.4.3 (Alpine 3.23 / musl) - Linux x86_64 - Filesystem: maildir on ZFS - Solr 10.0.0 - fts_solr plugin with DNS-based Solr URL dovecot -n: # 2.4.3 (e278b1e09b): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.3 (0bf9ee48) # OS: Linux 6.12.74+deb13+1-amd64 x86_64 dovecot_config_version = 2.4.0 auth_mechanisms = oauthbearer xoauth2 dovecot_storage_version = 2.4.0 fts_autoindex = yes fts_search_add_missing = yes mail_always_cache_fields = date.save mail_driver = maildir mail_plugins { fts = yes fts_solr = yes } protocols = imap lmtp sieve ssl = required fts solr { url = http://solr.example.com/solr/dovecot } (LDAP userdb/passdb, pigeonhole sieve, imapsieve for spam learning, and oauth2 passdb omitted) How to reproduce: The crash occurs in the indexer-worker when processing multiple user mailboxes sequentially for FTS indexing, using a DNS hostname for the Solr URL. Steps: 1. Configure fts_solr with a DNS-based URL (not an IP address) 2. Have the indexer-worker process mailboxes for more than one user (e.g. fts_autoindex = yes with multiple users, or manual doveadm index -A) 3. The first user session completes successfully. On the second user session, the indexer-worker crashes with SIGSEGV during the DNS lookup for the Solr host. Reproduces reliably on musl (Alpine) due to aggressive memory reuse. Likely also affects glibc but may not crash immediately due to delayed reuse of freed memory. Root cause: The solr_http_client singleton outlives the user session that created it. Its event chain holds a ref on the mail_storage_service_user event, keeping it alive after the user is freed. The SETTINGS_EVENT_INSTANCE on that event still points to the already-freed settings_instance. On the next user session, dns_lookup() walks the stale event chain and dereferences the dangling pointer in settings_instance_get(). Stack trace (from core dump, debug build with musl-dbg): #0 strlen(s=0x415641d189485741) -- SIGSEGV, freed/reused memory #1 p_strdup() strfuncs.c:56 #2 event_add_str(key="protocol", value=...) lib-event.c:1099 #3 settings_instance_get() settings.c:2521 #4 settings_get_real() settings.c:2706 #5 settings_get_full() settings.c:2915 #6 settings_get(dns_client_setting_parser_info) settings.c:2976 #7 dns_client_init() dns-lookup.c:465 #8 dns_client_init_handle_failure() dns-lookup.c:317 #9 dns_lookup("solr.example.com") dns-lookup.c:337 #10 http_client_host_shared_lookup() http-client-host.c:166 #11 http_client_host_shared_refresh() http-client-host.c:195 #12-#19 http_client queue/host/request submit chain #20 http_client_request_continue_payload() http-client-request.c:1170 #21 http_client_request_send_payload() http-client-request.c:1261 #22 solr_connection_post_more() solr-connection.c:269 Proposed fix: Destroy solr_http_client in solr_connection_deinit() so it is recreated with a fresh event chain on the next user session: --- a/src/plugins/fts-solr/solr-connection.c +++ b/src/plugins/fts-solr/solr-connection.c @@ -117,6 +117,8 @@ void solr_connection_deinit(struct solr_connection **_conn) *_conn = NULL; event_unref(&conn->event); + if (solr_http_client != NULL) + http_client_deinit(&solr_http_client); i_free(conn->http_host); i_free(conn->http_base_url); I've been running for few days with the patch applied. FTS indexing across multiple user sessions completes without crashes using a DNS-based Solr URL. Please let me know if there's anything else that would be helpful. The core files have sensitive information so I've omitted them from the report. -Nick Dovecot 2.4.3 crashes with SIGSEGV in indexer-worker and lmtp during FTS Solr indexing. The crash is a use-after-free triggered when the HTTP client does a DNS lookup for the Solr host. Environment: - Dovecot 2.4.3 (Alpine 3.23 / musl) - Linux x86_64 - Filesystem: maildir on ZFS - Solr 10.0.0 - fts_solr plugin with DNS-based Solr URL dovecot -n: # 2.4.3 (e278b1e09b): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.3 (0bf9ee48) # OS: Linux 6.12.74+deb13+1-amd64 x86_64 dovecot_config_version = 2.4.0 auth_mechanisms = oauthbearer xoauth2 dovecot_storage_version = 2.4.0 fts_autoindex = yes fts_search_add_missing = yes mail_always_cache_fields = date.save mail_driver = maildir mail_plugins { fts = yes fts_solr = yes } protocols = imap lmtp sieve ssl = required fts solr { url = http://solr.example.com/solr/dovecot } (LDAP userdb/passdb, pigeonhole sieve, imapsieve for spam learning, and oauth2 passdb omitted) How to reproduce: The crash occurs in the indexer-worker when processing multiple user mailboxes sequentially for FTS indexing, using a DNS hostname for the Solr URL. Steps: 1. Configure fts_solr with a DNS-based URL (not an IP address) 2. Have the indexer-worker process mailboxes for more than one user (e.g. fts_autoindex = yes with multiple users, or manual doveadm index -A) 3. The first user session completes successfully. On the second user session, the indexer-worker crashes with SIGSEGV during the DNS lookup for the Solr host. Reproduces reliably on musl (Alpine) due to aggressive memory reuse. Likely also affects glibc but may not crash immediately due to delayed reuse of freed memory. Root cause: The solr_http_client singleton outlives the user session that created it. Its event chain holds a ref on the mail_storage_service_user event, keeping it alive after the user is freed. The SETTINGS_EVENT_INSTANCE on that event still points to the already-freed settings_instance. On the next user session, dns_lookup() walks the stale event chain and dereferences the dangling pointer in settings_instance_get(). Stack trace (from core dump, debug build with musl-dbg): #0 strlen(s=0x415641d189485741) -- SIGSEGV, freed/reused memory #1 p_strdup() strfuncs.c:56 #2 event_add_str(key="protocol", value=...) lib-event.c:1099 #3 settings_instance_get() settings.c:2521 #4 settings_get_real() settings.c:2706 #5 settings_get_full() settings.c:2915 #6 settings_get(dns_client_setting_parser_info) settings.c:2976 #7 dns_client_init() dns-lookup.c:465 #8 dns_clien t_init_handle_failure() dns-lookup.c:317 #9 dns_lookup("solr.example.com") dns-lookup.c:337 #10 http_client_host_shared_lookup() http-client-host.c:166 #11 http_client_host_shared_refresh() http-client-host.c:195 #12-#19 http_client queue/host/request submit chain #20 http_client_request_continue_payload() http-client-request.c:1170 #21 http_client_request_send_payload() http-client-request.c:1261 #22 solr_connection_post_more() solr-connection.c:269 Proposed fix: Destroy solr_http_client in solr_connection_deinit() so it is recreated with a fresh event chain on the next user session: --- a/src/plugins/fts-solr/solr-connection.c +++ b/src/plugins/fts-solr/solr-connection.c @@ -117,6 +117,8 @@ void solr_connection_deinit(struct solr_connection **_conn) *_conn = NULL; event_unref(&conn->event); + if (solr_http_client != NULL) + http_client_deinit(&solr_http_client); i_free(conn->http_host); i_free(conn->http_base_url); I've been running for few days with the patch applied. FTS indexing across multiple user sessions completes without crashes using a DNS-based Solr URL. Please let me know if there's anything else that would be helpful. The core files have sensitive information so I've omitted them from the report. -Nick

1 0

migration from 2.3 to 2.4 : postfix can't deliver via lmtp
by Stefan G. Weichinger 31 Mar '26

31 Mar '26

I am in the process of upgrading and rewriting my config. I can access IMAP etc ... so my database access is working. I have issues with LMTP: postfix can't deliver to dovecot. The postfix-confiog wasn't touched at all. the error: Mar 27 11:46:37 co dovecot: auth(stefan(a)oops.co.at): Error: userdb: client doesn't have lookup permissions for this user: userdb reply doesn't contain uid (to bypass this check, set: service auth { unix_listener /run/dovecot/auth-userdb { mode=0777 } }) What I don't understand: I configure this: service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service auth-worker { user = postfix } service lmtp { user = vmail unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } protocol lmtp { mail_plugins = sieve postmaster_address = logs(a)xunil.at } And in postfix: virtual_transport = lmtp:unix:private/dovecot-lmtp virtual_uid_maps = static:5000 virtual_gid_maps = static:5000 local_transport = virtual local_recipient_maps = $virtual_mailbox_maps smtpd_sasl_auth_enable = yes smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth Where does "/run/dovecot/auth-userdb" come from? I understand that according to my config /var/spool/postfix/private/auth should be used? ls /var/spool/postfix/private/auth -l srw-rw-rw- 1 postfix postfix 0 Mar 27 11:45 /var/spool/postfix/private/auth ls /var/spool/postfix/private/dovecot-lmtp -l srw-rw---- 1 postfix postfix 0 Mar 27 11:45 /var/spool/postfix/private/dovecot-lmtp I'd appreciate any quick help here ... while googling and testing around ... thanks!

2 17

upgrade to 2.4
by John Hill 31 Mar '26

31 Mar '26

Dovecot may go down as one of the best/worst software in its category. I'm staying on Debian 12 doing backports, till the dust settles several times. --john

1 0

Fwd: dovecot mailing list probe message
by Jaco Kroon 30 Mar '26

30 Mar '26

Hi, It seems like the list system is breaking DKIM - triggering bounces, resulting in unsuscribes. Is there recommendations on how to deal with this? Looks like it relates 100% to the addition of the footer: ______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org Kind regards, Jaco -------- Forwarded Message -------- Subject: dovecot mailing list probe message Date: Mon, 30 Mar 2026 06:32:58 +0000 From: dovecot-bounces+a190cb9ae5d94d8fa6e2af68fc964a7aaa13256b(a)dovecot.org To: jaco(a)uls.co.za This is a probe message. You can ignore this message. The dovecot(a)dovecot.org mailing list has received a number of bounces from you, indicating that there may be a problem delivering messages to jaco(a)uls.co.za. A sample is attached below. Please examine this message to make sure there are no problems with your email address. You may want to check with your mail administrator for more help. You don't need to do anything to remain an enabled member of the mailing list. If you have any questions or problems, you can contact the mailing list owner at dovecot-owner(a)dovecot.org Hi, It seems like the list system is breaking DKIM - triggering bounces, resulting in unsuscribes. Is there recommendations on how to deal with this? Looks like it relates 100% to the addition of the footer: ______________________________________________ dovecot mailing list -- [1]dovecot(a)dovecot.org To unsubscribe send an email to [2]dovecot-leave(a)dovecot.org Kind regards, Jaco -------- Forwarded Message -------- Subject: dovecot mailing list probe message Date: Mon, 30 Mar 2026 06:32:58 +0000 From: [3]dovecot-bounces+a190cb9ae5d94d8fa6e2af68fc964a7aaa13256b(a)dovecot.org To: [4]jaco(a)uls.co.za This is a probe message. You can ignore this message. The [5]dovecot(a)dovecot.org mailing list has received a number of bounces from you, indicating that there may be a problem delivering messages to [6]jaco(a)uls.co.za. A sample is attached below. Please examine this message to make sure there are no problems with your email address. You may want to check with your mail administrator for more help. You don't need to do anything to remain an enabled member of the mailing list. If you have any questions or problems, you can contact the mailing list owner at [7]dovecot-owner(a)dovecot.org References Visible links 1. mailto:dovecot@dovecot.org 2. mailto:dovecot-leave@dovecot.org 3. mailto:dovecot-bounces+a190cb9ae5d94d8fa6e2af68fc964a7aaa13256b@dovecot.org 4. mailto:jaco@uls.co.za 5. mailto:dovecot@dovecot.org 6. mailto:jaco@uls.co.za 7. mailto:dovecot-owner@dovecot.org

3 4

Update to v2.4.3 breaks ldap connection
by markus-dovecot＠doits.de 30 Mar '26

30 Mar '26

Unfortunately the upgrade to v2.4.3 broke the ldap connection. I have configured an ldap connection like this: ``` ldap_uris = ldaps://xxx.com ldap_auth_dn = uid=xxx,ou=general accounts,dc=xxx,dc=com ldap_auth_dn_password = xxx ldap_base = dc=xxx,dc=com passdb ldap { ldap_bind = yes [...] } ``` v2.4.3 cannot connect and says: ``` auth: Error: ldap(ldaps://xxx.com636): Can't connect to server: ldaps://xxx.com ``` Ldap server logs: ``` ACCEPT from IP=[XXX]:45674 (IP=[::]:636) TLS established tls_ssf=256 ssf=256 tls_proto=TLS1.3 tls_cipher=AES-256-GCM closed (connection lost) ``` Downgrade to dovecot v2.4.2 makes it work again. Was there any ldap change in v2.4.3 that required a config change? Using ubuntu 24.04 with the dovecot ppa, now forced version 2.4.2 by using https://repo.dovecot.org/ce-2.4.2/ubuntu/noble

4 6

Dovecot 2.4.3 virtual now broken even more
by sev monster 30 Mar '26

30 Mar '26

As of 2.4.2, Dovecot no longer crashed and broken config vars no longer caused it to error out, so I finally (reluctantly) switched to it over 2.3, though I had to disable/change a few things to get it to work. However, my virtual namespaces were still broken, since the `autosubscribe = yes` option would cause the driver to attempt to create the virtual directories, and fail when they already existed. Turning off autosubscribe meant that the folders were not visible to my users without manually subscribing. With 2.4.3, now the virtual configs that "worked" before now cause Dovecot to error out completely! Yay It seems this commit introduced a "feature" that restricts the virtual driver to the fs list format: https://github.com/dovecot/core/commit/b4a4a32361b8f0e68ef230add6467eddd0ff… But why? Is fs the only format that works? But maildir++ worked in both 2.3 and in previous versions of 2.4. The 2.4.3 docs (still) also recommend switching to maildir++ if desired: https://doc.dovecot.org/2.4.3/core/plugins/virtual.html#virtual-mailbox-plu… In my config, I use maildir for everything. That means in my mailboxes and all my namespaces. But with this change, I must now use fs as my list format for the virtuals. But, I can't do that, because all `list = yes` namespaces in use by a mailbox must use the same list format... So now my previously invisible virtual folders now cause Dovecot to fall over and I have to completely remove the virtual declarations from my config. What am I supposed to do now?

3 2

Executing a sieve-extprograms pipe script as non-root
by Roland Hieber 29 Mar '26

29 Mar '26

Hi, Ultimately I'm trying to call procmail via a `pipe "procmail";` in my Sieve script on Dovecot 2.4.1. I have therefore created the respective wrapper script in /usr/lib/dovecot/sieve-pipe/procmail, but I noted that the script is apparently run as root. With some debug output in the wrapper script, I see: # `id` output uid=0(root) gid=1059(rhi) groups=1059(rhi),116(dovecot) # `pstree -s -u $$` systemd(1)---dovecot(1064)---lmtp(266577,rhi)---procmail(266706,root)---pstree(266711) This Dovecot gets mail delivered via LMTP from another server. 1059 (rhi) is my local user ID on the IMAP server both in /etc/passwd and in /etc/dovecot/users (using auth-passwdfile.conf.ext in 10-auth.conf instead of auth-system.conf.ext), since mail needs to be delivered and chown'ed correctly into Maildirs that should be user-accessible. However I don't understand how the `procmail` wrapper can be run as the root user rights when the LMTP process starting it is running as my own user?!? I'd like to prevent procmail from running as root as far as possible, so for now I've been able to work around this by wrapping the procmail call into an additional `sudo -U $USER` (after determining the user who owns the target maildir), but I'd like to understand the problem a bit further and like to know if this is really how calling sieve-extprograms is supposed to work – I'd have expected that the external scripts are also run as my unprivileged user. I'm running a fairly standard config on Debian stable (dovecot package version 1:2.4.1+dfsg1-6+deb13u2) with only minimal changes by enabling the passwdfile backend and some sieve plugins. Thanks for any insights, - Roland -- Roland Hieber, Pengutronix e.K. | rhi(a)pengutronix.de | Steuerwalder Str. 21 | https://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |

6 8

dovecot 2.4.x director
by Maciej Milaszewski 27 Mar '26

27 Mar '26

HI Has anyone managed to create a fork or other solution that provides director functionality? A small setup where it can be managed, for example, with Rabit/Redis, is one thing, but not a larger environment. The documentation for 2.4.x seems to have something like this: https://doc.dovecot.org/2.4.3/howto/lua_director.html "This is an unsupported method of running Dovecot. Caveat emptor. It is only intended for small-scale deployments – this is NOT designed to scale for more than a few servers."

2 1

Dovecot Security Advisory OXDC-2026-0001
by Aki Tuomi 27 Mar '26

27 Mar '26

Hi! We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. This advisory is also published at https://documentation.open-xchange.com/dovecot/security/advisories/html/202… --- Internal reference: DOV-7830 Type: CWE-1250 (Improper Preservation of Consistency Between Independent Representations of Shared State) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.1 Discovery date: 2025-07-24 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: Erik <erik(a)broadlux.com> CVE: CVE-2025-30189 CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Details: v2.4 regression: auth cache broken with several passdb / userdb. When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. Risk: After cached login, all subsequent logins are for same user. No publicly available exploits are known. Solution: Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers. --- Internal reference: DOV-8349 Type: CWE-20 (Improper Input Validation) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2025-11-04 Solution date: 2026-03-27 Disclosure date: 2026-03-27 CVE: CVE-2025-59028 CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Details: Invalid base64 authentication can cause DoS for other logins. When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Risk: Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. No publicly available exploits are known. Solution: Install fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments). --- Internal reference: DOV-8508 Type: CWE-20 (Improper Input Validation) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2025-11-29 Solution date: 2026-03-27 Disclosure date: 2026-03-27 CVE: CVE-2025-59032 CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Details: v2.4/v3.1 regression: Pigeonhole: ManageSieve panic occurs with sieve-connect as a client. ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. Risk: This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. No publicly available exploits are known. Solution: Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. --- Internal reference: DOV-8584 Type: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2025-12-29 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: cavid@yeswehack CVE: CVE-2025-59031 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Details: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing. Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Risk: Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. No publicly available exploits are known. Solution: Do not use the provided script, instead, use something else like FTS tika. --- Internal reference: DOV-8591 Type: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot CE core 2.4.0 Discovery date: 2026-01-07 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: strokep@yeswehack CVE: CVE-2026-0394 CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Details: auth: Path traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`Pre-auth path traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`. When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characters, path traversal can happen if the domain component is directory partial. Risk: This allows inadvertently reading /etc/passwd (or some other path which ends with passwd). If this file contains passwords, it can be used to authenticate wrongly, or if this is userdb, it can unexpectly make system users appear valid users. No publicly available exploits are known. Solution: Upgrade to fixed version, or use different authentication scheme that does not rely on paths. Alternatively you can also ensure that the per-domain passwd files are in some other location, such as /etc/dovecot/auth/%d. --- Internal reference: DOV-8775 Type: CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2026-02-20 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: cookiejack15@yeswehack CVE: CVE-2026-27860 CVSS: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Details: v2.4/v3.1 regression: auth-ldap is not escaping usernames. If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. Risk: This leads to potentially bypassing restrictions and allows probing of LDAP structure. No publicly available exploits are known. Solution: Do not clear out auth_username_chars, or install fixed version. --- Internal reference: DOV-8781 Type: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2026-02-23 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: whisperer@yeswehack CVE: CVE-2026-24031 CVSS: 7.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Details: v2.4/v3.1 regression: SQL injection allows bypassing authentication. Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. Risk: This vulnerability allows bypassing authentication for any user and user enumeration. No publicly available exploits are known. Solution: Do not clear auth_username_chars. If this is not possible, install latest fixed version. --- Internal reference: DOV-8787 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2026-02-24 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: djvirus@yeswehack CVE: CVE-2026-27859 CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Details: v3.0.2+ regression: Message headers MIME parameter parsing can cause excessive CPU usage. A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. Risk: A suitably formatted mail message causes mail delivery process to consume large amounts of CPU time. No publicly available exploits are known. Solution: Use MTA capabilities to limit RFC 2231 MIME parameters in mail messages, or upgrade to fixed version where the processing is limited. --- Internal reference: DOV-8816 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2026-02-27 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: whisperer@yeswehack CVE: CVE-2026-27857 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: imap-login: Excessive memory usage DoS. Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Risk: Attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. No publicly available exploits are known. Solution: Install fixed version, there is no other remediation. --- Internal reference: DOV-8818 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0, OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2026-02-28 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: ilyar@yeswehack CVE: CVE-2026-27858 CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Details: managesieve-login out-of-memory DoS. Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Risk: Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. No publicly available exploits are known. Solution: Protect access to managesieve protocol, or install fixed version. --- Internal reference: DOV-8830 Type: CWE-287 (Improper Authentication) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2026-03-04 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: bksparajuli@yeswehack CVE: CVE-2026-27856 CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Details: doveadm: Credentials verified without timing safety. Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Risk: Figuring out the credential will lead into full access to the affected component. No publicly available exploits are known. Solution: Limit access to the doveadm http service port, install fixed version. --- Internal reference: DOV-8859 Type: CWE-294 (Authentication Bypass by Capture-replay) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2026-03-09 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: hamizanazman@yeswehack CVE: CVE-2026-27855 CVSS: 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Details: auth: OTP driver vulnerable to replay attack. Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. Risk: An attacker able to observe an OTP exchange is able to log in as the user. No publicly available exploits are known. Solution: If authentication happens over unsecure connection, switch to SCRAM protocol. Alternatively ensure the communcations are secured, and if possible switch to OAUTH2 or SCRAM.

1 0

Imap Sieve errors in 2.4.2
by Alberto 26 Mar '26

26 Mar '26

Hi, I have a Dovecot docker image with last version (2.4.2). I'm getting some errors, last time a few minutes ago, when dragging some emails into a folder I had just created. ... Mar 26 10:48:20 imap(alberto(a)bersol.info)<451><wHkgJepNsLRYDtBg>: Info: Mailbox INBOX.carpetanueva: Mailbox created Mar 26 10:48:24 imap(alberto(a)bersol.info)<397><x8N6YuhNMs9YDtBg>: Panic: file imap-sieve-storage.c: line 216 (imap_sieve_add_mailbox_event): assertion failed : (ismt->src_box == NULL || ismt->src_box == src_box) Mar 26 10:48:24 imap(alberto(a)bersol.info)<397><x8N6YuhNMs9YDtBg>: Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 [unw_get_proc_name() failed: -10] -> #3 i_panic[0x7fbaed2ee8ab] -> #4 [unw_get_proc_name() failed: -1] Mar 26 10:48:24 imap(alberto(a)bersol.info)<397><x8N6YuhNMs9YDtBg>: Fatal: master: service(imap): child 397 killed with signal 6 (core dumped) This breaks Dovecot and I have to restart the container, but it doesn't fix it either. When I access again, I've receive this errors again, until I disable sieve in the imap.conf: conf.d/20-imap.conf ------------------- ... protocol imap { # Space separated list of plugins to load (default is global mail_plugins). mail_plugins { # imap_sieve = yes imap_quota = yes last_login = yes } And I have to keep "imap_sieve" disabled. Regards, Alberto

2 1

Issues with doveadm sync
by cryintothebluesky＠gmail.com 21 Mar '26

21 Mar '26

Hello, I have two replica IMAP servers both running dovecot-2.4.2: imap1.example.com imap2.example.com I'm observing the following issues when replicating mailboxes with doveadm sync: 1. Permission errors with public and shared mailboxes For this test I delete all mailboxes on imap2.example.com and then use full sync from imap1.example.com to replicate mailboxes: # doveadm sync -f -s "" -N -l 10 -u ${user:?} ${server:?} The first time I run this command, the following error messages are logged: doveadm(XXX(a)example.com)<1363><eZzOJic5vWlTBQAAMBZ7fQ>: Error: brain S: Can't create mailbox Shared/support(a)example.com: Permission denied doveadm(XXX(a)example.com)<1334><ZV88Byg5vWk2BQAAMBZ7fQ>: Error: brain S: Can't create mailbox Public/Test: Permission denied If I wait 10 seconds and run the same sync command again, all mailboxes are replicated correctly. This only happens with public and shared mailboxes. I'm not sure of the exact cause, but it looks as if there is a race condition, where on the target server replicated ACLs are not applied immediately and this results in permission errors. Can anyone confirm the root cause? 2. Mailboxes are not always synchronised correctly For this test I'm using stateful sync. The man page states it performs a two-way sync, hence both server should end up with the same state. 1) I log into imap2.example.com and move some messages from Inbox to Drafts and Junk folders. 2) On imap1.example.com I run: doveadm sync -s "${state}" -N -l 10 -u ${user:?} ${server:?} 3) I log into imap1.example.com and sometimes observe the recently moved messages missing from Drafts and/or Junk folders. 4) The only way to resolve this issue is to either run full sync from imap1.example.com or to run another stateful sync but from imap2.example.com. Can anyone confirm if this is a bug or if stateful sync is required to be run on both IMAP servers against each other?

1 0

Error: ldap: auth_passdb_post settings
by Ruud Baart 21 Mar '26

21 Mar '26

Dovecot 2.4.1 works fine on my Debian Trixie server. I use LDAP as backend for the users. I don't have problems. Authentication works fine. However logging show every time the following line: auth-worker(<user name@domain,::1)<109040><3v5ddOlJvrgAAAAAAAAAAAAAAAAAAAAB>: request [7]: Error: ldap: auth_passdb_post settings: Failed to parse configuration: Failed to expand passdb_fields/password setting variables: ldap: No such attribute 'userpassword' The LDAP authentication works correct. So I don't understand this message. My correct working LDAP configuration in auth-ldap.conf.ext: passdb ldap { passdb_use_worker = yes passdb_ldap_filter = (&(objectClass=PromptMailUser)(accountStatus=TRUE)(mailDeliveryaddress=%{user})) ldap_bind = yes fields { user = %{ldap:mailDeliveryaddress} password = %{ldap:userPassword} } } userdb ldap { userdb_use_worker = yes userdb_ldap_filter = (&(objectClass=PromptMailUser)(accountStatus=TRUE)(mailDeliveryaddress=%{user})) fields { home = %{ldap:mailBase} mail = %{ldap:mailMessageStore} mail_path = %{ldap:mailMessageStore} quota_storage_size = %{ldap:dovecotQuota} } }

6 21

shared mailbox error
by Marc 19 Mar '26

19 Mar '26

I am getting this error. This file does not exist. Error: t_readlink(/xxxxxx/dbox-alt-root) failed: readlink() failed: Permission denied

2 4

dovecot-2.4.2: doveconf seg fault
by Eray Aslan 16 Mar '26

16 Mar '26

Running dovecot -c /dev/null -n results in: # 2.4.2 (0962ed2104): /dev/null # Pigeonhole version 2.4.2 (767418c3) Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7c0f3a6 in str_to_uint () at ../lib/strnum.c:76 for a user. And the issue seems to be const unsigned char ** vs const char * mismatch: int str_to_uintmax(const char *str, uintmax_t *num_r) { const char *endp = NULL; uintmax_t n; int ret = str_parse_uintmax(str, &n, &endp); if ((ret != 0) || (*endp != '\0')) /* <--- reading via 'const char *' return -1; *num_r = n; return 0; } vs int str_parse_data_uintmax(const unsigned char *data, size_t size, uintmax_t *num_r, const unsigned char **endp_r) { const unsigned char *p = data, *pend = data + size; uintmax_t n = 0; if (p >= pend || *p < '0' || *p > '9') return -1; do { if (n >= ((uintmax_t)-1 / 10)) { if (n > (uintmax_t)-1 / 10) return -1; if ((uintmax_t)(*p - '0') > ((uintmax_t)-1 % 10)) return -1; } n = n * 10 + (*p - '0'); p++; } while (p < pend && *p >= '0' && *p <= '9'); if (endp_r != NULL) *endp_r = p; /* <--- writing via 'const unsigned char *' *num_r = n; return 0; } We don't know enough to choose which one would be preferable so that the interfaces match. It needs an informed decision as it shows up in a bunch of other places as well. More details at: https://bugs.gentoo.org/971191 Thank you -- Eray

1 0

Issues with 2.4.1 & remote postgresql server
by Terry Braun 14 Mar '26

14 Mar '26

Hello, I'm stumped with using a remote postgresql database for authentication. I went through the process once, failed, debugged, failed again. I could successfully use psql to access the remote database from my host machine, so I do not believe the remote access is an issue. I implemented an instance using sqlite3 database and it worked just fine. ``` from auth-sql.conf.ext ``` sql_driver = pgsql pgsql 72.44.55.66 { parameters { sslmode = require user = user password = 123 dbname = db } } I'm using lmtp over sockets to deliver mail to dovecot, in order to isolate any interaction issues. With a postgresql db I get "Mailbox isn't a valid mbox file", but with changes only to auth-sql.conf.ext it fails. I can run the queries from psql and they work. I'm pretty much out of ideas of things to try. - I could not find anything to validate the syntax of the psql data. All the examples had "psql localhots {" - Because of the above, I am wondering if there may be an issue in the postgres driver somehow? - I did look at the documentation for https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWO… but I'm unsure what is needed. Thanks for any ideas, help, hints. If someone has an example that works with 2.4.1-4 (7d8c0e5759) on debian 13 that would be great Terry

2 1

How to declare port 143
by Steve Litt 10 Mar '26

10 Mar '26

Hi all, I have Dovecot 2.4.2 working (plain text only) on my Qemu virtual machine, with Claws-Mail able to work with all its files. However, I want to declare the Dovecot server as running on Port 143, and when I do, I dovecot -F throws the error message shown later in this message. If I comment out the explicit port declaration, it works fine, and I want to know why. To the best of my knowledge, my declaration of port 143 exactly matches your 2.4.2 documentation: The following is my attempt to tell Dovecot to serve *explicitly* at port 143: =============================================== # My Dovecot server will operate on Localhost listen = 127.0.0.1 service imap { inet_listener imap-login { port = 143 } # inet_listener imaps { # port = 993 # ssl = yes # } } =============================================== The following is the result: =============================================== [root@dovecotvoid ~]# dovecot -F doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf: duplicate listener: 143:127.0.0.1 [root@dovecotvoid ~]# =============================================== If I comment out the port = 143, it works. Why is it griping about a duplicate listener? At the bottom of this email is the entire dovecot.conf and the result of dovecot -n, and there are no sub-configuration files in conf.d : =============================================== # Start new configs with the latest Dovecot version numbers here: dovecot_config_version = 2.4.2 # Must be current version dovecot_storage_version = 2.4.2 # Must be current version or earlier # 2.3 is minimum # I only want imap protocols { imap = yes lmtp = no pop3 = no } # My Dovecot server will operate on Localhost listen = 127.0.0.1 service imap { inet_listener imap-login { port = 143 } # inet_listener imaps { # port = 993 # ssl = yes # } } # mail_home is only for virtual users # A virtual user is a user with no system account # I have no virtual users, so I've commented out mail_home. #mail_home = /srv/mail/%{user} # mail_driver is the storage format mail_driver = maildir # mail_path is location of top of storage data # WARNING: For troubleshooting be prepared to switch # to literal location of ~ mail_path = ~/mail/Maildir # In my case # mail_home is the home directory of the user identified as ~ # WARNING: system users have no ~ without it. mail_home = /home/slitt # You need a log you can locate # There might not be a log_path=/var/log/dovecot.log #mail_uid = slitt #mail_gid = slitt mail_uid = vmail mail_gid = vmail # By default first_valid_uid is 500. #If your vmail user's UID is smaller, # you need to modify this: #first_valid_uid = uid-number-of-vmail-user namespace inbox { inbox = yes separator = / } # Authenticate as system users: passdb pam { driver = pam #driver = passwd } userdb passwd { driver = passwd } #ssl_server_cert_file = /etc/dovecot/ssl-cert.pem #ssl_server_key_file = /etc/dovecot/ssl-key.pem =============================================== The following is the output of dovecot -n: =============================================== # 2.4.2 (0962ed2104): /etc/dovecot/dovecot.conf # OS: Linux 6.12.71_1 x86_64 # Hostname: dovecotvoid dovecot_config_version = 2.4.2 dovecot_storage_version = 2.4.2 listen = 127.0.0.1 log_path = /var/log/dovecot.log mail_driver = maildir mail_gid = vmail mail_home = /home/slitt mail_path = ~/mail/Maildir mail_uid = vmail protocols { imap = yes lmtp = no pop3 = no } service imap { inet_listener imap-login { port = 143 } } namespace inbox { inbox = yes separator = / } passdb pam { driver = pam } userdb passwd { driver = passwd } ===============================================

5 5

Republish of 2.4.2
by Aki Tuomi 10 Mar '26

10 Mar '26

Hi all! We have republished 2.4.2 packages to fix some packaging issues with Pigeonhole. Please note that for now dovecot-sieve and dovecot-managesieved will get installed together due to dependency issues. Kind regards, Aki Tuomi

1 0

solr-config-9.xml Fails to Load with Solr 9.10.1
by Steven Smith 10 Mar '26

10 Mar '26

I’m trying to use the latest dovecot solr module solr-config-9.xml at with Solr 9.10.1: https://github.com/dovecot/core/blob/956fd0f9a101673be72a7df7d643dd20cf4c40… This dovecot module has been updated to work with version 9.8 and removes the deprecated <lib> directives. However, I observe that it does not load under solr 9.10.1 with the Java exception below. Does anyone have any pointers on how to modify this module for the latest solr versions? var/solr/logs/solr-8983-console.log: > 2026-03-10 01:34:45.983 INFO (main) [] o.a.s.c.CorePropertiesLocator Found 1 core definitions underneath /opt/local/var/solr > 2026-03-10 01:34:45.984 INFO (main) [] o.a.s.c.CorePropertiesLocator Cores are: [dovecot] > 2026-03-10 01:34:46.012 INFO (coreLoadExecutor-13-thread-1) [ x:dovecot] o.a.s.c.SolrConfig Using Lucene MatchVersion: 9.8.0 > 2026-03-10 01:34:46.045 INFO (coreLoadExecutor-13-thread-1) [ x:dovecot] o.a.s.s.ManagedIndexSchemaFactory The schema is configured as managed, but managed schema resource managed-schema.xml not found - loading non-managed schema schema.xml instead > 2026-03-10 01:34:46.064 INFO (coreLoadExecutor-13-thread-1) [ x:dovecot] o.a.s.s.IndexSchema Schema name=dovecot > 2026-03-10 01:34:46.100 ERROR (coreLoadExecutor-13-thread-1) [ x:dovecot] o.a.s.c.CoreContainer SolrCore failed to load on startup =>org.apache.solr.common.SolrException: Unable to create core [dovecot] > at org.apache.solr.core.CoreContainer.createFromDescriptor(CoreContainer.java:1803) I'm trying to use the latest dovecot solr module solr-config-9.xml at with Solr 9.10.1: [1]https://github.com/dovecot/core/blob/956fd0f9a101673be72a7df7d643dd20cf4c… This dovecot module has been updated to work with version 9.8 and removes the deprecated <lib> directives. However, I observe that it does not load under solr 9.10.1 with the Java exception below. Does anyone have any pointers on how to modify this module for the latest solr versions? var/solr/logs/solr-8983-console.log: 2026-03-10 01:34:45.983 INFO (main) [] o.a.s.c.CorePropertiesLocator Found 1 core definitions underneath /opt/local/var/solr 2026-03-10 01:34:45.984 INFO (main) [] o.a.s.c.CorePropertiesLocator Cores are: [dovecot] 2026-03-10 01:34:46.012 INFO (coreLoadExecutor-13-thread-1) [ x:dovecot] o.a.s.c.SolrConfig Using Lucene MatchVersion: 9.8.0 2026-03-10 01:34:46.045 INFO (coreLoadExecutor-13-thread-1) [ x:dovecot] o.a.s.s.ManagedIndexSchemaFactory The schema is configured as managed, but managed schema resource managed-schema.xml not found - loading non-managed schema schema.xml instead 2026-03-10 01:34:46.064 INFO (coreLoadExecutor-13-thread-1) [ x:dovecot] o.a.s.s.IndexSchema Schema name=dovecot 2026-03-10 01:34:46.100 ERROR (coreLoadExecutor-13-thread-1) [ x:dovecot] o.a.s.c.CoreContainer SolrCore failed to load on startup =>org.apache.solr.common.SolrException: Unable to create core [dovecot] at org.apache.solr.core.CoreContainer.createFromDescriptor(CoreContainer.java:1803) References Visible links 1. https://github.com/dovecot/core/blob/956fd0f9a101673be72a7df7d643dd20cf4c40…

1 1

Preventing Plain Auth
by Steve Litt 10 Mar '26

10 Mar '26

Hi all, https://doc.dovecot.org/2.4.2/core/summaries/settings.html , the auth_allow_cleartext section, says "If no, disables the LOGIN command and all other cleartext authentication unless SSL/TLS is used (LOGINDISABLED capability) or the connection is secured (see ssl). See SSL configuration for more detailed explanation of how this setting interacts with the ssl setting. This setting replaces the disable_plaintext_auth setting." I put auth_allow_cleartext = no in my 2.4.2 dovecot.conf, but my Claws-Mail client can still access it, even though there are no key files. I tried putting this setting in several different places: Didn't prevent plain access. I tried switching from 127.0.0.1 to 10.0.2.15, same problem. The following is the output of my dovecot -n command: ========================================= # 2.4.2 (0962ed2104): /etc/dovecot/dovecot.conf # OS: Linux 6.12.74_1 x86_64 # Hostname: dovecotvoid dovecot_config_version = 2.4.2 dovecot_storage_version = 2.4.2 listen = 10.0.2.15 log_path = /var/log/dovecot.log mail_driver = maildir mail_gid = vmail mail_home = /home/slitt mail_path = ~/mail/Maildir mail_uid = vmail protocols { imap = yes lmtp = no pop3 = no } service imap { inet_listener imap-login { auth_allow_cleartext = no } } namespace inbox { inbox = yes separator = / } passdb pam { driver = pam } userdb passwd { driver = passwd } ========================================= How do I disable plain text authentication? Thanks, SteveT Steve Litt http://444domains.com

4 13

[BUG?] Dovecot 2.4.2 from Dovecot repo (RHEL 9) does not implement Sieve (properly/fully)
by Patrick S 09 Mar '26

09 Mar '26

Hi all Below is report of what I suspect is a bug arising in Dovecot 2.4.x regarding Sieve functionality after Pigeonhole functionality was folded into Dovecot/Dovecot-sieve. ISSUE: ====== I am building a new mail server on Rocky Linux 9.7 with Postfix 3.10 and Dovecot 2.4.2. The base installation & setup of Dovecot was OK with core functionality (Postfix interoperability and mail into virtual mail domain mailboxes no problem). Once I had the base setup done I started with Sieve functionality: 1) Incoming mail marked as SPAM by Rspamd auto moved into /Junk 2) Mail manually moved in/out of /Junk handed to Rspamd for training as SPAM/HAM This consistantly failed - the first issue I found was Dovecot failing to restart and `dovecot -n` reporting fatal errors related to sieve — section not found etc. etc. From my reading previously I knew I needed to install `dovecot-sieve` and it was installed before I started working on Sieve functionality. I also saw `dovecot-pigeonhole` but I seemed to read that (version >= 2.4) the functionality for that had been included in `dovecot-sieve` **and** there was no Pigeonhole included in the Dovecot 2.4.2 repo — also if I tried to install it I got errors of course because of the version mismatch, and it was not in the dovecot-2.4-latest repo. ``` # dnf info dovecot-pigeonhole Last metadata expiration check: 1:21:15 ago on Fri 06 Mar 2026 08:05:08. Available Packages Name : dovecot-pigeonhole Epoch : 1 Version : 2.3.16 Release : 15.el9 Architecture : x86_64 Size : 371 k Source : dovecot-2.3.16-15.el9.src.rpm Repository : appstream Summary : Sieve and managesieve plug-in for dovecot URL : https://www.dovecot.org/ License : MIT and LGPLv2 Description : This package provides sieve and managesieve plug-in for dovecot LDA. ``` I also saw `dovecot-managesieved` but as I was **not** going to implement a client sieve functionality I did not install that. Anyway I could not even get to first base with Sieve, Dovecot simply did not know about it. I went on IRC and chatted with Aki Tuomi who confirmed that "yeah, looks like there is some packaging mistake." because the directory `/usr/lib64/dovecot/settings` was empty. As a workaround he suggested "you need to install dovecot-managesieved as workaround". I did that and as a result the following files appeared: ``` -rwxr-xr-x 1 root root 15560 Jan 8 12:13 libmanagesieve_login_settings.so -rwxr-xr-x 1 root root 15840 Jan 8 12:13 libmanagesieve_settings.so -rwxr-xr-x 1 root root 19656 Jan 8 12:13 libpigeonhole_settings.so ``` The `dovecot -n` errors went away, it recognised the sieve directives, and I continued with the Sieve setup. All — `dovecot.conf`, sieve files source and compiled — installed OK. But the sieve functionality simply refused to work. I got advice and we found the following which essentially points to sieve (even with `dovecot-managesieved` installed) not working. After installing everything — dovecot.conf, sieve files (compiled successfully) and a pipe to a shell script to call `rspamc` nothing seemed to happen. * `journalctl -f -u dovecot | grep -E "sieve|pipe"` -> nothing showed * `rspamc stat` -> 'Messages scanned' & 'Messages learned' no increase When we checked we found the following: 1) `lib90_sieve_settings.so` (which should be in `/etc/lib64/dovecot/settings`) is missing from the system. `find / -name "lib90_sieve_settings.so"` -> not found I believe the file is critical for the running of (Dovecot using) Sieve? 2) The Dovecot build options missing any sieve functionality: ``` #dovecot --build-options Build options: ioloop=epoll notify=inotify openssl io_block_size=8192 SQL driver plugins: mysql postgresql sqlite Passdb: ldap pam passwd passwd-file sql Userdb: ldap(plugin) passwd prefetch passwd-file sql ``` I believe (I was told) that minus the above (even though `dovecot-managesieved` was installed as well as `dovecot-sieve`) Sieve simply will not function. Is this a bug/packaging error? Regards Patrick ENVIRONMENT: ============ Software -------- * Rocky Linux 9.7 (RHEL) * Postfix 3.10 Built from source * Postscreen running in Postfix * Dovecot 2.4 installed from Dovecot repo * Valkey 9.0.3 (Redis replacement) * Rspamd 3.14.3 Setup ----- * Rspamd <-> Valkey communicate via Unix socket * Postfix & Dovecot <-> Rspamd via inet port/milter: smtpd_milters = inet:localhost:11332 non_smtpd_milters = inet:localhost:11332 * 'First line defence' = DNSBL via postscreen * Rspamd SPF checking, DKIM signing and DMARC configured All of the above installed, working and tested. DOVECOT PACKAGES INSTALLED: =========================== ``` Name : dovecot Version : 2.4.2 Architecture : x86_64 Source : dovecot-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-sieve Version : 2.4.2 Architecture : x86_64 Source : dovecot-sieve-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-managesieved (see note about this in the email) Version : 2.4.2 Architecture : x86_64 Source : dovecot-sieve-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-submissiond Version : 2.4.2 Architecture : x86_64 Source : dovecot-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-imapd Version : 2.4.2 Architecture : x86_64 Source : dovecot-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-lmtpd Version : 2.4.2 Architecture : x86_64 Source : dovecot-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-lua Version : 2.4.2 Architecture : x86_64 Source : dovecot-2.4.2-2.src.rpm From repo : dovecot-2.4-latest ``` OUTPUT OF `dovecot -n`: ======================= ``` # dovecot -n # 2.4.2-2 (0962ed2104): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.2-2 (767418c3) # OS: Linux 5.14.0-611.34.1.el9_7.x86_64 x86_64 Rocky Linux release 9.7 (Blue Onyx) # Hostname: srv01.example.com dovecot_config_version = 2.4.2 auth_default_domain = example.com auth_mechanisms = plain auth_username_format = %{user | lower } dovecot_storage_version = 2.4.2 mail_access_groups = vmail mail_control_path = ~/control mail_driver = maildir mail_gid = 5000 mail_home = /var/vmail/%{user | domain }/%{user | username } mail_index_path = ~/indexes mail_path = %{home}/Maildir mail_privileged_group = vmail mail_uid = 5000 mailbox_list_utf8 = yes protocols = imap lmtp sieve_global_extensions { vnd.dovecot.pipe = yes } sieve_pipe_bin_dir = /etc/dovecot/sieve/bin sieve_plugins { sieve_imapsieve = yes sieve_extprograms = yes } sieve_trace_dir = /var/log/dovecot/sieve-trace sieve_trace_level = actions ssl = required syslog_facility = local5 protocol lmtp { mail_plugins { sieve = yes } } ssl_server { cert_file = /etc/ssl/server/server_example_com.crt key_file = /etc/ssl/server/server_example_com.key } passdb passwd-file { auth_username_format = %{user | username} default_password_scheme = SHA512-CRYPT passwd_file_path = /etc/dovecot/passwd } userdb passwd-file { auth_username_format = %{user | username} passwd_file_path = /etc/dovecot/passwd fields { gid:default = 5000 uid:default = 5000 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service auth-worker { user = $SET:default_internal_user } service anvil { unix_listener anvil { group = $SET:default_internal_group mode = 0660 } } service doveadm { unix_listener doveadm-server { mode = 0600 user = $SET:default_internal_user } } sieve_script rspamd_to_junk { driver = file path = /etc/dovecot/sieve/rspamd-to-junk.sieve type = before } namespace inbox { mail_plugins { imap_sieve = yes } inbox = yes mailbox Junk { auto = create autoexpunge = 90d special_use = "\\Junk" sieve_script report-spam { cause = copy path = /etc/dovecot/sieve/report-spam.sieve type = before } } imapsieve_from Junk { sieve_script report-ham { cause = copy path = /etc/dovecot/sieve/report-ham.sieve type = before } } mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Sent { auto = subscribe special_use = "\\Sent" } mailbox Trash { auto = subscribe special_use = "\\Trash" } } ```

4 7

Curve25519/Ed25519 ?
by Steve Litt 09 Mar '26

09 Mar '26

On my new Dovecot 2.4.2 IMAP server, which when completed will be accessible only via SSL, I plan to use Curve25519/Ed25519 self-signed-cert/private-key. Is there any reason this would be a mistake? Thanks, SteveT Steve Litt http://444domains.com

2 2

Dovecot 2.4 doveadm_worker_count corrupts tab-formatted output
by Philip Iezzi 08 Mar '26

08 Mar '26

Hi there On a Dovecot 2.4.2 (Debian Bookworm) server with over 1300 users, I am using the following config to retrieve quota usage information with doveadm: --------------------------------------- quota "User quota" { } mail_plugins = quota acl mail_log notify userdb sql { iterate_query = SELECT username AS user, CONCAT(quota, 'M') AS quota_storage_size FROM mailaccounts WHERE active = 1 query = \ SELECT '/var/vmail/%{user | domain}/%{user | username}' AS home, 'vmail' AS uid, 'vmail' AS gid, CONCAT(quota, 'M') AS quota_storage_size \ FROM mailaccounts \ WHERE username = '%{user}' AND (active = 1 OR transport_suspended = 0) } --------------------------------------- Initially, I had to run `doveadm quota recalc -A` to recalc quotas and populate the `count` quota driver which is enabled by default for "User quota". But still, it took roughly 20ms per single user or 15-20s for all users: $ time doveadm -f tab quota get -u demo(a)example.com real 0m0.020s $ time doveadm -f tab quota get -A real 0m16.800s Now, to greatly speed this up, I have introduced parallel processing: doveadm_worker_count = 4 Like this, `doveadm -f tab quota get -A` runs approx 10x faster, done in 1.5 - 2.5s But there is one major drawback which I assume to be a bug: # sane output without `doveadm_worker_count = 4` => always 6 fields demo(a)example.com User quota STORAGE 29 204800 0 demo(a)example.com User quota MESSAGE 1 - 0 # broken output with `doveadm_worker_count = 4` => sometimes 7 fields demo(a)example.com User quota STORAGE 29 2048 00 0 demo(a)example.com User quota MESSAGE 1 - 0 Somehow, the tab formatter does not play nicely together with parallel processing. On some output, the value gets split apart by an extra tab, e.g. '2024<TAB>00' in above example. Can you explain this corrupted data? Some kind of "output interleaving" seems to happen when running parallel workers. If I switch to json output (`doveadm -f json quota get -A`), this does not seem to happen and I always get valid JSON output, even with `doveadm_worker_count = 4`. Cheers, Philip

2 8

Getting quota limits from DB
by Alberto 04 Mar '26

04 Mar '26

Hi group: I have a Docker Dovecot 2.4.2 installation with MySQL user management, with this record: SELECT * FROM users; +---------------------------------------------------------------------------- | username | domain | password | home | uid | gid | active | quota | quotamsgs | crampassword +---------------------------------------------------------------------------- | alberto | bersol.info | {MD5-CRYPT}$1$Jm... | /var/mail/alberto | 1000 | 1000 | Y | 3221225472 | 149999 | {CRAM-MD5}fd246... | +---------------------------------------------------------------------------- But I have a problem with user quota definitions... If I run "doveadm" command, I get the user quota occupation, I have "quota_clone" plugin working, but I don't get user quota limit, I don't know why: ----- # docker exec -it midovecot doveadm quota get -A Username Quota name Type Value Limit % alberto(a)bersol.info User quota STORAGE 1925805 3145728 61 alberto(a)bersol.info User quota MESSAGE 37608 100000 37 ----- That limit isn't the correct limit set in DB, but the one is put in the config, and it must to be override in my userdb:Extra Fields. ----- # # docker exec -it midovecot doveadm config # 2.4.2 (0962ed2104): /etc/dovecot/dovecot.conf ... userdb sql { iterate_query = SELECT CONCAT(username,'@',domain) AS user FROM users query = SELECT home,CONCAT(username,'@',domain) AS username,crampassword AS password,uid AS userdb_uid,gid AS userdb_gid,CONCAT(quota,'B') AS userdb_quota_storage_size,concat('*:messages=',quotamsgs) AS userdb_quota_storage_size FROM users WHERE username = '%{ user | username | lower }' AND domain = '%{ user | domain | lower }' } ... quota_storage_size = 3G quota_message_count = 100000 ... ----- Do you have any idea of the problem? Best Regards, Alberto

2 3

Dovecot marking outgonig emails as unread
by stef204 03 Mar '26

03 Mar '26

Starting a few days ago, I have one email account where ALL outgoing emails are automatically marked as UNREAD. The message is sent, then copied to the "Sent" folder, and has status "unread". Then, a couple of minutes later, something happens where this message gets marked as UNREAD, without ANY interaction of client side. This occurs not matter the email client used, I have tried it with multiple email clients, both local and via web interface, the behavior does not change. This is via Dovevot on Cpanel. if I look at the [1]changelog, it is difficult to identify which changes could have triggered this as there seem to be changes impacting Dovecot almost with every update. I do not control the server myself, this is on a shared hosting plan; tech support has been willing to troubleshoot but is unable to locate the problem. This problem does NOT occur on other email accounts on the same domain, so it looks to me like some corruption or problem syncing flags perhaps? I am at a loss at the moment to fix this behavior. Any suggestions or ideas welcome. Thanks. References Visible links 1. https://docs.cpanel.net/changelogs/132-change-log/

3 5

[Pigeonhole] extracttext on "message/rfc822" attachment ignores included headers
by quentinduchemin＠tuta.io 03 Mar '26

03 Mar '26

Hi everyone! I'm not sure this is a design decision, a bug, something not implemented or malformed input on my side. My use case is the following: users that forward their mails outside the domain I manage have the option to report spam as attachment so the spam classifier can learn anyway. I prefer attachment over forward because MUAs have their own way to do it and it's difficult to reliably reconstruct some headers/email structure that can be important for the spam classifier. Each input message is processed through a Sieve extensions of RFC 5703 to extract the attachment. I ask user to produce a file with .eml extension through any export-like feature of their MUA. Below is an example EML file produced by Tuta (Thunderbird does a similar thing with a different encoding for the body). I'll use a bunch of = characters as a separator in the rest of this. =============================================== [...bunch of header...] X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-0000000000 00 X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYSPR04MB7035 Content-Type: multipart/related; boundary="------------79Bu5A16qPEYcVIZL@tutanota" --------------79Bu5A16qPEYcVIZL@tutanota Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 DQo8ZGl2IHN0eWxlPSJmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3 NfTVNGb250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6 [...base64 encoding of the body...] =============================================== While attached and sent, the received messaged looks like this: =============================================== [...headers of the actual email...] X-Infomaniak-Routing: alpha This is a multi-part message in MIME format. --------------5jyKrhQ08xXUif7LHhgg648N Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit --------------5jyKrhQ08xXUif7LHhgg648N Content-Type: message/rfc822; name="a.eml" Content-Disposition: attachment; filename="a.eml" Content-Transfer-Encoding: 7bit [...headers of the spam....] Subject: Re: //Re: AI + Ranking /// Thread-Topic: //Re: AI + Ranking /// [....] Content-Type: multipart/related; boundary="------------79Bu5A16qPEYcVIZL@tutanota" --------------79Bu5A16qPEYcVIZL@tutanota Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 DQo8ZGl2IHN0eWxlPSJmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3 NfTVNGb250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6 [...base64 encoding of the spam....] --------------79Bu5A16qPEYcVIZL@tutanota-- --------------5jyKrhQ08xXUif7LHhgg648N-- =============================================== I face two issues: 1. Only the base64 decoded string can be retrived through foreverypart/extracttext; 2. It has a lot of newlines. - 2. is not a big deal. The original spam has a lot of HTML junk, and each line with HTML without an inner text node is stripped, but the newline is kept. I don't know if this is intended. - 1. is more of a big deal. To try to confirm that, I made an over-simplified version of the Sieve script (I skip configuration but plugins are loaded etc, please ask if useful). =============================================== [...require...] foreverypart { extracttext "eml"; debug_log "PART ============================== ${eml}"; } =============================================== mail_debug is activated. In the logs, I can read: =============================================== Info: sieve: DEBUG: PART ============================== Info: sieve: DEBUG: PART ============================== Info: sieve: DEBUG: PART ============================== Info: sieve: DEBUG: PART ============================== Info: sieve: DEBUG: PART ============================== Info: sieve: Info: sieve: Info: sieve: Info: sieve: Info: sieve: Info: sieve: Info: sieve: Hello, Info: sieve: Info: sieve: Hope you're doing well. Info: sieve: Info: sieve: Info: sieve: Info: sieve: Info: sieve: Would you like attract more traffic with our AEO + GEO + SEO services. AI-driven search is here—don’t miss out. =============================================== So multiple parts are analyzed but only the last gives something. The RFC says that "If the transfer encoding or character set is unrecognized by the implementation or recognized but invalid, an empty string will result.". But it's over my knowledge. I activated trace for Sieve with "matching" level, and the file looks like (this is another test but was the same result): =============================================== Sieve trace log for message delivery: Username: REDACTED Session ID: ozNMOEPNl2nlAAAAO14Lzw Sender: REDACTED Final recipient: REDACTED Default mailbox: INBOX ## Started executing script 'move-spam' 33: foreverypart loop begin 33: loop ends at line 36 35: extracttext command 36: assign 'eml' [0] = "" 36: debug_log "PART ============================== " 36: foreverypart loop end 36: switched to next message part 36: looping back to line 35 35: extracttext command 36: assign 'eml' [0] = "" 36: debug_log "PART ============================== " 36: foreverypart loop end 36: switched to next message part 36: looping back to line 35 35: extracttext command 36: assign 'eml' [0] = "" 36: debug_log "PART ============================== " 36: foreverypart loop end 36: switched to next message part 36: looping back to line 35 35: extracttext command 36: assign 'eml' [0] = "" 36: debug_log "PART ============================== " 36: foreverypart loop end 36: switched to next message part 36: looping back to line 35 35: extracttext command 36: assign 'eml' [0] = "Hi, Just checking in to see if you had a chance to review my earlier message. [...body spam....] 36: debug_log "PART ============================== ????????????Hi, ?? ??Just checking in t..." 36: foreverypart loop end 36: no more message parts 36: exiting loops at line 36 ## Finished executing script 'move-spam' =============================================== Hypothesis: A. Could it be because the mail headers are indistinguishable from the part headers? B. Or is it related to Pigeonhole not implementing yet the enclose extension, which do this the other way? I hope this message is not too hard to read with all the code/logs. Please tell me if there is a better way of doing it. And thanks in advance for any help, because I don't really know what to do and trying to take a (superficial) look at the Pigeonhole code didn't helped.

1 2

Panic: file imap-sieve-storage.c: line 216 (imap_sieve_add_mailbox_event): assertion failed: (ismt->src_box == NULL || ismt->src_box == src_box)
by Christian Kivalo 28 Feb '26

28 Feb '26

Reposting my reply from a few days ago to a thread with the same panic message. I found this in my logs when some mails that got deleted on the phone were still visible in roundcube. I currently have three users that trigger the panic. One user with an iPad accounts for nearly all of the panics. The problem shows when the account is accessed from android (thunderbird) or ipad. The same accounts show no problems when beeing used with roundcube or thunderbird on windows. I enabled core dumps on 2026-01-14 and have ~8500 core dumps of the imap binary until now. What causes this error and how can I fix it? In the logs all I see is the users login, then the panic. # doveconf -n # 2.4.2-2+debian13 (0962ed2104): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.2-2+debian13 (767418c3) # OS: Linux 6.12.0-custom.kvm x86_64 Debian 13.3 ext4 2026-01-13T21:44:32.317609+01:00 uschi dovecot: imap-login: Logged in: user=<user(a)example.com>, method=PLAIN, rip=<IP1>, lip=<IP2>, mpid=4194077, TLS, session=<cpkID0tId7dUc9rl> 2026-01-13T21:44:38.455379+01:00 uschi dovecot: imap(user(a)example.com)<4194077><cpkID0tId7dUc9rl>: Panic: file imap-sieve-storage.c: line 216 (imap_sieve_add_mailbox_event): assertion failed: (ismt->src_box == NULL || ismt->src_box == src_box) 2026-01-13T21:44:38.458755+01:00 uschi dovecot: imap(user(a)example.com)<4194077><cpkID0tId7dUc9rl>: Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 [unw_get_proc_name() failed: -10] -> #3 i_panic[0x7f6b6c46c2f6] -> #4 [unw_get_proc_name() failed: -10] -> #5 [unw_get_proc_name() failed: -10] -> #6 [unw_get_proc_name() failed: -10] -> #7 mailbox_save_alloc[0x7f6b6ca103c0] -> #8 [unw_get_proc_name() failed: -10] -> #9 command_exec[0x55654e677400] -> #10 [unw_get_proc_name() failed: -10] -> #11 [unw_get_proc_name() failed: -10] -> #12 [unw_get_proc_name() failed: -10] -> #13 client_handle_input[0x55654e67ddc0] -> #14 client_continue_pending_input[0x55654e67e0b0] -> #15 io_loop_call_io[0x7f6b6c565490] -> #16 io_loop_handler_run_internal[0x7f6b6c567230] -> #17 io_loop_handler_run[0x7f6b6c5673c0] -> #18 io_loop_run[0x7f6b6c5675a0] -> #19 master_service_run[0x7f6b6c4b27f0] -> #20 main[0x55654e6688a0] -> #21 [unw_get_proc_name() failed: -10] -> #22 __libc_start_main[0x7f6b6c234ce0] -> #23 _start[0x55654e668eb0] 2026-01-13T21:44:38.459536+01:00 uschi dovecot: imap(user(a)example.com)<4194077><cpkID0tId7dUc9rl>: Fatal: master: service(imap): child 4194077 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) # coredumpctl dump PID: 1071230 (imap) UID: 5000 (vmail) GID: 5000 (vmail) Signal: 6 (ABRT) Timestamp: Fri 2026-01-16 19:17:15 CET (2s ago) Command Line: $'dovecot/imap [user(a)example.com <IP redacted> UID MOVE]' Executable: /usr/lib/dovecot/imap Control Group: /system.slice/dovecot.service Unit: dovecot.service Slice: system.slice Boot ID: 3668d179bda340229a780d5d43e426c3 Machine ID: 05698baa30ae984c9bd014566e16da18 Hostname: uschi Storage: /var/lib/systemd/coredump/core.imap.5000.3668d179bda340229a780d5d43e426c3.1071230.1768587435000000.zst (present) Size on Disk: 1.1M Message: Process 1071230 (imap) of user 5000 dumped core. Module libgcc_s.so.1 from deb gcc-14-14.2.0-19.amd64 Module libstdc++.so.6 from deb gcc-14-14.2.0-19.amd64 Module libzstd.so.1 from deb libzstd-1.5.7+dfsg-1.amd64 Stack trace of thread 1071230: #0 0x00007fbd1ca9f95c n/a (libc.so.6 + 0x9495c) #1 0x00007fbd1ca4acc2 raise (libc.so.6 + 0x3fcc2) #2 0x00007fbd1ca334ac abort (libc.so.6 + 0x284ac) #3 0x00007fbd1cc6caa0 n/a (libdovecot.so.0 + 0x6caa0) #4 0x00007fbd1cd49e67 n/a (libdovecot.so.0 + 0x149e67) #5 0x00007fbd1cc6c3d0 i_panic (libdovecot.so.0 + 0x6c3d0) #6 0x00007fbd1c42f942 n/a (lib95_imap_sieve_plugin.so + 0x4942) #7 0x00007fbd1c431223 n/a (lib95_imap_sieve_plugin.so + 0x6223) #8 0x00007fbd1d258f10 n/a (libdovecot-storage.so.0 + 0x11bf10) #9 0x00007fbd1d1a843b mailbox_save_alloc (libdovecot-storage.so.0 + 0x6b43b) #10 0x00005590b7ed4a69 n/a (n/a + 0x0) ELF object binary architecture: AMD x86-64 -- Christian Kivalo

5 12

LDAP AD Quota override not working
by wt.forsaken＠gmail.com 26 Feb '26

26 Feb '26

Hi there, I'm testing the new version of Dovecot 2.4 in Debian 13 before upgrading to my customers and I'm having difficult on trying to override the user's quota. The LDAP base is from Samba4 AD and having been trying the following configuration: auth-ldap.conf.ext: ldap_uris = ldap://localhost ldap_auth_dn = cn=admin,dc=localdomain ldap_auth_dn_password = password ldap_base = ou=users, dc=localdomain passdb ldap { filter = (&(objectClass=person)(sAMAccountName=%{user})) bind = yes fields { userdb_quota_storage_size = %{ldap:telephoneNumber}B } } userdb prefetch { driver = prefetch } userdb ldap { fields { quota_storage_size = %{ldap:telephoneNumber}B } } 90-quota.conf mail_plugins { quota = yes } quota "User quota" { } quota_storage_size = 40M Since there is no quotaBytes in Samba AD, I'm testing to map the telephoneNumber parameters to override the quota, also I'm just testing a 40M to see how it works. Roundcube webmail can see the quota being overriden in its inferior bar, but when I send an email to the user which is above the quota, the journal log inform "failed to store into mailbox 'INBOX': Quota exceeded (mailbox for user is full)". I don't know how to override the quota, since in passdb section I used the "userdb_" prefix but it is not being passed to userdb when I input the "doveadm user ..." command. I don't know if I have been clear in my request, but I'd appreciate any help.

3 3

Dovecot 2.4 LMTP socket for Postfix / Dovecot base_dir not created upon restart
by Philip Iezzi 24 Feb '26

24 Feb '26

Hi there, After over a week of Dovecot 2.3 -> 2.4 upgrade testing in various mailserver clones, I am now ready for the big picture. Thanks Aki for the Config Upgrader https://dovecot.org/upgrader/ which helped a lot! Tomorrow, I am planning to upgrade a larger mailserver in these 3 steps: 1) Debian Bullseye / Dovecot 2.3.21 => 2.4.1 2) Debian Bullseye => Bookworm / Dovecot 2.4.1 => 2.4.2 3) Debian Bookworm => Trixie Postfix needs to talk to Dovecot over LMTP, using the following in main.cf: virtual_transport = lmtp:unix:/run/dovecot/lmtp Now, while testing this in a full server clone, I stepped over my planned LMTP server setup: =============================================== service lmtp { unix_listener /run/dovecot/lmtp { mode = 0666 user = postfix group = postfix } } protocols = imap pop3 sieve lmtp =============================================== The socket needs to be owned by postfix:postfix for some (security) reasons, otherwise Postfix complains. That's why I cannot go with the default, as documented here: https://doc.dovecot.org/2.4.2/core/config/delivery/lmtp.html#lmtp-server > The UNIX listener on $base_dir/lmtp is enabled by default when protocols setting contains lmtp. But, when using an absolute path on unix_listener, upgrade step 2) Bullseye=>Bookworm breaks with: Processing triggers for dovecot-core (2:2.4.2-2+debian12) ... Job for dovecot.service failed because the control process exited with error code. (...) dovecot[34446]: master: Error: service(lmtp): Socket already exists: /var/run/dovecot/lmtp dovecot[34446]: master: Fatal: Failed to start listeners I then moved to `unix_listener lmtp`: service lmtp { unix_listener lmtp { mode = 0666 user = postfix group = postfix } } Bookworm upgrade (restarted from scratch with a fresh server clone) went through fine. But even after several dovecot.service restarts, the socket ended up in /run/lmtp without creating the /run/dovecot directory, and after a full system reboot, it was suddenly back where I have expected it: /run/dovecot/lmtp I never changed base_dir, which defaults to /var/run/dovecot/ So, here's my question: Is that really the recommended setup (using `inet_listener lmtp` instead of an absolute path) and how can I trust Dovecot to always create the socket in $base_dir/lmtp as documented? Are you guys aware of this issue or was it just me, a temporary hiccup on my just upgraded server? I just found this in mail.log: dovecot: master: Error: bind(/var/run/dovecot/lmtp) failed: No such file or directory dovecot: master: Error: service(lmtp): net_listen_unix(/var/run/dovecot/lmtp) failed: No such file or directory dovecot: master: Fatal: Failed to start listeners Again, this problem seems to have occurred both with `unix_listener /run/dovecot/lmtp` and `unix_listener lmtp` and only resolved after a full system reboot. Thanks, Philip

2 2

Migrating a mailbox from v2.2 to v2.4, production server to pre-production server.
by Mike 23 Feb '26

23 Feb '26

I'm migrating a mailbox from dovecot v2.2 to v2.4. Not that it matters, I'm also changing from mbox to Maildir. As an initial test I used this command: sudo doveadm sync -1D -u theuser -m amailbox remote:theuser@destination.com I received this error: Error: doveadm: Unexpected or incomplete option: -U After changing the dsync_remote_cmd to: dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u I was able to transfer the mailbox without issue. Before changing it, the setting on the source server was: dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u -U I'm interested to discover what the -U was intended for since I couldn't find specific documentation to its use. I'll accept that it was a legacy thing and removing it won't cause any unintended consequences...but I do still have that curiosity about what it was for. Additionally, the subscription status doesn't seem to flow to the new server. When checking the source server with: doveconf -d | grep subscriptions doveconf -n | grep subscriptions No value is returned...So I'm wondering if I need to specifically set subscriptions = yes in the source server to make this happen properly. Maybe this is an artifact of using sync -1? Thanks for any insight you may provide. Mike

1 0

Localhost Dovecot server without ssl?
by Steve Litt 23 Feb '26

23 Feb '26

Hi all, I'd like your opinions to add to my own opinion. Bottom line question: If I trust everybody with physical access to my Daily Driver Desktop (DDD) computer, my Dovecot IMAP runs on my DDD, I access my Dovecot IMAP *exclusively* from my DDD, and I trust everybody with physical access to my DDD (that would be my wife), then if I serve out IMAP on localhost (127.0.0.1), am I being unduly risky using plain text auth (port 143)? Details: I use a Dovecot IMAP server, on my DDD, specifically to hold all my email messages. Therefore, I can use any IMAP aware email client, interchangeably, to view every email I've received since April 2001. People whose emails are held by their email clients are "locked in" to their email client unless they convert their email data. I can switch between Evolution and Claws-Mail, because one of the two is always doing something stupid. Bottom line: I use Dovecot IMAP exclusively to hold my emails and folders. Graphical description below: ISP ---> My --------> procmail --> Dovecot IMAP fetchmail Maildir | | V email <--- Dovecot client IMAP server For the time being, I don't need to access my Dovecot IMAP from any computer except my DDD, and therefore, I can serve Dovecot IMAP on 127.0.0.1. So here's my question. Assuming (and I know this is a big assumption) I'm not worried about somebody gaining physical possession of my DDD, is there any reason not to use plain text to access this server? Thanks, SteveT Steve Litt http://444domains.com

2 1

Copies/duplicates of Dovecot indices
by Joseph Tam 23 Feb '26

23 Feb '26

In my setup, I put mail indices outside the user's mailbox locations (user mailboxs are NFS, indices stored local attached storage). I notice that sometimes, there are 2 sets of indices representing the same mailbox: one at top level, one underneath .imap/. (They usually appear in the latter.) For example, if I have the configuration (Dovcot version 3.2.21) mail_location = mbox:~/mail:INBOX=/nfs/mail/%n:INDEX=/cache/%n I see for a particular user [1] drwx------ 5 user group 512 Feb 22 21:56 /cache/user/box [2] drwxr-xr-x 5 user group 512 Feb 22 21:46 /cache/user/.imap/box cooresponding to their mailbox in ~user/mail/box. Each of these have the dovecot.* index files. If I delete [1], it comes back. The timestamps are close to each other so both sets are being used, possibly by different clients. Another quirky discovery is 2 /.imap/ folders beneath each other e.g. /cache/user/.imap/folder1/folder2/.imap/box/dovecot.index What determines which index pathname gets created or used? Joseph Tam <jtam.home(a)gmail.com>

1 0

2.3 replication issue throwing errors
by Paul Kudla 22 Feb '26

22 Feb '26

shows same error on both servers Server 1 : # sync faye(a)scom.ca doveadm(faye(a)scom.ca)<90952><BJq9J2dHmGlIYwEA0dxyZQ>: Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID f982a82747469869ea0f0100cf58dcff (maybe it was just deleted?) Server 2: # sync faye(a)scom.ca doveadm(faye(a)scom.ca)<90952><BJq9J2dHmGlIYwEA0dxyZQ>: Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID f982a82747469869ea0f0100cf58dcff (maybe it was just deleted?) i am aware there is a mismatch on one of the servers but there does not seem to be a clear cut way to find the offending file to delete it or force a backwards sync ? How would i identify what GUID f982a82747469869ea0f0100cf58dcff means? same on both servers. doveadm force-resync -u faye(a)scom.ca '*' have tried reindex etc etc etc issue persists logs ?? mail18 02-20 06:45:24 {dovecot} [67632] (3014654310) doveadm(faye(a)scom.ca)<71073><hOl0ClRJmGmhFQEAz1jc/w>: Debug: open(/proc/self/stat) failed: No such file or directory mail18 02-20 06:45:24 {dovecot} [67632] (3014654311) doveadm(faye(a)scom.ca)<71073><hOl0ClRJmGmhFQEAz1jc/w>: Debug: open(/proc/self/io) failed: No such file or directory mail18 02-20 06:45:24 {dovecot} [67632] (3014654312) doveadm(faye(a)scom.ca)<71073><hOl0ClRJmGmhFQEAz1jc/w>: Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ any help would be appreciated -- Thanks - Paul Kudla (Manager SCOM.CA Internet Services Inc.) Have A Happy Friday AND Happy Sucessful 2026 ! Scom.ca Internet Services <http://www.scom.ca> 104-1009 Byron Street South Whitby, Ontario - Canada L1N 4S3 Toronto 416.642.7266 Main 1.866.411.7266 Fax 1.888.892.7266 Email paul(a)scom.ca

2 2

How do you use doveadm fetch -S
by Steve Litt 20 Feb '26

20 Feb '26

Hi all, I have a working plain text 127.0.0.1:143 Dovecot 2.4.2 on my Qemu VM guest. The following command displays the Receive date, From and Subject for every email in my golugTech mailbox, exactly like the docs say it should: =================================================== doveadm fetch -u slitt "date.received hdr.from hdr.subject" mailbox golugTech =================================================== But when I add the -S in order to specify the 127.0.0.1 listener at port 143, it throws the following error: =================================================== [slitt@mydesk ~]$ cat junk.jnk [root@dovecotvoid dovecot]# doveadm fetch -S 127.0.0.1:143 -u slitt "date.received hdr.from hdr.subject" mailbox golugTech doveadm(slitt): Error: conn 127.0.0.1:143 (127.0.0.1:143): doveadm server sent invalid handshake: * OK Waiting for authentication process to respond.. doveadm(slitt): Error: cmd fetch: 127.0.0.1:143: Command fetch failed for slitt: Connection closed [root@dovecotvoid dovecot]# [slitt@mydesk~]$ =================================================== The docs say -S is to specify the socket_path, and it should be expressed as hostname:port. For hostname, besides 127.0.0.1, I tried localhost and dovecotvoid, the latter of which should not work because dovecotvoid is not 127.0.0.1, it's 10.0.2.15. The docs say "This allows an administrator to execute doveadm(1) mail commands through the given socket." So I guess finding the server isn't the purpose of socket_path. My plain text 143 Dovecot 2.4.2 IMAP works just fine without the -S. Is there ever a case where doveadm fetch would need to know the specific address and port of the dovecot IMAP server, and if so, how would I specify it? Thanks, SteveT Steve Litt http://444domains.com

2 1

What replaced mail_home in 2.4.2?
by Steve Litt 20 Feb '26

20 Feb '26

Hi all, In my Dovecot 2.4.2 virtual machine guest I've used mail_home to indicate the value of ~ and presumably of ${home}. However, the only documentation I can find on mail_home is on https://doc.dovecot.org/main/core/summaries/settings.html#mail_home , which is NOT a 2.4.2 document. I find no reference to mail_home on any 2.4.2 documentation. Has something replace mail_home, and if so what's it called and can I put it outside of any {} blocks? Thanks, SteveT Steve Litt http://444domains.com

2 2

mail_utf8_extensions and IMAP Folder Naming
by max.wriedt＠rehost.eu 20 Feb '26

20 Feb '26

i just upgraded my 2.3 installation to 2.4. I like to be bleeding edge and i want to use SMTPUTF8. I came across problems with mailboxes that have german umlauts. when enabling "mail_utf8_extensions=yes" e.g. Microsoft Outlook gives me mUTF-7 encoded folder names. Also the folder names when list via openssl s_client are encoded in mUTF-7. Am i missing something or can i disable utf8 for IMAP (UTF8=ACCEPT) only, but keep for LMTP Transport/SMTPUTF8 from postfix to dovecot? I am using mdbox format as storage, if that matters. My namespace config (shortened): namespace inbox { inbox = yes type = private #mailbox_list_utf8 = yes # also tried this -> when folder didn't exist before it would create a new one with utf8, no matter mail_utf8_extensions is on or off mailbox Drafts { auto = no special_use = \Drafts } mailbox Entw&APw-rfe { special_use = \Drafts } mailbox Entw%26APw-rfe { special_use = \Drafts } mailbox Entw\&APw-rfe { special_use = \Drafts } mailbox Entwürfe { auto = create special_use = \Drafts } mailbox Trash { auto = no special_use = \Trash quota_storage_percentage = 110 } mailbox "Gel&APY-schte Elemente" { special_use = \Trash quota_storage_percentage = 110 } mailbox "Gelöschte Elemente" { auto = subscribe special_use = \Trash quota_storage_percentage = 110 } mailbox Sent { auto = no special_use = \Sent } mailbox Archiv { auto = subscribe special_use = \Archive } mailbox Spam { special_use = \Junk auto = no } }

3 4

2.4.2 breaks user iterations for LDAP
by cpfeiffer＠rev-crew.info 20 Feb '26

20 Feb '26

Hello everyone, Due to the fix for CVE-2025-30189, routines like userdb_ldap_preinit() call auth_cache_parse_key_and_fields() unconditionally, with the eventually called auth_cache_parse_key_exclude() erroring if a cache key could not be constructed. It’s also noteworthy that this call happens regardless of whether use_cache is set or not, and as of such failing to construct a cache key would cause an error even if use_cache = no was set for that database. This is however an issue for user iteration with LDAP, as documented here LDAP | Dovecot CE <https://doc.dovecot.org/2.4.2/core/config/auth/databases/ldap.html#user-ite…> . Such a userdb only has iterate_filter fields that would inherently not be containing any user variables. The call to auth_cache_parse_key_and_fields() uses a combination of ldap_base and userdb_ldap_filter anyway (so whatever is in iterate_filter isn’t considered), and for an iteration userdb as described in the documentation, the latter would be empty. Alas, I ended up getting the rather confusing error * auth: Fatal: auth-cache: dc=rev-crew,dc=info: Cache key must contain at least one variable With dc=rev-crew,dc=info being my ldap_base setting for the iteration userdb. I’m not critically dependent on the user iteration, so I’ve commented the userdb out for now, but this would need fixing. Regards, Christian Pfeiffer Hello everyone, Due to the fix for CVE-2025-30189, routines like userdb_ldap_preinit() call auth_cache_parse_key_and_fields() unconditionally, with the eventually called auth_cache_parse_key_exclude() erroring if a cache key could not be constructed. It's also noteworthy that this call happens regardless of whether use_cache is set or not, and as of such failing to construct a cache key would cause an error even if use_cache = no was set for that database. This is however an issue for user iteration with LDAP, as documented here [1]LDAP | Dovecot CE. Such a userdb only has iterate_filter fields that would inherently not be containing any user variables. The call to auth_cache_parse_key_and_fields() uses a combination of ldap_base and userdb_ldap_filter anyway (so whatever is in iterate_filter isn't considered), and for an iteration userdb as described in the documentation, the latter would be empty. Alas, I ended up getting the rather confusing error o auth: Fatal: auth-cache: dc=rev-crew,dc=info: Cache key must contain at least one variable With dc=rev-crew,dc=info being my ldap_base setting for the iteration userdb. I'm not critically dependent on the user iteration, so I've commented the userdb out for now, but this would need fixing. Regards, Christian Pfeiffer References Visible links 1. https://doc.dovecot.org/2.4.2/core/config/auth/databases/ldap.html#user-ite…

4 5

Search for missing To: header?
by Joseph Tam 20 Feb '26

20 Feb '26

Is there a proper way to torture doveadm search query to look for messages with a missing "To:" header? I played around with it and this seems to work: doveadm fetch -A text mailbox {box} NOT TO '' (Looking through a large spam corups: spam often exclude recipients in the headers as it gives the game away their personalized fraud was blasted to hundreds of addresses.) Joseph Tam <jtam.home(a)gmail.com>

1 0

More Dovecot 2.4 woes: LDAP cache bug and virtual autosubscribe
by sev monster 19 Feb '26

19 Feb '26

8 months ago I messaged this list communicating some of the issues I had with 2.4. Before I could even start testing 2.4 properly, 2 bugs had to be fixed—one that caused crashes on startup (https://gitlab.alpinelinux.org/alpine/aports/-/issues/17050) and one that caused passdb to use the same caching key for all connections and as such always have the same user log in. There was another bug, one that prevented me from using LDAP binds for passdb, but it had a workaround that mostly worked without side-eeffects. All of those have since been fixed, hurray! So in my infinite naïveté, I decided to give 2.4 another shake. And it, again, does not work. Surprise! I did manage to massage the configuration to allow me to at least run 2.4 without crashing and with users able to access (most of) their mailboxes, but there are still blockers to full functionality. I face the following issues: 1. Christian Pfeiffer back in November found a bug where auth caching with LDAP did not work, and due to how it's implemented, even turning caching off would still raise an error. I experienced the same issue for both userdb iteration and passdb bind logins. I had to comment out the userdb and use a static one instead (all my users, currently, use the same UID and easily composable path, so this wasn't a big deal) and start using a service account for LDAP binds. 2. Virtual mailbox autosubscribe does not work anymore. It throws an error about trying to create the virtual mailbox. This worked in 2.3. My virtual mailbox config: namespace virtual { type = private prefix = Search Folders. mail_driver = virtual mail_path = /etc/dovecot/virtual mail_index_path = ~/dovecot-virtual.cache mail_control_path = ~/dovecot-virtual.cache mail_volatile_path = ~/dovecot-virtual.cache hidden = yes list = children subscriptions = no mailbox All { auto = subscribe special_use = \All comment = All messages, excluding Junk and Trash } mailbox Unread { auto = subscribe special_use = \Important comment = All unread messages, excluding Junk and Trash } mailbox Flagged { auto = subscribe special_use = \Flagged comment = All flagged messages } } If there is something wrong with this config that might be responsible for my issue, please let me know. Otherwise, I believe this is a regression. I understand autosubscribe is documented to (and in other situations with non-virtual boxes) create mailboxes if missing, so if this is actually a fix to make the feature work as documented, we need a new option that allows for autosubscription without attempting to create the mailbox. Otherwise, my users will not know they even have these mailboxes—no one anymore knows or cares about mailbox (re: folder) subscription and won't know where to look to get them to show up in their client. With autosubscribe enabled, I can see the mailboxes in my mail client without explicitly subscribing, but attempting to open them will throw a server error. Removing the setting will make the mailbox disappear without going into settings and explicitly subscribing. Any ETA on the first bug being fixed, and any help with the second issue (bug or not) would be greatly appreciated. Best regards. P.S.: I wanted to spread this information that wasn't mentioned at all in the documentation. The shadow passdb was removed in the move to 2.4; why exactly is neither here nor there, though I will remark that I still don't know why it was done. I had believed at the time this necessitated enabling PAM for Dovecot, which it is not by default in my distro's package (Alpine), so if I wanted to continue allowing local users to log in, I would have to build Dovecot it myself and install PAM, neither of which I particularly wanted to do. I did play with passwd-file in the past, but there were issues with it that prevented me from using it—I don't remember what they were exactly, but I believe they have since been fixed, since in my testing now it does seem to work properly in the use-cases I tested. Anyway, while going over my config and getting ready to re-install PAM, I had a thought. /etc/shadow uses the same format for the first two fields as /etc/password, and Dovecot still (supposedly) allows for passwords to be used when reading /etc/password, so wouldn't it be possible to point the driver at the shadow file? Turns out, yes, it works! I am now able to authenticate local users from /etc/shadow again. Thanks to this, I no longer need to build with PAM support and don't need to install PAM on a PAM-less system. I hope this isn't considered a bug or something and support for this use-case is removed, because I really don't want to bother once again with adding PAM when I don't have to. :)

2 2

Fedora 43 and Dovecot version 2.4.2
by Bill Steinberg 19 Feb '26

19 Feb '26

Hello, I am running Fedora 43 on a server which is running a dovecot server, version 2.4.1-8. I am not running a cluster, there is only one dovecot server running on the Fedora 43 instance. Redhat has just updated the dovecot version on Fedora 43 to version 2.4.2-5. I would like to upgrade dovecot to version 2.4.2. I assume that the dovecot_config_version should be changed to 2.4.2. Should the dovecot_storage_version be changed to 2.4.2 as well? Are there any steps that should be taken to upgrade the dovecot storage to version 2.4.2? FYI the mail_driver on the dovecot server is mbox: mail_driver = mbox. Best regards, -Bill Hello, I am running Fedora 43 on a server which is running a dovecot server, version 2.4.1-8. I am not running a cluster, there is only one dovecot server running on the Fedora 43 instance. Redhat has just updated the dovecot version on Fedora 43 to version 2.4.2-5. I would like to upgrade dovecot to version 2.4.2. I assume that the dovecot_config_version should be changed to 2.4.2. Should the dovecot_storage_version be changed to 2.4.2 as well? Are there any steps that should be taken to upgrade the dovecot storage to version 2.4.2? FYI the mail_driver on the dovecot server is mbox: mail_driver = mbox. Best regards, -Bill

2 1

deliver fails because of a permission issue with SSL private key file
by Markus Schönhaber 19 Feb '26

19 Feb '26

Hi, I'm trying to make Postfix hand incoming mail to Dovecot by using Dovecot's deliver. But this fails with a permission error: > Feb 17 15:50:12 debian13-cont postfix/pipe[13133]: 171C17206: to=<recipient(a)dest.examle.org>, relay=dovecot, delay=0.17, delays=0.1/0/0/0.07, dsn=5.3.0, status=bounced (Command died with status 89: "/usr/lib/dovecot/deliver". Command output: doveconf: Fatal: Error in configuration file /etc/dovecot/certs.conf line 3: key_file: open(/etc/ssl/private/ssl-cert-snakeoil.key) failed: Permission denied ) How can I solve this (short of making the private key file world readable, of course)? Regards mks I have this in Postfix' master.cf: > dovecot unix - n n - - pipe > flags=DROhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -e -f ${sender} -a ${recipient} -d ${user}@${domain} # LANG=C id vmail uid=501(vmail) gid=501(vmail) groups=501(vmail),104(ssl-cert) # LANG=C ls -l /etc/ssl/private/ total 4 -rw-r----- 1 root ssl-cert 1704 Feb 4 17:15 ssl-cert-snakeoil.key # doveconf -n # 2.4.2-2+debian13 (0962ed2104): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.2-2+debian13 (767418c3) # OS: Linux 6.19.0-2-MANJARO x86_64 Debian 13.3 btrfs # Hostname: debian13-cont dovecot_config_version = 2.4.2 dovecot_storage_version = 2.4.2 log_debug = category=sql mail_driver = sdbox mail_gid = vmail mail_home = /var/spool/vmail/home/%{user | domain}/%{user | username} mail_path = /var/spool/vmail/mail/%{user | domain}/%{user | username} mail_plugins { quota = yes } mail_uid = vmail protocols = imap lmtp sieve sql_driver = mysql mysql localhost { dbname = postfixadmin password = # hidden, use -P to show it user = postfixadmin } passdb sql { query = SELECT 'vmail' AS userdb_uid, 'vmail' AS userdb_gid, CONCAT('/var/spool/vmail/home/', maildir) AS userdb_home, CONCAT(quota, 'B') AS userdb_quota_storage_size, username AS user, password FROM mailbox WHERE username = '%{user}' AND active = '1'; } userdb prefetch { } userdb sql { iterate_query = SELECT username AS user FROM mailbox WHERE active = '1'; query = SELECT 'vmail' AS uid, 'vmail' AS gid, CONCAT('/var/spool/vmail/home/', maildir) AS home, CONCAT(quota, 'B') AS quota_storage_size, username AS user, password FROM mailbox WHERE username = '%{user}' AND active = '1'; } namespace inbox { inbox = yes separator = / mailbox Drafts { special_use = "\\Drafts" } mailbox Entwürfe { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox "Gelöschte Objekte" { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Gesendete Objekte" { special_use = "\\Sent" } } service auth { inet_listener tcp_auth { port = 12345 } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service auth-worker { } ssl_server { cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem key_file = /etc/ssl/private/ssl-cert-snakeoil.key } protocol imap { mail_plugins { imap_quota = yes } } quota "User quota" { } dict_server { dict mysql { driver = sql sql_driver = mysql dict_map priv/quota/messages { sql_table = quota username_field = username dict_map_value_field messages { } } dict_map priv/quota/storage { sql_table = quota username_field = username dict_map_value_field bytes { } } } } quota_clone { dict proxy { name = mysql } }

6 14

dovecot 2.4 changes
by Curtis J Blank 18 Feb '26

18 Feb '26

I just did a Tumbleweed upgrade. then I had to fix dovecot. No warning that dovecot was going to break what so ever. Below is all the things I had to fix. And then I could not read my email in Thunderbird because you changed: mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u to mail_driver = mbox mail_path = ~/mail mail_inbox_path = /var/spool/mail/%{user} and the "%u" to "%{user}" was the showstopper. What a crock of BS! I spent 3 hours determining the problem and then fixing dovecot because you decided to make major changes for no good reason. It worked just fine the way it was. You could have automated the changes by providing a utility that would make the changes the first time it started up after the upgrade. I had to try to start dovecot and when it failed to start look in the log and see the error and fix it. Over and over and over and over and over and over and over and... Like I said what a bunch of BS! Yes this is a rant. And maybe openSuSE's is too blame also. Jan 24 03:33:35 server dovecot[2223449]: doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 25: The first setting must be dovecot_config_version Jan 24 03:36:45 server dovecot[4626]: doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 25: The first setting must be dovecot_config_version Jan 24 03:46:10 server dovecot[21464]: doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 2: Invalid dovecot_config_version: Currently supported versions are: 2.4.0 2.4.1 2.4.2 Jan 24 03:48:45 server dovecot[22135]: doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 92: dict { } is missing section name Jan 24 03:51:47 server dovecot[28824]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/auth-system.conf.ext line 10: passdb { } is missing section name Jan 24 03:53:22 server dovecot[29258]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/auth-system.conf.ext line 10: passdb { } is missing section name Jan 24 03:55:26 server dovecot[29906]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/auth-system.conf.ext line 49: userdb { } is missing section name Jan 24 03:56:57 server dovecot[30179]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-director.conf line 40: inet_listener { } is missing section name Jan 24 03:58:37 server dovecot[30652]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-logging.conf line 64: Unknown section name: plugin Jan 24 04:01:32 server dovecot[37805]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-mail.conf line 31: mail_location: Unknown setting: mail_location Jan 24 04:05:30 server dovecot[38898]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-mail.conf line 32: mail_location: Unknown setting: mail_location Jan 24 04:06:35 server dovecot[39158]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 23: ssl_cert: Unknown setting: ssl_cert Jan 24 04:09:07 server dovecot[39707]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 25: ssl_server_cert_file: open(/etc/dovecot/conf.d/-----BEGIN CERTIFICATE----- Jan 24 04:09:07 server dovecot[39707]: doveconf: Fatal: -----END CERTIFICATE----- Jan 24 04:09:07 server dovecot[39707]: doveconf: Fatal: ) failed: File name too long Jan 24 04:14:52 server dovecot[47156]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 27: ssl_server_cert_file: open(/etc/dovecot/conf.d/-----BEGIN CERTIFICATE----- Jan 24 04:14:52 server dovecot[47156]: doveconf: Fatal: -----END CERTIFICATE----- Jan 24 04:14:52 server dovecot[47156]: doveconf: Fatal: ) failed: File name too long Jan 24 04:17:35 server dovecot[54187]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 72: ssl_dh: Unknown setting: ssl_dh Jan 24 04:19:04 server dovecot[54532]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 93: ssl_prefer_server_ciphers: Unknown setting: ssl_prefer_server_ciphers Jan 24 04:21:07 server dovecot[60961]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-acl.conf line 11: Unknown section name: plugin Jan 24 04:22:40 server dovecot[61409]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-acl.conf line 17: Unknown section name: plugin Jan 24 04:23:35 server dovecot[61624]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-plugin.conf line 9: Unknown section name: plugin Jan 24 04:24:40 server dovecot[61932]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-quota.conf line 17: Unknown section name: plugin Jan 24 04:25:38 server dovecot[62301]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-quota.conf line 41: Unknown section name: plugin Jan 24 04:26:12 server dovecot[62335]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-quota.conf line 69: Unknown section name: plugin Jan 24 04:26:42 server dovecot[62550]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-quota.conf line 78: Unknown section name: plugin Jan 24 04:27:05 server dovecot[62582]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-sieve-extprograms.conf line 9: Unknown section name: plugin Jan 24 04:28:11 server dovecot[62819]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-sieve.conf line 24: Unknown section name: plugin Jan 24 04:29:02 server dovecot[63099]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-sieve.conf line 39: sieve: Unknown setting: sieve Jan 24 04:36:01 server dovecot[71295]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-sieve.conf line 39: sieve: Unknown setting: sieve Jan 24 04:39:04 server dovecot[72067]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-sieve.conf line 40: sieve: Unknown setting: sieve (sieve_script_sieve or sieve_script_personal_sieve not found either.) Jan 24 04:47:39 server dovecot[86665]: doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf: ssl_options: unknown flag: 'no_compression' Jan 24 04:50:51 server dovecot[93375]: doveconf: Fatal: dovecot_storage_version setting must be set Jan 24 05:01:51 server dovecot[105836]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-mail.conf line 31: mail_location: Unknown setting: mail_location Jan 24 05:06:18 cjbnew dovecot: imap(bob)<107288><SOtYQyBJTOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:06:18 cjbnew dovecot: imap(bob)<107288><SOtYQyBJTOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:06:18 cjbnew dovecot: imap(bob)<107289><9+pYQyBJTeXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:06:18 cjbnew dovecot: imap(bob)<10Jan 24 05:06:18 cjbnew dovecot: imap(bob)<107288><SOtYQyBJTOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:06:18 cjbnew dovecot: imap(bob)<107288><SOtYQyBJTOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:06:18 cjbnew dovecot: imap(bob)<107289><9+pYQyBJTeXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:06:18 cjbnew dovecot: imap(bob)<107289><9+pYQyBJTeXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=07557289><9+pYQyBJTeXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:08:38 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:08:38 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:11:10 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:11:10 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:15:09 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:473 mode=0755) Jan 24 05:15:09 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:473 mode=0755) Jan 24 05:18:35 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, we're not in group 473(mail), dir owned by 0:473 mode=0775) Jan 24 05:18:35 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, we're not in group 473(mail), dir owned by 0:473 mode=0775) Jan 24 05:19:09 cjbnew dovecot: imap(bob)<122933></apLcSBJaKrAqBTq>: Disconnected: Connection closed (SELECT finished 0.138 secs ago) in=102 out=787 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Jan 24 05:19:58 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, we're not in group 473(mail), dir owned by 0:473 mode=0775) Jan 24 05:19:58 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, we're not in group 473(mail), dir owned by 0:473 mode=0775) Jan 24 05:20:20 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, we're not in group 473(mail), dir owned by 0:473 mode=0775) Jan 24 05:20:20 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, we're not in group 473(mail), dir owned by 0:473 mode=0775) Jan 24 05:21:17 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, we're not in group 473(mail), dir owned by 0:473 mode=0775) Jan 24 05:21:17 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, we're not in group 473(mail), dir owned by 0:473 mode=0775)

12 19

"Synchronization corrupted index header" with mdbox: thousands of deleted e-mails reappeared in INBOX
by Ákos Szőts 17 Feb '26

17 Feb '26

Hi everyone, Suddenly, the following messages appeared in my Dovecot error log: master: Warning: Killed with signal 15 (by pid=0 uid=0 code=kill) Error: Mailbox Trash: Synchronization corrupted index header [...]/Trash/dbox-Mails/dovecot.index: uidvalidity=0, but next_uid=73 Warning: Mailbox Trash: fscking index file [...]/Trash/dbox-Mails/dovecot.index Warning: mdbox([...]/mail/storage): rebuilding indexes: Mailbox Trash index was fsck'd Warning: mdbox([...]/mail/storage): fscking index file [...]/index/inbox/storage/dovecot.map.index Error: Mailbox INBOX: [...]/INBOX/dbox-Mails/dovecot.index reset, view is now inconsistent The first message is because I restarted the container. Since then, Thunderbird shows thousands of previously deleted e-mails again in INBOX where all my messages are marked as unread. - Do you know what can cause it and how can I avoid to happen again? - Is the used mdbox storage engine that fragile? Is the fault tolerance of other engines better? I have a backup from some days ago. Is it possible to somehow revert back to it and sync the new e-mails on top of those? Version: 2.4.2. Thank you, Ákos

2 1

Most relevant documents for 2.4.x config file syntax
by Steve Litt 16 Feb '26

16 Feb '26

Hi all, Some time has gone by, so I'm hoping there's some good documentation for somebody needing syntax help on building a 2.4.x Dovecot. I've seen https://doc.dovecot.org/2.4.0/installation/upgrade/2.3-to-2.4.html , but it's not useful to me because I don't know *where* all those various pieces go. Which things go in what curly braces? It doesn't say. https://doc.dovecot.org/2.4.2/core/config/quick.html looks like an excellent starting place. Do you agree? What other *simple* documentation do you recommend? Because I am not and never was a Dovecot expert, I'll need something that does a considerable amount of teaching: A sort of Dovecot 4.2 For Dummies type thing. Thanks, SteveT Steve Litt http://444domains.com

3 4

Configuration upgrade tool
by Aki Tuomi 15 Feb '26

15 Feb '26

Hi! To make migrating from Dovecot 2.3 to 2.4 a bit easier, we are now providing a tool that helps upgrade your existing configuration. The tool allows you to upload either a full dovecot.conf or selected ancillary configuration files from a 2.3 setup, and will attempt to convert them accordingly. You can find the tool here: https://dovecot.org/upgrader/ We do not store any of the configurations processed by the tool, nor do we track who uses it. It's offered as-is, without any warranty or guarantee. If you run into any issues, unexpected results, or have feedback about the tool, please let us know — it’s very much appreciated. Please note that the tool can make mistakes, so we strongly recommend carefully reviewing and testing the output before using it in production. There are currently no plans to release this tool as open source. Regards, Aki Tuomi Open-Xchange oy

11 18

Sdbox/mdbox purge on Public folders
by luke+dovecot＠psy.io 15 Feb '26

15 Feb '26

Hi dovecot mailing list people, After having looked through the mailing list archives, tried various search engines & asked an LLM to hallucinate an answer all to no avail, I now pose the following question to you all: For a Dovecot 2.4 system that uses mail_driver = mdbox for regular mailboxes and also has a public namespace, how might I invoke the maintenance routine of `doveadm purge` against the m.1, m.2 ... m.N files under the mail_path location? Below is the snippet of what I have in the configuration files for the public namespace: namespace public { type = public separator = / prefix = Public/ mail_path = /var/spool/mail/Public mail_index_private_path = ~/public subscriptions = yes mailbox "communal" { auto = subscribe } } Since my dovecot instance is a self-hosted matter, I am in a position to move all mail data out of there, delete any left over storage files and change the mail_driver to Maildir, if that is the easiest way to manage the risk of dbox m file sprawl/growth. Best regards, Luke

2 1

Is there a lint utility for 2.4.x configuration?
by Steve Litt 14 Feb '26

14 Feb '26

Hi all, I use a local Dovecot IMAP server to store all my emails, which I access from either Claws-Mail or Evolution. On 7/7/2025 my email stopped working, a few hours of troubleshooting led to a Dovecot problem, a few more hours led to the 2.3 to 2.4 config file changes, and the next 3 days I went without email while trying to get a working 2.4. Finally I managed to downgrade back to 2.3.x and restore the config from backup, and didn't lose too many emails. I've waited 6 months for all the dust to settle, and now I'm going to try to make a test VM (Void Linux) with 2.4.x, using phony baloney data because I don't want to lose my email capabilities again. So my first question is this: Is there a lint utility for my configuration, so that I can cut down on experimenting with 50 different variables at once and reading conflicting documentation? Here's what I know so far about lint utilities: * I know doveconf -n and dovecot -n dump non-default settings, but I don't think they can detect syntax errors. * dovecot-sysreport doesn't seem to give me info about syntax errors. * None of the doveadm commands seem to check syntax. Thanks, SteveT Steve Litt http://444domains.com

2 3

My plan for a test Dovecot 2.4.2
by Steve Litt 14 Feb '26

14 Feb '26

Hi all, I need to thoroughly test Dovecot 2.4.2 on a Virtual Machine before upgrading my real machine. Please tell me whether you think this plan is good... I install Void Linux, my Daily Driver Distro, on a Qemu VM. I also install Dovecot and Claws-Mail. Then I copy part or all of my current (2.3.21.1 (d492236fa0)) maildir to the VM, and work until I can configure a Dovecot on the VM that serves IMAP only, SSL only (ssl = required on 2.3.x), such that Claws-Mail can read, search and delete messages on the VM just the same as on 2.3.21.1 on my daily driver. I'm using few or no Dovecot features other than using it as a Maildir driven IMAP server. Maildir is a must because I write to it from Procmail, and Procmail doesn't write every kind of mail storage. Does this sound like a good, safe way to test before upgrading? Thanks, SteveT Steve Litt http://444domains.com

1 0

Clean up of dovecot.index.pvt.log files
by Sad Clouds 14 Feb '26

14 Feb '26

Hello, I'm trying to understand how to clean up old dovecot.index.pvt.log files, which are used for per user private \Seen flags. Running "doveadm purge" does not seem to remove them. I have the following public namespace configured: namespace public { type = public separator = / prefix = Public/ inbox = no hidden = no mail_driver = mdbox mail_path = /data/mailstore/%{user|domain|lower}/mail_public/mdbox mail_index_private_path = ~/mdbox/Public.index.pvt # Enable user private \Seen flags list = yes subscriptions = no # Allow users in the 'admin' group to have complete control over the namespace acl group=admin { rights = lrwstipekxa } } The problem is - if the admin deletes a public folder, the old dovecot.index.pvt.log files forever remain in all of the users' home mailbox directories, like tombstones. I see two ways around it: 1. Attempt to store private index files in the original folder's mail path, so when the folder is deleted, all files underneath it are also deleted automatically: mail_path = %{mail_directory}/Public.index.pvt/%{user|domain|lower} However there appears to be no %{mail_directory} variable which would expand to mdbox/mailboxes/<folder_name>/dbox-Mails/ and even if there was one, with public folders, for every user subscribed to this folder, there would be a user-specific directory just for the private index file. This may not scale well with thousands of users. 2. Run a cron script to list all public folders and then compare ~/mdbox/Public.index.pvt directory of each user for stale private index files which refer to non-existent folders. This can probably be done efficiently with commands like find, awk and sed, but it feels a bit cumbersome and arcane. Can anyone suggest any other or better alternatives to solve this issue? Thanks.

1 0

shared mailbox on 2.3 - will I avoid concurrency (mailbox corruption) issues if both users are on the same server
by daniel.botting＠codethink.co.uk 13 Feb '26

13 Feb '26

Hi all, Currently we are running 2.3, with a plan to move to 2.4 later this year. Our current setup is two replicating servers, I have setup on my test servers a shared name space as this is a limited requirement at this time for an assistant to view their managers inbox. I had read here: https://doc.dovecot.org/2.3/configuration_manual/shared_mailboxes/cluster_s… For two or more servers Director is required because (taken from the docs): As mentioned in Director, you can’t have multiple servers accessing the same user at the same time or it will lead into trouble. This can become problematic with shared mailboxes, because two users who are sharing a folder may run in different servers. As this is a limited requirement at this time and we'll be migrating to 2.4 where Director has been removed (I read the Docs that there is an unsupported replacement) if I have both the manager and the assistant only accessing the managers inbox via the same server will I avoid concurrency issues (ie I presume mailbox corruption). Many thanks and have a nice weekend Daniel

1 1

Rebuilding missing index/paths
by Alain Perry 13 Feb '26

13 Feb '26

Hello, First of all, I'm sorry if this isn't the best place to ask for that kind of help, in which case I'd appreciate a pointer to any adequate asynchronous channel. ------------ Some context (skip to next horizontal line if you don't care): I'm happily self-hosting a few services at home. Some months ago I decided I needed to backup my emails to my NAS, in a way that would allow me to read or search them from a web browser as easily as I did with my "cloud" mailboxes. Since I didn't find a modern yet simple webmail that could directly read a Maildir storage, I finally bit the bullet and ran a dovecot container to copy my emails to (using imapsync). Since I opted for an IMAP server, I thought I didn't need to worry too much about the storage format and used the sdbox that (I believe) was the default. Backing up worked and searching worked and I was a happy person. I used my local webmail a couple of times to search for an old email, found it, thought this was a job well done that I wouldn't have to worry too much about anymore. Then, it stopped working. I honestly don't remember what I did around that time that might have broken things or caused a data loss, but IMAP clients couldn't access my emails anymore. Since I had other more urgent matters to address, I let that problem rot. Now that I have a bit more time, I decided to try again. ------------ My problem is that, while it is clear that some data is missing, I have no clue what that data is and how (if ?) I can rebuild it. The folder structure is there in /src/vmail/username/Mail/mailboxes. I do see index(.log) and dbox-Mails/u.* in the folders, so it does look like it conforms to the doc in this regard. However, the paths returned for the mailboxes by "doveadm mailbox path" all use guid's, and do not exist on the filesystem. I don't quite understand how it got to this point, nor what I should have lying around at those paths but I wonder if it is at all possible to rebuild them so I might regain access to my archives. Is there something I can do to recover my emails ? Thanks for reaching this point, and thank you for any help and/or pointers you might be able to provide. Regards,

2 2

History Assignment Writing Help – Expert Assistance
by Theo Wilson 13 Feb '26

13 Feb '26

Struggling with your history assignments? Our History Assignment Writing Help service offers expert guidance to help you craft well-researched, structured, and original assignments. Fill out this form to get personalized support from experienced writers and improve your grades with ease. https://www.newassignmenthelp.co.uk/history-assignment-help

1 0

fts-flatcurve change index location
by grabsoon＠gmail.com 12 Feb '26

12 Feb '26

hi is there any way to change location ONLY FOR flatcurve indexes all I want is to write fts-flatcurve directories outside ~/Maildir path I do not want to change location of: dovecot.list.index.log dovecot.mailbox.log dovecot-uidvalidity Only for flatcurve indexes. when i set mail_index_path = ~/Indexes all indexes are saved to this new location, not just flatcurve i'm afraid that changing mail_index_path value on production environment is very riski Thanks

2 1

Re: 2.4: fts flatcurve remove?
by Michael Slusarz 11 Feb '26

11 Feb '26

> On 02/10/2026 3:07 PM MST Bjoern Franke via dovecot <dovecot(a)dovecot.org> wrote: > > in the pre release docs > https://doc.dovecot.org/main/core/man/doveadm-fts.1.html#fts-flatcurve-remo… > > doveadm fts flatcurve remove > > was mentioned, but in https://doc.dovecot.org/2.4.2/ it's gone. ? https://doc.dovecot.org/2.4.2/core/man/doveadm-fts.1.html#fts-flatcurve-rem…

2 1

2.4: fts flatcurve remove?
by Bjoern Franke 11 Feb '26

11 Feb '26

Hi, in the pre release docs https://doc.dovecot.org/main/core/man/doveadm-fts.1.html#fts-flatcurve-remo… doveadm fts flatcurve remove was mentioned, but in https://doc.dovecot.org/2.4.2/ it's gone. So, how to remove the flatcurve data again? Simply a find ...--delete? Regards Bjoern

1 0

doveadm quota get issue in lcx container
by Kim Haverblad 09 Feb '26

09 Feb '26

Hi, I'm having some issues getting the quota plugin to work properly. Based on the error message, it looks like the plugin doesn't fully cooperate with Proxmox mount points for LXC containers. It appears to be referencing the secondary disk directly as /dev/nvme1n1p1, rather than the actual mount point inside the container. Here's the full error message: mlgate:/usr/lib/systemd/system# doveadm quota get -u [1]some(a)example.com doveadm([2]some(a)example.com): Error: Failed to get quota resource STORAGE: quota-fs: quotactl(Q_GETQUOTA, /dev/nvme1n1p1) failed: No such file or directory Are there any parameters that need to be adjusted to make this work, or is there an alternative plugin that would handle this setup better? //Kim

2 1

In an email client, tasks accumulate and are queued using the IMAP protocol
by Lafiel Elentari 08 Feb '26

08 Feb '26

Hello. By default, the email client uses 4 IMAP connections. However, tasks often hang, and changes to email statuses made via the web interface are not reflected in the client. I tried enabling imap-hibernate, which cleared the queue, but the issue with updating email statuses persisted. Is this a problem with the email client or the Dovecot server? -- Best regards, Lafiel Elentari mailto:lafiel@elven.pw

1 0

Configuring the Outbox folder in an email client
by Lafiel Elentari 08 Feb '26

08 Feb '26

Hello. The Bat! email client, when using the IMAP protocol, comes with three pre-defined folders: "Outbox," "Sent Mail," and "Trash." While setting up the "Sent Mail" and "Trash" folders is simple, configuring the "Outbox" folder may be less obvious. How should it be set up? Is it correct to designate the Drafts folder for this purpose? -- Best regards, Lafiel Elentari mailto:lafiel@elven.pw

1 0

doveadm sync panic
by Roberto Puzzanghera 07 Feb '26

07 Feb '26

I am experiencing a consistent panic while using doveadm sync on Dovecot v2.4.2. The panic occurs during a synchronization attempt between two servers. It appears that the sync panics when entering in a .Junk.Something folder. Any idea? I attach the log lines and my configuration Any help would be appreciated Roberto # doveadm -D sync -u postmaster@domain-tld tcp:10.0.0.24:12345 [...] Feb 06 22:39:46 doveadm(postmaster(a)domain.tld): Panic: file hash.c: line 252 (hash_table_insert_node): assertion failed: (opcode == HASH_TABLE_OP_UPDATE) Feb 06 22:39:46 doveadm(postmaster(a)domain.tld): Error: Raw backtrace: libdovecot.so.0(backtrace_append+0x40) [0x7f7bba941860] -> libdovecot.so.0(backtrace_get+0x22) [0x7f7bba9419b2] -> libdovecot.so.0(+0x14fc12) [0x7f7bba94fc12] -> libdovecot.so.0(+0x14fc41) [0x7f7bba94fc41] -> libdovecot.so.0(+0x72375) [0x7f7bba872375] -> libdovecot.so.0(+0x732c3) [0x7f7bba8732c3] -> doveadm(dsync_mailbox_tree_build_name128_hash+0x9a) [0x55e5f58108ba] -> doveadm(dsync_mailbox_tree_fill+0x750) [0x55e5f5811bb0] -> doveadm(dsync_brain_mailbox_trees_init+0x192) [0x55e5f58055b2] -> doveadm(dsync_brain_master_init+0x191) [0x55e5f5801f51] -> doveadm(+0x3544b) [0x55e5f57e644b] -> doveadm(+0x3794e) [0x55e5f57e894e] -> doveadm(doveadm_cmd_ver2_to_mail_cmd_wrapper+0x244) [0x55e5f57e9684] -> doveadm(doveadm_cmdline_run+0x593) [0x55e5f57fd473] -> doveadm(doveadm_cmdline_try_run+0xba) [0x55e5f57fc67a] -> doveadm(main+0x2fd) [0x55e5f57dacfd] -> libc.so.6(__libc_start_main+0xcd) [0x7f7bba4fd03d] -> doveadm(_start+0x2a) [0x55e5f57db0ea] # doveconf -n # 2.4.2 (): /usr/local/dovecot/etc/dovecot/dovecot.conf # Pigeonhole version 2.4.2 (767418c3) # OS: Linux 6.15.3 x86_64 Slackware 15.0 # Hostname: qt dovecot_config_version = 2.4.2 auth_allow_cleartext = yes auth_allow_weak_schemes = yes auth_default_domain = mydomain.tld auth_mechanisms = plain login auth_socket_path = ../../../var/run/dovecot/auth-userdb debug_log_path = /var/log/dovecot/dovecot.log default_login_user = vpopmail doveadm_password = # hidden, use -P to show it dovecot_storage_version = 2.4.2 first_valid_gid = 89 first_valid_uid = 89 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes hostname = mydomain.tld last_valid_gid = 89 last_valid_uid = 89 listen { * = yes :: = no } log_debug = category=mail log_path = /var/log/dovecot/dovecot.log mail_access_groups = 89 mail_driver = maildir mail_gid = 89 mail_path = ~/Maildir mail_plugins { notify = yes fts = no fts_solr = no quota = yes } mail_privileged_group = 89 mail_uid = 89 mailbox_list_validate_fs_names = no passdb_default_password_scheme = SHA512-CRYPT postmaster_address = postmaster(a)mydomain.tld protocols { imap = yes pop3 = yes sieve = yes } sendmail_path = /var/qmail/bin/sendmail sql_driver = mysql ssl_min_protocol = TLSv1.1 passdb sql { query = SELECT CONCAT(vpopmail.pw_name, '@', vpopmail.pw_domain) AS user, vpopmail.pw_passwd AS password, vpopmail.pw_dir AS userdb_home, 89 AS userdb_uid, 89 AS userdb_gid, CONCAT(REPLACE(SUBSTRING_INDEX(vpopmail.pw_shell, 'S', 1), 'NOQUOTA', '0'), 'B') AS userdb_quota_storage_size FROM vpopmail LEFT JOIN aliasdomains ON aliasdomains.alias='%{user | domain}' LEFT JOIN limits ON limits.domain='%{user | domain}' WHERE vpopmail.pw_name='%{user | username}' AND (vpopmail.pw_domain='%{user | domain}' OR vpopmail.pw_domain=aliasdomains.domain) AND ('%{local_port}'!='995' OR !(vpopmail.pw_gid & 2)) AND ('%{remote_ip}'!='10.0.0.4' OR !(vpopmail.pw_gid & 4)) AND ('%{remote_ip}'='10.0.0.4' OR '%{local_port}'!='993' OR !(vpopmail.pw_gid & 8)) AND ('%{remote_ip}'!='10.0.0.4' OR COALESCE(disable_webmail,0)!=1) AND ('%{remote_ip}'='10.0.0.4' OR COALESCE(disable_imap,0)!=1) } userdb prefetch { driver = prefetch } userdb sql { iterate_query = SELECT CONCAT(pw_name,'@',pw_domain) AS user FROM vpopmail query = SELECT vpopmail.pw_dir AS home, 89 AS uid, 89 AS gid, CONCAT(REPLACE(SUBSTRING_INDEX(vpopmail.pw_shell, 'S', 1), 'NOQUOTA', '0'), 'B') AS quota_storage_size FROM vpopmail WHERE vpopmail.pw_name='%{user | username}' AND vpopmail.pw_domain='%{user | domain}' } namespace inbox { inbox = yes mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { autoexpunge = 30d special_use = "\\Junk" } mailbox Junk.TeachSpam { auto = subscribe autoexpunge = 30d } mailbox Junk.TeachNotSpam { auto = subscribe autoexpunge = 30d } mailbox Trash { autoexpunge = 60d special_use = "\\Trash" quota_storage_extra = 100M } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } protocol !indexer-worker { mail_vsize_bg_after_count = 100 } maildir { broken_filename_sizes = yes } service imap-login { inet_listener imap { } inet_listener imaps { } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service imap { executable = imap postlogin } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login ../../etc/scripts/dovecot_postlogin.sh user = vpopmail unix_listener postlogin { group = vchkpw mode = 0660 user = vpopmail } } service auth { user = $SET:default_internal_user unix_listener auth-userdb { group = vchkpw mode = 0660 user = vpopmail } } service auth-worker { user = $SET:default_internal_user } service stats { unix_listener stats-reader { group = vchkpw mode = 0660 user = vpopmail } unix_listener stats-writer { group = vchkpw mode = 0660 user = vpopmail } } protocol lda { mail_plugins { sieve = yes mail_log = yes } } protocol imap { mail_plugins { notify = yes mail_log = yes imap_sieve = yes imap_quota = yes } } service managesieve-login { inet_listener sieve { port = 4190 } } service managesieve { } protocol pop3 { mail_plugins { notify = yes mail_log = yes } } language en { default = yes } quota "User quota" { driver = count storage_grace = 10M quota_warning overquota { quota_storage_percentage = 100 execute quota-warning { args = 100 %{user} } } quota_warning warn-95 { quota_storage_percentage = 95 execute quota-warning { args = 95 %{user} } } quota_warning warn-85 { quota_storage_percentage = 85 execute quota-warning { args = 85 %{user} } } } service quota-warning { executable = script ../../etc/scripts/quota-warning.sh user = vpopmail unix_listener quota-warning { group = vchkpw mode = 0660 user = dovenull } } sieve_script personal { active_path = ~/.sieve/dovecot.sieve driver = file path = ~/.sieve } sieve_script move-spam { cause = delivery path = /usr/local/dovecot/etc/sieve/move-spam.sieve type = before } mysql 10.0.0.112 { dbname = vpopmail_test password = # hidden, use -P to show it user = vpopmail_test } ssl_server { cert_file = /etc/ssl/certs/dovecot.pem key_file = /etc/ssl/private/dovecot.pem }

2 1

About mail_inbox_path and mail location
by Aki Tuomi 06 Feb '26

06 Feb '26

Hi! We've been noticing that many people are configuring mail_inbox_path. I assume that for most people this is because debian decided to include it in their default config, so that it would use /var/mail boxes for user INBOXes. If your inbox *does not* reside in some weird location, you should *not* set this setting to any value, instead you can either ensure it's commented out, or set to empty value. IN PARTICULAR, IT IS **NOT** REQUIRED SETTING. Setting it to some random weird value like '.' will just cause Problems, setting it to $MAIL_HOME/ or something else will just be either pointless or cause problems. Some most common conversions (please adjust to your environment) mail_home= /home/vmail/%u => mail_home = /home/vmail/%{user} mail_home = /home/vmail/%d/%u => mail_home = /home/vmail/%{user|domain}/%{user|username} or some variant of this. mail_location = maildir:~/ => mail_path = ~/ mail_driver = maildir mail_location = maildir:/var/srv/foo/%d/%u => mail_path = /var/srv/foo/%{user|domain}/%{user|username} mail_driver = maildir In addition you might want to convert INDEX=~/.index => mail_index_path=~/.index CONTROL=~/.control => mail_control_path=~/.control LAYOUT=fs => mailbox_list_layout=fs A minimal working config is mail_home=/home/vmail/%{user} mail_driver=maildir mail_path=~/maildir mail_uid=vmail mail_gid=vmail ## If you have settings like namespace other { location = maildir:/foo/bar } this converts into namespace other { mail_path = /foo/bar # optional, if this is matches your top level mail_driver = maildir } Hope this clears out some of the confusion. Aki

3 4

Pigeonhole 2.4.2 build failure: cannot find -ldovecot-ldap even without LDAP support
by adesh＠backuply.com 04 Feb '26

04 Feb '26

I'm building Pigeonhole 2.4.2 (fresh tarball from https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.2.tar.gz) against Dovecot 2.4.2 compiled without LDAP support (--without-ldap during Dovecot configure, no libdovecot-ldap.so present). The build fails at linking libdovecot-sieve.la: > > CC ext-fileinto.lo > CC ext-reject.lo > ... > CC sieve.lo > CCLD libdovecot-sieve.la > /opt/rh/devtoolset-11/root/usr/libexec/gcc/x86_64-redhat-linux/11/ld: cannot find -ldovecot-ldap > collect2: error: ld returned 1 exit status > make[4]: *** [Makefile:757: libdovecot-sieve.la] Error 1 NEWS confirms the fix is included: - sieve-ldap-storage: Fix compile without LDAP. Steps tried: make distclean && ./configure --with-dovecot=/usr/local/apps/dovecot --with-ldap=no Confirmed no openldap-devel influencing detection (or temporarily removed) Fresh source extract, no prior build artifacts Configure output shows LDAP as disabled (or paste relevant lines if different). Is there an additional flag needed, or is this a regression/edge case in 2.4.2? Any patch or workaround would be appreciated. System: RHEL-like (devtoolset-11/gcc 11), Dovecot prefix /usr/local/apps/dovecot.

1 0

How to let postfix use dovecot to check quotas for virtual aliases
by jerome＠jolimont.fr 04 Feb '26

04 Feb '26

Hi all. Receiving an email for an alias, I got those errors: <alias(a)domain.tld>Recipient address rejected: Unknown user; I realized this happened when postfix queries dovecot about user quota. Basically, what happens is that postfix queries dovecot using the virutal alias as name, not the virtual user. And since dovecot doesn't find a user under that name, it returns an error and postfix rejects the mail. ### Configuration I followed the docs at https://doc.dovecot.org/latest/core/plugins/quota.html when setting up the server. /etc/postfix/main.cf ``` smtpd_recipient_restrictions = check_policy_service unix:private/quota-status ``` /etc/dovecot/conf.d/90-quota.conf ``` service quota-status { executable = quota-status -p postfix unix_listener /var/spool/postfix/private/quota-status { user = postfix } client_limit = 1 } ``` /etc/dovecot/conf.d/auth-sql.conf.ext ``` userdb sql { query = SELECT '/var/mail/vmail/'||maildir AS home, 110 AS uid, 113 AS gid, quota || 'B' AS quota_storage_size FROM mailbox WHERE username = '%{user}' iterate_query = SELECT username FROM mailbox } ``` ### Solution 1: modify user query This issue was reported and analyzed here: https://dovecot.dovecot.narkive.com/FtjhqCuU/postfix-aliases-with-quota-sta… and there: https://github.com/docker-mailserver/docker-mailserver/issues/2091 A comment (https://dovecot.dovecot.narkive.com/FtjhqCuU/postfix-aliases-with-quota-sta…) suggests to modify the SQL query to also look for aliases. I modified my query like so: ``` query = SELECT '/var/mail/vmail/'||maildir AS home, 110 AS uid, 113 AS gid, quota || 'B' AS quota_storage_size FROM mailbox JOIN alias ON mailbox.username = alias.goto WHERE alias.address = '%{user}'; ``` and it seemed to work. I mean, I can query user quota with an alias: doveadm quota get -u alias(a)domain.tld but the iterate query ignores aliases so doveadm quota get -A only lists users, not aliases (which is what I want) and I can't IMAP login using aliases (which is also what I want) since I didn't modify the password query either. I find this configuration slightly inconsistent: the user query returns aliases, not the iterate query. Is the user query really meant to return aliases as well? Also, I realized this query is broken for alias to multiple addresses. I'd get the following error: Recipient address rejected: Unknown user Surprisingly, it seems to only affect messages from an external source to an alias pointing to an external mailbox. Messages submitted locally (and perhaps messages sent to an alias to local destinations only, I'm not sure) were not affected. ### Solution 2: ignore aliases, it will fail later anyway On another server, I had this configuration: /etc/dovecot/conf.d $ vi 90-quota.conf (Don't put this in `plugin` on dovecot 2.4+.) ``` plugin { quota_status_success = DUNNO quota_status_nouser = DUNNO quota_status_overquota = "552 5.2.2 Mailbox is full" } ``` The alias is unknown so the check returns DUNNO and postfix lets the message pass (postfix log read "delivered via spamassassin service") but then it fails at sieve stage when writing the message: sieve: msgid=<xxx>: failed to store into mailbox 'INBOX': Quota exceeded (mailbox for user is full) The result is what is expected: the message is rejected due to mailbox full. But I don't think it was intended to work this way. And since the message is quota-rejected at sieve stage, I could remove the `check_policy_service` line since it will be rejected for a virtual user (not alias) as well anyway. Right? ### Question What is the recommended configuration to let postfix use dovecot to check quotas for virtual aliases? I couldn't find documentation for this specific use case. Ideally, postfix would query using the resolved user, not the alias. Can this be achieved? Should I remove the check and rely on the fact that writing the message fails at a later step anyway? Thanks. (Question also posted on ServerFault: https://serverfault.com/questions/1197914/how-to-let-postfix-use-dovecot-to…)

3 3

Question about behavior I wound up patching 2.4 to fix
by Andy Baugh 03 Feb '26

03 Feb '26

Howdy, I had a complaint from RoundCube users that the maildir quotas weren't accurate when they logged in after something wound up deleting their maildirsize file on Dovecot 2.4. Since that does IMAP GETQUOTAROOT to fetch the info, I figured we're probably not triggering quota recalculation on maildir like we did on dovecot 2.3 (which doesn't seem to have this issue). Wound up writing a patch to src/plugins/imap-quota/imap-quota-plugin.c to add a hook into cmd_setquota which looks to see if imap_quota is enabled, and if so trigger maildir quota recalculation on IMAP login. This does work to solve the reported issue, but I'm ultimately more curious whether this could even be considered a regression, as per your own documentation for the quota plugin: > Once the maildirsize reaches 5120 bytes, the quota is recalculated and the file is recreated. This makes sure that if quota happens to be broken (e.g. externally deleted files) it won't stay that way forever. This suggests to me that the behavior I'm "fixing" a regression in is actually working "as designed." As such my question would be: Is there a good reason I *should not* be doing this? I would of course be happy to share this patch with the list, but I'm not going to bother if it's actually something the maintainers are not interested in due to it not being a good idea in the first place. Thanks, -- Thomas "Andy" Baugh | Software Development Engineer IV andy.baugh(a)webpros.com www.webpros.com

1 0

Unexpected Configuration Error `Unknown setting: ssl_server_cert_file`
by David Weingut 02 Feb '26

02 Feb '26

Hello, I upgraded from Debian 12 to 13 and thereby also from dovecot 2.3 to 2.4. Now I am facing a weird error in dovecot. The actual error is the following # doveconf -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 22: ssl_server_cert_file : Unknown setting: ssl_server_cert_file The corresponding entry in my config is ssl = yes ssl_server_cert_file = /etc/letsencrypt/live/example.com/fullchain.pem ssl_server_key_file = /etc/letsencrypt/live/example.com/privkey.pem I am sorry if I missed something in the archives but I did not find any similar posts. Is there something I am missing here and what would be further required to debug this? Best, David Hello, I upgraded from Debian 12 to 13 and thereby also from dovecot 2.3 to 2.4. Now I am facing a weird error in dovecot. The actual error is the following # doveconf -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 22: ssl_server_cert_file : Unknown setting: ssl_server_cert_file The corresponding entry in my config is ssl = yes ssl_server_cert_file = /etc/letsencrypt/live/example.com/fullchain.pem ssl_server_key_file = /etc/letsencrypt/live/example.com/privkey.pem I am sorry if I missed something in the archives but I did not find any similar posts. Is there something I am missing here and what would be further required to debug this? Best, David

2 3

Compiling Dovecot 2.4 on OpenBSD
by Joel Mawhorter 02 Feb '26

02 Feb '26

I'm writing to see if anyone has had success compiling Dovecot 2.4 on OpenBSD. I can't seem to find any documentation that lists prerequisites. At the moment, the 2.4.2 source tarball from the Dovecot site does not seem to compile on my OpenBSD 7.8 system and the error message is not very helpful. I'm unsure if this is just a problem of some required package not being installed. If anyone could point me to info to help move forward, I would appreciate that. Joel

6 19

How can these MBOX files on a Dovecot-based IMAP server be converted to PST for access in Outlook?
by Rawnie Dolgato 31 Jan '26

31 Jan '26

MBOX files stored on a Dovecot-based IMAP server cannot be accessed directly in Microsoft Outlook, because Outlook does not support the MBOX file format. Outlook works with PST files, so a conversion step is mandatory. While it is technically possible to convert MBOX files to EML and then import them into Outlook, this approach is impractical for real-world scenarios. It is time-consuming, difficult to manage, and not suitable when handling bulk mailboxes or large datasets, which is typically the case with server-level backups. For this reason, an MBOX to PST conversion tool (such as BitRecover MBOX to PST Converter) is recommended. It supports bulk MBOX data, preserves folder structure and metadata, and allows selective migration based on criteria like date, sender, or subject. The process runs 100% offline, ensuring data security, and works on Windows, macOS, and Linux, making it suitable for both single and multi-mailbox migrations.

2 1

Meaning of auth-worker disconnected message and relation to LMTP 451 errors on Ubuntu
by Kim Haverblad 31 Jan '26

31 Jan '26

Hi dovecot list, I’m troubleshooting an LMTP delivery issue with Dovecot and would appreciate clarification on the meaning and impact of the following log message, which appears repeatedly during delivery attempts: auth-worker(2961): Debug: conn unix:auth-worker (pid=2948,uid=107): Disconnected: Connection closed (fd=-1) *Environment* * OS: Ubuntu (latest LTS, fully up to date) * Dovecot: distribution package (current version for Ubuntu) * MTA: Postfix * Delivery: LMTP to Dovecot * User database: MySQL (userdb lookup succeeds) * Mail storage: Maildir * Quotas: enabled via userdb (quota_rule) *Context* * LMTP accepts the recipient and completes userdb lookup successfully. * The mailbox path, uid, gid, and quota are correctly returned. * Postfix later receives a 451 4.3.0 Temporary internal error after the DATA phase. * The above auth-worker ... Disconnected: Connection closed (fd=-1)message appears around the same time. *Questions* 1. Is this Disconnected: Connection closed (fd=-1) message expected/normal behavior for auth-worker processes once a lookup is complete? 2. Under what circumstances would this indicate a real problem versus a harmless connection teardown? 3. Could this message itself contribute to, or explain, LMTP 451 4.3.0 Temporary internal error responses? 4. Are there specific auth-worker, LMTP, or debug settings recommended to determine whether this disconnect is abnormal? So far, authentication and userdb lookups appear clean, and there are no explicit permission or quota errors logged, which makes it unclear whether this message is relevant to the delivery failure or simply informational. Any clarification on how to interpret this log entry — and how to confirm whether it is benign or problematic — would be greatly appreciated. Kind Regards, Kim Hi dovecot list, I'm troubleshooting an LMTP delivery issue with Dovecot and would appreciate clarification on the meaning and impact of the following log message, which appears repeatedly during delivery attempts: auth-worker(2961): Debug: conn unix:auth-worker (pid=2948,uid=107): Disconnected: Connection closed (fd=-1) Environment o OS: Ubuntu (latest LTS, fully up to date) o Dovecot: distribution package (current version for Ubuntu) o MTA: Postfix o Delivery: LMTP to Dovecot o User database: MySQL (userdb lookup succeeds) o Mail storage: Maildir o Quotas: enabled via userdb (quota_rule) Context o LMTP accepts the recipient and completes userdb lookup successfully. o The mailbox path, uid, gid, and quota are correctly returned. o Postfix later receives a 451 4.3.0 Temporary internal error after the DATA phase. o The above auth-worker ... Disconnected: Connection closed (fd=-1) message appears around the same time. Questions 1. Is this Disconnected: Connection closed (fd=-1) message expected/normal behavior for auth-worker processes once a lookup is complete? 2. Under what circumstances would this indicate a real problem versus a harmless connection teardown? 3. Could this message itself contribute to, or explain, LMTP 451 4.3.0 Temporary internal error responses? 4. Are there specific auth-worker, LMTP, or debug settings recommended to determine whether this disconnect is abnormal? So far, authentication and userdb lookups appear clean, and there are no explicit permission or quota errors logged, which makes it unclear whether this message is relevant to the delivery failure or simply informational. Any clarification on how to interpret this log entry -- and how to confirm whether it is benign or problematic -- would be greatly appreciated. Kind Regards, Kim

2 4

sieve auto-creation/subscription - Thunderbird cannot re-arrange folders
by listy 31 Jan '26

31 Jan '26

Hi guys. In Thunderbird auto-subscribed folders - in my case a path with sub-folders - cannot be moved around, meaning top-bottom order. Parent folders Thunderbird shows in cursive and sub-folders (targets for sieve fules) are shown "normal" It seems impossible to re-arrange top/parent folders - but every other folder, top or not, which is not auto created & auto subscribed, Thunderbird can move around as expected. Anybody seen, anybody knows this and knows a way to "fix" it? many thanks, L.

2 4

How can these MBOX files on a Dovecot-based IMAP server be accessed in Outlook?
by Rawnie Dolgato 31 Jan '26

31 Jan '26

MBOX files stored on a Dovecot-based IMAP server cannot be accessed directly in Microsoft Outlook, because Outlook does not support the MBOX file format. Outlook works with PST files, so a conversion step is mandatory. While it is technically possible to convert MBOX files to EML and then import them into Outlook, this approach is impractical for real-world scenarios. It is time-consuming, difficult to manage, and not suitable when handling bulk mailboxes or large datasets, which is typically the case with server-level backups. For this reason, an MBOX to PST conversion tool (such as BitRecover MBOX to PST Converter) is recommended. It supports bulk MBOX data, preserves folder structure and metadata, and allows selective migration based on criteria like date, sender, or subject. The process runs 100% offline, ensuring data security, and works on Windows, macOS, and Linux, making it suitable for both single and multi-mailbox migrations.

1 0

Subscriptions file broken in 2.4.x against 2.3.21 (V2)
by DaLiV 31 Jan '26

31 Jan '26

Hello! /eror at update from 2.3.21 to 2.4.2 / Maildir+ currently is broken. posix - so main hierarchy separator is "/" for file "subscriptions" in versions 2.4 lost possibility to recognize v2 format also as writes v1 instead with header V2 ... so all users will lost their subscriptions and must re-subscribe depsite in folder persist file in format V2 (tab separated) ... on subscribe that appends subscriptions delimeted with "/" namespace Public { type = public prefix = Public/ mail_driver = maildir mail_path = /var/mail/Public/%{auth_user|domain}/ mail_index_private_path = pvt.idx/Public mailbox_list_layout=fs separator = / subscriptions = no list = children } seems not taking in account separators and using "." instead of "/" slighlz debugged - in subsfile_set_subscribed - that gets on subscription for processing : "name"="Public/TEST" but "separator" = "." therefore splits not and decides that is version "0" ... so - somewhere deeper or possible need additional configuration Hello! eror at update from 2.3.21 to 2.4.2 Maildir+ currently is broken. posix - so main hierarchy separator is "/" for file "subscriptions" in versions 2.4 lost possibility to recognize v2 format also as writes v1 instead with header V2 ... so all users will lost their subscriptions and must re-subscribe depsite in folder persist file in format V2 (tab separated) ... on subscribe that appends subscriptions delimeted with "/" namespace Public { type = public prefix = Public/ mail_driver = maildir mail_path = /var/mail/Public/%{auth_user|domain}/ mail_index_private_path = pvt.idx/Public mailbox_list_layout=fs separator = / subscriptions = no list = children } seems not taking in account separators and using "." instead of "/" slighlz debugged - in subsfile_set_subscribed - that gets on subscription for processing : "name"="Public/TEST" but "separator" = "." therefore splits not and decides that is version "0" ... so - somewhere deeper or possible need additional configuration

1 0

New Member
by Jochen Becker 30 Jan '26

30 Jan '26

Hi all My name is Jochen and I have joined the list in order to get some first hand advice on my journey of migrating my SOHO mail server from 2.3 to 2.4. I set up my first server back in 2005 or so. OpenSuse and Cyrus IMAP. That went fine until all of a sudden, some 8 or 10 years ago, Suse no longer supported Cyrus directly. So I switched over to Dovecot and did not regret it. My current production server (OpenSuse Leap 16, Dovecot 2.4.2) is running fine after a recent migration. But the HW is ageing and disk usage is getting close to 80%. So I got new and larger HW. I run OpenSuse Leap 16.0 and Dovecot 2.4.2 on it. As I ran into unsurmountable problems there (could not move mail_path away from /var/mail), I decided to set up a test system under Ubuntu server 25.10. There I have got Dovecot running much better, but still, I ran into problems I could not solve for quite some time now. So here I am. I will start with questions about Dovecot on Ubuntu - my test system - because there I hope my mistakes are not as bad. Aki, thanks for taking me on board. Kind regards Jochen Mainz, Germany

2 1

Re: Panic: file imap-sieve-storage.c: line 216 (imap_sieve_add_mailbox_event): assertion failed: (ismt->src_box == NULL || ismt->src_box == src_box)
by Jeffrey Böhm 29 Jan '26

29 Jan '26

Hi, I’m seeing the same issue after upgrading to Dovecot 2.4.2. I reproduced it with both the Alpine Linux build and the official Dovecot Docker image referenced at [1]. In my case, the crash correlates strongly with iOS devices auto-deleting older messages from the Trash folder. As Christian described, it starts after a larger number of IMAP MOVE operations. Key finding: when I disable the imap_sieve extensions, the crashes stop. Personal Sieve rules continue to work as expected, so the problem appears to be specific to imap_sieve (or its interaction with frequent MOVE operations). > sieve_plugins { > sieve_imapsieve = no > } > > protocol imap { > mail_plugins { > imap_sieve = no > imap_filter_sieve = no > } > } My configuration with the enabled imap_sieve extension is located at [2]. Kind regards Jeff [1]: https://github.com/dovecot/docker [2]: https://github.com/jeboehm/docker-mailserver/blob/7433443ebd4af1c422cb4030c…

1 0

Migration to 2.4: Howto get the quota dict writing into a second DB
by volker.jaenisch＠inqbus.de 29 Jan '26

29 Jan '26

Dear Dovecot wizards! I have a question concerning the migration from 2.3.4 to 2.4.1. On 2.3.4 I had the following config dict { sql_store_user_quota = pgsql:/etc/dovecot/dovecot-sql-store-user_quota.conf } With /etc/dovecot/dovecot-sql-store-user_quota.conf: connect = host=127.0.0.1 port=5433 dbname=dddd user=uuuu password=pppp: map { pattern = priv/quota/storage table = fill_user username_field = username value_field = bytes } map { pattern = priv/quota/messages table = messages_user username_field = username value_field = messages } On 2.4.1 I tried dict_map priv/quota/storage { sql_table = emailaddress_fill username_field = emailaddress dict_map_value_field quota_bytes { type = uint } } dict fill { sql_driver = pgsql pgsql pg_mc2 { parameters { dbname = dddd host = hhhh password = ppppp user = uuuuu } } } But it is doing nothing. Am sure I am missing something here (I guess howto connect these config snippets). Any help appreciated. Cheers, Volker -- =========================================================== inqbus Scientific Computing GmbH Dr. Volker Jaenisch Hungerbichlweg 3 +49 (8860) 9222 7 92 86977 Burggen https://inqbus.de ===========================================================

4 8

Pigeonhole 2.4.2 build failure: cannot find -ldovecot-ldap even without LDAP support
by Adesh 29 Jan '26

29 Jan '26

Hi, I'm building Pigeonhole 2.4.2 (fresh tarball from https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.2.tar.gz) against Dovecot 2.4.2 compiled without LDAP support (--without-ldap during Dovecot configure, no libdovecot-ldap.so present). The build fails at linking libdovecot-sieve.la: > _CC ext-fileinto.lo_ > _CC ext-reject.lo_ > _..._ > _CC sieve.lo_ > _CCLD libdovecot-sieve.la_ > _/opt/rh/devtoolset-11/root/usr/libexec/gcc/x86_64-redhat-linux/11/ld: > cannot find -ldovecot-ldap_ > _collect2: error: ld returned 1 exit status_ > _make[4]: *** [Makefile:757: libdovecot-sieve.la] Error 1_ NEWS confirms the fix is included: - sieve-ldap-storage: Fix compile without LDAP. Steps tried: * make distclean && ./configure --with-dovecot=/usr/local/apps/dovecot --with-ldap=no * Confirmed no openldap-devel influencing detection (or temporarily removed) * Fresh source extract, no prior build artifacts Configure output shows LDAP as disabled (or paste relevant lines if different). Is there an additional flag needed, or is this a regression/edge case in 2.4.2? Any patch or workaround would be appreciated. System: RHEL-like (devtoolset-11/gcc 11), Dovecot prefix /usr/local/apps/dovecot. -- Thanks and Regards, Adesh Rane Hi, I'm building Pigeonhole 2.4.2 (fresh tarball from [1]https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.2.tar.…) against Dovecot 2.4.2 compiled without LDAP support (--without-ldap during Dovecot configure, no libdovecot-ldap.so present). The build fails at linking libdovecot-sieve.la: CC ext-fileinto.lo CC ext-reject.lo ... CC sieve.lo CCLD libdovecot-sieve.la /opt/rh/devtoolset-11/root/usr/libexec/gcc/x86_64-redhat-linux/11/ld: cannot find -ldovecot-ldap collect2: error: ld returned 1 exit status make[4]: *** [Makefile:757: libdovecot-sieve.la] Error 1 NEWS confirms the fix is included: - sieve-ldap-storage: Fix compile without LDAP. Steps tried: o make distclean && ./configure --with-dovecot=/usr/local/apps/dovecot --with-ldap=no o Confirmed no openldap-devel influencing detection (or temporarily removed) o Fresh source extract, no prior build artifacts Configure output shows LDAP as disabled (or paste relevant lines if different). Is there an additional flag needed, or is this a regression/edge case in 2.4.2? Any patch or workaround would be appreciated. System: RHEL-like (devtoolset-11/gcc 11), Dovecot prefix /usr/local/apps/dovecot. -- Thanks and Regards, Adesh Rane References Visible links 1. https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.2.tar.gz

1 0

Bug-Report config handling with named filters
by Patrick Cernko 27 Jan '26

27 Jan '26

Hello Dovecot devs, I think I found a bug in Dovecot's config handling. The semantic of e.g. ssl_server { cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem key_file = /etc/ssl/private/ssl-cert-snakeoil.key } in a config file is slightly different to ssl_server_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem ssl_server_key_file = /etc/ssl/private/ssl-cert-snakeoil.key If the directives are used in the second (flat) format, they can be overridden by doveadm (or the sieve* binaries), if the first (structured) version is used, they cannot be overridden. Even if the flat format is used in a "local" config file to override the default config as installed by the CE Debian package (which uses the structured), overriding the value of ssl_server_key_file on the doveadm cmdline is not possible. This prevents unprivileged users to use doveadm or the sieve* binaries as they cannot the tools will fail with an access error for the key file, even if the users knows and uses "-o ssl_server_key_file=''" or "-o ssl_server/key_file=''". I did not test overriding other settings in structured format, but I assume, that the issue is also present there. That means, settings that are specified in the structured format CANNOT be overridden with the "-o" cmdline option. I would like to ask you, to fix this issue in one of the next releases, please! Best regards, P.S.: It would be nice, if doveconf would also get a "-o" option to test overrides. -- Patrick Cernko <pcernko(a)mpi-klsb.mpg.de> +49 681 9325 5815 Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Softwaresysteme

1 0

mountpoint.c:264:33: error: implicit declaration of function ‘makedev’ [-Wimplicit-function-declaration]
by Andrew Watkins 27 Jan '26

27 Jan '26

Hello, I am trying to build dovecot-2.4.2 on Solaris 11.4 with gcc 14.2 and getting the following error: CC module-dir.lo CC mountpoint.lo mountpoint.c: In function ‘mountpoint_iter_next’: mountpoint.c:264:33: error: implicit declaration of function ‘makedev’ [-Wimplicit-function-declaration] 264 | iter->mnt.dev = makedev(ent.ext.mnt_major, ent.ext.mnt_minor); | ^~~~~~~ *** Error code 1 The following command caused the error: echo " CC " mountpoint.lo;/bin/sh ../../libtool --silent --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I../.. -std=gnu11 -g -O2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -mfunction-return=keep -mindirect-branch=keep -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -MT mountpoint.lo -MD -MP -MF .deps/mountpoint.Tpo -c -o mountpoint.lo mountpoint.c make: Fatal error: Command failed for target `mountpoint.lo' Current working directory /var/tmp/dovecot-2.4.0/src/lib *** Error code 1 I have been using dovecot for a long time and haven't seen this before. I just checked and rebuilt dovecot-2.3.21 and had no problems. Any ideas? Thanks, Andrew Hello, I am trying to build dovecot-2.4.2 on Solaris 11.4 with gcc 14.2 and getting the following error: CC module-dir.lo CC mountpoint.lo mountpoint.c: In function `mountpoint_iter_next': mountpoint.c:264:33: error: implicit declaration of function `makedev' [-Wimplicit-function-declaration] 264 | iter->mnt.dev = makedev(ent.ext.mnt_major, ent.ext.mnt_minor); | ^~~~~~~ *** Error code 1 The following command caused the error: echo " CC " mountpoint.lo;/bin/sh ../../libtool --silent --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I../.. -std=gnu11 -g -O2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -mfunction-return=keep -mindirect-branch=keep -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -MT mountpoint.lo -MD -MP -MF .deps/mountpoint.Tpo -c -o mountpoint.lo mountpoint.c make: Fatal error: Command failed for target `mountpoint.lo' Current working directory /var/tmp/dovecot-2.4.0/src/lib *** Error code 1 I have been using dovecot for a long time and haven't seen this before. I just checked and rebuilt dovecot-2.3.21 and had no problems. Any ideas? Thanks, Andrew

2 5

Blocking with RBLs
by Lefteris Tsintjelis 27 Jan '26

27 Jan '26

Hi, Is there a way to block with RBLs? I already have a really good and very trustworthy and accurate internal one that works extremely well and fast with my SMTP servers for years now. Is there a way to apply the same RBL to dovecot? Logs are really going crazy as they stopped with SMTP and started with IMAP for a while now since dovecot is wide open to these attacks. Anvil does not seem to do much here. I am looking for solutions other than fail2ban or anything similar to this. Lefteris

11 26

Possible Bug: Dovecot LDAP userdb search ignores DN template
by Esteban Heschung 25 Jan '26

25 Jan '26

Hello Dovecot Team, I am currently using *Dovecot 2.4.1* with *Windows Active Directory* via LDAPS (self-signed certificate). I have configured a *bind DN template* for authentication. Authentication works perfectly. However, when Dovecot tries to perform the *userdb lookup*, it seems to *ignore the DN template*. Instead, it attempts to perform a search using the *ldap_base and filter* I configured... According to the documentation, the *bind DN template should be sufficient*, and Dovecot should not need to perform this search. Additionally, if I *remove the ldap_base or filter fields*, Dovecot fails with an error and cannot perform the lookup at all. This results in doveadm user failing, even though authentication succeeds. Could this be a bug in the way Dovecot handles bind_userdn for LDAP userdb lookups? I would appreciate any guidance or confirmation on this behavior. Thank you for your help. Hello Dovecot Team, I am currently using Dovecot 2.4.1 with Windows Active Directory via LDAPS (self-signed certificate). I have configured a bind DN template for authentication. Authentication works perfectly. However, when Dovecot tries to perform the userdb lookup, it seems to ignore the DN template. Instead, it attempts to perform a search using the ldap_base and filter I configured... According to the documentation, the bind DN template should be sufficient, and Dovecot should not need to perform this search. Additionally, if I remove the ldap_base or filter fields, Dovecot fails with an error and cannot perform the lookup at all. This results in doveadm user failing, even though authentication succeeds. Could this be a bug in the way Dovecot handles bind_userdn for LDAP userdb lookups? I would appreciate any guidance or confirmation on this behavior. Thank you for your help.

3 5

YESCRYPT_COST_FACTOR=11 not working
by Matthias Bodenbinder 25 Jan '26

25 Jan '26

Hi, dovecot does not work with ENCRYPT_METHOD YESCRYPT and YESCRYPT_COST_FACTOR=11. I have tested with 2.4.2-4 and 2.3.21.1-4 on endeavouros. When changing YESCRYPT_COST_FACTOR to 11 in /etc/login.defs and recreacting the user password for my user and restarting the dovecot service I get: # doveadm auth test matthias Password: passdb: matthias auth failed extra fields: user=matthias When reverting the change to YESCRYPT_COST_FACTOR=5 it works again: # doveadm auth test matthias Password: passdb: matthias auth succeeded extra fields: user=matthias I have tested this back and forth. The culprit is definitely a high value for YESCRYPT_COST_FACTOR. A value of 7 is still good but a value of 9 or 11 fails. Matthias

4 11

Has anyone ever managed to link their AD to Dovecot?
by ByteWave 25 Jan '26

25 Jan '26

Are there any Dovecot configuration examples for linking an Active Directory? The documentation doesn't mention it, and my configuration only works for IMAP authentication; for some unknown reason, the user is then not found...

2 4

Question about mail_utf8_extensions on Dovecot 2.4
by Andy Baugh 25 Jan '26

25 Jan '26

Is there a reason this isn't enabled by default other than perhaps compatibility with very old systems/clients? This sounds like a pretty useful feature if I'm understanding it correctly, and there already were enough new breaking changes with 2.4 that I don't see much downside to making this the default behavior there. What am I missing? Thanks, -- Thomas "Andy" Baugh | Software Development Engineer IV andy.baugh(a)webpros.com www.webpros.com

3 4

Issue connecting Windows AD ↔ Dovecot via LDAPS
by heschung.esteban＠gmail.com 24 Jan '26

24 Jan '26

Hello, I’m trying to connect my Windows Active Directory to Dovecot 2.4.1 via LDAPS with a self-signed certificate. Authentication works correctly using the template method. I’m using a DN template for the bind DN. The ldap_base and passdb_ldap_filter field is present in my config because its required, otherwise it doen't work, maybe a internal requirement. Authentication succeeds, but sending mail fails. ldap_uris = ldaps://gr4.lan ldap_base = cn=Users,dc=gr4,dc=lan ssl_client_require_valid_cert = no # self-signed certificate passdb { driver = ldap passdb_ldap_filter = (objectClass=*) passdb_ldap_bind = yes bind_userdn = cn=%{user},cn=Users,dc=gr4,dc=lan } userdb { driver = static args = uid=vmail gid=vmail } So, the command doveadm auth test user@domain work but not doveadm user user@domain The issue in on Debian 13. Also i have print a doveadm -Dv user pol(a)gr4.lan root@deb13:/etc/dovecot/conf.d/ doveadm-Dv user pol(a)gr4.lan Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib1@_doveadm_acl plugin.so: undefined symbol: acl_user_moc ule (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/11b10_doveadm_quota_plugin.so: undefined symbol: quota_us er module (this is usually Intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/1ib20_doveadm_fts_plugin.so: undefined symbol: fts_backend_ rescan (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_flatcurve plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_fts_flatcurve_plugin.so: undefined syn bol: fts flatcurve_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadn/libdoveadm_mail_crypt_plugin.so: undefined symbol: c rypt_acl_setting_parser_info (this is usually intentional, so just ignore this message) Jan 24 18:51:29 Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Jan 24 18:51:29 Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libie_doveadm_acl_plugin.so: undefined symb ol: acl user module (this is usually intentional, so just ignore this message) Jan 24 18:51:29 Debug: Skipping nodule doveadm_quota_plugin, because diopen() failed: /usr/lib/dovecot/modules/doveadm/lib1(a)_doveadm_quota_plugin.so: undefined this message) symbol : quota_user_module (this is usually intentional, so just ignore Jan 24 18:51:29 Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symb Fol: fts backend_rescan (this is usually intentional, so just ignore this message) Jan 24 18:51:29 Debug: Skipping module doveadm_fts_flatcurve_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_fts_flatcurve_plugin.s o: undefined symbol: fts flatcurve_user_module (this is usually intentional, so just ignore this message) Skipping module doveadm_mail_crypt plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: und Jan 24 18:51:29 Debug: ef ined symbol: crypt_acl_setting_parser info (this is usually intentional, so just ignore this message) // this is normal Jan 24 18:51:29 doveadm(pol(a)gr4.lan) <2777><>: Debug: auth-master: userdb lookup (pol@gr4, lan): Started userdb lookup Jan 24 18:51:29 doveadm(pol(a)gr4.lan) <2777>>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb: Connecting Jan 24 18:51:29 doveadm(pol(a)gr4.lan) <2777><>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=2693,uid=e): Client connected (fd=9) Jan 24 18:51:35 doveadm(pol(a)gr4.lan) <2777>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=2693,uid=0): auth input: //why its empty ??? on passwd file its not Jan 24 18:51:35 doveadm(pol(a)gr4.lan) <2777>: Error: auth-master: userdb lookup(pol(a)gr4.lan): Auth USER Lookup failed //help ! Jan 24 18:51:35 doveadm(pol(a)gr4.lan) <2777><>: Debug: auth-master: userdb lookup(polegr4.lan): auth USER Input: Jan 24 18:51:35 doveadm(pol(a)gr4.lan) <2777>>: Debug: auth-master: userdb lookup(pol(a)gr4.lan): Userdb lookup failed userdb lookup: Internal error occurred. Refer to server log for more information. Jan 24 18:51:35 Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=2693,uid=0): Disconnected: Connection closed (fd=9) field value Thank for help.

3 5

Help with migration to dovecot 2.4
by Richard 23 Jan '26

23 Jan '26

Hi, I've just migrated our mail server from Debian 12 to 13. With this, dovecot was upgraded to v2.4. I was previously aware of the new config schema, but it seems the documentation wasn't enough to make the transition that smooth. I'm encountering several issues where I'd need some assistance: I have issues with message sizes not fitting: Jan 22 19:16:04 imap(user)<82612><thWtCP5I7OuGPXzg>: Error: Mailbox INBOX: UID 31518: Deleting corrupted cache record: Broken virtual size in mailbox INBOX: read(/maildirs/user/Maildir/cur/1769006028.M895618P2636851.mail,S=21001,W=21465:2,S): FETCH BODY[] got too little data: 11619 vs 21465 Jan 22 19:16:05 imap(user)<82614><Oy+wCP5I/OuGPXzg>: Error: Mailbox INBOX: UID 31517: Deleting corrupted cache record: Broken physical size in mailbox INBOX: read(/maildirs/user/Maildir/cur/1769002524.M378861P2632916.mail,S=229241,W=232394:2,S) failed: Cached message size larger than expected (229241 > 149967, box=INBOX, UID=31517) I have set maildir_broken_filename_sizes = yes in 10-mail.conf, which I expected to prevent this, but is seemingly doesn't really. Do I have to purge some cache? Also something similar happens when sending mail: Jan 22 19:26:53 indexer-worker(user)<88639><pobvLv5IOtqGPXzg:tyFvLuZrcmk/WgEApdA/4w>: Error: fts-flatcurve: fts-flatcurve(Sent): Could not write message data: uid=1075; InvalidArgumentError: Term too long (> 245): B)l�5y�h�^H1gg^W^�^O�o�]s�ቄ�^Elkhv/�g^Cok3�)�{^Ft^Cm�b�lw,�1l^B�^[u^MbҾ\�u�b�n[f�j�w;�r�y7+�eȯqu�^L^\�x^L�f�(`�xfkw�<�ǣ�x5rv^G^L)�#zhh^B_7w/ztl}^Q.�1�5a�/�q�^M�^C^_^�"^Dd�j_�o�"x^Dya͘_^_n Jan 22 19:26:53 indexer-worker(user)<88639><pobvLv5IOtqGPXzg:tyFvLuZrcmk/WgEApdA/4w>: Error: Mailbox Sent: UID 1077: Deleting corrupted cache record: Broken physical size in mailbox Sent: read(/maildirs/user/Maildir/.Sent/cur/1589821415.M621487P6382.mail,S=8285,W=8432:2,Sa) failed: Cached message size larger than expected (8285 > 3115, box=Sent, UID=1077) Jan 22 19:26:53 indexer-worker(user)<88639><pobvLv5IOtqGPXzg:tyFvLuZrcmk/WgEApdA/4w>: Error: Mailbox Sent: UID 1077: read(/maildirs/user/Maildir/.Sent/cur/1589821415.M621487P6382.mail,S=8285,W=8432:2,Sa) failed: Cached message size larger than expected (8285 > 3115, box=Sent, UID=1077) Jan 22 19:26:53 indexer-worker(user)<88639><pobvLv5IOtqGPXzg:tyFvLuZrcmk/WgEApdA/4w>: Error: Mailbox Sent: Precache for UID=1077 failed: read(/maildirs/user/Maildir/.Sent/cur/1589821415.M621487P6382.mail,S=8285,W=8432:2,Sa) failed: Cached message size larger than expected (8285 > 3115, box=Sent, UID=1077) (attempted to index 871 messages between UIDs 179..1077) And while the logs don't seem to mention it, I guess that's also interfering with receiving mails, as postfix confirms getting the mail (though it complains about not being able to write to /var/log/dovecot/error.log, but I also don't know why it would need that so I'm currently not looking into it), but it dovecot never says it received it and also no new file is created in /maildirs/user/Maildir/cur/. I have issues with some plugins. I have in 20-imap.conf and 15-lda.conf inside mail_plugins "zlib = yes", but no zlib-related module can be found. Is there a different way to enable mail compression and decompression or did Debian just miss to enable that at compilation? I also have issues with the sieve plugin. I had it enabled in 15-lda.conf, 20-managesieve.conf, 20-imap.conf and 20-lmtp.conf. As I understand I don't need all of them. At least if I do I get a weird issue (Error: Couldn't load required plugin /usr/lib/dovecot/modules/lib90_sieve_plugin.so: dlopen() failed: /usr/lib/dovecot/modules/lib90_sieve_plugin.so: undefined symbol: mail_deliver_ctx_get_log_var_expand_table). So where exactly do I enable it? Also, I'd need help modifying something I put into 90-plugins.conf: plugin { # From elsewhere to Junk folder imapsieve_mailbox1_name = Junk imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_before = file:/etc/dovecot/sieve/global/learn-spam.sieve # From Junk folder to elsewhere imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Junk imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_before = file:/etc/dovecot/sieve/global/learn-ham.sieve sieve_pipe_bin_dir = /etc/dovecot/sieve/global sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_plugins = sieve_imapsieve sieve_extprograms # Compression zlib_save_level = 4 # 1..9 zlib_save = zstd or bz2, If this config entry missing, compression is disabled. } but when I do it that way I get the error "doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-plugin.conf line 9: Unknown section name: plugin". I do have this in 90-sieve.conf: mailbox Spam { # From elsewhere to Spam folder sieve_script report-spam { type = before cause = copy path = /etc/dovecot/sieve/global/learn-spam.sieve } } # From Spam folder to elsewhere imapsieve_from Spam { sieve_script report-ham { type = before cause = copy path = /etc/dovecot/sieve/global/learn-ham.sieve } } (currently commented out), but I have no idea how exactly I fold the old config into the new one. Most of the config is already migrated, but how do I make sure that learn-spam-sieve is only running when something is moved to Junk, while learn-ham.sieve is executed when something is being moved from Junk, except when it's moved into Trash? And what exactly do I do with the last 5 configs? Sorry for the long message, but the new config scheme is a bit too different for me to understand it right away. Best regards Richard Hi, I've just migrated our mail server from Debian 12 to 13. With this, dovecot was upgraded to v2.4. I was previously aware of the new config schema, but it seems the documentation wasn't enough to make the transition that smooth. I'm encountering several issues where I'd need some assistance: I have issues with message sizes not fitting: Jan 22 19:16:04 imap(user)<82612><thWtCP5I7OuGPXzg>: Error: Mailbox INBOX: UID 31518: Deleting corrupted cache record: Broken virtual size in mailbox INBOX: read(/maildirs/user/Maildir/cur/1769006028.M895618P2636851.mail,S=21001,W=21465:2,S): FETCH BODY[] got too little data: 11619 vs 21465 Jan 22 19:16:05 imap(user)<82614><Oy+wCP5I/OuGPXzg>: Error: Mailbox INBOX: UID 31517: Deleting corrupted cache record: Broken physical size in mailbox INBOX: read(/maildirs/user/Maildir/cur/1769002524.M378861P2632916.mail,S=229241,W=232394:2,S) failed: Cached message size larger than expected (229241 > 149967, box=INBOX, UID=31517) I have set maildir_broken_filename_sizes = yes in 10-mail.conf, which I expected to prevent this, but is seemingly doesn't really. Do I have to purge some cache? Also something similar happens when sending mail: Jan 22 19:26:53 indexer-worker(user)<88639><pobvLv5IOtqGPXzg:tyFvLuZrcmk/WgEApdA/4w>: Error: fts-flatcurve: fts-flatcurve(Sent): Could not write message data: uid=1075; InvalidArgumentError: Term too long (> 245): B)l**5y**h**^H1gg^W^**^O**o**]s**qE**^Elkhv/**g^Cok3**)**{^Ft^Cm**b**lw,**1l^B**^[u^Mb*\**u**b**n[f**j**w;**r**y7+**e*qu**^L^\**x^L**f**(`**xfkw**<**a3**x5rv^G^L)**#zhh^B_7w/ztl}^Q.**1**5a**/**q**^M**^C^_^**"^Dd**j_**o**"x^Dya*_^_n Jan 22 19:26:53 indexer-worker(user)<88639><pobvLv5IOtqGPXzg:tyFvLuZrcmk/WgEApdA/4w>: Error: Mailbox Sent: UID 1077: Deleting corrupted cache record: Broken physical size in mailbox Sent: read(/maildirs/user/Maildir/.Sent/cur/1589821415.M621487P6382.mail,S=8285,W=8432:2,Sa) failed: Cached message size larger than expected (8285 > 3115, box=Sent, UID=1077) Jan 22 19:26:53 indexer-worker(user)<88639><pobvLv5IOtqGPXzg:tyFvLuZrcmk/WgEApdA/4w>: Error: Mailbox Sent: UID 1077: read(/maildirs/user/Maildir/.Sent/cur/1589821415.M621487P6382.mail,S=8285,W=8432:2,Sa) failed: Cached message size larger than expected (8285 > 3115, box=Sent, UID=1077) Jan 22 19:26:53 indexer-worker(user)<88639><pobvLv5IOtqGPXzg:tyFvLuZrcmk/WgEApdA/4w>: Error: Mailbox Sent: Precache for UID=1077 failed: read(/maildirs/user/Maildir/.Sent/cur/1589821415.M621487P6382.mail,S=8285,W=8432:2,Sa) failed: Cached message size larger than expected (8285 > 3115, box=Sent, UID=1077) (attempted to index 871 messages between UIDs 179..1077) And while the logs don't seem to mention it, I guess that's also interfering with receiving mails, as postfix confirms getting the mail (though it complains about not being able to write to /var/log/dovecot/error.log, but I also don't know why it would need that so I'm currently not looking into it), but it dovecot never says it received it and also no new file is created in /maildirs/user/Maildir/cur/. I have issues with some plugins. I have in 20-imap.conf and 15-lda.conf inside mail_plugins "zlib = yes", but no zlib-related module can be found. Is there a different way to enable mail compression and decompression or did Debian just miss to enable that at compilation? I also have issues with the sieve plugin. I had it enabled in 15-lda.conf, 20-managesieve.conf, 20-imap.conf and 20-lmtp.conf. As I understand I don't need all of them. At least if I do I get a weird issue (Error: Couldn't load required plugin /usr/lib/dovecot/modules/lib90_sieve_plugin.so: dlopen() failed: /usr/lib/dovecot/modules/lib90_sieve_plugin.so: undefined symbol: mail_deliver_ctx_get_log_var_expand_table). So where exactly do I enable it? Also, I'd need help modifying something I put into 90-plugins.conf: plugin { # From elsewhere to Junk folder imapsieve_mailbox1_name = Junk imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_before = [1]file:/etc/dovecot/sieve/global/learn-spam.sieve # From Junk folder to elsewhere imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Junk imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_before = [2]file:/etc/dovecot/sieve/global/learn-ham.sieve sieve_pipe_bin_dir = /etc/dovecot/sieve/global sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_plugins = sieve_imapsieve sieve_extprograms # Compression zlib_save_level = 4 # 1..9 zlib_save = zstd or bz2, If this config entry missing, compression is disabled. } but when I do it that way I get the error "doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-plugin.conf line 9: Unknown section name: plugin". I do have this in 90-sieve.conf: mailbox Spam { # From elsewhere to Spam folder sieve_script report-spam { type = before cause = copy path = /etc/dovecot/sieve/global/learn-spam.sieve } } # From Spam folder to elsewhere imapsieve_from Spam { sieve_script report-ham { type = before cause = copy path = /etc/dovecot/sieve/global/learn-ham.sieve } } (currently commented out), but I have no idea how exactly I fold the old config into the new one. Most of the config is already migrated, but how do I make sure that learn-spam-sieve is only running when something is moved to Junk, while learn-ham.sieve is executed when something is being moved from Junk, except when it's moved into Trash? And what exactly do I do with the last 5 configs? Sorry for the long message, but the new config scheme is a bit too different for me to understand it right away. Best regards Richard References Visible links 1. file://etc/dovecot/sieve/global/learn-spam.sieve 2. file://etc/dovecot/sieve/global/learn-ham.sieve

2 2

Public mailboxes with ACLs
by lukas＠email.it 22 Jan '26

22 Jan '26

Hi! I am setting up a new dovecot server in order to replace my old one. I am migrating from 2.3.6 to 2.4.1. I knew it would have been difficult but I didn't think so much. At the moment I am stuck in converting my configuration of Public mailboxes with ACLs. Even if I carefully checked the documentation, I do not understand clearly some point. My server has 2 Public Mailboxes that should be seen r/w by some user, read only by some other, not seen at all by all the others. Folders created in the Public Mailboxes need to have the same access privileges as the parent Public Mailbox. In 2.3 I set up a global ACL file containing the list of all privileges (some lines like "MAILBOX_NAME* user=USERNAME lrs" with the privileges of each user for the two mailboxes and their content) and it worked like a charm. I cannot get the same in 2.4. What I understand from dovecot 2.4 docs -correct me if I am wrong- is: - the global ACL file (and folder) is gone, deprecated; - I need to create a file in each folder shared in the public folder; - I need to enable "acl_driver = vfile" in 90-acl.conf. If I configure this way, it seems to work but I need to create a dovecot-acl file in every folder existing in the Public Mailbox... Given that the file is the same for every folder (since I do not need different privileges in my environment), should I really waste all of this time? Please, can you tell me if I am misunderstanding this argument? The dovecot 2.4 choice for this feature is really this or I am missing something? There is definitely no way to have something like the 2.3 global ACL file? Thank for help and patience. Bye Lukas

3 7

Configuration problem user quota
by Ruud Baart 21 Jan '26

21 Jan '26

Hi, I'm doing a migration from dovecot 2.3 to 2.4. I can't find why the user quota is not respected. In my case in version 2.3 the user quota where read from LDAP: user_attrs = mailBase=home,mailMessageStore=mail,dovecotQuota=quota_rule=*:storage=%$ I can't find how I can configure this in 2.4. The documentation refers to "quota_rule" but how and where? In 2.4 I have: userdb ldap { userdb_use_worker = yes userdb_ldap_filter = (&(objectClass=PromptMailUser)(accountStatus=TRUE)(mailDeliveryaddress=%{user})) fields { home = %{ldap:mailBase} mail = %{ldap:mailMessageStore} mail_path = %{ldap:mailMessageStore} quota_storage_size = %{ldap:dovecotQuota} } } quota "User quota" { storage_size = 5G warning warn-95 { quota_storage_percentage = 95 execute quota-warning { args = 95 %{user} } } warning warn-80 { quota_storage_percentage = 80 execute quota-warning { args = 80 %{user} } } } The global quota works (set on 5Gb). The command doveadm -D quota get -u <user> shows: Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_backend_rescan (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_flatcurve_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_fts_flatcurve_plugin.so: undefined symbol: fts_flatcurve_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: crypt_acl_setting_parser_info (this is usually intentional, so just ignore this message) Jan 21 13:53:34 Debug: Loading modules from directory: /usr/lib/dovecot/modules Jan 21 13:53:34 Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so Jan 21 13:53:34 Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Jan 21 13:53:34 Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) Jan 21 13:53:34 Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so Jan 21 13:53:34 Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_backend_rescan (this is usually intentional, so just ignore this message) Jan 21 13:53:34 Debug: Skipping module doveadm_fts_flatcurve_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_fts_flatcurve_plugin.so: undefined symbol: fts_flatcurve_user_module (this is usually intentional, so just ignore this message) Jan 21 13:53:34 Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: crypt_acl_setting_parser_info (this is usually intentional, so just ignore this message) Jan 21 13:53:34 doveadm(user(a)domain.xx)<229340><>: Debug: auth-master: userdb lookup(user(a)domain.xx): Started userdb lookup Jan 21 13:53:34 doveadm(user(a)domain.xx)<229340><>: Debug: auth-master: conn unix:/run/dovecot//auth-userdb: Connecting Jan 21 13:53:34 doveadm(user(a)domain.xx)<229340><>: Debug: auth-master: conn unix:/run/dovecot//auth-userdb (pid=229336,uid=0): Client connected (fd=9) Jan 21 13:53:34 doveadm(user(a)domain.xx)<229340><>: Debug: auth-master: conn unix:/run/dovecot//auth-userdb (pid=229336,uid=0): auth input: user(a)domain.xx home=/vmail/intern/user mail=/vmail/intern/user/Maildir/ mail_path=/vmail/intern/user/Maildir/ quota_storage_size=10G Jan 21 13:53:34 doveadm(user(a)domain.xx)<229340><>: Debug: auth-master: userdb lookup(user(a)domain.xx): auth USER input: user(a)domain.xx home=/vmail/intern/user mail=/vmail/intern/user/Maildir/ mail_path=/vmail/intern/user/Maildir/ quota_storage_size=10G Jan 21 13:53:34 doveadm(user(a)domain.xx)<229340><>: Debug: auth-master: userdb lookup(user(a)domain.xx): Finished userdb lookup (username=user(a)domain.xx home=/vmail/intern/user mail=/vmail/intern/user/Maildir/ mail_path=/vmail/intern/user/Maildir/ quota_storage_size=10G) Jan 21 13:53:34 doveadm(user(a)domain.xx)<229340><>: Debug: Added userdb setting: mail=/vmail/intern/user/Maildir/ Jan 21 13:53:34 doveadm(user(a)domain.xx)<229340><>: Debug: Added userdb setting: mail_path=/vmail/intern/user/Maildir/ Jan 21 13:53:34 doveadm(user(a)domain.xx)<229340><>: Debug: Added userdb setting: quota_storage_size=10G Jan 21 13:53:34 doveadm(user(a)domain.xx): Debug: Effective uid=118, gid=125, home=/vmail/intern/user Jan 21 13:53:34 doveadm(user(a)domain.xx): Debug: open(/proc/self/io) failed: Permission denied (euid=118(vmail) egid=125(vmail) missing +r perm: /proc/self/io) Jan 21 13:53:34 doveadm(user(a)domain.xx): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes Jan 21 13:53:34 doveadm(user(a)domain.xx): Debug: maildir++: root=/vmail/intern/user/Maildir, index=, indexpvt=, control=, inbox=/vmail/intern/user/Maildir, alt= Jan 21 13:53:34 doveadm(user(a)domain.xx): Debug: quota-count: quota_over_status check: quota_over_mask unset - skipping Jan 21 13:53:34 doveadm(user(a)domain.xx): Debug: Mailbox INBOX: Mailbox opened Jan 21 13:53:34 doveadm(user(a)domain.xx): Debug: User session is finished Jan 21 13:53:34 doveadm(user(a)domain.xx): Debug: auth-master: conn unix:/run/dovecot//auth-userdb (pid=229336,uid=0): Disconnected: Connection closed (fd=9) Quota name Type Value Limit % User quota STORAGE 9116042 5242880 173 User quota MESSAGE 60188 - 0 -- Cordialement, *R.J. Baart * Hi, I'm doing a migration from dovecot 2.3 to 2.4. I can't find why the user quota is not respected. In my case in version 2.3 the user quota where read from LDAP: user_attrs = mailBase=home,mailMessageStore=mail,dovecotQuota=quota_rule=*:storage=%$ I can't find how I can configure this in 2.4. The documentation refers to "quota_rule" but how and where? In 2.4 I have: userdb ldap { userdb_use_worker = yes userdb_ldap_filter = (&(objectClass=PromptMailUser)(accountStatus=TRUE)(mailDeliveryaddress=%{user})) fields { home = %{[1]ldap:mailBase} mail = %{[2]ldap:mailMessageStore} mail_path = %{[3]ldap:mailMessageStore} quota_storage_size = %{[4]ldap:dovecotQuota} } } quota "User quota" { storage_size = 5G warning warn-95 { quota_storage_percentage = 95 execute quota-warning { args = 95 %{user} } } warning warn-80 { quota_storage_percentage = 80 execute quota-warning { args = 80 %{user} } } } The global quota works (set on 5Gb). The command doveadm -D quota get -u <user> shows: Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_backend_rescan (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_flatcurve_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_fts_flatcurve_plugin.so: undefined symbol: fts_flatcurve_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: crypt_acl_setting_parser_info (this is usually intentional, so just ignore this message) Jan 21 13:53:34 Debug: Loading modules from directory: /usr/lib/dovecot/modules Jan 21 13:53:34 Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so Jan 21 13:53:34 Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Jan 21 13:53:34 Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) Jan 21 13:53:34 Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so Jan 21 13:53:34 Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_backend_rescan (this is usually intentional, so just ignore this message) Jan 21 13:53:34 Debug: Skipping module doveadm_fts_flatcurve_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_fts_flatcurve_plugin.so: undefined symbol: fts_flatcurve_user_module (this is usually intentional, so just ignore this message) Jan 21 13:53:34 Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: crypt_acl_setting_parser_info (this is usually intentional, so just ignore this message) Jan 21 13:53:34 doveadm([5]user(a)domain.xx)<229340><>: Debug: auth-master: userdb lookup([6]user(a)domain.xx): Started userdb lookup Jan 21 13:53:34 doveadm([7]user(a)domain.xx)<229340><>: Debug: auth-master: conn unix:/run/dovecot//auth-userdb: Connecting Jan 21 13:53:34 doveadm([8]user(a)domain.xx)<229340><>: Debug: auth-master: conn unix:/run/dovecot//auth-userdb (pid=229336,uid=0): Client connected (fd=9) Jan 21 13:53:34 doveadm([9]user(a)domain.xx)<229340><>: Debug: auth-master: conn unix:/run/dovecot//auth-userdb (pid=229336,uid=0): auth input: [10]user(a)domain.xx home=/vmail/intern/user mail=/vmail/intern/user/Maildir/ mail_path=/vmail/intern/user/Maildir/ quota_storage_size=10G Jan 21 13:53:34 doveadm([11]user(a)domain.xx)<229340><>: Debug: auth-master: userdb lookup([12]user(a)domain.xx): auth USER input: [13]user(a)domain.xx home=/vmail/intern/user mail=/vmail/intern/user/Maildir/ mail_path=/vmail/intern/user/Maildir/ quota_storage_size=10G Jan 21 13:53:34 doveadm([14]user(a)domain.xx)<229340><>: Debug: auth-master: userdb lookup([15]user(a)domain.xx): Finished userdb lookup ([16]username=user(a)domain.xx home=/vmail/intern/user mail=/vmail/intern/user/Maildir/ mail_path=/vmail/intern/user/Maildir/ quota_storage_size=10G) Jan 21 13:53:34 doveadm([17]user(a)domain.xx)<229340><>: Debug: Added userdb setting: mail=/vmail/intern/user/Maildir/ Jan 21 13:53:34 doveadm([18]user(a)domain.xx)<229340><>: Debug: Added userdb setting: mail_path=/vmail/intern/user/Maildir/ Jan 21 13:53:34 doveadm([19]user(a)domain.xx)<229340><>: Debug: Added userdb setting: quota_storage_size=10G Jan 21 13:53:34 doveadm([20]user(a)domain.xx): Debug: Effective uid=118, gid=125, home=/vmail/intern/user Jan 21 13:53:34 doveadm([21]user(a)domain.xx): Debug: open(/proc/self/io) failed: Permission denied (euid=118(vmail) egid=125(vmail) missing +r perm: /proc/self/io) Jan 21 13:53:34 doveadm([22]user(a)domain.xx): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes Jan 21 13:53:34 doveadm([23]user(a)domain.xx): Debug: maildir++: root=/vmail/intern/user/Maildir, index=, indexpvt=, control=, inbox=/vmail/intern/user/Maildir, alt= Jan 21 13:53:34 doveadm([24]user(a)domain.xx): Debug: quota-count: quota_over_status check: quota_over_mask unset - skipping Jan 21 13:53:34 doveadm([25]user(a)domain.xx): Debug: Mailbox INBOX: Mailbox opened Jan 21 13:53:34 doveadm([26]user(a)domain.xx): Debug: User session is finished Jan 21 13:53:34 doveadm([27]user(a)domain.xx): Debug: auth-master: conn unix:/run/dovecot//auth-userdb (pid=229336,uid=0): Disconnected: Connection closed (fd=9) Quota name Type Value Limit % User quota STORAGE 9116042 5242880 173 User quota MESSAGE 60188 - 0 -- Cordialement, R.J. Baart References Visible links 1. file:///tmp/tmp_2m1p1xn/ldap:mailBase 2. file:///tmp/tmp_2m1p1xn/ldap:mailMessageStore 3. file:///tmp/tmp_2m1p1xn/ldap:mailMessageStore 4. file:///tmp/tmp_2m1p1xn/ldap:dovecotQuota 5. mailto:user@domain.xx 6. mailto:user@domain.xx 7. mailto:user@domain.xx 8. mailto:user@domain.xx 9. mailto:user@domain.xx 10. mailto:user@domain.xx 11. mailto:user@domain.xx 12. mailto:user@domain.xx 13. mailto:user@domain.xx 14. mailto:user@domain.xx 15. mailto:user@domain.xx 16. mailto:username=user@domain.xx 17. mailto:user@domain.xx 18. mailto:user@domain.xx 19. mailto:user@domain.xx 20. mailto:user@domain.xx 21. mailto:user@domain.xx 22. mailto:user@domain.xx 23. mailto:user@domain.xx 24. mailto:user@domain.xx 25. mailto:user@domain.xx 26. mailto:user@domain.xx 27. mailto:user@domain.xx

2 1

default_login_user setting is not honored in 2.4.x
by dovecot＠freakout.de 21 Jan '26

21 Jan '26

i have in my dovecot.conf: default_login_user = www when i start dovecot: Starting mail server ...doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf: default_login_user doesn't exist: dovenull after adding dovenull user to /etc/passwd _AND_ leaving "default_login_user = www" in the dovecot.conf file everything is working fine. With 2.3.x user www worked.

2 1

Upgrade problems from Dovecot 2.3 to 2.4
by Gordon Dickens 21 Jan '26

21 Jan '26

I have attempted to upgrade my 2.3 installation to 2.4 but it will not allow my users to login closing the connections as authentication failures. My 2.3 installation has worked for many years and I simply attempted to make the changes that the dovecot documentation says are necessary to get 2.4 to work. I am running dovecot alongside Exim using mysql for the user addresses and passwords. Does anybody have any ideas as to why authentication is not working? Thanks in advance!.... Here is my dovecot.conf file: # *** REQUIRED *** Dovecot config and storage versions dovecot_config_version = 2.4.2 dovecot_storage_version = 2.4.2 passdb sql { query = SELECT crypt as password FROM users WHERE username = '%{user}' AND (type = 'local' OR type = 'piped'); } userdb sql { query = SELECT pop as home, uid, gid FROM users WHERE username =dovecot: auth: Fatal: auth-cache: SELECT crypt as password FROM users WHERE username = '%u' AND (type = 'local' OR type = 'piped');: Cache key must contain at least one variable '%{user}'; } sql_driver = mysql mysql /var/run/mysqld/mysqld.sock { user = exim4u password = SECRET dbname = exim4u } protocols { imap = yes pop3 = yes } protocol imap { mail_max_userip_connections = 50 } protocol pop3 { pop3_uidl_format = %{uid}%{uidvalidity} } service auth { user = dovecot } ssl = required ssl_server_cert_file = /etc/pki/tls/exim_tls/exim.cert ssl_server_key_file = /etc/pki/tls/exim_tls/exim.key ssl_server_dh_file = /etc/dovecot/dh.pem ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384: ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384

2 3

Replication and upgrade
by Francis Augusto Medeiros-Logeay 20 Jan '26

20 Jan '26

Hi, I have used Dovecot for about seven years, and I have a two server configuration with replication between them, mostly for redundancy and backup. I have by chance read that replication is gone with 2.4.0. I use the packages that come with ubuntu, so I feel I have to be careful with upgrading there. I read also that I can keep the functionality by using a replication plugin. My question is: do I need to compile dovecot myself to use the plugin, or can I simply install it ? Is there any guide for people like me who needs to keep replication? Best, Francis

2 2

Help regarding Postfix and Dovecot SASL
by Christophe Lohr 19 Jan '26

19 Jan '26

Hello, Please excuse my naive question. I am trying to understand how "service auth" is supposed to work between Postfix and Dovecot. (https://doc.dovecot.org/2.4.2/howto/sasl/postfix.html) Here is my test setup: - dovecot and postfix talking in lmtpd (via unix_listener /var/spool/postfix/private/dovecot-lmtp) - dovecot and postfix talking in sasl (via unix_listener /var/spool/postfix/private/auth) - "bob" and "alice" are virtual users of the virtual domain "my_domain.org" - passwd-file (plain) is /etc/dovecot/passwd Now, postrfix receive (by smtp) an email From: bob(a)my_domain.org To: alice(a)my_domain.org Postfix validate the domain according to its config (main.cf: virtual_mailbox_domains=my_domain.org) Then, it queries dovecot about these users via sasl: and that's where it fails! Here are logs from postfix: 2026-01-16T14:28:55.829532+01:00 pc-serveur postfix/qmgr[25055]: CA20D880486: from=<bob(a)my_domain.org>, size=9988, nrcpt=1 (queue active) 2026-01-16T14:28:55.831365+01:00 pc-serveur postfix/lmtp[25080]: CA20D880486: to=<alice(a)my_domain.org>, relay=pc-serveur.my_domain.org[private/dovecot-lmtp], delay=0, delays=0/0/0/0, dsn=5.1.1, status=bounced (host pc-serveur.tp-reseaux.enstb.org[private/dovecot-lmtp] said: 550 5.1.1 <alice(a)my_domain.org> User doesn't exist: alice(a)my_domain.org (in reply to RCPT TO command)) Here are logs from dovecot: Jan 16 14:28:55 lmtp(25081): Info: Connect from local Jan 16 14:28:55 auth: Debug: conn unix:/run/dovecot/auth-userdb (pid=25081,uid=118): Server accepted connection (fd=24) Jan 16 14:28:55 auth: Debug: master in: USER 1 bob(a)my_domain.org protocol=lmtp Jan 16 14:28:55 auth(bob7): Debug: passwd-file: Performing userdb lookup Jan 16 14:28:55 auth(bob7): Debug: passwd-file: lookup: user=bob7 file=/etc/dovecot/passwd Jan 16 14:28:55 auth(bob7): Info: passwd-file: unknown user Jan 16 14:28:55 auth(bob7): Debug: passwd-file: Finished userdb lookup Jan 16 14:28:55 auth: Debug: userdb out: NOTFOUND 1 Jan 16 14:28:55 lmtp(25081): Info: Disconnect from local: Logged out (state=READY) Jan 16 14:28:55 lmtp(25081): Info: Connect from local Jan 16 14:28:55 auth: Debug: master in: USER 2 alice(a)my_domain.org protocol=lmtp Jan 16 14:28:55 auth(alice7): Debug: passwd-file: Performing userdb lookup Jan 16 14:28:55 auth(alice7): Debug: passwd-file: lookup: user=alice7 file=/etc/dovecot/passwd Jan 16 14:28:55 auth(alice7): Info: passwd-file: unknown user Jan 16 14:28:55 auth(alice7): Debug: passwd-file: Finished userdb lookup Jan 16 14:28:55 auth: Debug: userdb out: NOTFOUND 2 Jan 16 14:28:55 lmtp(25081): Info: Disconnect from local: Logged out (state=READY) So, what's wrong? It seems to me that Dovecot receives a SASL request for the user "bob(a)my_domain.org", but only does a lookup for "bob", without the domain. Isn't it? So, why? What can I do? Best regards, Christophe

7 20

IMAP with Dovecot: Kerberos/GSSAPI in LAN only
by r.barclay＠habmalnefrage.de 19 Jan '26

19 Jan '26

Hi, I'm setting up a new IMAPS server using Dovecot 2.4 at the moment. I'd like my network internal users to authenticate using GSSAPI. The server is also exposed to the Internet for smart phone email access. I want to offer PLAIN login only for external users as they can't be legitimate internal Kerberos users. (Just as an additional layer of security.) Would this approach work? service imap-login { inet_listener imaps_external { port = 1993 ssl = yes auth_mechanisms = plain login } inet_listener imaps_internal { port = 7993 ssl = yes auth_mechanisms = plain login gssapi } } Then I'd allow only port 1993 externally and keep port 7993 for the LAN. Thank you for your advice! Reg

3 2

2.4.2 breaks big-endian builds
by Noah Meyerhans 19 Jan '26

19 Jan '26

From the Debian s390 build log, no merging parent is NULL ............................................ : ok no merging parent sent to stats ...................................... : ok no merging parent timestamp differs .................................. : ok merge events parent NULL ............................................. : ok merge events parent sent to stats .................................... : ok skip empty parents ................................................... : ok merge events and skip empty parents .................................. : ok parent updated after send ............................................ : ok large event id ....................................................... : ok merge events global .................................................. : ok 0 / 10 tests failed test-master-service-settings.c:472: Assert(#16) failed: strstr(error, tests[i].error) != NULL test-master-service-settings: Error: Failed to parse configuration: Settings block doesn't end with NUL at offset 70 test-master-service-settings.c:472: Assert(#19) failed: strstr(error, tests[i].error) != NULL test-master-service-settings: Error: Failed to parse configuration: Settings block doesn't end with NUL at offset 84 master_service_settings_read() - binary corruption ................... : FAILED 1 / 1 tests failed make[4]: *** [Makefile:958: check-local] Error 1 make[4]: Leaving directory '/build/reproducible-path/dovecot-2.4.2+dfsg1/src/lib-master' make[3]: *** [Makefile:806: check-am] Error 2 make[3]: Leaving directory '/build/reproducible-path/dovecot-2.4.2+dfsg1/src/lib-master' make[2]: *** [Makefile:604: check-recursive] Error 1 make[2]: Leaving directory '/build/reproducible-path/dovecot-2.4.2+dfsg1/src' make[1]: *** [Makefile:739: check-recursive] Error 1 make[1]: Leaving directory '/build/reproducible-path/dovecot-2.4.2+dfsg1' The build failure was introduced with commit 41bd7a502 ("lib-settings, config: Use native CPU endianess in binary config file"). The build is successful at the previous commit, but fails at that commit. I haven't yet determined whether the failure is with the code itself or the test. Full build log is available at https://buildd.debian.org/status/fetch.php?pkg=dovecot&arch=s390x&ver=1%3A2… noah

2 2

Re: Issue upgrading from 2.3.x to 2.4.1 when changing the mail driver from mbox to dbox
by Michael Slusarz 18 Jan '26

18 Jan '26

> On 01/16/2026 10:50 AM MST actionmystique via dovecot <dovecot(a)dovecot.org> wrote: > > I followed all the requirements detailed in https://doc.dovecot.org/main/installation/upgrade/2.3-to-2.4.html, but there seems to be an issue on my side configuring correctly the Mailbox locations. > In 10-mail.conf, I changed the mail driver from: > mail_driver = mbox --> mail_driver = dbox > I thought that would be sufficient but apparently, it is not the case. Changing mailbox format requires migration. See https://doc.dovecot.org/latest/core/admin/migration.html michael > All updated configurations are: > dovecot -n > # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf > # Pigeonhole version 2.4.1-4 (0a86619f) > # OS: Linux 6.17.0-8-generic x86_64 Ubuntu 25.10 > # Hostname: <hostname> > dovecot_config_version = 2.4.1 > auth_debug = yes > auth_debug_passwords = yes > auth_mechanisms = plain > auth_verbose = yes > auth_verbose_passwords = sha1 > dovecot_storage_version = 2.4.1 > fts_autoindex = yes > fts_autoindex_max_recent_msgs = 999 > fts_search_add_missing = yes > log_debug = category=ssl > log_timestamp = "%Y-%m-%d %H:%M:%S " > mail_driver = dbox > mail_home = /home/%{user|username} > mail_inbox_path = /var/mail/%{user} > mail_path = %{home}/mail > mail_privileged_group = mail > protocols = imap lmtp > ssl = required > ssl_cipher_list = <some list> > ssl_curve_list = <some list> > ssl_min_protocol = TLSv1.3 > passdb pam { > driver = pam > fields { > allow_nets = <nets> > } > result_failure = return-fail > result_internalfail = return-fail > result_success = return-ok > skip = never > } > userdb passwd { > } > namespace inbox { > inbox = yes > mailbox Drafts { > special_use = "\\Drafts" > } > mailbox Junk { > special_use = "\\Junk" > } > mailbox Trash { > special_use = "\\Trash" > } > mailbox Sent { > special_use = "\\Sent" > } > mailbox virtual/All { > special_use = "\\All" > } > } > service imap-login { > inet_listener imap { > port = 143 > listen = 127.0.0.1 [::1] > } > inet_listener imaps { > port = 993 > ssl = yes > listen = * [::] > } > } > service pop3-login { > inet_listener pop3 { > } > inet_listener pop3s { > } > } > service submission-login { > inet_listener submission { > } > } > service lmtp { > inet_listener lmtp { > port = 8024 > listen = 127.0.0.1 ::1 > } > } > service imap { > } > service pop3 { > } > service submission { > } > service auth { > unix_listener auth-userdb { > } > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0660 > user = postfix > } > } > service auth-worker { > } > service dict { > unix_listener dict { > } > } > ssl_server { > ca_file = <path> > cert_file = <path> > key_file = <path> > prefer_ciphers = server > request_client_cert = yes > require_crl = no > } > ssl_client { > ca_dir = /etc/ssl/certs > require_valid_cert = yes > } > protocol lmtp { > auth_username_format = %{user | username} > mail_plugins = quota sieve > postmaster_address = <email> > } > > In mail.err, I get multiple error messages such as: > Error: Mailbox INBOX: open() failed with file /var/mail/<user>/dovecot.index.log: Not a directory > of course, because /var/mail/<user> is not a folder but a file containing all the received mails. > > So, in /var/mail, I have one file per user, plus one user.lock.sav, and also some weird files such as mu8xTBeL, muaBkJQL... belonging to one of the user. > > How should I configure dbox? > _______________________________________________ > dovecot mailing list -- dovecot(a)dovecot.org > To unsubscribe send an email to dovecot-leave(a)dovecot.org

1 0

Issue upgrading from 2.3.x to 2.4.1 when changing the mail driver from mbox to dbox
by actionmystique＠gmail.com 16 Jan '26

16 Jan '26

I followed all the requirements detailed in https://doc.dovecot.org/main/installation/upgrade/2.3-to-2.4.html, but there seems to be an issue on my side configuring correctly the Mailbox locations. In 10-mail.conf, I changed the mail driver from: mail_driver = mbox --> mail_driver = dbox I thought that would be sufficient but apparently, it is not the case. All updated configurations are: dovecot -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.17.0-8-generic x86_64 Ubuntu 25.10 # Hostname: <hostname> dovecot_config_version = 2.4.1 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain auth_verbose = yes auth_verbose_passwords = sha1 dovecot_storage_version = 2.4.1 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes log_debug = category=ssl log_timestamp = "%Y-%m-%d %H:%M:%S " mail_driver = dbox mail_home = /home/%{user|username} mail_inbox_path = /var/mail/%{user} mail_path = %{home}/mail mail_privileged_group = mail protocols = imap lmtp ssl = required ssl_cipher_list = <some list> ssl_curve_list = <some list> ssl_min_protocol = TLSv1.3 passdb pam { driver = pam fields { allow_nets = <nets> } result_failure = return-fail result_internalfail = return-fail result_success = return-ok skip = never } userdb passwd { } namespace inbox { inbox = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox virtual/All { special_use = "\\All" } } service imap-login { inet_listener imap { port = 143 listen = 127.0.0.1 [::1] } inet_listener imaps { port = 993 ssl = yes listen = * [::] } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service submission-login { inet_listener submission { } } service lmtp { inet_listener lmtp { port = 8024 listen = 127.0.0.1 ::1 } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { ca_file = <path> cert_file = <path> key_file = <path> prefer_ciphers = server request_client_cert = yes require_crl = no } ssl_client { ca_dir = /etc/ssl/certs require_valid_cert = yes } protocol lmtp { auth_username_format = %{user | username} mail_plugins = quota sieve postmaster_address = <email> } In mail.err, I get multiple error messages such as: Error: Mailbox INBOX: open() failed with file /var/mail/<user>/dovecot.index.log: Not a directory of course, because /var/mail/<user> is not a folder but a file containing all the received mails. So, in /var/mail, I have one file per user, plus one user.lock.sav, and also some weird files such as mu8xTBeL, muaBkJQL... belonging to one of the user. How should I configure dbox?

1 0

Is dovecot CE 2.4.x supported with 32bit compile?
by dovecot＠freakout.de 16 Jan '26

16 Jan '26

these compiler messages make me nervous: test-event-filter.c:1006:53: warning: integer overflow in expression of type 'long int' results in '-694967296' [-Woverflow] 1006 | { "field = 1hours", 60L * 60 * 1000 * 1000, TRUE },

2 1

issue with quota warning using separate namespace quotas
by Andreas Oster 15 Jan '26

15 Jan '26

Hello everyone, I am currently trying to implement quota warnings for two separate namespaces (INBOX, MailArchive). The individual quota values for these namespaces are derived from ldap, which is working fine. However since adding the quota_warning configuration error messages appear in the logs: Error: quota-count: Filter quota_warning=warn-95 unexpectedly not found (invalid userdb or -o override settings?) Error: quota-count: Filter quota_warning=ma-warn-95 unexpectedly not found (invalid userdb or -o override settings?) The relevant configuration parameters from my config: quota_storage_size = 1G userdb ldap { fields { quota/ma_quota/storage_size = %{ldap:quota1} quota_storage_size = %{ldap:quota2} } } namespace subscriptions { mailbox_subscriptions_filename = subscriptions hidden = yes list = no prefix = subscriptions = yes } namespace inbox { inbox = yes prefix = INBOX/ subscriptions = no quota user_quota { name = User Quota quota_warning warn-95 { quota_storage_percentage = 95 execute quota-warning { args = 95 %{user} } } quota_warning warn-80 { quota_storage_percentage = 80 execute quota-warning { args = 80 %{user} } } quota_warning warn-under { quota_storage_percentage = 100 threshold = under execute quota-warning { args = below %{user} } } } mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Sent { auto = subscribe special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } mailbox Spam { auto = subscribe special_use = "\\Junk" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { auto = subscribe special_use = "\\Trash" quota_storage_percentage = 110 } } namespace MailArchive { mail_driver = maildir mail_index_path = /var/mail/indexes/mailarchive/%{user} mail_path = /var/mail/mailarchive/%{user}/Maildir list = children prefix = MailArchiv/ subscriptions = no type = private quota ma_quota { name = MailArchive Quota quota_warning ma-warn-95 { quota_storage_percentage = 95 execute quota-warning { args = 95 %{user} } } quota_warning ma-warn-80 { quota_storage_percentage = 80 execute quota-warning { args = 80 %{user} } } quota_warning ma-warn-under { quota_storage_percentage = 100 threshold = under execute quota-warning { args = below %{user} } } } mailbox "Archived Mails" { auto = subscribe special_use = "\\Archive" } } } service quota-warning { executable = script /var/mail/scripts/quota-warning.sh user = vmail unix_listener quota-warning { } } Does anyone have an idea what could be causing this behavior ? Thank you very much for your kind help. Andreas

1 0

Dovecot 2.4.2: How to fix maildir incoming mails going to cur/ instead of new/
by Andy Baugh 13 Jan '26

13 Jan '26

Add the following to dovecot.conf if you use maildir: # Disable the maildir breaking default behavior of # mail_attachment_detection_options, as setting ANY flag forces you out of new/ # and into cur/ mail_attachment_detection_options = ..and voila, maildir works as it previously did. This is *hinted* to in the migration guide document, as the old default value was shown as blank in the table, but I didn't figure it out till reading through the source code to find what was adding the 'a' flag to all incoming mails (thus forcing them out of new, as any flag does this). Cheers, -- Thomas "Andy" Baugh | Software Development Engineer IV andy.baugh(a)webpros.com

2 2

How should virtual users update their password?
by vwoloszczuk＠tutanota.com 13 Jan '26

13 Jan '26

Hi, I now have my email system working with virtual users, using a passwd-file for passdb. Now I am at the stage where I would like to change my password and possibly add other virtual users for my friends, who should be able to add/change their password without my involvement. I had a look at the IMAP RFCs but didn't see any sort of "change password" instruction. I also looked at the Dovecot docs but didn't see any article which covered this. What is the recommended/suggested way to do this? Is there a way to do with within the MDA/IMAP ecosystem or is it required to have an external solution e.g. entering the new password on a webpage? Thanks, Viktor Hi, I now have my email system working with virtual users, using a passwd-file for passdb. Now I am at the stage where I would like to change my password and possibly add other virtual users for my friends, who should be able to add/change their password without my involvement. I had a look at the IMAP RFCs but didn't see any sort of "change password" instruction. I also looked at the Dovecot docs but didn't see any article which covered this. What is the recommended/suggested way to do this? Is there a way to do with within the MDA/IMAP ecosystem or is it required to have an external solution e.g. entering the new password on a webpage? Thanks, Viktor

4 3

BUG-Report: mysql: SSL support not compiled in (remove ssl_client_ca_file and ssl_client_ca_dir settings) second attempt!
by Klaus Tachtler 13 Jan '26

13 Jan '26

Hello everyone, Problem info: An error occurs, while trying to establish a TLS/SSL secured connection to a database (mariadb), which has the ability to accept TLS/SSL connections. Analysis from Archlinux Gitlab Issue, which could be found under following link by - Toolybird: https://gitlab.archlinux.org/archlinux/packaging/packages/dovecot/-/issues/… > Thanks for reporting. It would appear to be some kind of (upstream?) > bug in the autofoo. The error message can be traced back to > HAVE_MYSQL_SSL being undefined when it should be defined. This is > reflected in log: https://reproducible.archlinux.org/api/v0/builds/946041/log > It took quite some debugging, but adding the following hack before the > autoreconf call appears to make it work: > checking for mysql_ssl_set in -llibmariadb... no > sed -i 's/mysql_driver="libmariadb"/mysql_driver="mariadb"/' m4/ > want_mysql.m4 > After that it now shows: > checking for mysql_ssl_set in -lmariadb... yes Steps to reproduce: 1. Configure dovecot 2.4.2-4 as described below 2. Restart dovecot 2.4.2-4 3. Try send an email (echo "Test-E-Mail" | /usr/sbin/sendmail root) 4. Determine error messages inside dovecot 2.4.2-4-Log > 01 Dec 22 04:57:38 server dovecot[842]: auth: Error: > mysql(db.idmz.tachtler.net): mysql: SSL support not compiled in > (remove ssl_client_ca_file and ssl_client_ca_dir settings) > 02 Dec 22 04:57:38 server dovecot[842]: auth-worker: Error: > mysql(db.idmz.tachtler.net): mysql: SSL support not compiled in > (remove ssl_client_ca_file and ssl_client_ca_dir settings) Additional info: OS version: Archlinux package version(s): dovecot 2.4.2-4 necessary config file part: > 45 sql_driver = mysql > 46 > 47 mysql db.idmz.tachtler.net { > 48 host = db.idmz.tachtler.net > 49 port = 3306 > 50 user = postfixuser > 51 password = geheim > 52 dbname = postfix > 53 ssl = yes > 54 ssl_client_ca_file = /etc/dovecot/ssl/certs/CAcert.pem > 55 ssl_client_cert_file = > /etc/dovecot/ssl/certs/client.idmz.tachtler.net.pem > 56 ssl_client_key_file = > /etc/dovecot/ssl/private/client.idmz.tachtler.net.key.pem > 57 ssl_cipher_list = DHE-RSA-AES256-SHA > 58 } WITHOUT the following line, a database connections is possible and works as expected: > 53 ssl = yes > 54 ssl_client_ca_file = /etc/dovecot/ssl/certs/CAcert.pem > 55 ssl_client_cert_file = > /etc/dovecot/ssl/certs/client.idmz.tachtler.net.pem > 56 ssl_client_key_file = > /etc/dovecot/ssl/private/client.idmz.tachtler.net.key.pem > 57 ssl_cipher_list = DHE-RSA-AES256-SHA Thanky you in advance for your help! Klaus Tachtler. -- --------------------------------------- e-Mail : klaus(a)tachtler.net Homepage: https://www.tachtler.net DokuWiki: https://dokuwiki.tachtler.net ---------------------------------------

1 0

Re: Panic: file imap-sieve-storage.c: line 216 (imap_sieve_add_mailbox_event): assertion failed: (ismt->src_box == NULL || ismt->src_box == src_box)
by Stephen Callaghan 12 Jan '26

12 Jan '26

Having a similar issue: 2.4.2 (0962ed2104) via docker. Causing constant core dumping and my client keeps retrying blocking everything up. Any suggestions on how to identify the cause of the problem? S. Jan 09 19:22:13 imap(SNIP)<555><rn1EcflH+ILwCwUB>: Panic: file imap-sieve-storage.c: line 216 (imap_sieve_add_mailbox_event): assertion failed: (ismt->src_box == NULL || ismt->src_box == src_box) Jan 09 19:22:13 imap(SNIP)<555><rn1EcflH+ILwCwUB>: Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 [unw_get_proc_name() failed: -10] -> #3 [unw_get_proc_name() failed: -10] -> #4 i_panic[0x7f13c0e8b7dd] -> #5 [unw_get_proc_name() failed: -10] -> #6 [unw_get_proc_name() failed: -10] -> #7 [unw_get_proc_name() failed: -10] -> #8 mailbox_save_alloc[0x7f13c11baf52] -> #9 [unw_get_proc_name() failed: -10] -> #10 [unw_get_proc_name() failed: -10] -> #11 cmd_move[0x5572105ab0ca] -> #12 command_exec[0x5572105c33f4] -> #13 [unw_get_proc_name() failed: -10] -> #14 [unw_get_proc_name() failed: -10] -> #15 [unw_get_proc_name() failed: -10] -> #16 [unw_get_proc_name() failed: -10] -> #17 client_handle_input[0x5572105c060c] -> #18 client_input[0x5572105c0847] -> #19 io_loop_call_io[0x7f13c0eb9798] -> #20 io_loop_handler_run_internal[0x7f13c0ebd48a] -> #21 io_loop_handler_run[0x7f13c0eb9aea] -> #22 io_loop_run[0x7f13c0eb9963] -> #23 master_service_run[0x7f13c0d7264b] -> #24 main[0x5572105db2a4] -> #25 [unw_get_proc_name() failed: -10] -> #26 __libc_start_main[0x7f13c0ae4ce0] -> #27 _start[0x5572105a62f0] Jan 09 19:22:13 imap(SNIP)<555><rn1EcflH+ILwCwUB>: Fatal: master: service(imap): child 555 killed with signal 6 (core dumped) Having a similar issue: 2.4.2 (0962ed2104) via docker. Causing constant core dumping and my client keeps retrying blocking everything up. Any suggestions on how to identify the cause of the problem? S. Jan 09 19:22:13 imap(SNIP)<555><rn1EcflH+ILwCwUB>: Panic: file imap-sieve-storage.c: line 216 (imap_sieve_add_mailbox_event): assertion failed: (ismt->src_box == NULL || ismt->src_box == src_box) Jan 09 19:22:13 imap(SNIP)<555><rn1EcflH+ILwCwUB>: Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 [unw_get_proc_name() failed: -10] -> #3 [unw_get_proc_name() failed: -10] -> #4 i_panic[0x7f13c0e8b7dd] -> #5 [unw_get_proc_name() failed: -10] -> #6 [unw_get_proc_name() failed: -10] -> #7 [unw_get_proc_name() failed: -10] -> #8 mailbox_save_alloc[0x7f13c11baf52] -> #9 [unw_get_proc_name() failed: -10] -> #10 [unw_get_proc_name() failed: -10] -> #11 cmd_move[0x5572105ab0ca] -> #12 command_exec[0x5572105c33f4] -> #13 [unw_get_proc_name() failed: -10] -> #14 [unw_get_proc_name() failed: -10] -> #15 [unw_get_proc_name() failed: -10] -> #16 [unw_get_proc_name() failed: -10] -> #17 client_handle_input[0x5572105c060c] -> #18 client_input[0x5572105c0847] -> #19 io_loop_call_io[0x7f13c0eb9798] -> #20 io_loop_handler_run_internal[0x7f13c0ebd48a] -> #21 io_loop_handler_run[0x7f13c0eb9aea] -> #22 io_loop_run[0x7f13c0eb9963] -> #23 master_service_run[0x7f13c0d7264b] -> #24 main[0x5572105db2a4] -> #25 [unw_get_proc_name() failed: -10] -> #26 __libc_start_main[0x7f13c0ae4ce0] -> #27 _start[0x5572105a62f0] Jan 09 19:22:13 imap(SNIP)<555><rn1EcflH+ILwCwUB>: Fatal: master: service(imap): child 555 killed with signal 6 (core dumped)

2 1

Lazy expunge does not work as previously after upgrade from Dovecot 2.3 to 2.4.1
by Peter Milesson 11 Jan '26

11 Jan '26

Hi folks, I upgraded an IMAP server from Dovecot 2.3 to 2.4.1 (Debian 13). I have used the lazy expunge plugin for many years, and after upgrade, it was impossible to get it working as previously. After many trials I got it working sort of, but not as previously. The mail location and driver is the following: mail_home = /data/vmail/%{user | username} mail_driver = sdbox mail_path = ~/dbox Previously I had the following structure ~/dbox (user's mailboxes) ~/expunged (user's expunged emails) After upgrade I had to resort to store expunged messages in the inbox namespace in the hidden folder .EXPUNGED, instead of in a separate structure under ~/expunged. This is something I sincerely dislike, as I want expunged messages separate. Now, when messages are expunged, Dovecot no longer obeys the structure of the mailboxes, and puts all expunged messages in the .EXPUNGED folder. Previously the structure of the ~/expunged folder was a copy of the inbox namespace, but now it is just a large garbage bag. This is really a breaking change, and very unfortunate. I had a retention period of 90 days for expunged messages, mainly as a forensic tool. It has been of great help in correcting users that do not follow company guidelines, and opened insecure/infected archives, even if it's strictly prohibited. It has also rescued whole folder structures with sub folders on several occasions, when the users have inadvertently deleted a main folder, and then emptied trash. Now all expunged messages are stored in one big mess, which is much harder to analyze, and I assume, almost impossible to recover to the original state, if that would be needed. I would like to ask, if it is at all possible to get the equivalent of the previous behavior, and in that case, what the configuration would look like. Any help would be very appreciated. Best regards, Peter

1 0

mail-crypt transition from Dovecot 2.3 to 2.4
by m＠maltris.org 11 Jan '26

11 Jan '26

In Dovecot 2.3 I had used the following query: password_query = \ SELECT USER.user, USER.host, \ SECRET.password, SECRET.public_key AS mail_crypt_global_public_key, SECRET.private_key AS mail_crypt_global_private_key \ FROM USER \ WHERE USER.user = '%Lu' This worked fine, enabling encryption and decryption properly. For Dovecot 2.4 this does not work anymore. Example from LMTP: Dec 11 15:02:59 lmtp(975838): Info: lmtp-server: conn unix:pid=975905,uid=113 [1]: rcpt user(a)test.de: <Ti6aNxPPOmne4w4APAc66w>: Failed to send message to <user(a)test.de> at server:24: 451 4.2.0 <user(a)test.de> get_public_key(INBOX) failed: mailbox_attribute_get(INBOX, /shared/vendor/vendor.dovecot/pvt/crypt/active) failed: Mailbox attributes not enabled (1/1 at 12 ms) I tried to adapt it to Dovecot 2.4 per the documentation, ending up with this: query = \ SELECT \ USER.user, USER.host, \ SECRET.password, \ concat('inline:', SECRET.public_key) AS crypt_global_public_key_file, \ 'main' AS crypt_global_private_key, \ concat('inline:', SECRET.private_key) AS 'crypt_global_private_key/main/crypt_private_key_file' \ FROM USER \ WHERE USER.user = '%{user | lower}' Still the error message: get_public_key(INBOX) failed: mailbox_attribute_get(INBOX, /shared/vendor/vendor.dovecot/pvt/crypt/active) failed: Mailbox attributes not enabled Additionally I tried without the "inline:" prefix, because without, doveadm mailbox cryptokey list would return a "no such file or directory error" trying to treat the key as a filename. With the "inline:" prefix it returns nothing except a warning: Warning: mailbox cryptokey list: Nothing was matched. Use -U or specify mask? What is the right way to proceed here?

2 2