- dovecot - dovecot.org

dovecot 2.4 Restricting Access - journal/log differences for failed login?
by David C Rankin 21 May '26

21 May '26

All, I have restricted access for several users using the Restring Access documentation https://doc.dovecot.org/2.4.0/howto/restrict_access.html This was to cut down on the brute-force attempts against dovecot for certain users whose usernames/e-mails are routinely used. I have a very simply passdb config: passdb passwd-file { passwd_file_path = /etc/dovecot/deny.%{protocol} deny = yes } passdb pam { driver = pam } userdb pam { driver = passwd } I created the /etc/dovecot/deny.imap file with one username per-line. But what confuses me is the server logs the exact same failure for unsuccessful login after restricting access as it did before restricting access. E.g. 2026-05-20T07:22:43.039585-05:00 valkyrie auth[28618]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=janice(a)mydomain.com rhost=70.186.179.37 2026-05-20T07:22:51.578711-05:00 valkyrie auth[28618]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=janice(a)mydomain.com rhost=70.186.179.37 May 20 07:25:36 valkyrie dovecot[1015]: imap-login: Login aborted: Inactivity (auth failed, 2 attempts in 177 secs) (auth_failed): user=<janice(a)mydomain.com>, method=PLAIN, rip=70.186.179.37, lip=192.168.6.14, TLS, session=<ouXP2T5SJpZGurMl> Is this normal, or should dovecot respond to restricted users in some way that differs from a normal login failure? All could be working fine, I'm just not certain about the log entries. -- David C. Rankin, J.D.,P.E.

1 0

"imap" command not usable in dovecot 2.4
by Mark Hills 20 May '26

20 May '26

Since upgrading to 2.4 (from 2.3) the "imap" command no longer works: $ /usr/libexec/dovecot/imap * PREAUTH [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE REPLACE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW SPECIAL-USE STATUS=SIZE SAVEDATE COMPRESS=DEFLATE INPROGRESS NOTIFY LITERAL+] Logged in as mark imap(mark)<6109><5GlNEEHaDWrdFwAABxE9Dg>: Fatal: Namespace inbox: mail_storage settings: Failed to parse configuration: Invalid setting mail_path=~/Maildir: mail_path setting used home directory (~/) but there is no mail_home and userdb didn't return it Whereas I would expect an authenticated IMAP session. Removing the offending /etc/dovecot.conf line temporarily: dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.0 protocols = imap lmtp sieve mail_driver = maildir #mail_path = ~/Maildir passdb passwd-file { passwd_file_path = /etc/dovecot/passwd } userdb passwd { } [...] And re-testing suggests the cause runs deeper: $ /usr/lib/exec/dovecot/imap [...] imap(mark)<6364><tetIC6/aDWrcGAAABxE9Dg>: Fatal: Namespace inbox: mail_storage settings: Failed to parse configuration: Failed to expand mail_path setting variables: Setting used home directory (%h) but there is no mail_home and userdb didn't return it Attempts to hard-wire it seem to suggest that usedb is not involved. I imagine this may be not consulted, because the process is pre-authenticated and running as a local UID: userdb passwd { fields_import_all = no fields { mail_home = /home/mark mail_path = /home/mark/Maildir } } $ /usr/libexec/dovecot/imap [...] imap(mark)<6656><qPqUB17cDWoAGgAABxE9Dg>: Fatal: Namespace inbox: mail_storage settings: Failed to parse configuration: Failed to expand mail_path setting variables: Setting used home directory (%h) but there is no mail_home and userdb didn't return it It seems like 2.3 looked up these fields from the user invoking it, but no longer is this the case? Running "imap" like this is very useful, especially when a client like Pine/Alpine can access over SSH. To get to here I had to workaround the missing "shadow" passdb module, which is also useful as Alpine Linux 3.23 neither uses PAM extensively nor provides dovecot built with PAM. -- Mark

1 0

undocumented changed behavior of 2.4.3 (possible bug report)
by Patrick Cernko 20 May '26

20 May '26

Hello Dovecot-Devs, hello list, while upgrading my Dovecot 2.4.2 setup to 2.4.3 I observed two instances of changed behavior. I could not find notes about those issues in the corresponding documentation (https://doc.dovecot.org/2.4.3/installation/upgrade/2.4-to-2.4.x.html) or release notes: 1. I had to change userdb_ldap_iterate_filter = (&(objectClass=posixAccount)%{if(protocol,"eq","pop3","(istIsMemberOf=POP3-users)","")}) to userdb_ldap_iterate_filter = (&(objectClass=posixAccount)%{if(protocol,"eq","pop3","(istIsMemberOf=POP3-users)","")|safe) otherwise the characters '()=' in the "true"-case of the condition got somehow "quoted" with escaped ASCII codes, which led to a broken LDAP filter string. Maybe you could add some documentation (in "Upgrading" as well as "Settings Variables") about that? 2. The behavior of sieve matches using ":matches" has changed: Example email (only the relevant header): List-Id: Dovecot Mailing List <dovecot.dovecot.org> Example Sieve script: if header :matches "List-Id" "*<dovecot*.dovecot.org>" { fileinto "dovecot"; } In 2.4.2 (and earlier) the example email matched the condition and got stored in the dovecot folder, while in 2.4.3 the condition does NOT match. As a workaround I added a '*' at the end of the match ("*<dovecot*.dovecot.org>*") to get my mails stored correctly again. Is this changed behavior for Sieve intentional or a bug? In case of a bug, could you please provide a fix? In case of intentional behavior: * Could you please explain the intention? Why was it necessary? * What would be the correct fix for the sieve example to match a List-Id header that ENDS WITH ".dovecot.org>"? * I assume, that other users on my servers will run into similar problems once I upgrade their servers. Is it possible to detect such problematic matches in Sieve scripts? E.g. "all matches without a trailing '*' are affected", ... This would give me a chance, to inform my users or even fix their scripts in advance. Best regards, -- Patrick Cernko <pcernko(a)mpi-klsb.mpg.de> +49 681 9325 5815 Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Softwaresysteme

2 3

flatcurve index size (10x larger than lucene)
by Jean-Daniel Beaubien 19 May '26

19 May '26

Hi everyone, I am currently trying to update from an old dovecot 2.3 setup with fts-lucene to 2.4.2 with fts-flatcurve. However, I am seeing a giant jump in the size of the indexes. For an email account that takes 12GB of storage, I get the following index sizes: - lucene: 270 MB - flatcurve: 2400 MB That is almost a 10x increase in the index size (with flatcurve the indexes represent 20% of the size of the mailbox). Considering I have a mailbox that takes 270GB, I can't imagine the size of the indexes. *Am I doing something wrong with flatcurve? How can the indexes be so much larger than lucene?* I took the default flatcurve configuration from the Ubuntu 26.04 install: mail_plugins { fts = yes fts_flatcurve = yes } fts_autoindex = yes language_filters = normalizer-icu snowball stopwords language_tokenizers = generic email-address language_tokenizer_generic_algorithm = simple language en { default = yes filters = lowercase snowball english-possessive stopwords } fts flatcurve { # All of these are optional, and indicate the default values. # They are listed here for documentation purposes; most people should not # need to define/override in their config. # commit_limit = 500 # max_term_size = 30 # min_term_size = 2 # optimize_limit = 10 # rotate_count = 5000 # rotate_time = 5000 substring_search = yes } *Any help/insight would be greatly appreciated.* Best regards, -J Hi everyone, I am currently trying to update from an old dovecot 2.3 setup with fts-lucene to 2.4.2 with fts-flatcurve. However, I am seeing a giant jump in the size of the indexes. For an email account that takes 12GB of storage, I get the following index sizes: o lucene: 270 MB o flatcurve: 2400 MB That is almost a 10x increase in the index size (with flatcurve the indexes represent 20% of the size of the mailbox). Considering I have a mailbox that takes 270GB, I can't imagine the size of the indexes. Am I doing something wrong with flatcurve? How can the indexes be so much larger than lucene? I took the default flatcurve configuration from the Ubuntu 26.04 install: mail_plugins { fts = yes fts_flatcurve = yes } fts_autoindex = yes language_filters = normalizer-icu snowball stopwords language_tokenizers = generic email-address language_tokenizer_generic_algorithm = simple language en { default = yes filters = lowercase snowball english-possessive stopwords } fts flatcurve { # All of these are optional, and indicate the default values. # They are listed here for documentation purposes; most people should not # need to define/override in their config. # commit_limit = 500 # max_term_size = 30 # min_term_size = 2 # optimize_limit = 10 # rotate_count = 5000 # rotate_time = 5000 substring_search = yes } Any help/insight would be greatly appreciated. Best regards, -J

3 3

[Dovecot] batch convert mbox to maildir
by Netlink Tech 18 May '26

18 May '26

Hello, I have used mb2md for an individual user like this: su ~username cd ~ ./mb2md -m This converted /var/spool/mail/username mbox to /home/users/username/Maildir just as I expected. To convert 100s of users the same way would be a chore (su as each user for permissions, etc.). Is there a way to batch process all /var/spool/mail/$USER to /home/users/$USER/Maildir with the correct permissions/file owners for each user?

4 4

Lua authentication
by John Fawcett 18 May '26

18 May '26

Hi I'm finally getting round to taking up Aki's suggestion here to look into lua. The original requirement was to check the ip reputation giving an OK or KO before proceeding to the login. I'd be interested in any feedback on the dovecot.conf settings and lua script. Also I've encountered a strange caching issue. https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/E5FLX… To do this I've added a new passdb before the existing sql passdb. I am assuming that I will need to reverse the defaults (in 2.3.21.1) for result_success and result_failure. passdb { driver = lua args = file=/etc/dovecot/passdb.lua blocking=yes result_success = continue result_failure = return-fail } This is my lua test script. function auth_passdb_lookup(req) dovecot.i_info("login request from " .. req.remote_ip .. " user=" .. req.user) if (req.user == "user_to_deny(a)example.com") then dovecot.i_info("deny login") return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN, "" end return dovecot.auth.PASSDB_RESULT_NEXT, "" end I am trying to get this working with this very simple logic before developing the real logic. But basically I am considering two responses from the lua script, one which is OK (returning dovecot.auth.PASSDB_RESULT_NEXT) in which case the next passdb should be consulted for the real password lookup. The other case is a KO (returning dovecot.auth.PASSDB_RESULT_USER_UNKNOWN) where this should be taken as an immediate failure without proceeding to password lookup in the next passd.I have passdb caching disabled. While testing the KO case which seems to be working, if I modify the script changing the user_to_deny(a)example.com so it no longer matches, the script still outputs "deny login". It's not a passdb caching issue since it is going through the "deny login" code despite the user not matching. Could it be that lua scripts are being cached by dovecot? John

1 0

Re: [EXT] Re: postfix/dovecot migration
by bcs＠nanomail.net 16 May '26

16 May '26

Was able to execute the process as root with "doveadm -D backup -Ru tst tcp:10.0.1.212:12354" after updating some destination side configuration options that do not appear to be documented in the link provided, but there are a few errors that I am unable to understand or correct. 1. Debug: open(/proc/self/io) failed: Permission denied - This file is read only for root and permissions cannot be modified. 2. Error: Mailbox INBOX sync: mailbox_delete failed: INBOX can't be deleted. - Not sure why a mailbox would need to be deleted other than the backup is using a delete and recreate to retain only current emails, assuming this is on the destination server. 3. All emails for tst account are deleted from the source server - This is a significant issue when only copies should be made for a backup. Full log is attached. Any additional insights would be greatly appreciated, Bryan May 15, 2026 10:01 AM, "Aki Tuomi" <aki.tuomi(a)open-xchange.com> wrote: > Yeah, you can do migration with dsync or imap between 2.3 and 2.4 > > Aki > >> On 15/05/2026 16:10 EEST Bryan Simmons <bcs(a)nanomail.net> wrote: >> >> Aki, >> >> Thank you for the guidance. Just to confirm, doveadm/imap based >> migration is the section under "Migrating Mailboxes from Another Dovecot >> Server" in the link referenced below since this migration will be >> between servers? >> >> Seems an upgrade from dovecot 2.3.21 (current version on source server) >> to 2.4.2 (installed version on the destination server) would be >> appropriate before migrating any user accounts based on information from >> some of the other posts regarding migration. >> >> Thanks , Bryan >> >> On 5/13/26 13:41, Aki Tuomi via dovecot wrote: >> On 13/05/2026 20:31 EEST Bryan Simmons via dovecot <dovecot(a)dovecot.org> wrote: >> >> Moving postfix and dovecot to a new server including all current users >> and emails. There exists several dovecot files in each user mail directory: >> >> dovecot.index >> dovecot.index.cache >> dovecot.index.log >> dovecot-keywords >> dovecot.list.index.log >> dovecot.mailbox.log >> dovecot-uidlist >> dovecot-uidvalidity >> dovecot-uidvalidity.612d3d34 >> >> Should these files be migrated also or will dovecot recreate them as needed? >> >> Thank you, Bryan >> >> https://doc.dovecot.org/2.4.4/core/admin/migration.html#migrating-mailboxes >> >> I would recommend seeing this. Depending on your mailbox format, it can be important that those >> files are copied, but I would suggest doveadm/imap based migration. >> >> Aki >> >> _______________________________________________ >> dovecot mailing list -- dovecot(a)dovecot.org >> To unsubscribe send an email to dovecot-leave(a)dovecot.org

2 2

Panic: file charset-iconv.c: line 83 (charset_to_utf8_try): assertion failed: (srcleft <= CHARSET_MAX_PENDING_BUF_SIZE)
by Alex Rosenberg 15 May '26

15 May '26

Attached is an LLM-reduced reproduction of the crash in the title. My particular setup is dovecot 2.3.21.1 (d492236fa0) in a FreeBSD jail (13.5). I realize that this is an older release but there is no FreeBSD port/pkg for dovecot 2.4.x yet. The message in the attachment is reduced from an old (2017!) email to one of the LLVM compiler mailing lists. The original malformed email had this header: X-Mailer: Evolution 3.22.5 (3.22.5-1.fc25) The bug occurs when dovecot's FTS indexer processes a MIME part that: 1. Declares charset="UTF-7" 2. Contains base64-encoded content that, when decoded, has bare '+' characters 3. Causes UTF-7 decoder buffer overflow in charset-iconv.c:83 The base64 content decodes to C source code with expressions like: - argc + 4 - state++ - state-- These '+' characters in UTF-7 context cause the decoder's pending buffer to exceed CHARSET_MAX_PENDING_BUF_SIZE, triggering the assertion failure. Alex

4 5

Can't find unicode/ustring.h in test
by mr.thesaw＠gmail.com 14 May '26

14 May '26

I get this error during compilation: make[3]: Entering directory '/home/hacksaw/src/dovecot-2.4.4/src/lib-language' CC test-lang-icu.o In file included from test-lang-icu.c:8: lang-icu.h:4:10: fatal error: unicode/ustring.h: No such file or directory 4 | #include <unicode/ustring.h> | ^~~~~~~~~~~~~~~~~~~ compilation terminated. I have unicode 66, at least as far as Ubuntu is concerned.

2 8

Dovecot 2.4.4 - mail_crypt with per-user Global Keys from LDAP (not Folder Keys)
by luis.neapolis＠gmail.com 14 May '26

14 May '26

Hi everyone, I'm trying to configure Dovecot 2.4.4 with per-user encryption keys stored in LDAP, using Global Keys mode (NOT Folder Keys). My goal: Each user has their own public key and private key (encrypted with the user's login password) stored in LDAP attributes. 1) LMTP should use the public key to encrypt incoming emails. 2) IMAP should use the user's login password to decrypt the private key from LDAP, then decrypt the emails. I want to use Global Keys mode (where keys are provided via userdb), NOT Folder Keys (where Dovecot stores keys in dovecot-attributes files). What works: LMTP receives emails and encrypts them correctly using the user's public key from LDAP and the encrypted files are saved to disk. What doesn't work: IMAP can log in and see the email list (subject, from, date), but the email body never loads. Error: Decryption error: no private key available May 14 18:58:45 host dovecot[295725]: imap(test(a)example.com)<295760><SESSIONID>: Debug: Mailbox INBOX: UID 11: Opened mail because: prefetch May 14 18:58:45 host dovecot[295725]: imap(test(a)example.com)<295760><SESSIONID>: Debug: dict(file): Looking up 'priv/a82ea60599ba056ad47904003a5aeee9/vendor/vendor.dovecot/pvt/crypt/privkeys/aacbcb614fb59f81e9519186b12ac8862858d89fa3bcc1be5f25b886d3e95ee3' May 14 18:58:45 host dovecot[295725]: imap(test(a)example.com)<295760><SESSIONID>: Debug: dict(file): Lookup finished for 'priv/a82ea60599ba056ad47904003a5aeee9/vendor/vendor.dovecot/pvt/crypt/privkeys/aacbcb614fb59f81e9519186b12ac8862858d89fa3bcc1be5f25b886d3e95ee3': not found May 14 18:58:45 host dovecot[295725]: imap(test(a)example.com)<295760><SESSIONID>: Error: Mailbox INBOX: UID 11: read() failed: read(/mail/example.com/test/cur/1778773528.M279604P294174.host.example.com,… failed: Decryption error: no private key available (FETCH BODY[1]) The confusing part: IMAP has the user's password (the user authenticated successfully). The private key in LDAP is encrypted with that same password. So IMAP should be able to decrypt the private key, then decrypt the email. But Dovecot is not using the password it already has to unlock the private key. My configuration: dovecot_config_version = 2.4.4 mail_plugins { quota = yes } # Empty global key block (workaround for LMTP not to fail) crypt_global_private_key main { } passdb ldap { driver = ldap filter = (&(objectClass=Account) (mail=%{user})) fields { mail = %{ldap:mail} password = %{ldap:userPassword} userdb_home = %{ldap:homeDirectory} } } userdb ldap { driver = ldap filter = (&(objectClass=Account) (mail=%{user})) fields { home = %{ldap:homeDirectory} uid = %{ldap:uidNumber|default('500')} gid = %{ldap:gidNumber|default('500')} # Per-user keys from LDAP (Global Keys mode) crypt_global_public_key_file = inline:%{ldap:userPublicKey} crypt_global_private_key/main/crypt_private_key_file = inline:%{ldap:userPrivateKey} crypt_private_key_password = %{password} } } protocol imap { mail_plugins { imap_quota = yes mail_crypt = yes } protocol lmtp { mail_plugins { sieve = yes mail_crypt = yes } } Note: I do NOT have mail_attribute_dict configured. I do NOT want Dovecot to store keys in local files. I want everything to come from LDAP. What I've verified: 1) The private key is valid and decrypts correctly with the user's password using openssl pkey -passin pass:xxx. 2) doveadm user shows the keys are retrieved from LDAP. The error persists. The question: Since IMAP already has the user's password (from the successful login), how can I make Dovecot use that password to decrypt the private key from LDAP and then decrypt the emails? Is there a specific setting I'm missing? Does crypt_private_key_password = %{password} need to be placed somewhere else (e.g., inside the protocol imap block) to work correctly? Also, I see in the logs that Dovecot is still looking for dict(file) keys (Folder Keys mode). How can I completely disable Folder Keys behavior and force Dovecot to only use Global Keys from LDAP? Thank you! Dovecot version: 2.4.4-5 OS: AlmaLinux 9.7 Mail storage: Maildir

1 0

Backup problem
by Doug Hardie 13 May '26

13 May '26

I just migrated my mail server to a new machine. When the new machine was back up and running, I found one mailbox that used to have many emails, now only had 3. I went back to the old machine and found there were only those three messages in the mailbox. I suspect somehow I managed to delete them prior to the backup to the new machine. I have a copy of that mailbox on a backup machine. I just checked and all are there. They have file names like: 1658299911.M966551P8821.mail,S=5001,W=5108:2,S 1664572476.M701757P94428.mail,S=4051,W=4135:2,Sab 1665119988.M609674P37848.mail,S=8455,W=8629:2,Sab 1665757235.M137163P32739.mail,S=5838,W=5950:2,S 1665774793.M299412P37846.mail,S=4669,W=4755:2,S 1665782571.M706364P40033.mail,S=12191,W=12379:2,S The backup machine has all the dovecot files for that user. How can I restore those email from the backup machine to the new server? -- Doug

2 1

Can I use a static userdb or no?
by social+17dw1scw＠lombra.net 13 May '26

13 May '26

Hi, I've been researching this for a while now, and can't find a definitive answer. I have a virtual setup, with globally static UID, GID and mail locations set. The documentation is clear that this lets me use a static userdb instead of SQL. But then, doveadm mailbox list -A requires that a valid iterate_query is set, and that requires an SQL userdb. So, which is it? If querying does not work with a static userdb, that seems like a significant caveat. I'm also curious how this works with prefetch. I understand I can make the passdb query return static values, but I figure since I already have those configured, I shouldn't need to do that. How can I determine whether prefetching is working as intended? Thank you.

3 2

postfix/dovecot migration
by Bryan Simmons 13 May '26

13 May '26

Moving postfix and dovecot to a new server including all current users and emails. There exists several dovecot files in each user mail directory: dovecot.index dovecot.index.cache dovecot.index.log dovecot-keywords dovecot.list.index.log dovecot.mailbox.log dovecot-uidlist dovecot-uidvalidity dovecot-uidvalidity.612d3d34 Should these files be migrated also or will dovecot recreate them as needed? Thank you, Bryan

2 1

Expand dovecot recipients from ldap group
by Maksim Rodin 13 May '26

13 May '26

Hello, I have set up dovecot (2.3.21) to get its recipients from Active Directory. I can successfully get recipients from Active Directory user objects using their sAMAccountName: # cat /etc/dovecot/local.conf ... passdb users { driver = ldap args = /etc/dovecot/dovecot-ldap_domain.conf.ext } userdb users { driver = static args = uid=vmail gid=vmail } ... Here is the relevant part of the ldap config: # cat /etc/dovecot/dovecot-ldap_domain.conf.ext ... user_attrs = \ =home=/vmail/%{ldap:sAMAccountName}, \ =uid=vmail, \ =gid=vmail pass_filter = (&(objectCategory=person)(mail=%u)) user_filter = (&(objectCategory=person)(mail=%u)) ... I can also successfully get user aliases from Active Directory user objects using their otherMailbox attribute: # cat /etc/dovecot/local.conf ... userdb aliases { driver = ldap args = /etc/dovecot/dovecot-ldap_domain_aliases.conf.ext } ... Here is the relevant part of the ldap config: # cat /etc/dovecot/dovecot-ldap_domain_aliases.conf.ext: ... user_attrs = \ =home=/vmail/%{ldap:sAMAccountName}, \ =uid=vmail, \ =gid=vmail pass_filter = (&(objectCategory=person)(otherMailbox=%u)) user_filter = (&(objectCategory=person)(otherMailbox=%u)) Now I am struggling with the task of getting recipients from Active Directory group objects to handle them as distribution groups. Is there a way to expand an Active Directory group object to multiple recipients? I know all of this can be done with postfix ldap module, but I would like to handle all the delivery tasks to dovecot LMTP. -- Best regards Maksim Roin

1 0

Sync'ing two dovecot servers
by Marc Singer 12 May '26

12 May '26

Greetings, I was pleased to see that dovecot has a sync function in doveadm. So far, other tools for moving mailbox contents from one server to another has not been successful. However. Perhaps I don't understand how this should work. I have a new containerized dovecot v2.4.2 # 2.4.2 (0962ed2104): /etc/dovecot/dovecot.conf # OS: Linux 6.12.63+deb13-amd64 x86_64 and I have an existing dovecot running in a VPS: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 6.1.0-35-amd64 x86_64 Debian 12.11 I want to move one user, as a test. I execute this in the container. # doveadm sync -R1 -u USER tcps:OLD_SERVER:993 doveadm(USER): Error: conn OLD_SERVER:993 (IP:993): doveadm server sent invalid handshake: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot (Debian) ready. doveadm(USER): Error: cmd sync: Disconnected from remote: Connection closed I'm pretty sure that doveadm sync was able to negotiate the TLS connection. I don't see what it could object to in the sign-on. What am I missing? Cheers -- /Marc Oscar Singer/ *Woollysoft* Dial 817.1823.602.1+ from right to left. Greetings, I was pleased to see that dovecot has a sync function in doveadm. So far, other tools for moving mailbox contents from one server to another has not been successful. However. Perhaps I don't understand how this should work. I have a new containerized dovecot v2.4.2 # 2.4.2 (0962ed2104): /etc/dovecot/dovecot.conf # OS: Linux 6.12.63+deb13-amd64 x86_64 and I have an existing dovecot running in a VPS: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 6.1.0-35-amd64 x86_64 Debian 12.11 I want to move one user, as a test. I execute this in the container. # doveadm sync -R1 -u USER tcps:OLD_SERVER:993 doveadm(USER): Error: conn OLD_SERVER:993 (IP:993): doveadm server sent invalid handshake: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot (Debian) ready. doveadm(USER): Error: cmd sync: Disconnected from remote: Connection closed I'm pretty sure that doveadm sync was able to negotiate the TLS connection. I don't see what it could object to in the sign-on. What am I missing? Cheers -- Marc Oscar Singer Woollysoft Dial 817.1823.602.1+ from right to left.

5 7

Dovecot and Pigeonhole v2.4.4 Released
by Aki Tuomi 12 May '26

12 May '26

Hi! We are happy to publish version 2.4.4 of Dovecot and Pigeonhole. These contain CVEs, discovered by external researches. The majority of these have been discovered with help of automated code analysis tools like claude code security, which is why some of these are rather old, missed bugs. No new supported distros have been added or old removed, no new dependencies have been added. Note that there are experimental features in 2.4, one is enabled with `--enable-experimental-mail-utf8`, and another with `--enable-experimental-imap4rev2`, and you also need to set mail_utf8_extensions=yes and imap4rev2_enabled=yes to enable them in config. https://dovecot.org/releases/2.4/dovecot-2.4.4.tar.gz https://dovecot.org/releases/2.4/dovecot-2.4.4.tar.gz.sig https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.4.tar.gz https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.4.tar.gz… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot --- * CVE-2026-27851: lib-var-expand: Safe filter marks all following pipelines safe. * CVE-2026-33603: auth: CRAM-SHA-*-PLUS channel binding could be faked. MITM attacker with a certificate trusted by the client could have bypassed the requirement for channel binding. * CVE-2026-40020: IMAP folders can be shared-spammed to everyone. * CVE-2026-42006: An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete. * indexer-worker, quota-status, script-login, program-client-local: Root privileges are now dropped permanently before serving requests. * indexer-worker: Default restart_request_count changed to 1 to work correctly after permanent root privilege drop. * lmtp: Add back service_extra_groups=$SET:default_internal_group that was incorrectly removed in v2.4.3. * master: inet_listener_reuse_port has been replaced by service_reuse_port. The new setting properly pre-creates all listener sockets at startup and assigns one unique socket per process. Using this allows evenly distributing incoming connections to login processes. See https://doc.dovecot.org/latest/core/config/service.html#service_reuse_port for details. - auth: Fix LDAP escaping of 0x13 control character. - auth: Use timing-safe comparison for certificate and public key fingerprints. - fts: Correctly handle internal http-client response errors. - fts: Don't send request to Tika if there is no body text. - fts: Fix address header indexing for RFC 2047 encoded-words. - fts: tika, fts-solr: Fix use-after-free crash during DNS lookup. - imap: Fix assertion panic on invalid REPLACE 0 command. - lib-auth-client: Avoid "unknown id" errors for aborted auth requests. - lib-dcrypt: Fix potential crash if trying to access untrusted/corrupted keys. - lib-dcrypt: Improve error message if keys aren't in hex format as expected. - lib-index: Fix potential crash if fsck fails. - lib-ldap: Fix using OpenLDAP default CA when ssl_client_ca_dir/file is unset. v2.4.3 regression. - lib-master, master: Fix behavior for services with client_limit>1 and restart_request_count so that processes reaching restart_request_count are no longer counted towards process_limit. - lib-master: Fix crash when reaching client_limit with restart_request_count>1. - lib-master: haproxy - Don't trust client certificate common name when HAProxy reports verification failure. - lib-sasl: cram-md5 - Fix out of bounds memory read. - lib-sasl: oauth2 - Fix one byte out of bounds read. - lib-sql: cassandra - Fix reusing Cassandra SSL connections. - lib-sql: sqlite - Fix sqlite_journal_mode=wal to actually work. - lib-storage: Auto-rename non-NFC subscription file entries to NFC on read. - lib-storage: Prevent non-atom SEARCH keywords from causing IMAP command injection. - lib-var-expand-crypt: Return error if hex decoding fails. - lib-var-expand: Fix crash (SIGFPE) with non-positive divisor for / and %. - log: Fix memory leak at deinit. - login-common: When process is full, don't destroy clients waiting on master auth. - login-proxy: Fix crash with rawlog and multiplexing during reconnection. - mail-compress: Fix panic when save method unavailable. - mail-crypt: Fix crash when HMAC-based algorithm is used. - mail-crypt: Use AEAD instead of HMAC with ChaCha20-Poly1305. - mdbox: Create files with O_NOFOLLOW. - push-notification: ox - Fix use-after-free crash during DNS lookup. - quota: quota-status - Limit input buffer size to 1 kB. ––- * CVE-2026-40016: sieve :contains and :matches operators could have been using excessive amount of CPU. Limit the CPU to sieve_max_cpu_time. - Fix potential crashes parsing corrupted Sieve binaries. - lib-sieve: matches - Fix trailing literal match when it fills value exactly. v2.4.3 regression.

2 2

Dovecot Security Advisory OXDC-2026-0002
by Aki Tuomi 12 May '26

12 May '26

Hi! We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. This advisory is also published at https://documentation.open-xchange.com/dovecot/security/advisories/html/202… --- Classification: TLP:GREEN Internal reference: DOV-8967 Type: CWE-235 (Improper Handling of Extra Parameters) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 3.1.4, OX Dovecot CE core 2.4.3 First fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4 Discovery date: 2026-03-29 Solution date: 2026-05-05 Disclosure date: 2026-05-05 Researcher credits: caprinuxx@yeswehack CVE: CVE-2026-27851 CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Details: lib-var-expand: Safe filter leaks to all following pipelines. When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. Risk: This can enable SQL / LDAP injection attacks when used in authentication. No publicly available exploits are known. Solution: Avoid using safe filter until on fixed version. --- Internal reference: DOV-8948 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4 Discovery date: 2026-03-24 Solution date: 2026-05-05 Disclosure date: 2026-05-05 Researcher credits: djvirus@yeswehack CVE: CVE-2026-40016 CVSS: 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Details: Sieve :contains/:matches O(N×M) Substring Match Bypasses sieve_max_cpu_time Limit (130× Overrun). Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Risk: Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. No publicly available exploits are known. Solution: Install fixed version, or alternatively prevent direct access to Sieve scripts via ManageSieve or local access. --- Internal reference: DOV-9030 Type: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4 Discovery date: 2026-04-08 Solution date: 2026-05-05 Disclosure date: 2026-05-05 Researcher credits: ylwango613@yeswehack CVE: CVE-2026-33603 CVSS: 6.8 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Details: login: Base64 input can contain tabs that bypass IPC protection. Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection. Risk: If successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy. No publicly available exploits are known. Solution: Install fixed version. --- Internal reference: DOV-9040 Type: CWE-284 (Improper Access Control) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4 Discovery date: 2026-04-08 Solution date: 2026-05-05 Disclosure date: 2026-05-05 Researcher credits: ilhamaf@yeswehack CVE: CVE-2026-40020 CVSS: 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: IMAP folders can be shared-spammed to everyone. Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. Risk: The impact is limited to being able to spam folders to other users, no unexpected access is gained. No publicly available exploits are known. Solution: Install to fixed version. --- Internal reference: DOV-9138 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 3.0.5, OX Dovecot Pro core 3.1.4, OX Dovecot CE core 2.4.3 First fixed revision: OX Dovecot Pro core 3.1.5, OX Dovecot CE core 2.4.4 Discovery date: 2026-04-27 Solution date: 2026-05-05 Disclosure date: 2026-05-05 Researcher credits: D4RKCYPH3R@yeswehack CVE: CVE-2026-42006 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: imap-login: Excessive memory usage DoS - Try 2. An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Risk: Using excessive bracing, attacker can cause memory usage up to configured memory limit. No publicly available exploits are known. Solution: Install fixed version, or configure vsz_limit for imap process to low value.

1 0

Changed location of index files
by Lafiel Elentari 11 May '26

11 May '26

Hello. After upgrading to version 2.4, index files were moved to the user's home directory, and the `mail_path = ~/mail` parameter was no longer taken into account when processing index files. In addition, indexes for the `INBOX` folder no longer respect the `mail_index_path=` parameter and are stored in the `./INBOX/dovecot.index.*` folder, although they should be stored in the same folder where the messages are stored, given the current configuration. My configuration: ``` mail_home = mail_inbox_path = mail_index_path = mail_path = ~/mail userdb declarative { passwd_file_path = /var/data/mail/dovecot/passdb driver = passwd-file fields { home = /var/data/mail/vmail/%{user | domain}/%{user | username} mail_index_path = /var/data/mail/vmail/%{user | domain }/%{user | username} } } ``` Current location of index files: ``` /var/data/mail/vmail/example.com/user ├── INBOX │ ├── dovecot.index.cache │ └── dovecot.index.log ├── Sent │ ├── dovecot.index.cache │ └── dovecot.index.log ├── Drafts │ └── dovecot.index.log ├── Junk │ └── dovecot.index.log ├── Trash │ ├── dovecot.index.cache │ └── dovecot.index.log ├── dovecot.list.index ├── dovecot.list.index.log └─── mail ├── cur ├── new ├── tmp ├── Sent │ ├── cur │ ├── new │ ├── tmp │ └── dovecot-uidlist ├── Drafts │ ├── cur │ ├── new │ ├── tmp │ └── dovecot-uidlist ├── Junk │ ├── cur │ ├── new │ ├── tmp │ └── dovecot-uidlist ├── Trash │ ├── cur │ ├── new │ ├── tmp │ └── dovecot-uidlist ├── subscriptions ├── dovecot.mailbox.log ├── dovecot-uidlist ├── dovecot-uidvalidity └── dovecot-uidvalidity.69d94118 ``` Expected location of index files according to configuration: ``` /var/data/mail/vmail/example.com/user └─── mail ├── cur ├── new ├── tmp ├── Sent │ ├── cur │ ├── new │ ├── tmp │ ├── dovecot.index │ ├── dovecot.index.cache │ ├── dovecot.index.log │ └── dovecot-uidlist ├── Drafts │ ├── new │ ├── tmp │ ├── cur │ ├── dovecot.index │ ├── dovecot.index.cache │ ├── dovecot.index.log │ └── dovecot-uidlist ├── Junk │ ├── new │ ├── tmp │ ├── cur │ ├── dovecot.index │ ├── dovecot.index.cache │ ├── dovecot.index.log │ └── dovecot-uidlist ├── Trash │ ├── cur │ ├── new │ ├── tmp │ ├── dovecot.index │ ├── dovecot.index.cache │ ├── dovecot.index.log │ └── dovecot-uidlist ├── dovecot.index ├── dovecot.index.cache ├── dovecot.index.log ├── dovecot.list.index ├── dovecot.list.index.log ├── dovecot.mailbox.log ├── dovecot-uidlist ├── dovecot-uidvalidity ├── dovecot-uidvalidity.69d94118 └── subscriptions ``` -- Best regards, Lafiel Elentari mailto:lafiel@elven.pw

2 2

Dovecot 2.3.21.1 missing dbox-Mails folder causes IMAP folder which can not be deleted? Possible known bug?
by Benoit Panizzon 11 May '26

11 May '26

Hi Team Running Dovecot 2.3.21.1 in an ISP environment using dbox format as storage and built in dovecot replication to a secondary storage. => I know, it's not new - migration to 2.4 with completely replacing replication is pending. For quite some time we are fighting issues with customers which are unable to delete IMAP folder. Those folder end up in status \NoSelect When you issue a 'delete' for the folder, it is successful, but either the folder is back after logout/login or back right away when you list the folders. Usual remedy: completely delete mail index of affected mailbox on both, primary and secondary storage, delete complete mail storage on secondary, resync with doveadm force-resync, cross filters. Now I had a mailbox where even this did not solve the issue - but I noticed something weird. . delete "mailbox" => OK . delete "mailbox" => OK . create "mailbox" => OK . create "mailbox" => Mailbox does already exist . delete "mailbox" => OK . delete "mailbox" => Mailbox does not exist Now the Mailbox is gone from the file system and is not shown with list anymore. Now I had a closer look at the next affected mailbox on the filesystem. IMAP Foldername: LIST (\Noselect \HasNoChildren) "." INBOX.brokenmbox Filesystem, directories: INBOX/brokenmbox/ => There is no content, no hidden files inside the folder 'broeknmbox' . delete "INBOX.brokenmbox" => OK Checking Filesystem. Nothing changed, still the same. . create "INBOX.brokenmbox" => OK Checking Filesystem: Now we have: INBOX/broeknmbox/dbox-Mails/ all empty. . delete "INBOX.brokenmbox" => OK Checking Filesystem: broeknmbox/dbox-Mails/ are both gone within INBOX! Conclusion: Dovecot seems to get confused, when a directory without dbox-Mails subdirectory exists, fails to delete such directories but still lists them as IMAP folders. Is this a known bug? Is there anything which is know to cause this issue which we could tweak at our configuration? Mit freundlichen Grüssen -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

1 0

Migration Planning for Dovecot 2.3 to 2.4
by Gregory Carter 05 May '26

05 May '26

Hello so I have started planning my 2.3 to 2.4 migration and finished the lab work today for that process. Does anyone know of any tools to migrate the configs from 2.3 to 2.4? Also if you are running 2.4 I would like to hear from you as to how well it is working out. Thanks. Hello so I have started planning my 2.3 to 2.4 migration and finished the lab work today for that process. Does anyone know of any tools to migrate the configs from 2.3 to 2.4? Also if you are running 2.4 I would like to hear from you as to how well it is working out. Thanks.

8 12

Dovecot sieve, help !
by Tommy Berglund 03 May '26

03 May '26

Hi! I need help and advice on how to get sieve working. Postfix dovecot works to receive and send mail but I can't get sieve to work. Domain and user are virtual in mariadb. Tips are welcome. Doveconf -n attached.

3 4

mail_inbox_path in manual
by Daniel Convissor (business) 01 May '26

01 May '26

Hi: Recently upgraded Debian to version 13/Trixie, which brings Dovecot up to 2.4 (with its significant configuration file changes). As mentioned on this list, Debian decided to manually put mail_inbox_path in their distribution's config files (and set it to /var/mail/%{user}).[1] This resulted in mayhem for me because that's not where our mail is. I assume this has happened to others as well. I figured out the problem by looking at mail.log after adding mail_debug=yes to my local Dovecot config file. Perhaps Dovecot's manual can be updated to clarify the situation, please? The Mail Location page[2] warns admins to not touch this setting. The upgrade page[3] does not mention needing to look out for Debian's choice. (Granted, this is a Debian problem, but the Dovecot manual is where people turn to figure out what is happening.) Thank you, --Dan [1] https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/message/Q6HI… [2] https://doc.dovecot.org/2.4.3/core/config/mail_location.html#mail_inbox_path [3] https://doc.dovecot.org/2.4.3/installation/upgrade/2.3-to-2.4.html -- T H E A N A L Y S I S A N D S O L U T I O N S C O M P A N Y Designing transportation systems everyone can use https://www.AnalysisAndSolutions.com/

1 0

Confusion about ldap in 2.4
by fc26wuqa＠studserv.uni-leipzig.de 28 Apr '26

28 Apr '26

Hello, With dovecot 2.3 it was clear to me, how I should set up ldap: Include `conf.d/auth-ldap.conf.ext` in `conf.d/10-auth.conf` and include `dovecot-ldap.conf.ext` with the usual parameters like hosts, uris, dn, etc. In dovecot 2.4 I am a little bit confused about whats the best practice. I heard about that .ext files being outdated and examples in the documentation saying I should put everything in dovecot.conf? So If in 2.3 my config would look like this: ``` # auth-ldap.conf.ext passdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf.ext } userdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf.ext } ``` ``` # dovecot-ldap.conf.ext hosts = ldap.something.org:636 uris = ldaps://smoething.org dn = cn=something,ou=something,dc=something,dc=org dnspass = somethingsomething auth_bind = yes auth_bind_userdn = uid=%u,ou=something ... ``` I would put something like this in dovecot.conf? Or in auth-ldap.conf.ext? ``` ldap_uris = ldap://ldap.example.org ldap_auth_dn = cn=admin,dc=example,dc=org ldap_auth_dn_password = secret ldap_base = dc=example,dc=org passdb ldap { bind = yes filter = (&(objectClass=posixAccount)(uid=%{user})) fields { user = %{ldap:uid} } } ``` (https://doc.dovecot.org/2.4.3/core/config/auth/databases/ldap.html#dn-lookup)

1 0

Upgrading from 2.4.2 to 2.4.3 broke static password login
by harrison＠hhj.me 28 Apr '26

28 Apr '26

Hey folks, I've got dovecot running via docker on version 2.4.2. Here's what my config extension looks like: ``` # auth_mechanisms = plain login auth_verbose = yes passdb static { password = %{env:USER_PASSWORD} } service lmtp { inet_listener lmtps { port = 31024 ssl = no } } ssl_server_cert_file = /etc/dovecot/ssl/cert.pem ssl_server_key_file = /etc/dovecot/ssl/key.pem ssl = yes auth_allow_cleartext = no namespace inbox { type = private separator = / inbox = yes mailbox Drafts { special_use = \Drafts auto = subscribe } mailbox Junk { special_use = \Junk auto = create } mailbox spam { special_use = \Junk auto = no } mailbox Spam { special_use = \Junk auto = no } mailbox Trash { special_use = \Trash auto = subscribe } mailbox TRASH { special_use = \Trash auto = no } mailbox Sent { special_use = \Sent auto = subscribe } mailbox "Sent Mail" { special_use = \Sent auto = no } mailbox "Sent Messages" { special_use = \Sent auto = no } mailbox Archive { special_use = \Archive auto = create } mailbox "Archives" { special_use = \Archive auto = no } } ``` I have env `USER_PASSWORD` defined in the format of `{PLAIN}REDACTED` This has been humming along fine for a little while. I recently automatically upgraded to 2.4.3 which broke my ability to login via IMAP to retrieve emails (it also broke my local mail transport setup; it was unable to send emails). I could see the following messages in the logs: ``` Apr 27 11:12:09 auth(REDACTED,REDACTED,sasl:plain)<REDACTED>: Info: static: No password returned (and no nopassword) Apr 27 11:12:11 imap-login: Info: Login aborted: Connection closed (auth failed, 1 attempts in 6 secs) (auth_failed): user=<REDACTED>, method=PLAIN, rip=REDACTED, lip=172.17.0.2, TLS, session=<REDACTED> ``` Downgrading back to 2.4.2 "fixed" the problem (I was able to login again; LMTP worked again). I didn't change my config extension between the upgrades. I tried searching https://github.com/search?q=repo%3Adovecot%2Fcore+password&type=issues and I see a few related to passwords but nothing is really jumping out at me. Help? I'm staying pinned on 2.4.2 for now but that's not a long term solution.

2 3

Panic in logs
by Kamil Jońca 26 Apr '26

26 Apr '26

Recently I found in my lda logs: 2025-12-30T07:55:14.717927+01:00 alfa dovecot: lda(kjonca): Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 i_syslog_fatal_handler[0x7f99a2351430] -> #3 i_panic[0x7f99a226d453] -> #4 [unw_get_proc_name() failed: -10] -> #5 [unw_get_proc_name() failed: -10] -> #6 [unw_get_proc_name() failed: -10] -> #7 buffer_append[0x7f99a2345270] -> #8 dregex_code_match_groups[0x7f99a233f1a0] -> #9 [unw_get_proc_name() failed: -10] -> #10 [unw_get_proc_name() failed: -10] -> #11 sieve_match_value[0x7f99a117f770] -> #12 sieve_match[0x7f99a117fa30] -> #13 [unw_get_proc_name() failed: -10] -> #14 sieve_interpreter_continue[0x7f99a117e100] -> #15 sieve_multiscript_run[0x7f99a1190330] -> #16 [unw_get_proc_name() failed: -10] -> #17 mail_deliver[0x7f99a27e54a0] -> #18 main[0x55e371c555e0] -> #19 __libc_start_call_main[0x7f99a1e29f00] -> #20 __libc_start_main_alias_2[0x7f99a1e29fa0] -> #21 _start[0x55e371c566a0] And sadly it seems, that mail is missing (it was passed to pipe program to further processing) KJ -- http://wolnelektury.pl/wesprzyj/teraz/ When you go out to buy, don't show your silver.

4 6

Incorrect ARC signature on emails
by Lafiel Elentari 25 Apr '26

25 Apr '26

Hello. On the mail server, I configured addition of the `Authentication-Results` header with authentication check results. I noticed that emails from the dovecot.org server have an incorrect ARC signature: Authentication-Results: ...; dkim=pass header.d=dovecot.org header.s=... header.b=...; dkim=fail ("body hash did not verify") header.d=... header.s=... header.b=...; arc=reject ("signature check failed: fail, {[1] = sig:dovecot.org:reject}"); spf=pass (...: domain of "dovecot-bounces+...=...(a)dovecot.org" designates ... as permitted sender) smtp.mailfrom="dovecot-bounces+...=...(a)dovecot.org"; dmarc=pass (policy=reject) header.from=dovecot.org ``` -- Best regards, Lafiel Elentari mailto:lafiel@elven.pw

2 2

mbox to maildir migration, same server?
by kjohnson＠eclypse.org 25 Apr '26

25 Apr '26

What is the recommended procedure to migrate from mbox to maildir on a server already running dovecot? Ideally, this procedure would convert messages in an existing mbox INBOX and in ~/mail mboxes (as defined in my dovecot configuration) to storage in a ~/Maildir. Some of the INBOXs are rather large -- 100's of MB (one of the reasons for migrating). What I have tried has not worked for me. Below, I describe what I tried, how I tested before I tried, what went wrong, and the current setup (pre-migration). What I tried: ============= stop exim4 service dovecot stop Make dovecot listen only locally, not to external connections. /etc/dovecot/local.conf protocol imap { listen = 127.0.0.1:143 ssl_listen = 127.0.0.1:993 } protocol pop3 { listen = 127.0.0.1:110 ssl_listen = 127.0.0.1:995 } Modify dovecot configuration for maildir: Watch capitalization! #in 10-mail.conf: mail_location = maildir:/home/%u/Maildir namespace inbox { separator = / } dovecot -n, to confirm results and perform limited syntax checking. service dovecot start for each user, in a bash script: dsync -v -u "$U" mirror "mbox:/home/$U/mail:INBOX=/var/mail/$U" (if the conversion worked for all users, then reconfigure exim to use maildir and restart it; reconfigure dovecot to listen to external interfaces and restart.) How I tested: ============= Before trying this on the real server, I set up a matching (same versions of Debian, Exim, and Dovecot) VM using mbox, with a couple of accounts. One using POP3, one using IMAP. The IMAP account was accessed from Claws and from Outlook. The test accounts had perhaps a dozen messages on the server. I tried the conversion procedure, and everything I tried worked flawlessly. (Yes, next time I will move some real inbox files from the live server). What went wrong: ================ I encountered two types of problems here. The first was several dsync warnings (username changed): dsync(example): Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID 21bfa11a81f11763ac150000d09efc50 (maybe it was just deleted?) As I understand it, this can result in some or all messages being downloaded again by clients. My understanding may be wrong. I also don't understand how the mailbox could have changed -- exim4 was stopped, dovecot is only listening on 127.0.0.1, and I am the only user who uses a local mail client on that system, and this was not my account. The second problem I encountered seems to match Debian Bug report logs - #1011238. In part of the discussion of that report, the reporter mentions adding -1 to the command, as shown: dsync -v -u "$U" mirror -1 "mbox:/home/$U/mail:INBOX=/var/mail/$U" While this seemed to eliminate the dsync panic of #1011238, as far as I can tell, no old messages were actually moved from the old mbox files to the new maildirs. At that point I restored the backup mbox files and undid the changes to dovecot and exim4. Current setup: ============== Debian 11.4 Exim 4.94.2-7 dovecot 1:2.3.13+dfsg1-2 The current setup with Dovecot was a successful migration from IMAP-UW in December 2020. Output from dovecot -n (the list of trusted networks has been removed) # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-16-686-pae i686 Debian 11.4 # Hostname: localhost auth_verbose = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } pop3_uidl_format = %08Xv%08Xu protocols = " imap pop3" ssl_cert = </etc/dovecot/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } Thank you to anyone who read this far. Ken

5 5

Is this a bug of `doveadm mailbox metadata set` with `-A` and `-s ""`
by Zhang Huangbin 24 Apr '26

24 Apr '26

Dear all, Recently i encountered an issue with `doveadm mailbox metadata set` (and `unset`) with either `-A` or `-F <path>`. When i run `doveadm mailbox metadata set` for single user, it correctly generates content in `dovecot-attributes` file: ``` doveadm mailbox metadata set -u <email> -s "" "/private/vendor/vendor.dovecot/http-notify" "user=all" ``` But if i run with `-A`, or `-F <path>`, Dovecot generates incorrect "path" and unreadable characters in `dovecot-attributes` file: ``` # doveadm mailbox metadata set -A -s "" "/private/vendor/vendor.dovecot/http-notify" "user=all" # for i in $(find . -name 'dovecot-attributes'); do echo $i; cat $i; done priv/4898662293abe1690d9a000063130d18/vendor/vendor.dovecot/pvt/server/?????? user=all priv/90e7b40fc8c1e9690924000063130d18/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify user=all priv/60ba353790c1e969f923000063130d18/vendor/vendor.dovecot/pvt/server/endor.dovecot/pvt/server/CV?? user=all ``` It's ok if i specify the mailbox in -s, for example: `-s "INBOX"`, `-s "Sent"`, but it's not what i want, because only emails delivered to specified mailbox will be pushed. Is this a bug?

1 1

[Bug Report] anvil panic: anvil-connection.c:727: unreached triggered by duplicate imap-login handshake with pid=-1
by Jeff Aitken 24 Apr '26

24 Apr '26

Environment: FreeBSD 14.4-RELEASE Dovecot 2.4.3 (e278b1e09b) Pigeonhole 2.4.3 (0bf9ee48) Postfix 3.11.1, rspamd 4.0.0 Description: The dovecot anvil process is crashing repeatedly with a panic in anvil-connection.c at line 727. The panic is triggered by i_unreached() in anvil_connection_destroy(). Total of ~18 crashes in the last 24 hours, happens to multiple users. The anvil process restarts successfully and works as expected other than the crashes. No other symptoms that I can see that appear related. Log messages: dovecot[87542]: anvil: Panic: file anvil-connection.c: line 727: unreached dovecot[87542]: anvil: Fatal: master: service(anvil): child 88408 killed with signal 6 (core not dumped) dovecot[87542]: anvil: Error: connect limit: disconnection for unknown (pid=88756, user=<username>, service=imap, ip=X.X.X.X, ...) dovecot[87542]: anvil: Warning: conn unix:anvil (uid=0): Handshake with duplicate service=imap-login pid=-1 - replacing the old connection Analysis (from claude): In anvil_connection_destroy(), when conn->added_to_hash is true, the code asserts that the connection must still be present in anvil_connections_hash. However, when a duplicate handshake is received for the same (service, pid) key, the old connection appears to be evicted from the hash table without clearing its added_to_hash flag. When the old connection is subsequently destroyed, hash_table_lookup_full() fails to find it, triggering i_unreached(). The pid=-1 in the duplicate handshake warning is also notable — this does not appear to be a valid process ID and may indicate that the handshake is being sent before the imap-login process has fully initialized. Workaround: Setting service_restart_request_count = unlimited and service_process_min_avail = 2 on the imap-login service seems to have reduces process turnover and appears to have reduced the frequency of the crash, but I’ve only got a couple of hours since that change so too early to say for sure. Suggested fix: When a duplicate handshake causes an existing connection to be evicted from anvil_connections_hash, the evicted connection's added_to_hash flag should be cleared to prevent the assertion failure in anvil_connection_destroy(). Appreciate any insight, and happy to provide additional info that would be helpful. —Jeff

1 0

Unable to get Dovecot 2.4 to allow unencrypted connection
by David Koski 24 Apr '26

24 Apr '26

Hello, In spite of: ssl = no auth_allow_cleartext = yes ..in a telnet session, I get: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS LOGINDISABLED AUTH=GSSAPI AUTH=CRAM-MD5] Dovecot (Debian) ready. a1 login ln(a)zample.com <super-secret> * BAD [ALERT] Plaintext authentication not allowed without SSL/TLS, but your client did it anyway. If anyone was listening, the password was exposed. a1 NO [PRIVACYREQUIRED] Plaintext authentication disallowed on non-secure (SSL/TLS) connections. I need to see the network traffic to troubleshoot the way Outlook 2019 handles IMAP folders. Regards, David Koski dkoski(a)sutinen.com

3 9

Re: large mbox files
by Joseph Tam 23 Apr '26

23 Apr '26

On Wed, 22 Apr 2026, Marc wrote: > How are messages deleted from large mbox files, are these files > completely rewritten? I can't really believe that as some are bigger > than the free disk space available. I think it's a little better than that: bytes are shuffled up to fill the deleted message hole. I gather this from noting the difference in operation time from deleting a message from the top vs bottom of a large mailbox. Joseph Tam <jtam.home(a)gmail.com>

1 0

large mbox files
by Marc 23 Apr '26

23 Apr '26

How are messages deleted from large mbox files, are these files completely rewritten? I can't really believe that as some are bigger than the free disk space available.

2 1

doveadm expunge silently ignores multiple -u flags instead of erroring or processing all users
by Robert Kretowicz 21 Apr '26

21 Apr '26

Hello, I would like to report what I believe is a bug in doveadm expunge argument handling. Summary When multiple -u flags are passed to doveadm expunge, for example: doveadm expunge -u user1 -u user2 -u user3 mailbox '*' BEFORE 2015-01-01 the command exits with code 0 (success) but only processes one of the specified users. The remaining users are silently skipped with no warning or error message produced. Why this is a bug This is a silent failure on a destructive, irreversible operation. An administrator has no indication that most users were not processed. Good CLI tools should either: Accept multiple -u flags and process all specified users (consistent with how -F file works), or Reject the command immediately with a clear error such as: Error: -u flag specified multiple times. Use -F <file> for multiple users. Silently accepting invalid input and doing something unpredictable is the worst possible outcome, especially for a mail expunge operation. Environment OS: Debian GNU/Linux 12 (Bookworm) Dovecot version: 2.3.x (from Debian package) doveconf -n output available on request — omitted due to containing internal domain names. Workaround I am currently using bashfor user in user1 user2 user3; do doveadm expunge -u "$user" mailbox '*' BEFORE 2015-01-01 done Thank you for your time. Robert Kretowicz

2 1

Master user login attempted without master passdbs
by horst.simon.aus＠gmail.com 21 Apr '26

21 Apr '26

Hi, I have dovecot version v2.3.21.1 and my users (username(a)domain.name) are in mysql, all can logon to imap and sending mail, but when I am trying to create and enable sieve scripts from an weblient (horde webmail) it fails with authentication errors. It tries to use master user authentication and the logs are showing following: A pr 15 10:34:51 auth: Debug: client in: AUTH 1 PLAIN service=sieve secured session=yTdN4nRPFcF/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=4190 rport=49429 resp=aG9yc3QAaG9yc3RAaGJzaW1vbi5uZXQAYXVnQDYmOXVzdA== (previous base64 data may contain sensitive data) Apr 15 10:34:51 auth: Info: plain(horst(a)hbsimon.net,127.0.0.1,<yTdN4nRPFcF/AAAB>): login user: Master user login attempted without master passdbs Apr 15 10:34:51 auth: Debug: auth(horst(a)hbsimon.net,127.0.0.1,<yTdN4nRPFcF/AAAB>): Auth request finished Apr 15 10:34:51 auth: Debug: auth client connected (pid=1478) Apr 15 10:34:53 auth: Debug: client passdb out: FAIL 1 user=horst(a)hbsimon.net Apr 15 10:34:53 managesieve-login: Info: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<horst(a)hbsimon.net>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<yTdN4nRPFcF/AAAB> Apr 15 10:35:06 auth: Debug: client in: AUTH 1 PLAIN service=sieve secured session=VEgr43RPGMF/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=4190 rport=49432 resp=aG9yc3QAaG9yc3RAaGJzaW1vbi5uZXQAYXVnQDYmOXVzdA== (previous base64 data may contain sensitive data) Apr 15 10:35:06 auth: Info: plain(horst(a)hbsimon.net,127.0.0.1,<VEgr43RPGMF/AAAB>): login user: Master user login attempted without master passdbs Apr 15 10:35:06 auth: Debug: auth(horst(a)hbsimon.net,127.0.0.1,<VEgr43RPGMF/AAAB>): Auth request finished Apr 15 10:35:06 auth: Debug: auth client connected (pid=1484) Apr 15 10:35:08 auth: Debug: client passdb out: FAIL 1 user=horst(a)hbsimon.net Apr 15 10:35:08 managesieve-login: Info: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<horst(a)hbsimon.net>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<VEgr43RPGMF/AAAB> How can I bypass the master user login and use the assigned user or what should the master user be and how to create it? Thanks and Regards, Horst

4 7

Dovecot 2.4 SETQUOTA, how to allow (admin) users to set quota (and write it back to LDAP)
by Johannes Nohl 20 Apr '26

20 Apr '26

Is it true that Dovecot dismissed the functionality of SETQUOTA with version 2.4.0 - without any replacement? see https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/message… Does this also applies to 2.4.2 and 2.4.3, or does the mechanism of plugin imap_quota returned (manual reads that there are no options to this plugin)? IMAP always replies `c008 NO [NOPERM] Permission denied (0.001 + 0.000 secs).` If you can activate the former `quota_set` option, how to combine it with LDAP? I know that you can read Quota from LDAP with userdb field `quota_storage_size = {ldap:quotaBytes}B`. But how to set it? I also remember an old opinion that writing LDAP is to slow, you should store quota e.g. in a text file and write it back to LDAP time shifted. That would be fine for me - however, how to enable SETQUOTA then? Thank you for help. -- Johannes Nohl postmaster(a)i-t-cloud.de

3 3

Config: Reading value from file for password does not work
by René Neumann 19 Apr '26

19 Apr '26

Hi, I want to read the ldap auth-dn password from a file to avoid having it as part of the configuration (which may be checked into VCS). I specified ldap_auth_dn_password = </some/file where /some/file contains the password without extra whitespace (esp. there is no `\n`, I checked with xxd). But ldap auth does not succeed because of a wrong password. Password itself does work though, as checked with ldapsearch (even using the same file as password provider) `doveconf -x -P` *does* show the correct value. The same issue has been reported back in 2019 [1], without any reply though :-/ Any ideas? Thanks, René [1] https://dovecot.org/list/dovecot/2019-September/117100.html

2 3

[Bug Report] 2.4.3 on macOS: anvil panics at anvil-connection.c:727 on every IMAP client handshake
by I-K-D-T＠web.de 18 Apr '26

18 Apr '26

Hi Dovecot developers, I'm hitting a reproducible anvil panic on macOS when any IMAP client tries to connect. Every client handshake triggers an `i_unreached()` assertion in `anvil-connection.c:727`, causing the anvil child to be killed with SIGABRT. Dovecot keeps restarting anvil, but every subsequent connection attempt triggers the same panic, so the service effectively cannot accept logins. ## Environment - Dovecot: 2.4.3 (e278b1e09b), Pigeonhole 2.4.3 (0bf9ee48) -- from Homebrew - OS: macOS 15.6 (Sequoia, Darwin 24.6.0, arm64/Apple Silicon, APFS) - Mail client: Mozilla Thunderbird 149.0.2 - Dovecot started via `sudo brew services start dovecot` (launchd) ## Reproducing 1. Fresh macOS install of Dovecot 2.4.3 via Homebrew. 2. Configure a minimal single-user IMAP setup with `passdb static` / `userdb static`, SSL on port 993 with a self-signed cert, Maildir storage (config at end of this mail). 3. Start Dovecot as root via launchd (`sudo brew services start dovecot`). 4. Connect any IMAP client to localhost:993 (I used Thunderbird 149 with a permanent cert exception for the self-signed certificate). 5. The client hangs / reports "server closed the connection" / sees no folders. 6. `dovecot.log` fills with repeated entries like the following: ``` anvil: Warning: conn unix:anvil (uid=0): Handshake with duplicate service=imap-login pid=-1 - replacing the old connection anvil: Panic: file anvil-connection.c: line 727: unreached anvil: Error: Raw backtrace: 0 libdovecot.0.dylib backtrace_append + 72 -> 1 libdovecot.0.dylib backtrace_get + 44 -> 2 libdovecot.0.dylib default_fatal_finish + 72 -> 3 libdovecot.0.dylib default_error_handler -> 4 libdovecot.0.dylib i_internal_error_handler -> 5 libdovecot.0.dylib i_fatal -> 6 libdovecot.0.dylib default_write -> 7 anvil anvil_connection_input_line -> 8 libdovecot.0.dylib connection_input_read_stream + 196 -> 9 libdovecot.0.dylib connection_input_default + 72 -> 10 libdovecot.0.dylib io_loop_call_io + 116 -> 11 libdovecot.0.dylib io_loop_handler_run_internal + 284 -> 12 libdovecot.0.dylib io_loop_handler_run + 220 -> 13 libdovecot.0.dylib io_loop_run + 88 -> 14 libdovecot.0.dylib master_service_run + 292 -> 15 anvil main + 368 -> 16 dyld start + 6076 anvil: Fatal: master: service(anvil): child NNNN killed with signal 6 (core dumps disabled) ``` The key signature is the two-line sequence: ``` Warning: conn unix:anvil (uid=0): Handshake with duplicate service=imap-login pid=-1 - replacing the old connection Panic: file anvil-connection.c: line 727: unreached ``` Every IMAP client handshake produces this. The `pid=-1` in the handshake warning looks suspicious -- it appears anvil is either not receiving a valid pid from imap-login or is registering a second connection with the same service name before the first is cleaned up. ## Workarounds attempted (none succeeded) - User-level setup with default_login_user=andreas -> same panic - Root-level setup with default_login_user=andreas -> same panic - Root-level setup with default_login_user=_www (unprivileged macOS service account with uid=70) -> same panic - Adding `default_vsz_limit = unlimited` (required separately on macOS because setrlimit(RLIMIT_DATA) fails with EINVAL on Darwin) -> did not affect anvil - Plaintext IMAP on 143 (no TLS) vs. IMAPS on 993 with self-signed cert -> same panic in both - Restarting Dovecot via launchd (`sudo brew services stop/start dovecot`) -> the panic recurs on the next connection ## `doveconf -n` output ``` # 2.4.3 (e278b1e09b): /opt/homebrew/etc/dovecot/dovecot.conf # Pigeonhole version 2.4.3 (0bf9ee48) # OS: Darwin 24.6.0 arm64 apfs # Hostname: macbook-air-von-andreas.local dovecot_config_version = 2.4.3 auth_mechanisms = plain login default_internal_group = _www default_internal_user = _www default_login_user = _www default_vsz_limit = unlimited dovecot_storage_version = 2.4.3 info_log_path = /opt/homebrew/var/log/dovecot/dovecot-info.log listen = 127.0.0.1 log_path = /opt/homebrew/var/log/dovecot/dovecot.log mail_driver = maildir mail_gid = staff mail_home = /Users/andreas/mail/%{user} mail_path = /Users/andreas/mail/%{user} mail_uid = andreas protocols = imap ssl_server { cert_file = /opt/homebrew/etc/dovecot/ssl/dovecot.crt key_file = /opt/homebrew/etc/dovecot/ssl/dovecot.key } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } passdb static { password = # hidden } userdb static { fields { gid = staff home = /Users/andreas/mail/%{user} uid = andreas } } namespace inbox { mailbox_list_layout = fs inbox = yes prefix = separator = / } ``` ## What I would expect The anvil connection from imap-login should register with a valid pid (not -1) or anvil should tolerate the re-registration gracefully instead of hitting an i_unreached() assertion. ## Note on `dovecot-sysreport` Running `dovecot-sysreport` as the normal user fails with permission errors on `/opt/homebrew/var/run/dovecot/*` sockets (log-errors, master). The `grep -P` usage inside the script also fails on BSD grep (macOS). Let me know if a sysreport archive would be useful -- I can re-run with sudo and adjust grep if needed. Happy to provide further reproduction details, additional log output, or test any fix suggestions. Thanks for Dovecot. Andreas Marth I-K-D-T(a)web.de

2 1

still a compile error in 2.4.3
by matthias 14 Apr '26

14 Apr '26

Hi, I got this message while I compile the version 2.4.3: libtool: error: cannot find the library '../../src/lib-lua/libdovecot-lua.la' or unhandled argument '../../src/lib-lua/libdovecot-lua.la' Thanks Matthias

3 2

INBOX.dovecot.sieve not selectable
by 87auteur-niobium＠icloud.com 14 Apr '26

14 Apr '26

Hi folks, I’m seeing “INBOX.dovecot.sieve” listed on the response of the IMAP LIST command, but attempting to select the mailbox fails with “Internal server error occurred. Refer to the server log for more information”. I assume INBOX.dovecot.sieve is an internal/system folder that shouldn’t be on the LIST response. Is this a known issue? If it is, is it being tracked anywhere (I don’t see an “Issues” tab on GitHub for Dovecot Core)?

2 1

imap-login not passing DSN through
by Hadmut Danisch 14 Apr '26

14 Apr '26

Hi, I have a problem with postfix + dovecot 1:2.3.21+dfsg1-2ubuntu6.3 on Ubuntu Server 24.04: When using dovecot's imap-login to verify users and passwords againgst dovecot's user list, it doesn't pass the DSN flag through, therefore effectively disabling DSN. Postfix, submission port bound to 127.0.0.1, port 587: 250-myhostname 250-PIPELINING 250-SIZE 18432000 250-ETRN 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING but imap-login (configured to forward to 127.0.0.1:587): 250-myhostname 250-8BITMIME 250-AUTH PLAIN 250-BURL imap 250-CHUNKING 250-ENHANCEDSTATUSCODES 250-SIZE 250 PIPELINING So both the size limit and DSN are not passed through, SMTPUTF8 either. Even setting imap_capability = +DSN in 20-imap.conf doesn't help. What is keeping dovecot's imap-login from offering DSN? best regards Hadmut Hi, I have a problem with postfix + dovecot 1:2.3.21+dfsg1-2ubuntu6.3 on Ubuntu Server 24.04: When using dovecot's imap-login to verify users and passwords againgst dovecot's user list, it doesn't pass the DSN flag through, therefore effectively disabling DSN. Postfix, submission port bound to 127.0.0.1, port 587: 250-myhostname 250-PIPELINING 250-SIZE 18432000 250-ETRN 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING but imap-login (configured to forward to 127.0.0.1:587): 250-myhostname 250-8BITMIME 250-AUTH PLAIN 250-BURL imap 250-CHUNKING 250-ENHANCEDSTATUSCODES 250-SIZE 250 PIPELINING So both the size limit and DSN are not passed through, SMTPUTF8 either. Even setting imap_capability = +DSN in 20-imap.conf doesn't help. What is keeping dovecot's imap-login from offering DSN? best regards Hadmut

1 1

doveadm batch crash
by Jonathan Casiot 13 Apr '26

13 Apr '26

Hi I'm having an issue with doveadm batch - the following command always crashes: doveadm batch : mailbox status all inbox Whereas the following work as expected: doveadm mailbox status all inbox doveadm batch : mailbox list Any assistance gratefully received. Debug output from the crash: Debug: Loading modules from directory: /usr/lib64/dovecot Debug: Module loaded: /usr/lib64/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib64/dovecot/lib10_mail_crypt_plugin.so Debug: Module loaded: /usr/lib64/dovecot/lib90_stats_plugin.so Debug: Loading modules from directory: /usr/lib64/dovecot/doveadm Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib64/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so doveadm(jc): Debug: Effective uid=1001, gid=100, home=/home/jc doveadm(jc): Debug: acl: No acl_shared_dict setting - shared mailbox listing is disabled doveadm(jc): Debug: mail_crypt_plugin: mail_crypt_curve setting missing - generating EC keys disabled doveadm(jc): Debug: Namespace inbox: type=private, prefix=, sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes location=mdbox:~/mdbox:ALT=~/Archive/tape/mdbox doveadm(jc): Debug: fs: root=/home/jc/mdbox, index=, indexpvt=, control=, inbox=, alt=/home/jc/Archive/tape/mdbox doveadm(jc): Debug: acl: initializing backend with data: vfile doveadm(jc): Debug: acl: acl username = jc doveadm(jc): Debug: acl: owner = 1 doveadm(jc): Debug: acl vfile: Global ACLs disabled doveadm(jc): Panic: file mail-storage.c: line 875 (mailbox_set_reason): assertion failed: (reason != NULL) doveadm(jc): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0xa0e9e) [0x7fc993023e9e] -> /usr/lib64/dovecot/libdovecot.so.0(default_fatal_handler+0x2a) [0x7fc993023f0a] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7fc992fb3c97] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x49856) [0x7fc993301856] -> /usr/bin/doveadm(+0x348e2) [0x5631dbb5f8e2] -> /usr/bin/doveadm(+0x2e1ad) [0x5631dbb591ad] -> /usr/bin/doveadm(+0x2bd2c) [0x5631dbb56d2c] -> /usr/bin/doveadm(+0x2c92a) [0x5631dbb5792a] -> /usr/bin/doveadm(doveadm_mail_try_run+0x215) [0x5631dbb58285] -> /usr/bin/doveadm(main+0x46a) [0x5631dbb473fa] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7fc992bd83d5] -> /usr/bin/doveadm(+0x1c565) [0x5631dbb47565] Aborted (core dumped) And doveconf -n output: # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-957.1.3.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) # Hostname: ### redacted ### first_valid_gid = 100 first_valid_uid = 1000 last_valid_gid = 100 last_valid_uid = 1999 listen = * login_greeting = IMAP ready login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e session=<%{session}> %k mail_attribute_dict = file:%h/mdbox/dovecot-attributes mail_location = mdbox:~/mdbox:ALT=~/Archive/tape/mdbox mail_plugins = acl stats mail_crypt mailbox_list_index = yes mdbox_rotate_size = 16 M namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = . } passdb { driver = pam } plugin { acl = vfile mail_crypt_global_private_key = <### redacted ### mail_crypt_global_public_key = <### redacted ### mail_crypt_save_version = 2 stats_memory_limit = 16 M stats_refresh = 30 secs stats_track_cmds = yes } postmaster_address = ### redacted ### protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { process_limit = 200 process_min_avail = 4 service_count = 1 } service stats { fifo_listener stats-mail { group = users mode = 01224 } } ssl = required ssl_cert = <### redacted ### ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 !TLSv1 userdb { driver = passwd } verbose_proctitle = yes protocol imap { imap_idle_notify_interval = 10 mins imap_metadata = yes mail_max_userip_connections = 20 mail_plugins = acl stats mail_crypt imap_acl imap_stats } Regards, -- Jonathan

2 3

decode2text
by Joan Moreau 13 Apr '26

13 Apr '26

Hi I can't find decode2text.sh in the git Where is it maintained ? Thank you Joan Hi I can't find decode2text.sh in the git Where is it maintained ? Thank you Joan

2 3

Fwd: [EXT] In Yocto-Mailinglist, there were two version of dovecot 2.4.3 found?
by Martin Maurer 10 Apr '26

10 Apr '26

Hello, resent to get clarification, about different content of 2.4.3 release tar file Best regards, Martin -------- Weitergeleitete Nachricht -------- Betreff: Re: [EXT] In Yocto-Mailinglist, there were two version of dovecot 2.4.3 found? Datum: Fri, 10 Apr 2026 14:37:36 +0300 (EEST) Von: Aki Tuomi <aki.tuomi(a)open-xchange.com> An: Martin Maurer <martin.maurer(a)mmeacs.de> Kopie (CC): dovecot-owner(a)dovecot.org <dovecot-owner(a)dovecot.org> Please send mails to dovecot(a)dovecot.org, which is our public mailing list. Aki > On 10/04/2026 14:18 EEST Martin Maurer <martin.maurer(a)mmeacs.de> wrote: > > Hi, > > in Yocto mailing list there was found out, that two different version > of dovecot 2.4.3 seems to exist: > > > https://github.com/dovecot/core/releases/download/2.4.3/dovecot-2.4.3.tar.gz > > > sha256:e0b30330fe51e47ecfcf641bc16041184d91bdd0ac3db789b7cef54e3a75ac9b > > > https://dovecot.org/releases/2.4/dovecot-2.4.3.tar.gz > > SHA256: ff0be85228122f250627b19e67505fdb7fb2f72a702ef6bf35f27fce54c072e5 > > > When downloading both and comparing them: > > The doc/man directory seem to be different. > > When I had looked correctly, all others files seems to be identical. > > > Can you explain, what could have happened? > > In Yocto the SHA256 checksum is checked, and this seems to fail, when > the one or the other download place is used. > > Is this as planned or had an error happened? > > > Many thanks for the clarification! > > > Best regards, > > Martin Hello, resent to get clarification, about different content of 2.4.3 release tar file Best regards, Martin -------- Weitergeleitete Nachricht -------- Betreff: Re: [EXT] In Yocto-Mailinglist, there were two version of dovecot 2.4.3 found? Datum: Fri, 10 Apr 2026 14:37:36 +0300 (EEST) Von: Aki Tuomi [1]<aki.tuomi(a)open-xchange.com> An: Martin Maurer [2]<martin.maurer(a)mmeacs.de> Kopie (CC): [3]dovecot-owner(a)dovecot.org [4]<dovecot-owner(a)dovecot.org> Please send mails to [5]dovecot(a)dovecot.org, which is our public mailing list. Aki On 10/04/2026 14:18 EEST Martin Maurer [6]<martin.maurer(a)mmeacs.de> wrote: Hi, in Yocto mailing list there was found out, that two different version of dovecot 2.4.3 seems to exist: [7]https://github.com/dovecot/core/releases/download/2.4.3/dovecot-2.4.3.tar… sha256:e0b30330fe51e47ecfcf641bc16041184d91bdd0ac3db789b7cef54e3a75ac9b [8]https://dovecot.org/releases/2.4/dovecot-2.4.3.tar.gz SHA256: ff0be85228122f250627b19e67505fdb7fb2f72a702ef6bf35f27fce54c072e5 When downloading both and comparing them: The doc/man directory seem to be different. When I had looked correctly, all others files seems to be identical. Can you explain, what could have happened? In Yocto the SHA256 checksum is checked, and this seems to fail, when the one or the other download place is used. Is this as planned or had an error happened? Many thanks for the clarification! Best regards, Martin References Visible links 1. mailto:aki.tuomi@open-xchange.com 2. mailto:martin.maurer@mmeacs.de 3. mailto:dovecot-owner@dovecot.org 4. mailto:dovecot-owner@dovecot.org 5. mailto:dovecot@dovecot.org 6. mailto:martin.maurer@mmeacs.de 7. https://github.com/dovecot/core/releases/download/2.4.3/dovecot-2.4.3.tar.gz 8. https://dovecot.org/releases/2.4/dovecot-2.4.3.tar.gz

1 0

Source tarballs for dovecot 2.4.3 republished
by Aki Tuomi 10 Apr '26

10 Apr '26

Hi! We have republished the source tarballs for 2.4.3 due to missing man pages in the tarball. Regards, AKi

1 0

Dovecot Proxy with mysql passdb and oauth2 authentication: upgrade from 2.3.21 to 2.4.3 does not work
by Urban Loesch 07 Apr '26

07 Apr '26

Hi, I am running a Dovecot IMAP/POP3 proxy in my test environment using the latest version, 2.3.21, installed from the Dovecot repository. It functions as a pure IMAP/POP3 proxy for 7 different IMAP backends (currently always Dovecot 2.3.21). The proxy retrieves all its information from a MySQL database mainly the ip-address to which backend he should pass the connection and forwards all authentication information to the backend. This has always worked without any issues so far. Now I'm trying to upgrade the proxy from 2.3.21 to 2.4.3. I tried to convert my 2.3.21 configuration to 2.4.3 with your very helpfull tool from https://dovecot.org/upgrader/. But now when I try to start dovecot I get the followong error in my logs: ... 2026-04-07T12:00:57.692994+02:00 imap-dev dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth 2026-04-07T12:00:57.695908+02:00 imap-dev dovecot: auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_mysql.so 2026-04-07T12:00:57.696532+02:00 imap-dev dovecot: auth: Fatal: Cannot initialize oauth2: Missing oauth2_introspection_mode setting 2026-04-07T12:00:57.697569+02:00 imap-dev dovecot: master: Error: service(auth): command startup failed, throttling for 4.000 secs ... As I just said, the server only works as a proxy (no mailboxes hosted on itself, etc). Have you any idea how I can solve this issues? Below my current .deb packages installed and "doveconf -n" from 2.4.3. Many thanks in advance Urban ----------------------- # dpkg -l |grep dovecot ii dovecot-core 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - core files ii dovecot-imapd 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-ldap 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - LDAP support ii dovecot-lmtpd 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - LMTP server ii dovecot-managesieved 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - ManageSieve server ii dovecot-mysql 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - MySQL support ii dovecot-pop3d 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - POP3 daemon ii dovecot-sieve 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - Sieve filters support ------------------------ # 2.4.3-1+debian12 (c1b22ef978): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.3-1+debian12 (99939e07) # OS: Linux 6.1.0-31-amd64 x86_64 Debian 12.13 # Hostname: imap-dev.domain.com dovecot_config_version = 2.4.3 auth_cache_negative_ttl = 0 auth_cache_size = 128 M auth_cache_ttl = 0 auth_debug = yes auth_debug_passwords = yes auth_failure_delay = 5 secs auth_mechanisms = plain login oauthbearer xoauth2 auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_%@ auth_username_translation = %@ dovecot_storage_version = 2.4.0 login_log_format_elements = user=<%{user}> method=%{mechanism} rip=%{remote_ip} lip=%{local_ip} mpid=%{mail_pid} %{secured} %{ssl_security} managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext protocols = imap sieve sql_driver = mysql ssl_min_protocol = TLSv1 verbose_proctitle = yes namespace inbox { inbox = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } mailbox Trash { special_use = "\\Trash" } } passdb sql { default_password_scheme = PLAIN query = SELECT NULL AS password, 'y' AS nodb, SUBSTRING_INDEX(SUBSTRING_INDEX(param, '[', -1), ']', 1) AS host, '%{user}' AS destuser, 'Y' AS nologin, 'Y' AS nopassword, 'Y' AS proxy, '%{mechanism}' AS proxy_mech FROM mail_username WHERE user = '%{user}' AND allow_login = 'y' AND ('%{protocol}' = 'imap' OR '%{protocol}' = 'sieve'); } mysql devdb1.domain.com { dbname = mailconfig_dev password = # hidden, use -P to show it user = imap-dev } sieve_script personal { driver = file path = ~/sieve } service imap-login { process_min_avail = 2 restart_request_count = unlimited vsz_limit = 512 M } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { process_min_avail = 2 restart_request_count = unlimited vsz_limit = 256 M } service tcpwrap { unix_listener login/tcpwrap { group = $SET:default_login_user mode = 0600 user = $SET:default_login_user } } ssl_server { cert_file = /etc/letsencrypt/live/domain.com/fullchain.pem dh_file = /etc/dovecot/dh.pem key_file = /etc/letsencrypt/live/domain.com/privkey.pem prefer_ciphers = server } protocol imap { imap_capability = IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE login_greeting = Domain-Dev IMAP Server ready. } protocol pop3 { login_greeting = Domain-Dev POP3 Server ready. pop3_enable_last = yes pop3_uidl_format = %{uid | substr(0, 8)}%{uidvalidity | substr(0, 8)} }

1 0

Dovecot and Pigeonhole v2.4.3 released
by Aki Tuomi 07 Apr '26

07 Apr '26

Hi! We are happy to publish version 2.4.3 of Dovecot and Pigeonhole. These contain several CVEs, discovered by external researches. The majority of these have been discovered with help of automated code analysis tools like claude code security, which is why some of these are rather old, missed bugs. No new supported distros have been added or old removed, no new dependencies have been added. Note that there are experimental features in 2.4, one is enabled with `--enable-experimental-mail-utf8`, and another with `--enable-experimental-imap4rev2`, and you also need to set mail_utf8_extensions=yes and imap4rev2_enabled=yes to enable them in config. https://dovecot.org/releases/2.4/dovecot-2.4.3.tar.gz https://dovecot.org/releases/2.4/dovecot-2.4.3.tar.gz.sig https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.3.tar.gz https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.3.tar.gz… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot --- * CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins. * CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing. Fixed by dropping the script. * CVE-2026-24031: SQL injection possible if auth_username_chars is configured empty. Fixed escaping to always happen. v2.4 regression. * CVE-2026-27859: Excessive RFC 2231 MIME parameters in email would cause excessive CPU usage. Fixed by limiting number of parameters to process. * CVE-2026-27860: LDAP query injection possible if auth_username_chars is configured empty. Fixed escaping to always happen. v2.4 regression. * CVE-2026-27857: Sending excessive parenthesis causes imap-login to use excessive memory. * CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function. * CVE-2026-27855: OTP driver vulnerable to replay attack. * Remove default service/*/service_extra_groups=$SET:default_internal_group. They are now replaced by default mail_access_groups=$SET:default_internal_group. * The version file has been renamed as version.txt to avoid clash with C++ headers. * auth: oauth2 - Do not export token automatically, must be exported using fields. * config: Don't accept 0 as meaning unlimited anymore for last_valid_uid, last_valid_gid, mail_cache_max_headers_count, mail_cache_max_header_name_length, mail_vsize_bg_after_count, mail_sort_max_read_count, message_max_size, submission_max_recipients and quota_mail_size. * imap, pop3: Don't autoexpunge if Dovecot is shutting down or process is killed. * imap: LIST - Handle invalid mUTF-7 mailbox names as never matching anything * lazy-expunge: Change lazy_expunge_only_last_instance default to yes. * lda: Use EX_TEMPFAIL (75) if configuration is invalid instead of 89. v2.4 regression. * lib-master: Increase ANVIL_DEFAULT_LOOKUP_TIMEOUT_MSECS from 5s to 30s * lib: crc32 - Use zlib's built-in CRC32 function + Improve UTF-8 support for mail storage. + auth: Add default auth-token UNIX socket for token-based authentication. + doc: solr-config-9.xml - Make it compatible with Solr 9.8.0 + doveadm: dsync - Search mails when exporting to reduce number of mails exported by dsync-server. + dovecot-sysreport: Add -D|--destdir support. + imap, imap-hibernate: Use DOVECOT-TOKEN authentication for unhibernation. Default imap-master socket permissioms have been changed due to this. + imap: Add APPENDLIMIT capability when configured with quota_mail_size. + imap: Support STATUS (DELETED) for IMAP4rev2. + imapc: Add support for SEARCH MIMEPART + imapc: Improve error forwarding. + imapc: Support SORT and ESORT extensions. + imapc: Support STATUS (DELETED) for IMAP4rev2. + lib-sql: Support parameterized queries. + lib-test: Add new test-dir API for better temporary test directory handling. + lmtp: Advertize SIZE capability when configured with quota_mail_size. + lmtp: Support XCLIENT DESTADDR and DESTPORT + pop3-login: proxy - Add support for XCLIENT DESTIP and DESTPORT + submission-login: proxy - Add support for XCLIENT DESTIP and DESTPORT + Various optimizations have been made to the code. - Fix building dovecot with BSD, Solaris and macOS. - auth: Crash would occur if users were iterated but userdb_ldap_iterate_fields was not set. - auth: Fix request leak when client authenticates with unsupported mechanism. - auth: Some passdbs would default to PLAIN instead of CRYPT scheme. - config: Section and setting names could have been intermixed, resulting in the setting being silently ignored. - configure: Fix checking if BUILD_IMAP_HIBERNATE is set - doveadm: dsync - -e parameter was handled wrong with dsync-server. - fts-flatcurve: Mailbox leak would occur if mailbox failed to open. - imap: Fix potential issues with unhibernation and process state handling. - imapc: SEARCH failure handling was done wrong. - imapc: UID STORE commands included extra comma in uidset. - lib-auth-client: auth-master - Fix panic when reconnecting after handshake timeout. - lib-compression: Lz4 algorithm would assert-crash with malicious data. - lib-dcrypt: Fix digest algorithm handling. - lib-dict: Escape username paths to prevent traversal issues with dict-fs. - lib-http: Fix HTTP parsing edge cases and state handling. - lib-iostream: Disallow empty ssl_min_protocol. - lib-json: Fix incorrect character handling logic. - lib-ldap: Fix various TLS related bugs. - lib-mail: Fix charset translation and MIME parsing edge cases. - lib-mail: Fix multiple bounds checks and parsing issues in message handling. - lib-var-expand: Multiple fixes and improvements for expansion handling. - lib: Fix punycode decoding out-of-bounds reads. - lib: Fix unicode normalization edge cases causing crashes. - lib-http: Chunked transfer trailer size was not limited. - login-common: Improve logging and internal error handling. - login-common: login_log_format_elements was split by spaces naively, which could break variable expansion. Use template aware splitting now. - master: Dovecot would fail to start if listen directive was used and dovenull or dovecot user was missing. - pop3c: Connection might've hung with SSL. - util: Fix handling of environment variables containing control characters. - Many other bugs have been fixed. --- * CVE-2026-27858: managesieve-login can allocate large amount of memory during authentication. * CVE-2025-59032: ManageSieve panic occurs with sieve-connect as a client. * lib-sieve: Don't accept 0 as meaning unlimited anymore for sieve_quota_script_count and sieve_quota_storage_size. * managesieve-login: If mail_max_userip_connections is reached, return LIMIT/CONNECTIONS resp-code. * managesieve-login: proxy - Return unexpected backend failures as TRYLATER/NORETRY resp-code. * managesieve: Remove default service_extra_groups=$SET:default_internal_group. + managesieve-login: proxy - Add support for XCLIENT DESTIP and DESTPORT. - imapsieve: Fix panic occurring upon implicit flag changes. - lib-sieve: include-extension - Fix crash occurring when previous global command has no arguments. - lib-sieve: Fix erroneous attempt to read active script for non-personal storage. - lib-sieve: ldap: Fix linking non-shared LIBDOVECOT.

8 11

Bug report: filter `default` in LDAP context does not suppress error logging
by Johannes Nohl 07 Apr '26

07 Apr '26

Bug report: Expanding variables with filter `default` in LDAP context does not suppress error logging if LDAP attribute is missing. Expected behaviour: Missing LDAP attribute does not throw an error. Example `nologin = %{ldap:missingAttribute | default}` Details: Please note: The missing attribute is called `shadowInactive` in reality. There might be another issue, the field nologin is boolean and set true if any value is assigned -- while default without parameter returns empty (thus, you cannot use default with nologin without workaround). The intended behaviour is documented clearly, however due to a bug in rendering you need to look into the doc sources (my PR for that was accepted already: https://doc.dovecot.org/2.4.2/core/config/auth/databases/ldap.html#ldap-spe… https://github.com/dovecot/documentation/pull/1478#pullrequestreview-403461… Full context: passdb ldap { driver = ldap ldap_filter = (&(objectClass=posixAccount)(mail=%{user})) fields { user = %{ldap:uid} nologin = %{ldap:shadowInactive | default} reason = The account for this email address is disabled. } } The same error was reported already a year ago, although among others, see point 4: https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/TLJ2O… Please excuse my first attempt of 31-03-2026. It was unreadable. Aki already tried to help but was - I guess - distracted from the main point. I found a workaround for the missing attribute translation to boolean fields (if someone is interested) https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/67Z4C… I tested with dovecot 2.4.2 and 2.4.3 (openSUSE repos) against local LDAP. The check for disabled users throws permanently errors in the log file, whenever the user is missing the ldap attribute for disabled. Thus, for each login of all enabled users (you will probably agree that this not acceptable). This results in the following log line: 2026-03-31T00:46:31.102690+02:00 mailserver dovecot: auth(test,ipv4,sasl:plain)<YE81n0VOVuofEeSD>: Error: ldap: auth_passdb_post settings: Failed to parse configuration: Failed to expand passdb_fields/nologin setting variables: ldap: No such attribute 'shadowinactive' Thank you Johannes -- Johannes Nohl postmaster(a)i-t-cloud.de

2 3

[Dovecot] migration from IMAP/POP3 courier server to a remote dovecot server
by nik600 06 Apr '26

06 Apr '26

Dear all i'm planning a transparent migration from a courier server that provides both IMAP and POP3 access to users to a remote dovecot server with both IMAP and POP3 access. I have to migrate about 2500 users for 250 GB of space. I'm using dovecot 2.2.5.4 on debian6 squeeze. To make a transparent migration i have to maintain old IMAP UIDs and POP3 UIDs, so i've read http://wiki2.dovecot.org/Migration and http://wiki2.dovecot.org/Migration/Courier and http://wiki2.dovecot.org/Migration/Dsync And decided that probably the best tool to use is Dsync, as the courier-dovecot-migrate.pl<http://www.dovecot.org/tools/courier-dovecot-migrate.pl> script works only locally. I've tested the dsync following instructions reported above but after the migration of one test-account the client re-download messages. If i want to keep both IMAP UIDs and POP3 UIDs i have to sync both imapc and pop3c with two commands? doveadm -o imapc_user=foo -o pop3c_user=foo -o imapc_password=bar -o pop3c_password=bar backup -R -u user@domain imapc: doveadm -o imapc_user=foo -o pop3c_user=foo -o imapc_password=bar -o pop3c_password=bar backup -R -u user@domain pop3c: Or imapc is enough? Do you have any suggestion? Thanks -- /*************/ nik600 http://www.kumbe.it

2 3

oath-toolkit pam authentication with dovecot
by "Tóth Attila" 04 Apr '26

04 Apr '26

Anybody has experience in deploying oath-toolkit totp authentication for dovecot? It works for ssh in a challenge response fashion, but I have concernes against concatenating the password with the totp digits, because I have difficulties even with su+oath_toolkit... Thx: Dw. -- dr Tóth Attila, Radiológus, 06-20-825-8057 Attila Toth MD, Radiologist, +36-20-825-8057

2 1

enabling fts_flatcurve on debian
by Stefan G. Weichinger 03 Apr '26

03 Apr '26

Which xapian-related packages do I need? I have issues enabling the plugin ... pls advise

2 6

2.4 upgrade : INBOX does not exist
by Stefan G. Weichinger 02 Apr '26

02 Apr '26

Today I upgraded a server at a customer. I modified the config I had built over the last week, with the help of this list. So far nearly everything works, but thunderbird complains about non-existing mailboxes like INBOX. But we can access it, it's a bit strange. In the filesystem it looks like: # ls -la /home/vmail/our.tld/user\(a)our.tld/ insgesamt 7096 drwx------ 69 vmail vmail 4096 2. Apr 19:00 . drwx------ 129 vmail vmail 12288 2. Apr 18:56 .. drwx------ 5 vmail vmail 4096 8. Jun 2021 .Administrator drwx------ 5 vmail vmail 4096 2. Apr 18:40 .Administrator.Archiv drwx------ 5 vmail vmail 4096 2. Apr 18:40 '.Administrator.Domainwechsel AquaCC' drwx------ 5 vmail vmail 4096 11. Mai 2025 .Archives drwx------ 5 vmail vmail 4096 2. Apr 18:40 .Archives.2001 drwx------ 5 vmail vmail 4096 2. Apr 18:40 .Archives.2002 drwx------ 5 vmail vmail 4096 2. Apr 18:40 .Archives.2003 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2004 drwx------ 5 vmail vmail 4096 2. Apr 18:40 .Archives.2005 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2006 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2007 drwx------ 5 vmail vmail 4096 10. Feb 18:17 .Archives.2008 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2009 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2010 drwx------ 5 vmail vmail 4096 10. Feb 18:10 .Archives.2011 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2012 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2013 drwx------ 5 vmail vmail 4096 10. Feb 18:09 .Archives.2014 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2015 drwx------ 5 vmail vmail 4096 2. Apr 17:51 .Archives.2016 drwx------ 5 vmail vmail 4096 11. Feb 11:57 .Archives.2017 drwx------ 5 vmail vmail 4096 10. Jun 2025 .Archives.2018 drwx------ 5 vmail vmail 4096 11. Feb 11:57 .Archives.2019 drwx------ 5 vmail vmail 4096 10. Feb 18:23 .Archives.2020 drwx------ 5 vmail vmail 4096 1. Apr 20:18 .Archives.2021 drwx------ 5 vmail vmail 4096 30. Mär 09:37 .Archives.2022 drwx------ 5 vmail vmail 4096 1. Apr 20:18 .Archives.2023 drwx------ 5 vmail vmail 4096 1. Apr 20:18 .Archives.2024 drwx------ 5 vmail vmail 4096 2. Apr 17:48 .Archives.2025 drwx------ 5 vmail vmail 4096 2. Apr 17:59 .Archives.2026 drwx------ 2 vmail vmail 323584 2. Apr 19:00 cur -rw------- 1 vmail vmail 0 2. Aug 2021 dovecot-acl-list -rw------- 1 vmail vmail 70712 2. Apr 18:37 dovecot.index -rw------- 1 vmail vmail 6266860 2. Apr 19:01 dovecot.index.cache -rw------- 1 vmail vmail 32160 2. Apr 19:00 dovecot.index.log -rw------- 1 vmail vmail 46940 2. Apr 06:20 dovecot.index.log.2 -rw------- 1 vmail vmail 91 18. Aug 2020 dovecot-keywords -rw------- 1 vmail vmail 65 2. Apr 18:37 .dovecot.lda-dupes drwx------ 5 vmail vmail 4096 2. Apr 18:37 .dovecot.lda-dupes.locks -rw------- 1 vmail vmail 6504 2. Apr 18:49 dovecot.list.index -rw------- 1 vmail vmail 3356 2. Apr 19:02 dovecot.list.index.log -rw------- 1 vmail vmail 2904 7. Jän 13:53 dovecot.mailbox.log -rw------- 1 vmail vmail 186894 2. Apr 18:59 dovecot-uidlist -rw------- 1 vmail vmail 8 7. Jän 13:53 dovecot-uidvalidity -r--r--r-- 1 vmail vmail 0 21. Apr 2020 dovecot-uidvalidity.5e9efc52 drwx------ 5 vmail vmail 4096 2. Apr 12:02 .Drafts drwx------ 5 vmail vmail 4096 12. Jun 2025 '.Entw&APw-rfe' drwx------ 5 vmail vmail 4096 6. Mai 2020 .Gesendet drwx------ 5 vmail vmail 4096 2. Apr 18:22 .INBOX.Administrator drwx------ 5 vmail vmail 4096 2. Apr 18:21 .INBOX.Alerts [..] We have mail_home = /home/vmail/%{user | domain}/%{user} I tried mail_home = /home/vmail/%{user | domain}/%{user | username} but that breaks things completely. In 2.3 we had these namespaces: namespace { type = private separator = / prefix = #location defaults to mail_location. inbox = yes } namespace { type = public separator = / prefix = Oeffentlich/ location = maildir:/home/vmail/oeffentlich subscriptions = yes } I tried "prefix = INBOX/" ... not good. I share the config, a little bit anonymized, acls removed ... # doveconf -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.74+deb13+1-amd64 x86_64 Debian 13.4 # Hostname: xxxx dovecot_config_version = 2.4.1 auth_allow_weak_schemes = yes auth_cache_size = 4M auth_debug = yes auth_mechanisms = plain login auth_verbose = yes default_process_limit = 300 dovecot_storage_version = 2.4.0 import_environment { CORE_ERROR = %{env:CORE_ERROR} CORE_OUTOFMEM = %{env:CORE_OUTOFMEM} LISTEN_FDS = %{env:LISTEN_FDS} LISTEN_PID = %{env:LISTEN_PID} MALLOC_MMAP_THRESHOLD_ = 131072 NOTIFY_SOCKET = %{env:NOTIFY_SOCKET} PATH = %{env:PATH} TZ = :/etc/localtime } info_log_path = /var/log/dovecot.info listen = * [::] log_path = /var/log/dovecot.log mail_debug = yes mail_driver = maildir mail_gid = 5000 mail_home = /home/vmail/%{user | domain}/%{user} mail_path = ~ mail_plugins { acl = yes notify = yes quota = no } mail_uid = 5000 protocols = imap sieve lmtp sieve_extensions { fileinto = yes reject = yes envelope = yes encoded-character = yes vacation = yes subaddress = yes comparator-i;ascii-numeric = yes relational = yes regex = yes imap4flags = yes copy = yes include = yes body = yes variables = yes enotify = yes environment = yes mailbox = yes date = yes index = yes ihave = yes duplicate = yes mime = yes foreverypart = yes extracttext = yes editheader = yes mboxmetadata = yes servermetadata = yes spamtest = yes spamtestplus = yes virustest = yes } sieve_global_extensions { vnd.dovecot.debug = yes vnd.dovecot.environment = yes vnd.dovecot.pipe = yes } sieve_pipe_bin_dir = /usr/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_spamtest_score_max_value = 15 sieve_spamtest_status_header = X-Spamd-Result: .*? \[([[:digit:]]+\.[[:digit:]]+) / [[:digit:]]+\.[[:digit:]]+\]; sql_driver = mysql ssl = required verbose_proctitle = yes mysql /var/run/mysqld/mysqld.sock { dbname = postfix_db password = # hidden, use -P to show it user = postfix_user } passdb sql { default_password_scheme = MD5-CRYPT query = SELECT username as user, password FROM mailbox WHERE ((username = '%{user | username}(a)domain1.at') OR (username = '%{user | username}(a)domain2.at')) AND active = '1' } userdb sql { iterate_query = SELECT userid AS username, domain FROM users query = SELECT username as user FROM mailbox WHERE ((username = '%{user | username}(a)domain1.at') OR (username = '%{user | username}(a)domain2.at') ) AND active = '1' } namespace inbox { inbox = yes prefix = separator = / type = private } namespace oeffentlich { mail_path = /home/vmail/oeffentlich prefix = Oeffentlich/ separator = / subscriptions = yes type = public mailbox Oeffentlich { acl [DELETED for now] } service imap-login { process_min_avail = 8 inet_listener imap { port = 0 ssl = no listen = } inet_listener imaps { port = 993 ssl = yes listen = } } service lmtp { extra_groups = $SET:default_internal_group user = vmail unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service imap { } service auth { client_limit = 1200 user = root unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-client { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0660 } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/letsencrypt/pfsense/cloud_imap_mail_smtp_LE_cert.fullchain key_file = /etc/letsencrypt/pfsense/cloud_imap_mail_smtp_LE_cert.key } protocol lda { mail_plugins = sieve } protocol imap { imap_idle_notify_interval = 29 mins mail_max_userip_connections = 50 mail_plugins { imap_acl = yes imap_quota = no imap_sieve = yes } } protocol lmtp { mail_plugins = sieve postmaster_address = logs(a)xunil.at } service managesieve-login { inet_listener sieve { port = 4190 } } service managesieve { } protocol sieve { managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave } sieve_script personal { active_path = /home/vmail/%{user | domain}/%{user}/sieve/scripts/.dovecot.sieve driver = file path = /home/vmail/%{user | domain}/%{user}/sieve/scripts } sieve_script before-0 { driver = file path = /usr/lib/dovecot/sieve/global-spam.sieve type = before } service anvil { unix_listener anvil { group = $SET:default_internal_group mode = 0660 } } I assume I am not far from full success, I'd just like to get rid of these errors because tomorrow dozens of users will access their mailboxes ... Thanks for any pointers!

1 1

BUG-Report: mysql: SSL support not compiled in (remove ssl_client_ca_file and ssl_client_ca_dir settings) third attempt!
by Klaus Tachtler 02 Apr '26

02 Apr '26

Hello everyone, Problem info: ============ An error occurs, while trying to establish a TLS/SSL secured connection to a database (mariadb), which has the ability to accept TLS/SSL connections. Analysis from Archlinux Gitlab Issue, which could be found under following link by - Toolybird: https://gitlab.archlinux.org/archlinux/packaging/packages/dovecot/-/issues/… > Thanks for reporting. It would appear to be some kind of (upstream?) > bug in the autofoo. The error message can be traced back to > HAVE_MYSQL_SSL being undefined when it should be defined. This is > reflected in log: https://reproducible.archlinux.org/api/v0/builds/946041/log > It took quite some debugging, but adding the following hack before the > autoreconf call appears to make it work: > checking for mysql_ssl_set in -llibmariadb... no > sed -i 's/mysql_driver="libmariadb"/mysql_driver="mariadb"/' m4/ > want_mysql.m4 > After that it now shows: > checking for mysql_ssl_set in -lmariadb... yes Steps to reproduce: ================== 1. Configure dovecot 2.4.2-4 as described below 2. Restart dovecot 2.4.2-4 3. Try send an email (echo "Test-E-Mail" | /usr/sbin/sendmail root) 4. Determine error messages inside dovecot 2.4.2-4-Log > 01 Dec 22 04:57:38 server dovecot[842]: auth: Error: > mysql(db.idmz.tachtler.net): mysql: SSL support not compiled in > (remove ssl_client_ca_file and ssl_client_ca_dir settings) > 02 Dec 22 04:57:38 server dovecot[842]: auth-worker: Error: > mysql(db.idmz.tachtler.net): mysql: SSL support not compiled in > (remove ssl_client_ca_file and ssl_client_ca_dir settings) Additional info: =============== OS version: Archlinux package version(s): dovecot 2.4.2-4 necessary config file part: > 45 sql_driver = mysql > 46 > 47 mysql db.idmz.tachtler.net { > 48 host = db.idmz.tachtler.net > 49 port = 3306 > 50 user = postfixuser > 51 password = secret > 52 dbname = postfix > 53 ssl = yes > 54 ssl_client_ca_file = /etc/dovecot/ssl/certs/CAcert.pem > 55 ssl_client_cert_file = > /etc/dovecot/ssl/certs/client.idmz.tachtler.net.pem > 56 ssl_client_key_file = > /etc/dovecot/ssl/private/client.idmz.tachtler.net.key.pem > 57 ssl_cipher_list = DHE-RSA-AES256-SHA > 58 } WITHOUT the following line, a database connections is possible and works as expected: > 53 ssl = yes > 54 ssl_client_ca_file = /etc/dovecot/ssl/certs/CAcert.pem > 55 ssl_client_cert_file = > /etc/dovecot/ssl/certs/client.idmz.tachtler.net.pem > 56 ssl_client_key_file = > /etc/dovecot/ssl/private/client.idmz.tachtler.net.key.pem > 57 ssl_cipher_list = DHE-RSA-AES256-SHA Thanky you in advance for your help! Klaus Tachtler. -- --------------------------------------- e-Mail : klaus(a)tachtler.net Homepage: https://www.tachtler.net DokuWiki: https://dokuwiki.tachtler.net ---------------------------------------

3 17

Error: sieve: fail2ban: line 23: read(<lmtp DATA local>) failed: Seeking past EOF by 2364 bytes
by Graham Cobb 01 Apr '26

01 Apr '26

Hi, dovecot is crashing for me while doing sieve processing for messages received via lmtp. This is reproducible, and seems to hit every message which runs a particular sieve script. Any thoughts or help would be appreciated! The error is: Error: sieve: fail2ban: line 23: read(<lmtp DATA local>) failed: Seeking past EOF by 2364 bytes Note: the number of bytes is always one of: 2169, 2272, 2259, 2364. I have many of these. I cannot see how the "Seeking past EOF" error can be caused by a bug in my sieve script. But please let me know if it can! Background: I have (and have had for many years) a complex set of sieve scripts for controlling my incoming email. They have worked fine for all that time. However, recently (ish), processing which uses a particular script is crashing dovecot. The actual log extract is below. The sieve script line 23, mentioned in the error report, is a large "if anyof (" statement containing many clauses like: body :raw :regex "country:[[:space:]]+KR", I can provide the full sieve script if required. This is what I see in the dovecot log (note: I reformatted the backtrace to make it easier to read. I also changed all my server names): Mar 29 03:03:52 SERVER dovecot-HOST: lmtp(4008073): Connect from local Mar 29 03:03:52 SERVER dovecot-HOST: lmtp(cobb)<4008073><PiAQHoiIyGmJKD0Ay7SJiA>: Error: sieve: fail2ban: line 23: read(<lmtp DATA local>) failed: Seeking past EOF by 2364 bytes Mar 29 03:03:52 SERVER dovecot-HOST: lmtp(cobb)<4008073><PiAQHoiIyGmJKD0Ay7SJiA>: Error: sieve: Execution of script 'auto:personal/.dovecot' was aborted due to temporary failure (user logfile /home/cobb/.dovecot.sieve.log may reveal additional details) Mar 29 03:03:52 SERVER dovecot-HOST: lmtp(cobb)<4008073><PiAQHoiIyGmJKD0Ay7SJiA>: Panic: file istream-concat.c: line 27 (i_stream_concat_close): assertion failed: (cstream->cur_input == cstream->input[cstream->cur_idx]) Mar 29 03:03:52 SERVER dovecot-HOST: lmtp(cobb)<4008073><PiAQHoiIyGmJKD0Ay7SJiA>: Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 [unw_get_proc_name() failed: -10] -> #3 i_panic[0x7f41540655e6] -> #4 [unw_get_proc_name() failed: -10] -> #5 io_stream_unref[0x7f415413c120] -> #6 i_stream_unref[0x7f4154145c30] -> #7 index_storage_mailbox_close[0x7f4154383e70] -> #8 mailbox_close[0x7f41542fd9e0] -> #9 mailbox_free[0x7f4154302ab0] -> #10 lmtp_local_deinit[0x55dfa9c4e320] -> #11 client_state_reset[0x55dfa9c4f0d0] -> #12 smtp_server_transaction_free[0x7f4154091880] -> #13 smtp_server_connection_reset_state[0x7f4154093c90] -> #14 smtp_server_command_call_hooks[0x7f415408be60] -> #15 smtp_server_command_send_replies[0x7f4154090050] -> #16 [unw_get_proc_name() failed: -10] -> #17 [unw_get_proc_name() failed: -10] -> #18 io_loop_call_io[0x7f4154151710] -> #19 io_loop_handler_run_internal[0x7f41541534b0] -> #20 io_loop_handler_run[0x7f4154153640] -> #21 io_loop_run[0x7f4154153820] -> #22 master_service_run[0x7f41540a6330] -> #23 main[0x55dfa9c4a260] -> #24 __libc_start_call_main[0x7f4153e32c30] -> #25 __libc_start_main_alias_2[0x7f4153e32ce0] -> #26 _start[0x55dfa9c4a470] Mar 29 03:03:54 SERVER dovecot-HOST: lmtp(cobb)<4008073><PiAQHoiIyGmJKD0Ay7SJiA>: Fatal: master: service(lmtp): child 4008073 killed with signal 6 (core dumped) Mar 29 03:04:05 SERVER postfix/lmtp[4008072]: 005083DC75D: to=<MYADDRESS@MYDOMAIN>, orig_to=<ANOTHER@ANOTHERDOMAIN>, relay=SERVERNAME[private/dovecot-lmtp], delay=1740676, delays=1740674/0.25/0.04/1.5, dsn=4.4.2, status=deferred (lost connection with SERVERNAME[private/dovecot-lmtp] while sending end of data -- message may be sent more than once) The only message in .dovecot.sieve.log is: fail2ban: line 23: error: failed to read input message: internal error occurred: refer to server log for more information. [2026-04-01 18:54:13]. Thanks in advance for any thoughts! Graham

2 1

Broken table in dovecot-pw manual
by Célestin Matte 01 Apr '26

01 Apr '26

Hello, I just noticed while reading the dovecot-pw man on Arch Linux that the table in the -r option is broken (missing newline between row): | Scheme | Minimum | Maximum | Default | | ------ | ------- | ------- | ------- | | BLF-CRYPT | 4 | 31 | 5 | | SHA256-CRYPT | 1000 | 999999999 | 5000 | | SHA512-CRYPT | 1000 | 999999999 | 5000 | Regards, -- Célestin Matte

2 1

dovecot.list.index.log owned by root: why?
by Stefan G. Weichinger 01 Apr '26

01 Apr '26

I use these sql-queries to let all mailboxes be accessed by the uid=1001: passdb sql { default_password_scheme = MD5-CRYPT passdb_sql_query = SELECT username as user, password, \ '/home/vmail/%{user | domain }/%{user}' as userdb_home, 'maildir:/home/vmail/%{user | domain }/%{user}' as userdb_mail,\ 1001 as userdb_uid, 1001 as userdb_gid FROM mailbox WHERE username = '%{user}' AND active = '1' } userdb prefetch { } ( I assume this following query isn't used then anymore) userdb sql { userdb_sql_query = SELECT username as user, password, \ '/home/vmail/%{user | domain }/%{user}' as userdb_home, 'maildir:/home/vmail/%{user | domain }/%{user}' as userdb_mail,\ 1001 as userdb_uid, 1001 as userdb_gid \ FROM mailbox WHERE username = '%{user}' AND active = '1' userdb_sql_iterate_query = SELECT userid AS username, domain FROM users } id 1001 uid=1001(vmail) gid=1001(vmail) groups=1001(vmail),118(dovecot) I get errors like: Apr 01 11:43:05 imap(logs(a)xunil.at)<1564491><N8oZ6WJO/uwgAQRwHwsMRX9ul+gRMpfY>: Error: open(/home/vmail/xunil.at/logs(a)xunil.at/dovecot.list.index.log) failed: Permission denied (euid=1001(vmail) egid=1001(vmail) missing +r perm: /home/vmail/xunil.at/logs(a)xunil.at/dovecot.list.index.log) ls -l /home/vmail/xunil.at/logs(a)xunil.at/ total 944 drwx------ 2 vmail vmail 622592 Apr 1 11:43 cur -rw------- 1 vmail vmail 0 Jul 30 2021 dovecot-acl-list -rw------- 1 vmail vmail 3304 Apr 1 11:35 dovecot.index -rw------- 1 vmail vmail 202444 Apr 1 11:43 dovecot.index.cache -rw------- 1 vmail vmail 2908 Apr 1 11:43 dovecot.index.log -rw------- 1 vmail vmail 32892 Apr 1 11:35 dovecot.index.log.2 -rw------- 1 vmail vmail 91 Feb 9 2024 dovecot-keywords -rw------- 1 root root 5744 Apr 1 10:30 dovecot.list.index -rw------- 1 root root 480 Apr 1 10:52 dovecot.list.index.log [..] Why do these 2 files get owned by root now ... ? All files below "/home/vmail" should be owned by vmail:vmail I ran chown, and chgrp, sure .. but the errors return. How to fix this? Thanks in advance!

2 5

cannot get IOS or MacOSX to connect to dovecot:995 since upgraded Mac or iPhone
by Bill Scheding 01 Apr '26

01 Apr '26

Versions: [wls(a)www.wls.org]$ uname -a Linux www.wls.org 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux [wls(a)ww.wls.org]$ dovecot --version 2.2.36 (1f10bfa63) My Certs: Testing cert dovecot.key unable to load certificate 139668060415888:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: TRUSTED CERTIFICATE lrwxrwxrwx 1 root root 21 Mar 25 15:44 dovecot.key -> dovecot.key.old_sep_2 Testing chain dovecot.pem SHA1 Fingerprint=4A:29:34:1D:D5:9C:67:59:FA:31:7E:FF:F4:53:F8:DB:25:73:15:07 subject= /OU=IMAP server/CN=imap.example.com/emailAddress=postmaster@example.com issuer= /OU=IMAP server/CN=imap.example.com/emailAddress=postmaster@example.com serial=C8AA4C688A3F2638 b5bd7939 notBefore=Sep 2 20:17:33 2018 GMT notAfter=Sep 2 20:17:33 2019 GMT lrwxrwxrwx 1 root root 21 Mar 25 15:44 dovecot.pem -> dovecot.crt.old_sep_2 New Certs: Testing key ca.key.3.13.4 RSA key ok lrwxrwxrwx 1 root root 31 Mar 13 14:14 ca.key.3.13.4 -> ../../tls/private/ca.key.3.13.4 Testing chain ca.crt.3.13.4 SHA1 Fingerprint=79:69:88:2A:E0:BF:58:A8:21:E3:88:12:8D:45:20:4F:FD:68:33:63 subject= /C=XX/ST= /L= /O= /OU=IMAP server/CN=imap.example.com/emailAddress=postmaster@example.com issuer= /C=XX/ST= /L= /O= /OU=IMAP server/CN=imap.example.com/emailAddress=postmaster@example.com serial=B912DD19FEDC441C 402b4e2a notBefore=Mar 13 20:02:58 2026 GMT notAfter=Mar 13 20:02:58 2027 GMT lrwxrwxrwx 1 root root 29 Mar 13 14:13 ca.crt.3.13.4 -> ../../tls/certs/ca.crt.3.13.4 They install OK, dovecot starts; but iPhone and mac cannot connect to pop3 Cannot get my iPhone or Mac to accept new certs from lets encrypt, et. al. This is a new problem, started recently. My existing cert expired in 2016 William

2 1

[BUG] 2.4.3 SIGSEGV in fts_solr
by Nick O'Connor 01 Apr '26

01 Apr '26

Dovecot 2.4.3 crashes with SIGSEGV in indexer-worker and lmtp during FTS Solr indexing. The crash is a use-after-free triggered when the HTTP client does a DNS lookup for the Solr host. Environment: - Dovecot 2.4.3 (Alpine 3.23 / musl) - Linux x86_64 - Filesystem: maildir on ZFS - Solr 10.0.0 - fts_solr plugin with DNS-based Solr URL dovecot -n: # 2.4.3 (e278b1e09b): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.3 (0bf9ee48) # OS: Linux 6.12.74+deb13+1-amd64 x86_64 dovecot_config_version = 2.4.0 auth_mechanisms = oauthbearer xoauth2 dovecot_storage_version = 2.4.0 fts_autoindex = yes fts_search_add_missing = yes mail_always_cache_fields = date.save mail_driver = maildir mail_plugins { fts = yes fts_solr = yes } protocols = imap lmtp sieve ssl = required fts solr { url = http://solr.example.com/solr/dovecot } (LDAP userdb/passdb, pigeonhole sieve, imapsieve for spam learning, and oauth2 passdb omitted) How to reproduce: The crash occurs in the indexer-worker when processing multiple user mailboxes sequentially for FTS indexing, using a DNS hostname for the Solr URL. Steps: 1. Configure fts_solr with a DNS-based URL (not an IP address) 2. Have the indexer-worker process mailboxes for more than one user (e.g. fts_autoindex = yes with multiple users, or manual doveadm index -A) 3. The first user session completes successfully. On the second user session, the indexer-worker crashes with SIGSEGV during the DNS lookup for the Solr host. Reproduces reliably on musl (Alpine) due to aggressive memory reuse. Likely also affects glibc but may not crash immediately due to delayed reuse of freed memory. Root cause: The solr_http_client singleton outlives the user session that created it. Its event chain holds a ref on the mail_storage_service_user event, keeping it alive after the user is freed. The SETTINGS_EVENT_INSTANCE on that event still points to the already-freed settings_instance. On the next user session, dns_lookup() walks the stale event chain and dereferences the dangling pointer in settings_instance_get(). Stack trace (from core dump, debug build with musl-dbg): #0 strlen(s=0x415641d189485741) -- SIGSEGV, freed/reused memory #1 p_strdup() strfuncs.c:56 #2 event_add_str(key="protocol", value=...) lib-event.c:1099 #3 settings_instance_get() settings.c:2521 #4 settings_get_real() settings.c:2706 #5 settings_get_full() settings.c:2915 #6 settings_get(dns_client_setting_parser_info) settings.c:2976 #7 dns_client_init() dns-lookup.c:465 #8 dns_client_init_handle_failure() dns-lookup.c:317 #9 dns_lookup("solr.example.com") dns-lookup.c:337 #10 http_client_host_shared_lookup() http-client-host.c:166 #11 http_client_host_shared_refresh() http-client-host.c:195 #12-#19 http_client queue/host/request submit chain #20 http_client_request_continue_payload() http-client-request.c:1170 #21 http_client_request_send_payload() http-client-request.c:1261 #22 solr_connection_post_more() solr-connection.c:269 Proposed fix: Destroy solr_http_client in solr_connection_deinit() so it is recreated with a fresh event chain on the next user session: --- a/src/plugins/fts-solr/solr-connection.c +++ b/src/plugins/fts-solr/solr-connection.c @@ -117,6 +117,8 @@ void solr_connection_deinit(struct solr_connection **_conn) *_conn = NULL; event_unref(&conn->event); + if (solr_http_client != NULL) + http_client_deinit(&solr_http_client); i_free(conn->http_host); i_free(conn->http_base_url); I've been running for few days with the patch applied. FTS indexing across multiple user sessions completes without crashes using a DNS-based Solr URL. Please let me know if there's anything else that would be helpful. The core files have sensitive information so I've omitted them from the report. -Nick Dovecot 2.4.3 crashes with SIGSEGV in indexer-worker and lmtp during FTS Solr indexing. The crash is a use-after-free triggered when the HTTP client does a DNS lookup for the Solr host. Environment: - Dovecot 2.4.3 (Alpine 3.23 / musl) - Linux x86_64 - Filesystem: maildir on ZFS - Solr 10.0.0 - fts_solr plugin with DNS-based Solr URL dovecot -n: # 2.4.3 (e278b1e09b): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.3 (0bf9ee48) # OS: Linux 6.12.74+deb13+1-amd64 x86_64 dovecot_config_version = 2.4.0 auth_mechanisms = oauthbearer xoauth2 dovecot_storage_version = 2.4.0 fts_autoindex = yes fts_search_add_missing = yes mail_always_cache_fields = date.save mail_driver = maildir mail_plugins { fts = yes fts_solr = yes } protocols = imap lmtp sieve ssl = required fts solr { url = http://solr.example.com/solr/dovecot } (LDAP userdb/passdb, pigeonhole sieve, imapsieve for spam learning, and oauth2 passdb omitted) How to reproduce: The crash occurs in the indexer-worker when processing multiple user mailboxes sequentially for FTS indexing, using a DNS hostname for the Solr URL. Steps: 1. Configure fts_solr with a DNS-based URL (not an IP address) 2. Have the indexer-worker process mailboxes for more than one user (e.g. fts_autoindex = yes with multiple users, or manual doveadm index -A) 3. The first user session completes successfully. On the second user session, the indexer-worker crashes with SIGSEGV during the DNS lookup for the Solr host. Reproduces reliably on musl (Alpine) due to aggressive memory reuse. Likely also affects glibc but may not crash immediately due to delayed reuse of freed memory. Root cause: The solr_http_client singleton outlives the user session that created it. Its event chain holds a ref on the mail_storage_service_user event, keeping it alive after the user is freed. The SETTINGS_EVENT_INSTANCE on that event still points to the already-freed settings_instance. On the next user session, dns_lookup() walks the stale event chain and dereferences the dangling pointer in settings_instance_get(). Stack trace (from core dump, debug build with musl-dbg): #0 strlen(s=0x415641d189485741) -- SIGSEGV, freed/reused memory #1 p_strdup() strfuncs.c:56 #2 event_add_str(key="protocol", value=...) lib-event.c:1099 #3 settings_instance_get() settings.c:2521 #4 settings_get_real() settings.c:2706 #5 settings_get_full() settings.c:2915 #6 settings_get(dns_client_setting_parser_info) settings.c:2976 #7 dns_client_init() dns-lookup.c:465 #8 dns_clien t_init_handle_failure() dns-lookup.c:317 #9 dns_lookup("solr.example.com") dns-lookup.c:337 #10 http_client_host_shared_lookup() http-client-host.c:166 #11 http_client_host_shared_refresh() http-client-host.c:195 #12-#19 http_client queue/host/request submit chain #20 http_client_request_continue_payload() http-client-request.c:1170 #21 http_client_request_send_payload() http-client-request.c:1261 #22 solr_connection_post_more() solr-connection.c:269 Proposed fix: Destroy solr_http_client in solr_connection_deinit() so it is recreated with a fresh event chain on the next user session: --- a/src/plugins/fts-solr/solr-connection.c +++ b/src/plugins/fts-solr/solr-connection.c @@ -117,6 +117,8 @@ void solr_connection_deinit(struct solr_connection **_conn) *_conn = NULL; event_unref(&conn->event); + if (solr_http_client != NULL) + http_client_deinit(&solr_http_client); i_free(conn->http_host); i_free(conn->http_base_url); I've been running for few days with the patch applied. FTS indexing across multiple user sessions completes without crashes using a DNS-based Solr URL. Please let me know if there's anything else that would be helpful. The core files have sensitive information so I've omitted them from the report. -Nick

1 0

migration from 2.3 to 2.4 : postfix can't deliver via lmtp
by Stefan G. Weichinger 31 Mar '26

31 Mar '26

I am in the process of upgrading and rewriting my config. I can access IMAP etc ... so my database access is working. I have issues with LMTP: postfix can't deliver to dovecot. The postfix-confiog wasn't touched at all. the error: Mar 27 11:46:37 co dovecot: auth(stefan(a)oops.co.at): Error: userdb: client doesn't have lookup permissions for this user: userdb reply doesn't contain uid (to bypass this check, set: service auth { unix_listener /run/dovecot/auth-userdb { mode=0777 } }) What I don't understand: I configure this: service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service auth-worker { user = postfix } service lmtp { user = vmail unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } protocol lmtp { mail_plugins = sieve postmaster_address = logs(a)xunil.at } And in postfix: virtual_transport = lmtp:unix:private/dovecot-lmtp virtual_uid_maps = static:5000 virtual_gid_maps = static:5000 local_transport = virtual local_recipient_maps = $virtual_mailbox_maps smtpd_sasl_auth_enable = yes smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth Where does "/run/dovecot/auth-userdb" come from? I understand that according to my config /var/spool/postfix/private/auth should be used? ls /var/spool/postfix/private/auth -l srw-rw-rw- 1 postfix postfix 0 Mar 27 11:45 /var/spool/postfix/private/auth ls /var/spool/postfix/private/dovecot-lmtp -l srw-rw---- 1 postfix postfix 0 Mar 27 11:45 /var/spool/postfix/private/dovecot-lmtp I'd appreciate any quick help here ... while googling and testing around ... thanks!

2 17

upgrade to 2.4
by John Hill 31 Mar '26

31 Mar '26

Dovecot may go down as one of the best/worst software in its category. I'm staying on Debian 12 doing backports, till the dust settles several times. --john

1 0

Fwd: dovecot mailing list probe message
by Jaco Kroon 30 Mar '26

30 Mar '26

Hi, It seems like the list system is breaking DKIM - triggering bounces, resulting in unsuscribes. Is there recommendations on how to deal with this? Looks like it relates 100% to the addition of the footer: ______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org Kind regards, Jaco -------- Forwarded Message -------- Subject: dovecot mailing list probe message Date: Mon, 30 Mar 2026 06:32:58 +0000 From: dovecot-bounces+a190cb9ae5d94d8fa6e2af68fc964a7aaa13256b(a)dovecot.org To: jaco(a)uls.co.za This is a probe message. You can ignore this message. The dovecot(a)dovecot.org mailing list has received a number of bounces from you, indicating that there may be a problem delivering messages to jaco(a)uls.co.za. A sample is attached below. Please examine this message to make sure there are no problems with your email address. You may want to check with your mail administrator for more help. You don't need to do anything to remain an enabled member of the mailing list. If you have any questions or problems, you can contact the mailing list owner at dovecot-owner(a)dovecot.org Hi, It seems like the list system is breaking DKIM - triggering bounces, resulting in unsuscribes. Is there recommendations on how to deal with this? Looks like it relates 100% to the addition of the footer: ______________________________________________ dovecot mailing list -- [1]dovecot(a)dovecot.org To unsubscribe send an email to [2]dovecot-leave(a)dovecot.org Kind regards, Jaco -------- Forwarded Message -------- Subject: dovecot mailing list probe message Date: Mon, 30 Mar 2026 06:32:58 +0000 From: [3]dovecot-bounces+a190cb9ae5d94d8fa6e2af68fc964a7aaa13256b(a)dovecot.org To: [4]jaco(a)uls.co.za This is a probe message. You can ignore this message. The [5]dovecot(a)dovecot.org mailing list has received a number of bounces from you, indicating that there may be a problem delivering messages to [6]jaco(a)uls.co.za. A sample is attached below. Please examine this message to make sure there are no problems with your email address. You may want to check with your mail administrator for more help. You don't need to do anything to remain an enabled member of the mailing list. If you have any questions or problems, you can contact the mailing list owner at [7]dovecot-owner(a)dovecot.org References Visible links 1. mailto:dovecot@dovecot.org 2. mailto:dovecot-leave@dovecot.org 3. mailto:dovecot-bounces+a190cb9ae5d94d8fa6e2af68fc964a7aaa13256b@dovecot.org 4. mailto:jaco@uls.co.za 5. mailto:dovecot@dovecot.org 6. mailto:jaco@uls.co.za 7. mailto:dovecot-owner@dovecot.org

3 4

Update to v2.4.3 breaks ldap connection
by markus-dovecot＠doits.de 30 Mar '26

30 Mar '26

Unfortunately the upgrade to v2.4.3 broke the ldap connection. I have configured an ldap connection like this: ``` ldap_uris = ldaps://xxx.com ldap_auth_dn = uid=xxx,ou=general accounts,dc=xxx,dc=com ldap_auth_dn_password = xxx ldap_base = dc=xxx,dc=com passdb ldap { ldap_bind = yes [...] } ``` v2.4.3 cannot connect and says: ``` auth: Error: ldap(ldaps://xxx.com636): Can't connect to server: ldaps://xxx.com ``` Ldap server logs: ``` ACCEPT from IP=[XXX]:45674 (IP=[::]:636) TLS established tls_ssf=256 ssf=256 tls_proto=TLS1.3 tls_cipher=AES-256-GCM closed (connection lost) ``` Downgrade to dovecot v2.4.2 makes it work again. Was there any ldap change in v2.4.3 that required a config change? Using ubuntu 24.04 with the dovecot ppa, now forced version 2.4.2 by using https://repo.dovecot.org/ce-2.4.2/ubuntu/noble

4 6

Dovecot 2.4.3 virtual now broken even more
by sev monster 30 Mar '26

30 Mar '26

As of 2.4.2, Dovecot no longer crashed and broken config vars no longer caused it to error out, so I finally (reluctantly) switched to it over 2.3, though I had to disable/change a few things to get it to work. However, my virtual namespaces were still broken, since the `autosubscribe = yes` option would cause the driver to attempt to create the virtual directories, and fail when they already existed. Turning off autosubscribe meant that the folders were not visible to my users without manually subscribing. With 2.4.3, now the virtual configs that "worked" before now cause Dovecot to error out completely! Yay It seems this commit introduced a "feature" that restricts the virtual driver to the fs list format: https://github.com/dovecot/core/commit/b4a4a32361b8f0e68ef230add6467eddd0ff… But why? Is fs the only format that works? But maildir++ worked in both 2.3 and in previous versions of 2.4. The 2.4.3 docs (still) also recommend switching to maildir++ if desired: https://doc.dovecot.org/2.4.3/core/plugins/virtual.html#virtual-mailbox-plu… In my config, I use maildir for everything. That means in my mailboxes and all my namespaces. But with this change, I must now use fs as my list format for the virtuals. But, I can't do that, because all `list = yes` namespaces in use by a mailbox must use the same list format... So now my previously invisible virtual folders now cause Dovecot to fall over and I have to completely remove the virtual declarations from my config. What am I supposed to do now?

3 2

Executing a sieve-extprograms pipe script as non-root
by Roland Hieber 29 Mar '26

29 Mar '26

Hi, Ultimately I'm trying to call procmail via a `pipe "procmail";` in my Sieve script on Dovecot 2.4.1. I have therefore created the respective wrapper script in /usr/lib/dovecot/sieve-pipe/procmail, but I noted that the script is apparently run as root. With some debug output in the wrapper script, I see: # `id` output uid=0(root) gid=1059(rhi) groups=1059(rhi),116(dovecot) # `pstree -s -u $$` systemd(1)---dovecot(1064)---lmtp(266577,rhi)---procmail(266706,root)---pstree(266711) This Dovecot gets mail delivered via LMTP from another server. 1059 (rhi) is my local user ID on the IMAP server both in /etc/passwd and in /etc/dovecot/users (using auth-passwdfile.conf.ext in 10-auth.conf instead of auth-system.conf.ext), since mail needs to be delivered and chown'ed correctly into Maildirs that should be user-accessible. However I don't understand how the `procmail` wrapper can be run as the root user rights when the LMTP process starting it is running as my own user?!? I'd like to prevent procmail from running as root as far as possible, so for now I've been able to work around this by wrapping the procmail call into an additional `sudo -U $USER` (after determining the user who owns the target maildir), but I'd like to understand the problem a bit further and like to know if this is really how calling sieve-extprograms is supposed to work – I'd have expected that the external scripts are also run as my unprivileged user. I'm running a fairly standard config on Debian stable (dovecot package version 1:2.4.1+dfsg1-6+deb13u2) with only minimal changes by enabling the passwdfile backend and some sieve plugins. Thanks for any insights, - Roland -- Roland Hieber, Pengutronix e.K. | rhi(a)pengutronix.de | Steuerwalder Str. 21 | https://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |

6 8

dovecot 2.4.x director
by Maciej Milaszewski 27 Mar '26

27 Mar '26

HI Has anyone managed to create a fork or other solution that provides director functionality? A small setup where it can be managed, for example, with Rabit/Redis, is one thing, but not a larger environment. The documentation for 2.4.x seems to have something like this: https://doc.dovecot.org/2.4.3/howto/lua_director.html "This is an unsupported method of running Dovecot. Caveat emptor. It is only intended for small-scale deployments – this is NOT designed to scale for more than a few servers."

2 1

Dovecot Security Advisory OXDC-2026-0001
by Aki Tuomi 27 Mar '26

27 Mar '26

Hi! We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. This advisory is also published at https://documentation.open-xchange.com/dovecot/security/advisories/html/202… --- Internal reference: DOV-7830 Type: CWE-1250 (Improper Preservation of Consistency Between Independent Representations of Shared State) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.1 Discovery date: 2025-07-24 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: Erik <erik(a)broadlux.com> CVE: CVE-2025-30189 CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Details: v2.4 regression: auth cache broken with several passdb / userdb. When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. Risk: After cached login, all subsequent logins are for same user. No publicly available exploits are known. Solution: Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers. --- Internal reference: DOV-8349 Type: CWE-20 (Improper Input Validation) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2025-11-04 Solution date: 2026-03-27 Disclosure date: 2026-03-27 CVE: CVE-2025-59028 CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Details: Invalid base64 authentication can cause DoS for other logins. When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Risk: Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. No publicly available exploits are known. Solution: Install fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments). --- Internal reference: DOV-8508 Type: CWE-20 (Improper Input Validation) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2025-11-29 Solution date: 2026-03-27 Disclosure date: 2026-03-27 CVE: CVE-2025-59032 CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Details: v2.4/v3.1 regression: Pigeonhole: ManageSieve panic occurs with sieve-connect as a client. ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. Risk: This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. No publicly available exploits are known. Solution: Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. --- Internal reference: DOV-8584 Type: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2025-12-29 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: cavid@yeswehack CVE: CVE-2025-59031 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Details: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing. Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Risk: Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. No publicly available exploits are known. Solution: Do not use the provided script, instead, use something else like FTS tika. --- Internal reference: DOV-8591 Type: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot CE core 2.4.0 Discovery date: 2026-01-07 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: strokep@yeswehack CVE: CVE-2026-0394 CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Details: auth: Path traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`Pre-auth path traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`. When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characters, path traversal can happen if the domain component is directory partial. Risk: This allows inadvertently reading /etc/passwd (or some other path which ends with passwd). If this file contains passwords, it can be used to authenticate wrongly, or if this is userdb, it can unexpectly make system users appear valid users. No publicly available exploits are known. Solution: Upgrade to fixed version, or use different authentication scheme that does not rely on paths. Alternatively you can also ensure that the per-domain passwd files are in some other location, such as /etc/dovecot/auth/%d. --- Internal reference: DOV-8775 Type: CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2026-02-20 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: cookiejack15@yeswehack CVE: CVE-2026-27860 CVSS: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Details: v2.4/v3.1 regression: auth-ldap is not escaping usernames. If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. Risk: This leads to potentially bypassing restrictions and allows probing of LDAP structure. No publicly available exploits are known. Solution: Do not clear out auth_username_chars, or install fixed version. --- Internal reference: DOV-8781 Type: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2026-02-23 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: whisperer@yeswehack CVE: CVE-2026-24031 CVSS: 7.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Details: v2.4/v3.1 regression: SQL injection allows bypassing authentication. Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. Risk: This vulnerability allows bypassing authentication for any user and user enumeration. No publicly available exploits are known. Solution: Do not clear auth_username_chars. If this is not possible, install latest fixed version. --- Internal reference: DOV-8787 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2026-02-24 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: djvirus@yeswehack CVE: CVE-2026-27859 CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Details: v3.0.2+ regression: Message headers MIME parameter parsing can cause excessive CPU usage. A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. Risk: A suitably formatted mail message causes mail delivery process to consume large amounts of CPU time. No publicly available exploits are known. Solution: Use MTA capabilities to limit RFC 2231 MIME parameters in mail messages, or upgrade to fixed version where the processing is limited. --- Internal reference: DOV-8816 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2026-02-27 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: whisperer@yeswehack CVE: CVE-2026-27857 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Details: imap-login: Excessive memory usage DoS. Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. Risk: Attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections. No publicly available exploits are known. Solution: Install fixed version, there is no other remediation. --- Internal reference: DOV-8818 Type: CWE-400 (Uncontrolled Resource Consumption) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0, OX Dovecot CE core 2.4.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2026-02-28 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: ilyar@yeswehack CVE: CVE-2026-27858 CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Details: managesieve-login out-of-memory DoS. Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Risk: Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. No publicly available exploits are known. Solution: Protect access to managesieve protocol, or install fixed version. --- Internal reference: DOV-8830 Type: CWE-287 (Improper Authentication) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2026-03-04 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: bksparajuli@yeswehack CVE: CVE-2026-27856 CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Details: doveadm: Credentials verified without timing safety. Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Risk: Figuring out the credential will lead into full access to the affected component. No publicly available exploits are known. Solution: Limit access to the doveadm http service port, install fixed version. --- Internal reference: DOV-8859 Type: CWE-294 (Authentication Bypass by Capture-replay) Component: core Report confidence: Confirmed Solution status: Fixed by vendor Last affected revision: OX Dovecot Pro core 2.3.0 First fixed revision: OX Dovecot CE core 2.4.3 Discovery date: 2026-03-09 Solution date: 2026-03-27 Disclosure date: 2026-03-27 Researcher credits: hamizanazman@yeswehack CVE: CVE-2026-27855 CVSS: 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Details: auth: OTP driver vulnerable to replay attack. Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. Risk: An attacker able to observe an OTP exchange is able to log in as the user. No publicly available exploits are known. Solution: If authentication happens over unsecure connection, switch to SCRAM protocol. Alternatively ensure the communcations are secured, and if possible switch to OAUTH2 or SCRAM.

1 0

Imap Sieve errors in 2.4.2
by Alberto 26 Mar '26

26 Mar '26

Hi, I have a Dovecot docker image with last version (2.4.2). I'm getting some errors, last time a few minutes ago, when dragging some emails into a folder I had just created. ... Mar 26 10:48:20 imap(alberto(a)bersol.info)<451><wHkgJepNsLRYDtBg>: Info: Mailbox INBOX.carpetanueva: Mailbox created Mar 26 10:48:24 imap(alberto(a)bersol.info)<397><x8N6YuhNMs9YDtBg>: Panic: file imap-sieve-storage.c: line 216 (imap_sieve_add_mailbox_event): assertion failed : (ismt->src_box == NULL || ismt->src_box == src_box) Mar 26 10:48:24 imap(alberto(a)bersol.info)<397><x8N6YuhNMs9YDtBg>: Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 [unw_get_proc_name() failed: -10] -> #3 i_panic[0x7fbaed2ee8ab] -> #4 [unw_get_proc_name() failed: -1] Mar 26 10:48:24 imap(alberto(a)bersol.info)<397><x8N6YuhNMs9YDtBg>: Fatal: master: service(imap): child 397 killed with signal 6 (core dumped) This breaks Dovecot and I have to restart the container, but it doesn't fix it either. When I access again, I've receive this errors again, until I disable sieve in the imap.conf: conf.d/20-imap.conf ------------------- ... protocol imap { # Space separated list of plugins to load (default is global mail_plugins). mail_plugins { # imap_sieve = yes imap_quota = yes last_login = yes } And I have to keep "imap_sieve" disabled. Regards, Alberto

2 1

Issues with doveadm sync
by cryintothebluesky＠gmail.com 21 Mar '26

21 Mar '26

Hello, I have two replica IMAP servers both running dovecot-2.4.2: imap1.example.com imap2.example.com I'm observing the following issues when replicating mailboxes with doveadm sync: 1. Permission errors with public and shared mailboxes For this test I delete all mailboxes on imap2.example.com and then use full sync from imap1.example.com to replicate mailboxes: # doveadm sync -f -s "" -N -l 10 -u ${user:?} ${server:?} The first time I run this command, the following error messages are logged: doveadm(XXX(a)example.com)<1363><eZzOJic5vWlTBQAAMBZ7fQ>: Error: brain S: Can't create mailbox Shared/support(a)example.com: Permission denied doveadm(XXX(a)example.com)<1334><ZV88Byg5vWk2BQAAMBZ7fQ>: Error: brain S: Can't create mailbox Public/Test: Permission denied If I wait 10 seconds and run the same sync command again, all mailboxes are replicated correctly. This only happens with public and shared mailboxes. I'm not sure of the exact cause, but it looks as if there is a race condition, where on the target server replicated ACLs are not applied immediately and this results in permission errors. Can anyone confirm the root cause? 2. Mailboxes are not always synchronised correctly For this test I'm using stateful sync. The man page states it performs a two-way sync, hence both server should end up with the same state. 1) I log into imap2.example.com and move some messages from Inbox to Drafts and Junk folders. 2) On imap1.example.com I run: doveadm sync -s "${state}" -N -l 10 -u ${user:?} ${server:?} 3) I log into imap1.example.com and sometimes observe the recently moved messages missing from Drafts and/or Junk folders. 4) The only way to resolve this issue is to either run full sync from imap1.example.com or to run another stateful sync but from imap2.example.com. Can anyone confirm if this is a bug or if stateful sync is required to be run on both IMAP servers against each other?

1 0

Error: ldap: auth_passdb_post settings
by Ruud Baart 21 Mar '26

21 Mar '26

Dovecot 2.4.1 works fine on my Debian Trixie server. I use LDAP as backend for the users. I don't have problems. Authentication works fine. However logging show every time the following line: auth-worker(<user name@domain,::1)<109040><3v5ddOlJvrgAAAAAAAAAAAAAAAAAAAAB>: request [7]: Error: ldap: auth_passdb_post settings: Failed to parse configuration: Failed to expand passdb_fields/password setting variables: ldap: No such attribute 'userpassword' The LDAP authentication works correct. So I don't understand this message. My correct working LDAP configuration in auth-ldap.conf.ext: passdb ldap { passdb_use_worker = yes passdb_ldap_filter = (&(objectClass=PromptMailUser)(accountStatus=TRUE)(mailDeliveryaddress=%{user})) ldap_bind = yes fields { user = %{ldap:mailDeliveryaddress} password = %{ldap:userPassword} } } userdb ldap { userdb_use_worker = yes userdb_ldap_filter = (&(objectClass=PromptMailUser)(accountStatus=TRUE)(mailDeliveryaddress=%{user})) fields { home = %{ldap:mailBase} mail = %{ldap:mailMessageStore} mail_path = %{ldap:mailMessageStore} quota_storage_size = %{ldap:dovecotQuota} } }

6 21

shared mailbox error
by Marc 19 Mar '26

19 Mar '26

I am getting this error. This file does not exist. Error: t_readlink(/xxxxxx/dbox-alt-root) failed: readlink() failed: Permission denied

2 4

dovecot-2.4.2: doveconf seg fault
by Eray Aslan 16 Mar '26

16 Mar '26

Running dovecot -c /dev/null -n results in: # 2.4.2 (0962ed2104): /dev/null # Pigeonhole version 2.4.2 (767418c3) Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7c0f3a6 in str_to_uint () at ../lib/strnum.c:76 for a user. And the issue seems to be const unsigned char ** vs const char * mismatch: int str_to_uintmax(const char *str, uintmax_t *num_r) { const char *endp = NULL; uintmax_t n; int ret = str_parse_uintmax(str, &n, &endp); if ((ret != 0) || (*endp != '\0')) /* <--- reading via 'const char *' return -1; *num_r = n; return 0; } vs int str_parse_data_uintmax(const unsigned char *data, size_t size, uintmax_t *num_r, const unsigned char **endp_r) { const unsigned char *p = data, *pend = data + size; uintmax_t n = 0; if (p >= pend || *p < '0' || *p > '9') return -1; do { if (n >= ((uintmax_t)-1 / 10)) { if (n > (uintmax_t)-1 / 10) return -1; if ((uintmax_t)(*p - '0') > ((uintmax_t)-1 % 10)) return -1; } n = n * 10 + (*p - '0'); p++; } while (p < pend && *p >= '0' && *p <= '9'); if (endp_r != NULL) *endp_r = p; /* <--- writing via 'const unsigned char *' *num_r = n; return 0; } We don't know enough to choose which one would be preferable so that the interfaces match. It needs an informed decision as it shows up in a bunch of other places as well. More details at: https://bugs.gentoo.org/971191 Thank you -- Eray

1 0

Issues with 2.4.1 & remote postgresql server
by Terry Braun 14 Mar '26

14 Mar '26

Hello, I'm stumped with using a remote postgresql database for authentication. I went through the process once, failed, debugged, failed again. I could successfully use psql to access the remote database from my host machine, so I do not believe the remote access is an issue. I implemented an instance using sqlite3 database and it worked just fine. ``` from auth-sql.conf.ext ``` sql_driver = pgsql pgsql 72.44.55.66 { parameters { sslmode = require user = user password = 123 dbname = db } } I'm using lmtp over sockets to deliver mail to dovecot, in order to isolate any interaction issues. With a postgresql db I get "Mailbox isn't a valid mbox file", but with changes only to auth-sql.conf.ext it fails. I can run the queries from psql and they work. I'm pretty much out of ideas of things to try. - I could not find anything to validate the syntax of the psql data. All the examples had "psql localhots {" - Because of the above, I am wondering if there may be an issue in the postgres driver somehow? - I did look at the documentation for https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWO… but I'm unsure what is needed. Thanks for any ideas, help, hints. If someone has an example that works with 2.4.1-4 (7d8c0e5759) on debian 13 that would be great Terry

2 1

How to declare port 143
by Steve Litt 10 Mar '26

10 Mar '26

Hi all, I have Dovecot 2.4.2 working (plain text only) on my Qemu virtual machine, with Claws-Mail able to work with all its files. However, I want to declare the Dovecot server as running on Port 143, and when I do, I dovecot -F throws the error message shown later in this message. If I comment out the explicit port declaration, it works fine, and I want to know why. To the best of my knowledge, my declaration of port 143 exactly matches your 2.4.2 documentation: The following is my attempt to tell Dovecot to serve *explicitly* at port 143: =============================================== # My Dovecot server will operate on Localhost listen = 127.0.0.1 service imap { inet_listener imap-login { port = 143 } # inet_listener imaps { # port = 993 # ssl = yes # } } =============================================== The following is the result: =============================================== [root@dovecotvoid ~]# dovecot -F doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf: duplicate listener: 143:127.0.0.1 [root@dovecotvoid ~]# =============================================== If I comment out the port = 143, it works. Why is it griping about a duplicate listener? At the bottom of this email is the entire dovecot.conf and the result of dovecot -n, and there are no sub-configuration files in conf.d : =============================================== # Start new configs with the latest Dovecot version numbers here: dovecot_config_version = 2.4.2 # Must be current version dovecot_storage_version = 2.4.2 # Must be current version or earlier # 2.3 is minimum # I only want imap protocols { imap = yes lmtp = no pop3 = no } # My Dovecot server will operate on Localhost listen = 127.0.0.1 service imap { inet_listener imap-login { port = 143 } # inet_listener imaps { # port = 993 # ssl = yes # } } # mail_home is only for virtual users # A virtual user is a user with no system account # I have no virtual users, so I've commented out mail_home. #mail_home = /srv/mail/%{user} # mail_driver is the storage format mail_driver = maildir # mail_path is location of top of storage data # WARNING: For troubleshooting be prepared to switch # to literal location of ~ mail_path = ~/mail/Maildir # In my case # mail_home is the home directory of the user identified as ~ # WARNING: system users have no ~ without it. mail_home = /home/slitt # You need a log you can locate # There might not be a log_path=/var/log/dovecot.log #mail_uid = slitt #mail_gid = slitt mail_uid = vmail mail_gid = vmail # By default first_valid_uid is 500. #If your vmail user's UID is smaller, # you need to modify this: #first_valid_uid = uid-number-of-vmail-user namespace inbox { inbox = yes separator = / } # Authenticate as system users: passdb pam { driver = pam #driver = passwd } userdb passwd { driver = passwd } #ssl_server_cert_file = /etc/dovecot/ssl-cert.pem #ssl_server_key_file = /etc/dovecot/ssl-key.pem =============================================== The following is the output of dovecot -n: =============================================== # 2.4.2 (0962ed2104): /etc/dovecot/dovecot.conf # OS: Linux 6.12.71_1 x86_64 # Hostname: dovecotvoid dovecot_config_version = 2.4.2 dovecot_storage_version = 2.4.2 listen = 127.0.0.1 log_path = /var/log/dovecot.log mail_driver = maildir mail_gid = vmail mail_home = /home/slitt mail_path = ~/mail/Maildir mail_uid = vmail protocols { imap = yes lmtp = no pop3 = no } service imap { inet_listener imap-login { port = 143 } } namespace inbox { inbox = yes separator = / } passdb pam { driver = pam } userdb passwd { driver = passwd } ===============================================

5 5

Republish of 2.4.2
by Aki Tuomi 10 Mar '26

10 Mar '26

Hi all! We have republished 2.4.2 packages to fix some packaging issues with Pigeonhole. Please note that for now dovecot-sieve and dovecot-managesieved will get installed together due to dependency issues. Kind regards, Aki Tuomi

1 0

solr-config-9.xml Fails to Load with Solr 9.10.1
by Steven Smith 10 Mar '26

10 Mar '26

I’m trying to use the latest dovecot solr module solr-config-9.xml at with Solr 9.10.1: https://github.com/dovecot/core/blob/956fd0f9a101673be72a7df7d643dd20cf4c40… This dovecot module has been updated to work with version 9.8 and removes the deprecated <lib> directives. However, I observe that it does not load under solr 9.10.1 with the Java exception below. Does anyone have any pointers on how to modify this module for the latest solr versions? var/solr/logs/solr-8983-console.log: > 2026-03-10 01:34:45.983 INFO (main) [] o.a.s.c.CorePropertiesLocator Found 1 core definitions underneath /opt/local/var/solr > 2026-03-10 01:34:45.984 INFO (main) [] o.a.s.c.CorePropertiesLocator Cores are: [dovecot] > 2026-03-10 01:34:46.012 INFO (coreLoadExecutor-13-thread-1) [ x:dovecot] o.a.s.c.SolrConfig Using Lucene MatchVersion: 9.8.0 > 2026-03-10 01:34:46.045 INFO (coreLoadExecutor-13-thread-1) [ x:dovecot] o.a.s.s.ManagedIndexSchemaFactory The schema is configured as managed, but managed schema resource managed-schema.xml not found - loading non-managed schema schema.xml instead > 2026-03-10 01:34:46.064 INFO (coreLoadExecutor-13-thread-1) [ x:dovecot] o.a.s.s.IndexSchema Schema name=dovecot > 2026-03-10 01:34:46.100 ERROR (coreLoadExecutor-13-thread-1) [ x:dovecot] o.a.s.c.CoreContainer SolrCore failed to load on startup =>org.apache.solr.common.SolrException: Unable to create core [dovecot] > at org.apache.solr.core.CoreContainer.createFromDescriptor(CoreContainer.java:1803) I'm trying to use the latest dovecot solr module solr-config-9.xml at with Solr 9.10.1: [1]https://github.com/dovecot/core/blob/956fd0f9a101673be72a7df7d643dd20cf4c… This dovecot module has been updated to work with version 9.8 and removes the deprecated <lib> directives. However, I observe that it does not load under solr 9.10.1 with the Java exception below. Does anyone have any pointers on how to modify this module for the latest solr versions? var/solr/logs/solr-8983-console.log: 2026-03-10 01:34:45.983 INFO (main) [] o.a.s.c.CorePropertiesLocator Found 1 core definitions underneath /opt/local/var/solr 2026-03-10 01:34:45.984 INFO (main) [] o.a.s.c.CorePropertiesLocator Cores are: [dovecot] 2026-03-10 01:34:46.012 INFO (coreLoadExecutor-13-thread-1) [ x:dovecot] o.a.s.c.SolrConfig Using Lucene MatchVersion: 9.8.0 2026-03-10 01:34:46.045 INFO (coreLoadExecutor-13-thread-1) [ x:dovecot] o.a.s.s.ManagedIndexSchemaFactory The schema is configured as managed, but managed schema resource managed-schema.xml not found - loading non-managed schema schema.xml instead 2026-03-10 01:34:46.064 INFO (coreLoadExecutor-13-thread-1) [ x:dovecot] o.a.s.s.IndexSchema Schema name=dovecot 2026-03-10 01:34:46.100 ERROR (coreLoadExecutor-13-thread-1) [ x:dovecot] o.a.s.c.CoreContainer SolrCore failed to load on startup =>org.apache.solr.common.SolrException: Unable to create core [dovecot] at org.apache.solr.core.CoreContainer.createFromDescriptor(CoreContainer.java:1803) References Visible links 1. https://github.com/dovecot/core/blob/956fd0f9a101673be72a7df7d643dd20cf4c40…

1 1

Preventing Plain Auth
by Steve Litt 10 Mar '26

10 Mar '26

Hi all, https://doc.dovecot.org/2.4.2/core/summaries/settings.html , the auth_allow_cleartext section, says "If no, disables the LOGIN command and all other cleartext authentication unless SSL/TLS is used (LOGINDISABLED capability) or the connection is secured (see ssl). See SSL configuration for more detailed explanation of how this setting interacts with the ssl setting. This setting replaces the disable_plaintext_auth setting." I put auth_allow_cleartext = no in my 2.4.2 dovecot.conf, but my Claws-Mail client can still access it, even though there are no key files. I tried putting this setting in several different places: Didn't prevent plain access. I tried switching from 127.0.0.1 to 10.0.2.15, same problem. The following is the output of my dovecot -n command: ========================================= # 2.4.2 (0962ed2104): /etc/dovecot/dovecot.conf # OS: Linux 6.12.74_1 x86_64 # Hostname: dovecotvoid dovecot_config_version = 2.4.2 dovecot_storage_version = 2.4.2 listen = 10.0.2.15 log_path = /var/log/dovecot.log mail_driver = maildir mail_gid = vmail mail_home = /home/slitt mail_path = ~/mail/Maildir mail_uid = vmail protocols { imap = yes lmtp = no pop3 = no } service imap { inet_listener imap-login { auth_allow_cleartext = no } } namespace inbox { inbox = yes separator = / } passdb pam { driver = pam } userdb passwd { driver = passwd } ========================================= How do I disable plain text authentication? Thanks, SteveT Steve Litt http://444domains.com

4 13

[BUG?] Dovecot 2.4.2 from Dovecot repo (RHEL 9) does not implement Sieve (properly/fully)
by Patrick S 09 Mar '26

09 Mar '26

Hi all Below is report of what I suspect is a bug arising in Dovecot 2.4.x regarding Sieve functionality after Pigeonhole functionality was folded into Dovecot/Dovecot-sieve. ISSUE: ====== I am building a new mail server on Rocky Linux 9.7 with Postfix 3.10 and Dovecot 2.4.2. The base installation & setup of Dovecot was OK with core functionality (Postfix interoperability and mail into virtual mail domain mailboxes no problem). Once I had the base setup done I started with Sieve functionality: 1) Incoming mail marked as SPAM by Rspamd auto moved into /Junk 2) Mail manually moved in/out of /Junk handed to Rspamd for training as SPAM/HAM This consistantly failed - the first issue I found was Dovecot failing to restart and `dovecot -n` reporting fatal errors related to sieve — section not found etc. etc. From my reading previously I knew I needed to install `dovecot-sieve` and it was installed before I started working on Sieve functionality. I also saw `dovecot-pigeonhole` but I seemed to read that (version >= 2.4) the functionality for that had been included in `dovecot-sieve` **and** there was no Pigeonhole included in the Dovecot 2.4.2 repo — also if I tried to install it I got errors of course because of the version mismatch, and it was not in the dovecot-2.4-latest repo. ``` # dnf info dovecot-pigeonhole Last metadata expiration check: 1:21:15 ago on Fri 06 Mar 2026 08:05:08. Available Packages Name : dovecot-pigeonhole Epoch : 1 Version : 2.3.16 Release : 15.el9 Architecture : x86_64 Size : 371 k Source : dovecot-2.3.16-15.el9.src.rpm Repository : appstream Summary : Sieve and managesieve plug-in for dovecot URL : https://www.dovecot.org/ License : MIT and LGPLv2 Description : This package provides sieve and managesieve plug-in for dovecot LDA. ``` I also saw `dovecot-managesieved` but as I was **not** going to implement a client sieve functionality I did not install that. Anyway I could not even get to first base with Sieve, Dovecot simply did not know about it. I went on IRC and chatted with Aki Tuomi who confirmed that "yeah, looks like there is some packaging mistake." because the directory `/usr/lib64/dovecot/settings` was empty. As a workaround he suggested "you need to install dovecot-managesieved as workaround". I did that and as a result the following files appeared: ``` -rwxr-xr-x 1 root root 15560 Jan 8 12:13 libmanagesieve_login_settings.so -rwxr-xr-x 1 root root 15840 Jan 8 12:13 libmanagesieve_settings.so -rwxr-xr-x 1 root root 19656 Jan 8 12:13 libpigeonhole_settings.so ``` The `dovecot -n` errors went away, it recognised the sieve directives, and I continued with the Sieve setup. All — `dovecot.conf`, sieve files source and compiled — installed OK. But the sieve functionality simply refused to work. I got advice and we found the following which essentially points to sieve (even with `dovecot-managesieved` installed) not working. After installing everything — dovecot.conf, sieve files (compiled successfully) and a pipe to a shell script to call `rspamc` nothing seemed to happen. * `journalctl -f -u dovecot | grep -E "sieve|pipe"` -> nothing showed * `rspamc stat` -> 'Messages scanned' & 'Messages learned' no increase When we checked we found the following: 1) `lib90_sieve_settings.so` (which should be in `/etc/lib64/dovecot/settings`) is missing from the system. `find / -name "lib90_sieve_settings.so"` -> not found I believe the file is critical for the running of (Dovecot using) Sieve? 2) The Dovecot build options missing any sieve functionality: ``` #dovecot --build-options Build options: ioloop=epoll notify=inotify openssl io_block_size=8192 SQL driver plugins: mysql postgresql sqlite Passdb: ldap pam passwd passwd-file sql Userdb: ldap(plugin) passwd prefetch passwd-file sql ``` I believe (I was told) that minus the above (even though `dovecot-managesieved` was installed as well as `dovecot-sieve`) Sieve simply will not function. Is this a bug/packaging error? Regards Patrick ENVIRONMENT: ============ Software -------- * Rocky Linux 9.7 (RHEL) * Postfix 3.10 Built from source * Postscreen running in Postfix * Dovecot 2.4 installed from Dovecot repo * Valkey 9.0.3 (Redis replacement) * Rspamd 3.14.3 Setup ----- * Rspamd <-> Valkey communicate via Unix socket * Postfix & Dovecot <-> Rspamd via inet port/milter: smtpd_milters = inet:localhost:11332 non_smtpd_milters = inet:localhost:11332 * 'First line defence' = DNSBL via postscreen * Rspamd SPF checking, DKIM signing and DMARC configured All of the above installed, working and tested. DOVECOT PACKAGES INSTALLED: =========================== ``` Name : dovecot Version : 2.4.2 Architecture : x86_64 Source : dovecot-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-sieve Version : 2.4.2 Architecture : x86_64 Source : dovecot-sieve-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-managesieved (see note about this in the email) Version : 2.4.2 Architecture : x86_64 Source : dovecot-sieve-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-submissiond Version : 2.4.2 Architecture : x86_64 Source : dovecot-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-imapd Version : 2.4.2 Architecture : x86_64 Source : dovecot-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-lmtpd Version : 2.4.2 Architecture : x86_64 Source : dovecot-2.4.2-2.src.rpm From repo : dovecot-2.4-latest Name : dovecot-lua Version : 2.4.2 Architecture : x86_64 Source : dovecot-2.4.2-2.src.rpm From repo : dovecot-2.4-latest ``` OUTPUT OF `dovecot -n`: ======================= ``` # dovecot -n # 2.4.2-2 (0962ed2104): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.2-2 (767418c3) # OS: Linux 5.14.0-611.34.1.el9_7.x86_64 x86_64 Rocky Linux release 9.7 (Blue Onyx) # Hostname: srv01.example.com dovecot_config_version = 2.4.2 auth_default_domain = example.com auth_mechanisms = plain auth_username_format = %{user | lower } dovecot_storage_version = 2.4.2 mail_access_groups = vmail mail_control_path = ~/control mail_driver = maildir mail_gid = 5000 mail_home = /var/vmail/%{user | domain }/%{user | username } mail_index_path = ~/indexes mail_path = %{home}/Maildir mail_privileged_group = vmail mail_uid = 5000 mailbox_list_utf8 = yes protocols = imap lmtp sieve_global_extensions { vnd.dovecot.pipe = yes } sieve_pipe_bin_dir = /etc/dovecot/sieve/bin sieve_plugins { sieve_imapsieve = yes sieve_extprograms = yes } sieve_trace_dir = /var/log/dovecot/sieve-trace sieve_trace_level = actions ssl = required syslog_facility = local5 protocol lmtp { mail_plugins { sieve = yes } } ssl_server { cert_file = /etc/ssl/server/server_example_com.crt key_file = /etc/ssl/server/server_example_com.key } passdb passwd-file { auth_username_format = %{user | username} default_password_scheme = SHA512-CRYPT passwd_file_path = /etc/dovecot/passwd } userdb passwd-file { auth_username_format = %{user | username} passwd_file_path = /etc/dovecot/passwd fields { gid:default = 5000 uid:default = 5000 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service auth-worker { user = $SET:default_internal_user } service anvil { unix_listener anvil { group = $SET:default_internal_group mode = 0660 } } service doveadm { unix_listener doveadm-server { mode = 0600 user = $SET:default_internal_user } } sieve_script rspamd_to_junk { driver = file path = /etc/dovecot/sieve/rspamd-to-junk.sieve type = before } namespace inbox { mail_plugins { imap_sieve = yes } inbox = yes mailbox Junk { auto = create autoexpunge = 90d special_use = "\\Junk" sieve_script report-spam { cause = copy path = /etc/dovecot/sieve/report-spam.sieve type = before } } imapsieve_from Junk { sieve_script report-ham { cause = copy path = /etc/dovecot/sieve/report-ham.sieve type = before } } mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Sent { auto = subscribe special_use = "\\Sent" } mailbox Trash { auto = subscribe special_use = "\\Trash" } } ```

4 7

Curve25519/Ed25519 ?
by Steve Litt 09 Mar '26

09 Mar '26

On my new Dovecot 2.4.2 IMAP server, which when completed will be accessible only via SSL, I plan to use Curve25519/Ed25519 self-signed-cert/private-key. Is there any reason this would be a mistake? Thanks, SteveT Steve Litt http://444domains.com

2 2

Dovecot 2.4 doveadm_worker_count corrupts tab-formatted output
by Philip Iezzi 08 Mar '26

08 Mar '26

Hi there On a Dovecot 2.4.2 (Debian Bookworm) server with over 1300 users, I am using the following config to retrieve quota usage information with doveadm: --------------------------------------- quota "User quota" { } mail_plugins = quota acl mail_log notify userdb sql { iterate_query = SELECT username AS user, CONCAT(quota, 'M') AS quota_storage_size FROM mailaccounts WHERE active = 1 query = \ SELECT '/var/vmail/%{user | domain}/%{user | username}' AS home, 'vmail' AS uid, 'vmail' AS gid, CONCAT(quota, 'M') AS quota_storage_size \ FROM mailaccounts \ WHERE username = '%{user}' AND (active = 1 OR transport_suspended = 0) } --------------------------------------- Initially, I had to run `doveadm quota recalc -A` to recalc quotas and populate the `count` quota driver which is enabled by default for "User quota". But still, it took roughly 20ms per single user or 15-20s for all users: $ time doveadm -f tab quota get -u demo(a)example.com real 0m0.020s $ time doveadm -f tab quota get -A real 0m16.800s Now, to greatly speed this up, I have introduced parallel processing: doveadm_worker_count = 4 Like this, `doveadm -f tab quota get -A` runs approx 10x faster, done in 1.5 - 2.5s But there is one major drawback which I assume to be a bug: # sane output without `doveadm_worker_count = 4` => always 6 fields demo(a)example.com User quota STORAGE 29 204800 0 demo(a)example.com User quota MESSAGE 1 - 0 # broken output with `doveadm_worker_count = 4` => sometimes 7 fields demo(a)example.com User quota STORAGE 29 2048 00 0 demo(a)example.com User quota MESSAGE 1 - 0 Somehow, the tab formatter does not play nicely together with parallel processing. On some output, the value gets split apart by an extra tab, e.g. '2024<TAB>00' in above example. Can you explain this corrupted data? Some kind of "output interleaving" seems to happen when running parallel workers. If I switch to json output (`doveadm -f json quota get -A`), this does not seem to happen and I always get valid JSON output, even with `doveadm_worker_count = 4`. Cheers, Philip

2 8

Getting quota limits from DB
by Alberto 04 Mar '26

04 Mar '26

Hi group: I have a Docker Dovecot 2.4.2 installation with MySQL user management, with this record: SELECT * FROM users; +---------------------------------------------------------------------------- | username | domain | password | home | uid | gid | active | quota | quotamsgs | crampassword +---------------------------------------------------------------------------- | alberto | bersol.info | {MD5-CRYPT}$1$Jm... | /var/mail/alberto | 1000 | 1000 | Y | 3221225472 | 149999 | {CRAM-MD5}fd246... | +---------------------------------------------------------------------------- But I have a problem with user quota definitions... If I run "doveadm" command, I get the user quota occupation, I have "quota_clone" plugin working, but I don't get user quota limit, I don't know why: ----- # docker exec -it midovecot doveadm quota get -A Username Quota name Type Value Limit % alberto(a)bersol.info User quota STORAGE 1925805 3145728 61 alberto(a)bersol.info User quota MESSAGE 37608 100000 37 ----- That limit isn't the correct limit set in DB, but the one is put in the config, and it must to be override in my userdb:Extra Fields. ----- # # docker exec -it midovecot doveadm config # 2.4.2 (0962ed2104): /etc/dovecot/dovecot.conf ... userdb sql { iterate_query = SELECT CONCAT(username,'@',domain) AS user FROM users query = SELECT home,CONCAT(username,'@',domain) AS username,crampassword AS password,uid AS userdb_uid,gid AS userdb_gid,CONCAT(quota,'B') AS userdb_quota_storage_size,concat('*:messages=',quotamsgs) AS userdb_quota_storage_size FROM users WHERE username = '%{ user | username | lower }' AND domain = '%{ user | domain | lower }' } ... quota_storage_size = 3G quota_message_count = 100000 ... ----- Do you have any idea of the problem? Best Regards, Alberto

2 3

Dovecot marking outgonig emails as unread
by stef204 03 Mar '26

03 Mar '26

Starting a few days ago, I have one email account where ALL outgoing emails are automatically marked as UNREAD. The message is sent, then copied to the "Sent" folder, and has status "unread". Then, a couple of minutes later, something happens where this message gets marked as UNREAD, without ANY interaction of client side. This occurs not matter the email client used, I have tried it with multiple email clients, both local and via web interface, the behavior does not change. This is via Dovevot on Cpanel. if I look at the [1]changelog, it is difficult to identify which changes could have triggered this as there seem to be changes impacting Dovecot almost with every update. I do not control the server myself, this is on a shared hosting plan; tech support has been willing to troubleshoot but is unable to locate the problem. This problem does NOT occur on other email accounts on the same domain, so it looks to me like some corruption or problem syncing flags perhaps? I am at a loss at the moment to fix this behavior. Any suggestions or ideas welcome. Thanks. References Visible links 1. https://docs.cpanel.net/changelogs/132-change-log/

3 5

[Pigeonhole] extracttext on "message/rfc822" attachment ignores included headers
by quentinduchemin＠tuta.io 03 Mar '26

03 Mar '26

Hi everyone! I'm not sure this is a design decision, a bug, something not implemented or malformed input on my side. My use case is the following: users that forward their mails outside the domain I manage have the option to report spam as attachment so the spam classifier can learn anyway. I prefer attachment over forward because MUAs have their own way to do it and it's difficult to reliably reconstruct some headers/email structure that can be important for the spam classifier. Each input message is processed through a Sieve extensions of RFC 5703 to extract the attachment. I ask user to produce a file with .eml extension through any export-like feature of their MUA. Below is an example EML file produced by Tuta (Thunderbird does a similar thing with a different encoding for the body). I'll use a bunch of = characters as a separator in the rest of this. =============================================== [...bunch of header...] X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-0000000000 00 X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYSPR04MB7035 Content-Type: multipart/related; boundary="------------79Bu5A16qPEYcVIZL@tutanota" --------------79Bu5A16qPEYcVIZL@tutanota Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 DQo8ZGl2IHN0eWxlPSJmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3 NfTVNGb250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6 [...base64 encoding of the body...] =============================================== While attached and sent, the received messaged looks like this: =============================================== [...headers of the actual email...] X-Infomaniak-Routing: alpha This is a multi-part message in MIME format. --------------5jyKrhQ08xXUif7LHhgg648N Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit --------------5jyKrhQ08xXUif7LHhgg648N Content-Type: message/rfc822; name="a.eml" Content-Disposition: attachment; filename="a.eml" Content-Transfer-Encoding: 7bit [...headers of the spam....] Subject: Re: //Re: AI + Ranking /// Thread-Topic: //Re: AI + Ranking /// [....] Content-Type: multipart/related; boundary="------------79Bu5A16qPEYcVIZL@tutanota" --------------79Bu5A16qPEYcVIZL@tutanota Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 DQo8ZGl2IHN0eWxlPSJmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3 NfTVNGb250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6 [...base64 encoding of the spam....] --------------79Bu5A16qPEYcVIZL@tutanota-- --------------5jyKrhQ08xXUif7LHhgg648N-- =============================================== I face two issues: 1. Only the base64 decoded string can be retrived through foreverypart/extracttext; 2. It has a lot of newlines. - 2. is not a big deal. The original spam has a lot of HTML junk, and each line with HTML without an inner text node is stripped, but the newline is kept. I don't know if this is intended. - 1. is more of a big deal. To try to confirm that, I made an over-simplified version of the Sieve script (I skip configuration but plugins are loaded etc, please ask if useful). =============================================== [...require...] foreverypart { extracttext "eml"; debug_log "PART ============================== ${eml}"; } =============================================== mail_debug is activated. In the logs, I can read: =============================================== Info: sieve: DEBUG: PART ============================== Info: sieve: DEBUG: PART ============================== Info: sieve: DEBUG: PART ============================== Info: sieve: DEBUG: PART ============================== Info: sieve: DEBUG: PART ============================== Info: sieve: Info: sieve: Info: sieve: Info: sieve: Info: sieve: Info: sieve: Info: sieve: Hello, Info: sieve: Info: sieve: Hope you're doing well. Info: sieve: Info: sieve: Info: sieve: Info: sieve: Info: sieve: Would you like attract more traffic with our AEO + GEO + SEO services. AI-driven search is here—don’t miss out. =============================================== So multiple parts are analyzed but only the last gives something. The RFC says that "If the transfer encoding or character set is unrecognized by the implementation or recognized but invalid, an empty string will result.". But it's over my knowledge. I activated trace for Sieve with "matching" level, and the file looks like (this is another test but was the same result): =============================================== Sieve trace log for message delivery: Username: REDACTED Session ID: ozNMOEPNl2nlAAAAO14Lzw Sender: REDACTED Final recipient: REDACTED Default mailbox: INBOX ## Started executing script 'move-spam' 33: foreverypart loop begin 33: loop ends at line 36 35: extracttext command 36: assign 'eml' [0] = "" 36: debug_log "PART ============================== " 36: foreverypart loop end 36: switched to next message part 36: looping back to line 35 35: extracttext command 36: assign 'eml' [0] = "" 36: debug_log "PART ============================== " 36: foreverypart loop end 36: switched to next message part 36: looping back to line 35 35: extracttext command 36: assign 'eml' [0] = "" 36: debug_log "PART ============================== " 36: foreverypart loop end 36: switched to next message part 36: looping back to line 35 35: extracttext command 36: assign 'eml' [0] = "" 36: debug_log "PART ============================== " 36: foreverypart loop end 36: switched to next message part 36: looping back to line 35 35: extracttext command 36: assign 'eml' [0] = "Hi, Just checking in to see if you had a chance to review my earlier message. [...body spam....] 36: debug_log "PART ============================== ????????????Hi, ?? ??Just checking in t..." 36: foreverypart loop end 36: no more message parts 36: exiting loops at line 36 ## Finished executing script 'move-spam' =============================================== Hypothesis: A. Could it be because the mail headers are indistinguishable from the part headers? B. Or is it related to Pigeonhole not implementing yet the enclose extension, which do this the other way? I hope this message is not too hard to read with all the code/logs. Please tell me if there is a better way of doing it. And thanks in advance for any help, because I don't really know what to do and trying to take a (superficial) look at the Pigeonhole code didn't helped.

1 2

Panic: file imap-sieve-storage.c: line 216 (imap_sieve_add_mailbox_event): assertion failed: (ismt->src_box == NULL || ismt->src_box == src_box)
by Christian Kivalo 28 Feb '26

28 Feb '26

Reposting my reply from a few days ago to a thread with the same panic message. I found this in my logs when some mails that got deleted on the phone were still visible in roundcube. I currently have three users that trigger the panic. One user with an iPad accounts for nearly all of the panics. The problem shows when the account is accessed from android (thunderbird) or ipad. The same accounts show no problems when beeing used with roundcube or thunderbird on windows. I enabled core dumps on 2026-01-14 and have ~8500 core dumps of the imap binary until now. What causes this error and how can I fix it? In the logs all I see is the users login, then the panic. # doveconf -n # 2.4.2-2+debian13 (0962ed2104): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.2-2+debian13 (767418c3) # OS: Linux 6.12.0-custom.kvm x86_64 Debian 13.3 ext4 2026-01-13T21:44:32.317609+01:00 uschi dovecot: imap-login: Logged in: user=<user(a)example.com>, method=PLAIN, rip=<IP1>, lip=<IP2>, mpid=4194077, TLS, session=<cpkID0tId7dUc9rl> 2026-01-13T21:44:38.455379+01:00 uschi dovecot: imap(user(a)example.com)<4194077><cpkID0tId7dUc9rl>: Panic: file imap-sieve-storage.c: line 216 (imap_sieve_add_mailbox_event): assertion failed: (ismt->src_box == NULL || ismt->src_box == src_box) 2026-01-13T21:44:38.458755+01:00 uschi dovecot: imap(user(a)example.com)<4194077><cpkID0tId7dUc9rl>: Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 [unw_get_proc_name() failed: -10] -> #3 i_panic[0x7f6b6c46c2f6] -> #4 [unw_get_proc_name() failed: -10] -> #5 [unw_get_proc_name() failed: -10] -> #6 [unw_get_proc_name() failed: -10] -> #7 mailbox_save_alloc[0x7f6b6ca103c0] -> #8 [unw_get_proc_name() failed: -10] -> #9 command_exec[0x55654e677400] -> #10 [unw_get_proc_name() failed: -10] -> #11 [unw_get_proc_name() failed: -10] -> #12 [unw_get_proc_name() failed: -10] -> #13 client_handle_input[0x55654e67ddc0] -> #14 client_continue_pending_input[0x55654e67e0b0] -> #15 io_loop_call_io[0x7f6b6c565490] -> #16 io_loop_handler_run_internal[0x7f6b6c567230] -> #17 io_loop_handler_run[0x7f6b6c5673c0] -> #18 io_loop_run[0x7f6b6c5675a0] -> #19 master_service_run[0x7f6b6c4b27f0] -> #20 main[0x55654e6688a0] -> #21 [unw_get_proc_name() failed: -10] -> #22 __libc_start_main[0x7f6b6c234ce0] -> #23 _start[0x55654e668eb0] 2026-01-13T21:44:38.459536+01:00 uschi dovecot: imap(user(a)example.com)<4194077><cpkID0tId7dUc9rl>: Fatal: master: service(imap): child 4194077 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) # coredumpctl dump PID: 1071230 (imap) UID: 5000 (vmail) GID: 5000 (vmail) Signal: 6 (ABRT) Timestamp: Fri 2026-01-16 19:17:15 CET (2s ago) Command Line: $'dovecot/imap [user(a)example.com <IP redacted> UID MOVE]' Executable: /usr/lib/dovecot/imap Control Group: /system.slice/dovecot.service Unit: dovecot.service Slice: system.slice Boot ID: 3668d179bda340229a780d5d43e426c3 Machine ID: 05698baa30ae984c9bd014566e16da18 Hostname: uschi Storage: /var/lib/systemd/coredump/core.imap.5000.3668d179bda340229a780d5d43e426c3.1071230.1768587435000000.zst (present) Size on Disk: 1.1M Message: Process 1071230 (imap) of user 5000 dumped core. Module libgcc_s.so.1 from deb gcc-14-14.2.0-19.amd64 Module libstdc++.so.6 from deb gcc-14-14.2.0-19.amd64 Module libzstd.so.1 from deb libzstd-1.5.7+dfsg-1.amd64 Stack trace of thread 1071230: #0 0x00007fbd1ca9f95c n/a (libc.so.6 + 0x9495c) #1 0x00007fbd1ca4acc2 raise (libc.so.6 + 0x3fcc2) #2 0x00007fbd1ca334ac abort (libc.so.6 + 0x284ac) #3 0x00007fbd1cc6caa0 n/a (libdovecot.so.0 + 0x6caa0) #4 0x00007fbd1cd49e67 n/a (libdovecot.so.0 + 0x149e67) #5 0x00007fbd1cc6c3d0 i_panic (libdovecot.so.0 + 0x6c3d0) #6 0x00007fbd1c42f942 n/a (lib95_imap_sieve_plugin.so + 0x4942) #7 0x00007fbd1c431223 n/a (lib95_imap_sieve_plugin.so + 0x6223) #8 0x00007fbd1d258f10 n/a (libdovecot-storage.so.0 + 0x11bf10) #9 0x00007fbd1d1a843b mailbox_save_alloc (libdovecot-storage.so.0 + 0x6b43b) #10 0x00005590b7ed4a69 n/a (n/a + 0x0) ELF object binary architecture: AMD x86-64 -- Christian Kivalo

5 12

LDAP AD Quota override not working
by wt.forsaken＠gmail.com 26 Feb '26

26 Feb '26

Hi there, I'm testing the new version of Dovecot 2.4 in Debian 13 before upgrading to my customers and I'm having difficult on trying to override the user's quota. The LDAP base is from Samba4 AD and having been trying the following configuration: auth-ldap.conf.ext: ldap_uris = ldap://localhost ldap_auth_dn = cn=admin,dc=localdomain ldap_auth_dn_password = password ldap_base = ou=users, dc=localdomain passdb ldap { filter = (&(objectClass=person)(sAMAccountName=%{user})) bind = yes fields { userdb_quota_storage_size = %{ldap:telephoneNumber}B } } userdb prefetch { driver = prefetch } userdb ldap { fields { quota_storage_size = %{ldap:telephoneNumber}B } } 90-quota.conf mail_plugins { quota = yes } quota "User quota" { } quota_storage_size = 40M Since there is no quotaBytes in Samba AD, I'm testing to map the telephoneNumber parameters to override the quota, also I'm just testing a 40M to see how it works. Roundcube webmail can see the quota being overriden in its inferior bar, but when I send an email to the user which is above the quota, the journal log inform "failed to store into mailbox 'INBOX': Quota exceeded (mailbox for user is full)". I don't know how to override the quota, since in passdb section I used the "userdb_" prefix but it is not being passed to userdb when I input the "doveadm user ..." command. I don't know if I have been clear in my request, but I'd appreciate any help.

3 3

Dovecot 2.4 LMTP socket for Postfix / Dovecot base_dir not created upon restart
by Philip Iezzi 24 Feb '26

24 Feb '26

Hi there, After over a week of Dovecot 2.3 -> 2.4 upgrade testing in various mailserver clones, I am now ready for the big picture. Thanks Aki for the Config Upgrader https://dovecot.org/upgrader/ which helped a lot! Tomorrow, I am planning to upgrade a larger mailserver in these 3 steps: 1) Debian Bullseye / Dovecot 2.3.21 => 2.4.1 2) Debian Bullseye => Bookworm / Dovecot 2.4.1 => 2.4.2 3) Debian Bookworm => Trixie Postfix needs to talk to Dovecot over LMTP, using the following in main.cf: virtual_transport = lmtp:unix:/run/dovecot/lmtp Now, while testing this in a full server clone, I stepped over my planned LMTP server setup: =============================================== service lmtp { unix_listener /run/dovecot/lmtp { mode = 0666 user = postfix group = postfix } } protocols = imap pop3 sieve lmtp =============================================== The socket needs to be owned by postfix:postfix for some (security) reasons, otherwise Postfix complains. That's why I cannot go with the default, as documented here: https://doc.dovecot.org/2.4.2/core/config/delivery/lmtp.html#lmtp-server > The UNIX listener on $base_dir/lmtp is enabled by default when protocols setting contains lmtp. But, when using an absolute path on unix_listener, upgrade step 2) Bullseye=>Bookworm breaks with: Processing triggers for dovecot-core (2:2.4.2-2+debian12) ... Job for dovecot.service failed because the control process exited with error code. (...) dovecot[34446]: master: Error: service(lmtp): Socket already exists: /var/run/dovecot/lmtp dovecot[34446]: master: Fatal: Failed to start listeners I then moved to `unix_listener lmtp`: service lmtp { unix_listener lmtp { mode = 0666 user = postfix group = postfix } } Bookworm upgrade (restarted from scratch with a fresh server clone) went through fine. But even after several dovecot.service restarts, the socket ended up in /run/lmtp without creating the /run/dovecot directory, and after a full system reboot, it was suddenly back where I have expected it: /run/dovecot/lmtp I never changed base_dir, which defaults to /var/run/dovecot/ So, here's my question: Is that really the recommended setup (using `inet_listener lmtp` instead of an absolute path) and how can I trust Dovecot to always create the socket in $base_dir/lmtp as documented? Are you guys aware of this issue or was it just me, a temporary hiccup on my just upgraded server? I just found this in mail.log: dovecot: master: Error: bind(/var/run/dovecot/lmtp) failed: No such file or directory dovecot: master: Error: service(lmtp): net_listen_unix(/var/run/dovecot/lmtp) failed: No such file or directory dovecot: master: Fatal: Failed to start listeners Again, this problem seems to have occurred both with `unix_listener /run/dovecot/lmtp` and `unix_listener lmtp` and only resolved after a full system reboot. Thanks, Philip

2 2

Migrating a mailbox from v2.2 to v2.4, production server to pre-production server.
by Mike 23 Feb '26

23 Feb '26

I'm migrating a mailbox from dovecot v2.2 to v2.4. Not that it matters, I'm also changing from mbox to Maildir. As an initial test I used this command: sudo doveadm sync -1D -u theuser -m amailbox remote:theuser@destination.com I received this error: Error: doveadm: Unexpected or incomplete option: -U After changing the dsync_remote_cmd to: dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u I was able to transfer the mailbox without issue. Before changing it, the setting on the source server was: dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u -U I'm interested to discover what the -U was intended for since I couldn't find specific documentation to its use. I'll accept that it was a legacy thing and removing it won't cause any unintended consequences...but I do still have that curiosity about what it was for. Additionally, the subscription status doesn't seem to flow to the new server. When checking the source server with: doveconf -d | grep subscriptions doveconf -n | grep subscriptions No value is returned...So I'm wondering if I need to specifically set subscriptions = yes in the source server to make this happen properly. Maybe this is an artifact of using sync -1? Thanks for any insight you may provide. Mike

1 0

Localhost Dovecot server without ssl?
by Steve Litt 23 Feb '26

23 Feb '26

Hi all, I'd like your opinions to add to my own opinion. Bottom line question: If I trust everybody with physical access to my Daily Driver Desktop (DDD) computer, my Dovecot IMAP runs on my DDD, I access my Dovecot IMAP *exclusively* from my DDD, and I trust everybody with physical access to my DDD (that would be my wife), then if I serve out IMAP on localhost (127.0.0.1), am I being unduly risky using plain text auth (port 143)? Details: I use a Dovecot IMAP server, on my DDD, specifically to hold all my email messages. Therefore, I can use any IMAP aware email client, interchangeably, to view every email I've received since April 2001. People whose emails are held by their email clients are "locked in" to their email client unless they convert their email data. I can switch between Evolution and Claws-Mail, because one of the two is always doing something stupid. Bottom line: I use Dovecot IMAP exclusively to hold my emails and folders. Graphical description below: ISP ---> My --------> procmail --> Dovecot IMAP fetchmail Maildir | | V email <--- Dovecot client IMAP server For the time being, I don't need to access my Dovecot IMAP from any computer except my DDD, and therefore, I can serve Dovecot IMAP on 127.0.0.1. So here's my question. Assuming (and I know this is a big assumption) I'm not worried about somebody gaining physical possession of my DDD, is there any reason not to use plain text to access this server? Thanks, SteveT Steve Litt http://444domains.com

2 1

Copies/duplicates of Dovecot indices
by Joseph Tam 23 Feb '26

23 Feb '26

In my setup, I put mail indices outside the user's mailbox locations (user mailboxs are NFS, indices stored local attached storage). I notice that sometimes, there are 2 sets of indices representing the same mailbox: one at top level, one underneath .imap/. (They usually appear in the latter.) For example, if I have the configuration (Dovcot version 3.2.21) mail_location = mbox:~/mail:INBOX=/nfs/mail/%n:INDEX=/cache/%n I see for a particular user [1] drwx------ 5 user group 512 Feb 22 21:56 /cache/user/box [2] drwxr-xr-x 5 user group 512 Feb 22 21:46 /cache/user/.imap/box cooresponding to their mailbox in ~user/mail/box. Each of these have the dovecot.* index files. If I delete [1], it comes back. The timestamps are close to each other so both sets are being used, possibly by different clients. Another quirky discovery is 2 /.imap/ folders beneath each other e.g. /cache/user/.imap/folder1/folder2/.imap/box/dovecot.index What determines which index pathname gets created or used? Joseph Tam <jtam.home(a)gmail.com>

1 0

2.3 replication issue throwing errors
by Paul Kudla 22 Feb '26

22 Feb '26

shows same error on both servers Server 1 : # sync faye(a)scom.ca doveadm(faye(a)scom.ca)<90952><BJq9J2dHmGlIYwEA0dxyZQ>: Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID f982a82747469869ea0f0100cf58dcff (maybe it was just deleted?) Server 2: # sync faye(a)scom.ca doveadm(faye(a)scom.ca)<90952><BJq9J2dHmGlIYwEA0dxyZQ>: Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID f982a82747469869ea0f0100cf58dcff (maybe it was just deleted?) i am aware there is a mismatch on one of the servers but there does not seem to be a clear cut way to find the offending file to delete it or force a backwards sync ? How would i identify what GUID f982a82747469869ea0f0100cf58dcff means? same on both servers. doveadm force-resync -u faye(a)scom.ca '*' have tried reindex etc etc etc issue persists logs ?? mail18 02-20 06:45:24 {dovecot} [67632] (3014654310) doveadm(faye(a)scom.ca)<71073><hOl0ClRJmGmhFQEAz1jc/w>: Debug: open(/proc/self/stat) failed: No such file or directory mail18 02-20 06:45:24 {dovecot} [67632] (3014654311) doveadm(faye(a)scom.ca)<71073><hOl0ClRJmGmhFQEAz1jc/w>: Debug: open(/proc/self/io) failed: No such file or directory mail18 02-20 06:45:24 {dovecot} [67632] (3014654312) doveadm(faye(a)scom.ca)<71073><hOl0ClRJmGmhFQEAz1jc/w>: Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ any help would be appreciated -- Thanks - Paul Kudla (Manager SCOM.CA Internet Services Inc.) Have A Happy Friday AND Happy Sucessful 2026 ! Scom.ca Internet Services <http://www.scom.ca> 104-1009 Byron Street South Whitby, Ontario - Canada L1N 4S3 Toronto 416.642.7266 Main 1.866.411.7266 Fax 1.888.892.7266 Email paul(a)scom.ca

2 2

How do you use doveadm fetch -S
by Steve Litt 20 Feb '26

20 Feb '26

Hi all, I have a working plain text 127.0.0.1:143 Dovecot 2.4.2 on my Qemu VM guest. The following command displays the Receive date, From and Subject for every email in my golugTech mailbox, exactly like the docs say it should: =================================================== doveadm fetch -u slitt "date.received hdr.from hdr.subject" mailbox golugTech =================================================== But when I add the -S in order to specify the 127.0.0.1 listener at port 143, it throws the following error: =================================================== [slitt@mydesk ~]$ cat junk.jnk [root@dovecotvoid dovecot]# doveadm fetch -S 127.0.0.1:143 -u slitt "date.received hdr.from hdr.subject" mailbox golugTech doveadm(slitt): Error: conn 127.0.0.1:143 (127.0.0.1:143): doveadm server sent invalid handshake: * OK Waiting for authentication process to respond.. doveadm(slitt): Error: cmd fetch: 127.0.0.1:143: Command fetch failed for slitt: Connection closed [root@dovecotvoid dovecot]# [slitt@mydesk~]$ =================================================== The docs say -S is to specify the socket_path, and it should be expressed as hostname:port. For hostname, besides 127.0.0.1, I tried localhost and dovecotvoid, the latter of which should not work because dovecotvoid is not 127.0.0.1, it's 10.0.2.15. The docs say "This allows an administrator to execute doveadm(1) mail commands through the given socket." So I guess finding the server isn't the purpose of socket_path. My plain text 143 Dovecot 2.4.2 IMAP works just fine without the -S. Is there ever a case where doveadm fetch would need to know the specific address and port of the dovecot IMAP server, and if so, how would I specify it? Thanks, SteveT Steve Litt http://444domains.com

2 1

What replaced mail_home in 2.4.2?
by Steve Litt 20 Feb '26

20 Feb '26

Hi all, In my Dovecot 2.4.2 virtual machine guest I've used mail_home to indicate the value of ~ and presumably of ${home}. However, the only documentation I can find on mail_home is on https://doc.dovecot.org/main/core/summaries/settings.html#mail_home , which is NOT a 2.4.2 document. I find no reference to mail_home on any 2.4.2 documentation. Has something replace mail_home, and if so what's it called and can I put it outside of any {} blocks? Thanks, SteveT Steve Litt http://444domains.com

2 2

mail_utf8_extensions and IMAP Folder Naming
by max.wriedt＠rehost.eu 20 Feb '26

20 Feb '26

i just upgraded my 2.3 installation to 2.4. I like to be bleeding edge and i want to use SMTPUTF8. I came across problems with mailboxes that have german umlauts. when enabling "mail_utf8_extensions=yes" e.g. Microsoft Outlook gives me mUTF-7 encoded folder names. Also the folder names when list via openssl s_client are encoded in mUTF-7. Am i missing something or can i disable utf8 for IMAP (UTF8=ACCEPT) only, but keep for LMTP Transport/SMTPUTF8 from postfix to dovecot? I am using mdbox format as storage, if that matters. My namespace config (shortened): namespace inbox { inbox = yes type = private #mailbox_list_utf8 = yes # also tried this -> when folder didn't exist before it would create a new one with utf8, no matter mail_utf8_extensions is on or off mailbox Drafts { auto = no special_use = \Drafts } mailbox Entw&APw-rfe { special_use = \Drafts } mailbox Entw%26APw-rfe { special_use = \Drafts } mailbox Entw\&APw-rfe { special_use = \Drafts } mailbox Entwürfe { auto = create special_use = \Drafts } mailbox Trash { auto = no special_use = \Trash quota_storage_percentage = 110 } mailbox "Gel&APY-schte Elemente" { special_use = \Trash quota_storage_percentage = 110 } mailbox "Gelöschte Elemente" { auto = subscribe special_use = \Trash quota_storage_percentage = 110 } mailbox Sent { auto = no special_use = \Sent } mailbox Archiv { auto = subscribe special_use = \Archive } mailbox Spam { special_use = \Junk auto = no } }

3 4

2.4.2 breaks user iterations for LDAP
by cpfeiffer＠rev-crew.info 20 Feb '26

20 Feb '26

Hello everyone, Due to the fix for CVE-2025-30189, routines like userdb_ldap_preinit() call auth_cache_parse_key_and_fields() unconditionally, with the eventually called auth_cache_parse_key_exclude() erroring if a cache key could not be constructed. It’s also noteworthy that this call happens regardless of whether use_cache is set or not, and as of such failing to construct a cache key would cause an error even if use_cache = no was set for that database. This is however an issue for user iteration with LDAP, as documented here LDAP | Dovecot CE <https://doc.dovecot.org/2.4.2/core/config/auth/databases/ldap.html#user-ite…> . Such a userdb only has iterate_filter fields that would inherently not be containing any user variables. The call to auth_cache_parse_key_and_fields() uses a combination of ldap_base and userdb_ldap_filter anyway (so whatever is in iterate_filter isn’t considered), and for an iteration userdb as described in the documentation, the latter would be empty. Alas, I ended up getting the rather confusing error * auth: Fatal: auth-cache: dc=rev-crew,dc=info: Cache key must contain at least one variable With dc=rev-crew,dc=info being my ldap_base setting for the iteration userdb. I’m not critically dependent on the user iteration, so I’ve commented the userdb out for now, but this would need fixing. Regards, Christian Pfeiffer Hello everyone, Due to the fix for CVE-2025-30189, routines like userdb_ldap_preinit() call auth_cache_parse_key_and_fields() unconditionally, with the eventually called auth_cache_parse_key_exclude() erroring if a cache key could not be constructed. It's also noteworthy that this call happens regardless of whether use_cache is set or not, and as of such failing to construct a cache key would cause an error even if use_cache = no was set for that database. This is however an issue for user iteration with LDAP, as documented here [1]LDAP | Dovecot CE. Such a userdb only has iterate_filter fields that would inherently not be containing any user variables. The call to auth_cache_parse_key_and_fields() uses a combination of ldap_base and userdb_ldap_filter anyway (so whatever is in iterate_filter isn't considered), and for an iteration userdb as described in the documentation, the latter would be empty. Alas, I ended up getting the rather confusing error o auth: Fatal: auth-cache: dc=rev-crew,dc=info: Cache key must contain at least one variable With dc=rev-crew,dc=info being my ldap_base setting for the iteration userdb. I'm not critically dependent on the user iteration, so I've commented the userdb out for now, but this would need fixing. Regards, Christian Pfeiffer References Visible links 1. https://doc.dovecot.org/2.4.2/core/config/auth/databases/ldap.html#user-ite…

4 5

Search for missing To: header?
by Joseph Tam 20 Feb '26

20 Feb '26

Is there a proper way to torture doveadm search query to look for messages with a missing "To:" header? I played around with it and this seems to work: doveadm fetch -A text mailbox {box} NOT TO '' (Looking through a large spam corups: spam often exclude recipients in the headers as it gives the game away their personalized fraud was blasted to hundreds of addresses.) Joseph Tam <jtam.home(a)gmail.com>

1 0

More Dovecot 2.4 woes: LDAP cache bug and virtual autosubscribe
by sev monster 19 Feb '26

19 Feb '26

8 months ago I messaged this list communicating some of the issues I had with 2.4. Before I could even start testing 2.4 properly, 2 bugs had to be fixed—one that caused crashes on startup (https://gitlab.alpinelinux.org/alpine/aports/-/issues/17050) and one that caused passdb to use the same caching key for all connections and as such always have the same user log in. There was another bug, one that prevented me from using LDAP binds for passdb, but it had a workaround that mostly worked without side-eeffects. All of those have since been fixed, hurray! So in my infinite naïveté, I decided to give 2.4 another shake. And it, again, does not work. Surprise! I did manage to massage the configuration to allow me to at least run 2.4 without crashing and with users able to access (most of) their mailboxes, but there are still blockers to full functionality. I face the following issues: 1. Christian Pfeiffer back in November found a bug where auth caching with LDAP did not work, and due to how it's implemented, even turning caching off would still raise an error. I experienced the same issue for both userdb iteration and passdb bind logins. I had to comment out the userdb and use a static one instead (all my users, currently, use the same UID and easily composable path, so this wasn't a big deal) and start using a service account for LDAP binds. 2. Virtual mailbox autosubscribe does not work anymore. It throws an error about trying to create the virtual mailbox. This worked in 2.3. My virtual mailbox config: namespace virtual { type = private prefix = Search Folders. mail_driver = virtual mail_path = /etc/dovecot/virtual mail_index_path = ~/dovecot-virtual.cache mail_control_path = ~/dovecot-virtual.cache mail_volatile_path = ~/dovecot-virtual.cache hidden = yes list = children subscriptions = no mailbox All { auto = subscribe special_use = \All comment = All messages, excluding Junk and Trash } mailbox Unread { auto = subscribe special_use = \Important comment = All unread messages, excluding Junk and Trash } mailbox Flagged { auto = subscribe special_use = \Flagged comment = All flagged messages } } If there is something wrong with this config that might be responsible for my issue, please let me know. Otherwise, I believe this is a regression. I understand autosubscribe is documented to (and in other situations with non-virtual boxes) create mailboxes if missing, so if this is actually a fix to make the feature work as documented, we need a new option that allows for autosubscription without attempting to create the mailbox. Otherwise, my users will not know they even have these mailboxes—no one anymore knows or cares about mailbox (re: folder) subscription and won't know where to look to get them to show up in their client. With autosubscribe enabled, I can see the mailboxes in my mail client without explicitly subscribing, but attempting to open them will throw a server error. Removing the setting will make the mailbox disappear without going into settings and explicitly subscribing. Any ETA on the first bug being fixed, and any help with the second issue (bug or not) would be greatly appreciated. Best regards. P.S.: I wanted to spread this information that wasn't mentioned at all in the documentation. The shadow passdb was removed in the move to 2.4; why exactly is neither here nor there, though I will remark that I still don't know why it was done. I had believed at the time this necessitated enabling PAM for Dovecot, which it is not by default in my distro's package (Alpine), so if I wanted to continue allowing local users to log in, I would have to build Dovecot it myself and install PAM, neither of which I particularly wanted to do. I did play with passwd-file in the past, but there were issues with it that prevented me from using it—I don't remember what they were exactly, but I believe they have since been fixed, since in my testing now it does seem to work properly in the use-cases I tested. Anyway, while going over my config and getting ready to re-install PAM, I had a thought. /etc/shadow uses the same format for the first two fields as /etc/password, and Dovecot still (supposedly) allows for passwords to be used when reading /etc/password, so wouldn't it be possible to point the driver at the shadow file? Turns out, yes, it works! I am now able to authenticate local users from /etc/shadow again. Thanks to this, I no longer need to build with PAM support and don't need to install PAM on a PAM-less system. I hope this isn't considered a bug or something and support for this use-case is removed, because I really don't want to bother once again with adding PAM when I don't have to. :)

2 2

Fedora 43 and Dovecot version 2.4.2
by Bill Steinberg 19 Feb '26

19 Feb '26

Hello, I am running Fedora 43 on a server which is running a dovecot server, version 2.4.1-8. I am not running a cluster, there is only one dovecot server running on the Fedora 43 instance. Redhat has just updated the dovecot version on Fedora 43 to version 2.4.2-5. I would like to upgrade dovecot to version 2.4.2. I assume that the dovecot_config_version should be changed to 2.4.2. Should the dovecot_storage_version be changed to 2.4.2 as well? Are there any steps that should be taken to upgrade the dovecot storage to version 2.4.2? FYI the mail_driver on the dovecot server is mbox: mail_driver = mbox. Best regards, -Bill Hello, I am running Fedora 43 on a server which is running a dovecot server, version 2.4.1-8. I am not running a cluster, there is only one dovecot server running on the Fedora 43 instance. Redhat has just updated the dovecot version on Fedora 43 to version 2.4.2-5. I would like to upgrade dovecot to version 2.4.2. I assume that the dovecot_config_version should be changed to 2.4.2. Should the dovecot_storage_version be changed to 2.4.2 as well? Are there any steps that should be taken to upgrade the dovecot storage to version 2.4.2? FYI the mail_driver on the dovecot server is mbox: mail_driver = mbox. Best regards, -Bill

2 1

deliver fails because of a permission issue with SSL private key file
by Markus Schönhaber 19 Feb '26

19 Feb '26

Hi, I'm trying to make Postfix hand incoming mail to Dovecot by using Dovecot's deliver. But this fails with a permission error: > Feb 17 15:50:12 debian13-cont postfix/pipe[13133]: 171C17206: to=<recipient(a)dest.examle.org>, relay=dovecot, delay=0.17, delays=0.1/0/0/0.07, dsn=5.3.0, status=bounced (Command died with status 89: "/usr/lib/dovecot/deliver". Command output: doveconf: Fatal: Error in configuration file /etc/dovecot/certs.conf line 3: key_file: open(/etc/ssl/private/ssl-cert-snakeoil.key) failed: Permission denied ) How can I solve this (short of making the private key file world readable, of course)? Regards mks I have this in Postfix' master.cf: > dovecot unix - n n - - pipe > flags=DROhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -e -f ${sender} -a ${recipient} -d ${user}@${domain} # LANG=C id vmail uid=501(vmail) gid=501(vmail) groups=501(vmail),104(ssl-cert) # LANG=C ls -l /etc/ssl/private/ total 4 -rw-r----- 1 root ssl-cert 1704 Feb 4 17:15 ssl-cert-snakeoil.key # doveconf -n # 2.4.2-2+debian13 (0962ed2104): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.2-2+debian13 (767418c3) # OS: Linux 6.19.0-2-MANJARO x86_64 Debian 13.3 btrfs # Hostname: debian13-cont dovecot_config_version = 2.4.2 dovecot_storage_version = 2.4.2 log_debug = category=sql mail_driver = sdbox mail_gid = vmail mail_home = /var/spool/vmail/home/%{user | domain}/%{user | username} mail_path = /var/spool/vmail/mail/%{user | domain}/%{user | username} mail_plugins { quota = yes } mail_uid = vmail protocols = imap lmtp sieve sql_driver = mysql mysql localhost { dbname = postfixadmin password = # hidden, use -P to show it user = postfixadmin } passdb sql { query = SELECT 'vmail' AS userdb_uid, 'vmail' AS userdb_gid, CONCAT('/var/spool/vmail/home/', maildir) AS userdb_home, CONCAT(quota, 'B') AS userdb_quota_storage_size, username AS user, password FROM mailbox WHERE username = '%{user}' AND active = '1'; } userdb prefetch { } userdb sql { iterate_query = SELECT username AS user FROM mailbox WHERE active = '1'; query = SELECT 'vmail' AS uid, 'vmail' AS gid, CONCAT('/var/spool/vmail/home/', maildir) AS home, CONCAT(quota, 'B') AS quota_storage_size, username AS user, password FROM mailbox WHERE username = '%{user}' AND active = '1'; } namespace inbox { inbox = yes separator = / mailbox Drafts { special_use = "\\Drafts" } mailbox Entwürfe { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox "Gelöschte Objekte" { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Gesendete Objekte" { special_use = "\\Sent" } } service auth { inet_listener tcp_auth { port = 12345 } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service auth-worker { } ssl_server { cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem key_file = /etc/ssl/private/ssl-cert-snakeoil.key } protocol imap { mail_plugins { imap_quota = yes } } quota "User quota" { } dict_server { dict mysql { driver = sql sql_driver = mysql dict_map priv/quota/messages { sql_table = quota username_field = username dict_map_value_field messages { } } dict_map priv/quota/storage { sql_table = quota username_field = username dict_map_value_field bytes { } } } } quota_clone { dict proxy { name = mysql } }

6 14

dovecot 2.4 changes
by Curtis J Blank 18 Feb '26

18 Feb '26

I just did a Tumbleweed upgrade. then I had to fix dovecot. No warning that dovecot was going to break what so ever. Below is all the things I had to fix. And then I could not read my email in Thunderbird because you changed: mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u to mail_driver = mbox mail_path = ~/mail mail_inbox_path = /var/spool/mail/%{user} and the "%u" to "%{user}" was the showstopper. What a crock of BS! I spent 3 hours determining the problem and then fixing dovecot because you decided to make major changes for no good reason. It worked just fine the way it was. You could have automated the changes by providing a utility that would make the changes the first time it started up after the upgrade. I had to try to start dovecot and when it failed to start look in the log and see the error and fix it. Over and over and over and over and over and over and over and... Like I said what a bunch of BS! Yes this is a rant. And maybe openSuSE's is too blame also. Jan 24 03:33:35 server dovecot[2223449]: doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 25: The first setting must be dovecot_config_version Jan 24 03:36:45 server dovecot[4626]: doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 25: The first setting must be dovecot_config_version Jan 24 03:46:10 server dovecot[21464]: doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 2: Invalid dovecot_config_version: Currently supported versions are: 2.4.0 2.4.1 2.4.2 Jan 24 03:48:45 server dovecot[22135]: doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 92: dict { } is missing section name Jan 24 03:51:47 server dovecot[28824]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/auth-system.conf.ext line 10: passdb { } is missing section name Jan 24 03:53:22 server dovecot[29258]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/auth-system.conf.ext line 10: passdb { } is missing section name Jan 24 03:55:26 server dovecot[29906]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/auth-system.conf.ext line 49: userdb { } is missing section name Jan 24 03:56:57 server dovecot[30179]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-director.conf line 40: inet_listener { } is missing section name Jan 24 03:58:37 server dovecot[30652]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-logging.conf line 64: Unknown section name: plugin Jan 24 04:01:32 server dovecot[37805]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-mail.conf line 31: mail_location: Unknown setting: mail_location Jan 24 04:05:30 server dovecot[38898]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-mail.conf line 32: mail_location: Unknown setting: mail_location Jan 24 04:06:35 server dovecot[39158]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 23: ssl_cert: Unknown setting: ssl_cert Jan 24 04:09:07 server dovecot[39707]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 25: ssl_server_cert_file: open(/etc/dovecot/conf.d/-----BEGIN CERTIFICATE----- Jan 24 04:09:07 server dovecot[39707]: doveconf: Fatal: -----END CERTIFICATE----- Jan 24 04:09:07 server dovecot[39707]: doveconf: Fatal: ) failed: File name too long Jan 24 04:14:52 server dovecot[47156]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 27: ssl_server_cert_file: open(/etc/dovecot/conf.d/-----BEGIN CERTIFICATE----- Jan 24 04:14:52 server dovecot[47156]: doveconf: Fatal: -----END CERTIFICATE----- Jan 24 04:14:52 server dovecot[47156]: doveconf: Fatal: ) failed: File name too long Jan 24 04:17:35 server dovecot[54187]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 72: ssl_dh: Unknown setting: ssl_dh Jan 24 04:19:04 server dovecot[54532]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 93: ssl_prefer_server_ciphers: Unknown setting: ssl_prefer_server_ciphers Jan 24 04:21:07 server dovecot[60961]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-acl.conf line 11: Unknown section name: plugin Jan 24 04:22:40 server dovecot[61409]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-acl.conf line 17: Unknown section name: plugin Jan 24 04:23:35 server dovecot[61624]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-plugin.conf line 9: Unknown section name: plugin Jan 24 04:24:40 server dovecot[61932]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-quota.conf line 17: Unknown section name: plugin Jan 24 04:25:38 server dovecot[62301]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-quota.conf line 41: Unknown section name: plugin Jan 24 04:26:12 server dovecot[62335]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-quota.conf line 69: Unknown section name: plugin Jan 24 04:26:42 server dovecot[62550]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-quota.conf line 78: Unknown section name: plugin Jan 24 04:27:05 server dovecot[62582]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-sieve-extprograms.conf line 9: Unknown section name: plugin Jan 24 04:28:11 server dovecot[62819]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-sieve.conf line 24: Unknown section name: plugin Jan 24 04:29:02 server dovecot[63099]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-sieve.conf line 39: sieve: Unknown setting: sieve Jan 24 04:36:01 server dovecot[71295]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-sieve.conf line 39: sieve: Unknown setting: sieve Jan 24 04:39:04 server dovecot[72067]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-sieve.conf line 40: sieve: Unknown setting: sieve (sieve_script_sieve or sieve_script_personal_sieve not found either.) Jan 24 04:47:39 server dovecot[86665]: doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf: ssl_options: unknown flag: 'no_compression' Jan 24 04:50:51 server dovecot[93375]: doveconf: Fatal: dovecot_storage_version setting must be set Jan 24 05:01:51 server dovecot[105836]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-mail.conf line 31: mail_location: Unknown setting: mail_location Jan 24 05:06:18 cjbnew dovecot: imap(bob)<107288><SOtYQyBJTOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:06:18 cjbnew dovecot: imap(bob)<107288><SOtYQyBJTOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:06:18 cjbnew dovecot: imap(bob)<107289><9+pYQyBJTeXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:06:18 cjbnew dovecot: imap(bob)<10Jan 24 05:06:18 cjbnew dovecot: imap(bob)<107288><SOtYQyBJTOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:06:18 cjbnew dovecot: imap(bob)<107288><SOtYQyBJTOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:06:18 cjbnew dovecot: imap(bob)<107289><9+pYQyBJTeXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:06:18 cjbnew dovecot: imap(bob)<107289><9+pYQyBJTeXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=07557289><9+pYQyBJTeXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:08:38 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:08:38 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:11:10 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:11:10 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:0 mode=0755) Jan 24 05:15:09 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:473 mode=0755) Jan 24 05:15:09 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, dir owned by 0:473 mode=0755) Jan 24 05:18:35 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, we're not in group 473(mail), dir owned by 0:473 mode=0775) Jan 24 05:18:35 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, we're not in group 473(mail), dir owned by 0:473 mode=0775) Jan 24 05:19:09 cjbnew dovecot: imap(bob)<122933></apLcSBJaKrAqBTq>: Disconnected: Connection closed (SELECT finished 0.138 secs ago) in=102 out=787 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Jan 24 05:19:58 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, we're not in group 473(mail), dir owned by 0:473 mode=0775) Jan 24 05:19:58 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, we're not in group 473(mail), dir owned by 0:473 mode=0775) Jan 24 05:20:20 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, we're not in group 473(mail), dir owned by 0:473 mode=0775) Jan 24 05:20:20 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, we're not in group 473(mail), dir owned by 0:473 mode=0775) Jan 24 05:21:17 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, we're not in group 473(mail), dir owned by 0:473 mode=0775) Jan 24 05:21:17 cjbnew dovecot: imap(bob)<107806><1/QbSyBJUOXAqBTz>: Error: Mailbox INBOX: Failed to autocreate mailbox: open(/var/spool/mail/%u) failed: Permission denied (euid=500(bob) egid=100(users) missing +w perm: /var/spool/mail, we're not in group 473(mail), dir owned by 0:473 mode=0775)

12 19

"Synchronization corrupted index header" with mdbox: thousands of deleted e-mails reappeared in INBOX
by Ákos Szőts 17 Feb '26

17 Feb '26

Hi everyone, Suddenly, the following messages appeared in my Dovecot error log: master: Warning: Killed with signal 15 (by pid=0 uid=0 code=kill) Error: Mailbox Trash: Synchronization corrupted index header [...]/Trash/dbox-Mails/dovecot.index: uidvalidity=0, but next_uid=73 Warning: Mailbox Trash: fscking index file [...]/Trash/dbox-Mails/dovecot.index Warning: mdbox([...]/mail/storage): rebuilding indexes: Mailbox Trash index was fsck'd Warning: mdbox([...]/mail/storage): fscking index file [...]/index/inbox/storage/dovecot.map.index Error: Mailbox INBOX: [...]/INBOX/dbox-Mails/dovecot.index reset, view is now inconsistent The first message is because I restarted the container. Since then, Thunderbird shows thousands of previously deleted e-mails again in INBOX where all my messages are marked as unread. - Do you know what can cause it and how can I avoid to happen again? - Is the used mdbox storage engine that fragile? Is the fault tolerance of other engines better? I have a backup from some days ago. Is it possible to somehow revert back to it and sync the new e-mails on top of those? Version: 2.4.2. Thank you, Ákos

2 1

Most relevant documents for 2.4.x config file syntax
by Steve Litt 16 Feb '26

16 Feb '26

Hi all, Some time has gone by, so I'm hoping there's some good documentation for somebody needing syntax help on building a 2.4.x Dovecot. I've seen https://doc.dovecot.org/2.4.0/installation/upgrade/2.3-to-2.4.html , but it's not useful to me because I don't know *where* all those various pieces go. Which things go in what curly braces? It doesn't say. https://doc.dovecot.org/2.4.2/core/config/quick.html looks like an excellent starting place. Do you agree? What other *simple* documentation do you recommend? Because I am not and never was a Dovecot expert, I'll need something that does a considerable amount of teaching: A sort of Dovecot 4.2 For Dummies type thing. Thanks, SteveT Steve Litt http://444domains.com

3 4

Configuration upgrade tool
by Aki Tuomi 15 Feb '26

15 Feb '26

Hi! To make migrating from Dovecot 2.3 to 2.4 a bit easier, we are now providing a tool that helps upgrade your existing configuration. The tool allows you to upload either a full dovecot.conf or selected ancillary configuration files from a 2.3 setup, and will attempt to convert them accordingly. You can find the tool here: https://dovecot.org/upgrader/ We do not store any of the configurations processed by the tool, nor do we track who uses it. It's offered as-is, without any warranty or guarantee. If you run into any issues, unexpected results, or have feedback about the tool, please let us know — it’s very much appreciated. Please note that the tool can make mistakes, so we strongly recommend carefully reviewing and testing the output before using it in production. There are currently no plans to release this tool as open source. Regards, Aki Tuomi Open-Xchange oy

11 18