- dovecot - dovecot.org

Confusion about ACL Files in Shared Mailboxes
by fc26wuqa＠studserv.uni-leipzig.de 07 Oct '25

07 Oct '25

Hello, I have a shared mailbox which I want to set ACL permissions to. I already tried "doveadm acl set -u shared-user Shared/shared_mailbox group=somegroup lookup read write write-seen write-deleted insert post delete expunge create" My shared namespace is configured like this: "type = shared, prefix = Shared/%%u" I get "Error: Can't update acl object '': No local acl file path", "Error: Mailbox Shared/shared_mailbox: Failed to set ACL". When I do "* group=some_group kxeilprwts" in dovecot-acl in the shared Mailbox, all users in group some_group lose all access to their folders (shared and not shared) except INBOX. What am I doing wrong?

2 1

recipient_delimiter issue
by Benoit Panizzon 06 Oct '25

06 Oct '25

Hi Gang We use Postfix and Dovecot. To allow customers to use sub addressing we have configured postfix and dovecot with recipient_delimiter = + This allows email addresses of the form john+doe(a)example.com The way postfix processes the recipient_delimiter is by first looking up 'john+doe' and if this is not found, try again with 'john'. This allow both to work, email accounts which contain the + sign as part of the address and sub addressing. Collisions may happen! I am aware of this! The full email address with + wins. I recall dovecot also performed the same lookup in an earlier version but I might be wrong as now after some colleagues re-configured our email platform to use authentication caching and the dovecot proxy functionality, this does not work anymore. Dovecot takes + as hard delimiter and only performs a lookup for 'john' thus returns the account 'john' does not exist. Is there a way to configure dovecot to handle recipient_delimiter the same way postfix does by trying the full username first and only if that fails retry with the part in front of the delimiter? Mit freundlichen Grüssen -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

1 0

Lots of problems with Dovecot 2.4
by sev+dovecot＠sev.monster 06 Oct '25

06 Oct '25

Hello all, I am trying to get Dovecot 2.4 running on Alpine Edge x86-64. But a myriad of problems have occurred that make it impossible to do so. First of all was the recent off-by-one bug that was recently fixed, which caused an unavoidable segfault on start under musl libc, which Alpine uses: https://gitlab.alpinelinux.org/alpine/aports/-/issues/17050 Then, I saw that the shadow driver was removed, which necessitated the installation of PAM and my learning about it... I haven't needed it before, so I'd never used it. I guess I understand why the decision was made to use PAM, though I still don't like it. After resolving those issue, I've run into new ones: 1. The passwd userdb does not seem to work correctly. It is able to get the first user and its information correctly, but any attempts to look up any user after that will seemingly always use the information from the first matched user. Setting max auths to 1 so that the auth process is discarded afterwards does not seem to help. For example, if the first user to log in to Dovecot is bob, and then user joe logs in, the information returned from the passwd userdb will all be that of user bob, not joe. This continues for all subsequent userdb lookups until Dovecot is restarted, and a new userdb lookup is persisted. Changing to passwd-file instead works and does not experience this problem. 2. Why is the only available username field for the passwd driver %{passwd:system_groups_user}? I understand what the purpose of the field is based on the docs, but shouldn't more than this be exposed? The fields available through passwd are also not documented, and I had to read the source to find them out. This should either be documented or a more standard username field be additionally exposed as with other drivers. Can this field even be relied on to use as the username, if the driver otherwise worked? 3. It seems the Exim auth driver is no longer able to successfully authenticate with Dovecot 2.4 against Exim 4.98.2. It works fine in the last version of 2.3.21.1. Has the authentication framework changed along with the other modifications that 2.4 underwent? Has any effort been made with the Exim team to resolve any incompatibilities? Can I somehow diagnose this issue if it's otherwise supposed to work? 4. The ldap driver can no longer look up missing fields from LDAP users. Some (but not all) of my users have the rfc2307bis schema posixAccount supplemental objectClass, and as such contain the posixHome, uidNumber, and gidNumber attributes—but even if I specify a default value, if one of the attributes is not queryable for the returned user, the lookup errors out and the login fails. This is a regression/undocumented change from 2.3.x, where instead of erroring out, the default_fields value would be used. Based on my interpretation of the design goals for 2.4, I would imagine the default filter would ignore the missing attribute error and set the default value like default_fields used to, no? Or am I missing something? 5. passdb_ldap_filter is always required for the ldap passdb driver, even if passdb_ldap_bind is enabled. Not only does this go against the docs, but the value is unused and it doesn't matter what it's set to. This is a regression from 2.3.x. Overall I am very unimpressed by 2.4. It clearly needed a lot more time in the oven and much more thorough testing. Relevant minimal config from my working 2.3.21.1 install: auth_username_format = %Ln auth_mechanisms = plain login passdb { driver = shadow } userdb { driver = passwd override_fields = gid=mail home=/var/mail/%Ln } passdb { driver = ldap args = /etc/dovecot/ldap-passdb.conf.ext #uris = ldapi://%2frun%2fopenldap%2fslapd.sock #base = ou=accounts,dc=ldap #auth_bind = yes #auth_bind_userdn = uid=%Ln,ou=accounts,dc=ldap } userdb { driver = ldap default_fields = uid=mail gid=mail home=/var/mail/%Ln args = /etc/dovecot/ldap-userdb.conf.ext #uris = ldapi://%2frun%2fopenldap%2fslapd.sock #dn = cn=dovecot,dc=ldap #dnpass = "some pw" #base = ou=accounts,dc=ldap #iterate_filter = (objectClass=inetOrgPerson) #iterate_attrs = uid=username #user_filter = (&(objectClass=inetOrgPerson)(uid=%Ln)) #user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid } mail_location = maildir:/var/mail/%Ln mail_plugins = $mail_plugins virtual namespace inbox { inbox = yes mailbox INBOX { auto = subscribe } } namespace virtual { type = private separator = . prefix = "Search Folders." location = virtual:/etc/dovecot/virtual:INDEX=~/dovecot-virtual.cache:CONTROL=~/dovecot-virtual.cache:VOLATILEDIR=~/dovecot-virtual.cache # virtual/All/dovecot-virtual: #!INBOX #* #-Junk #-Junk* #-Spam #-Spam* #-Trash #-Trash* #-Deleted #-Deleted* #-Deleted Items #-Deleted Items* # all hidden = yes list = children subscriptions = no mailbox All { auto = subscribe special_use = \All comment = All messages, excluding Junk and Trash } } namespace virtual-user { type = private separator = . prefix = "User Search Folders." location = virtual:~/.virtual:INDEX=~/dovecot-virtual-user.cache:CONTROL=~/dovecot-virtual-user.cache:VOLATILEDIR=~/dovecot-virtual-user.cache:LAYOUT=maildir++ hidden = yes list = children subscriptions = no } service auth { unix_listener auth-userdb { # restrict userdb to dovecot user/group only instead of world read/write mode = 0660 user = $default_internal_user group = $default_internal_group } unix_listener auth-client { # give Exim access to native authentication mode = 0660 group = exim } } service auth-worker { # no need to run as root user = $default_internal_user # allow pam passdb to read /etc/shadow group = shadow } !include_try /usr/share/dovecot/protocols.d/*.conf protocol imap { mail_max_userip_connections = 25 } protocol pop3 { mail_max_userip_connections = 25 } Converted config for 2.4: dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 mail_home = /var/mail/%{user | username | lower } mail_driver = maildir mail_path = $SET:mail_home mail_plugins = virtual auth_username_format = %{user | username | lower } auth_mechanisms = plain login passdb pam { failure_show_msg = yes max_requests = 1 } userdb passwd-file { passwd_file_path = /etc/passwd fields { gid = mail } } # BUG: doesn't work right #userdb passwd { # fields { # gid = mail # } #} passdb ldap { ldap_uris = ldapi://%2frun%2fopenldap%2fslapd.sock ldap_connection_group = login ldap_base = ou=accounts,dc=ldap ldap_bind = yes ldap_bind_userdn = uid=%{user | username | lower },ou=accounts,dc=ldap # XXX: thought this wasnt needed with bind? ldap_filter = z } userdb ldap { ldap_uris = ldapi://%2frun%2fopenldap%2fslapd.sock ldap_auth_dn = cn=dovecot,dc=ldap ldap_auth_dn_password = "some pw" ldap_base = ou=accounts,dc=ldap ldap_filter = (&(objectClass=inetOrgPerson)(uid=%{user | username | lower })) fields { username = %{ldap:uid} # BUG: causes errors if rfc2307bis posixAccount objectClass is not set home = %{ldap:homeDirectory | default($SET:mail_home)} uid = %{ldap:uidNumber | default(mail)} gid = %{ldap:gidNumber | default(mail)} } ldap_iterate_filter = (objectClass=inetOrgPerson) iterate_fields { username = %{ldap:uid} } } namespace inbox { inbox = yes mailbox INBOX { auto = subscribe } } namespace virtual { type = private separator = . prefix = "Search Folders." mail_driver = virtual mail_path = /etc/dovecot/virtual # virtual/All/dovecot-virtual: #!INBOX #* #-Junk #-Junk* #-Spam #-Spam* #-Trash #-Trash* #-Deleted #-Deleted* #-Deleted Items #-Deleted Items* # all mail_index_path = ~/dovecot-virtual.cache mail_control_path = ~/dovecot-virtual.cache mail_volatile_path = ~/dovecot-virtual.cache hidden = yes list = children subscriptions = no mailbox All { auto = subscribe special_use = \All comment = All messages, excluding Junk and Trash } } namespace virtual-user { type = private separator = . prefix = "User Search Folders." mail_driver = virtual mail_path = ~/dovecot-virtual-user mail_index_path = ~/dovecot-virtual-user.cache mail_control_path = ~/dovecot-virtual-user.cache mail_volatile_path = ~/dovecot-virtual-user.cache mailbox_list_layout = Maildir++ hidden = yes list = children subscriptions = no } service auth { unix_listener auth-userdb { # restrict userdb to dovecot user/group only instead of world read/write mode = 0660 } unix_listener auth-client { # give Exim access to native authentication mode = 0660 group = exim } } service auth-worker { # no need to run as root user = $SET:default_internal_user # allow pam passdb to read /etc/shadow group = shadow } protocols = imap pop3 protocol imap { mail_max_userip_connections = 25 } protocol pop3 { mail_max_userip_connections = 25 } In addition to help with the noted issues, I'd also love if anyone more knowledgeable on Dovecot 2.4 could give any pointers on my config and if I could improve the translation in any way, given I have been fumbling around with it for weeks and am not really sure if my various decisions are correct. Best regards.

9 11

A question about Debian
by Jean-Paul POZZI 06 Oct '25

06 Oct '25

Hello, I want to install Dovecot CE on a new machine fitted with a Debian Trixie and there is no Dovecot repository for Trixie. Is a Trixie-friendly version planned for the near future? Regards JPP Hello, I want to install Dovecot CE on a new machine fitted with a Debian Trixie and there is no Dovecot repository for Trixie. Is a Trixie-friendly version planned for the near future? Regards JPP

7 8

Message duplication in Sent folder after upgrade
by Oliver Welter 04 Oct '25

04 Oct '25

Hi All, I have migrated my mailserver (from dovecot 2.2 on debian 10 to dovecot 2.3 provided by the mailcow-dockerized project) by coping over the mailstorage directory "as is". There is now a single mailbox where I have an issue with duplicated mails - the "Sent" folder had approx 400 mails upon migration, it now has 4500 mails with each mail duplicated several times. Below are the header lines of one message, besides the Message-Id the header is exactly the same on all copies. I tried "doveadm force-resync" on the mailbox and the mailbox was removed and recreated from scratch on the mail app but we still get additional copies added - anybody has an idea what is going on here and how to fix this? Oliver From: "presse(a)example.com" <presse(a)example.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_451F3D0B-155E-46EF-9BFB-B8034A7E2AE1" Mime-Version: 1.0 (Mac OS X Mail 16.0 $3826.300.87.4.3$) Subject: Re: EXTERN: Re: Example Mail X-Universally-Unique-Identifier: 6CD82CDA-138B-412E-8D4D-74C8C82B72ED Date: Mon, 13 Jan 2025 11:17:09 +0100 References: <DB3PR05MB100724231A87B9AE130C0EE0C853A2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <DB3PR05MB100725A1F1367C304AC417A9585002(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <DB3PR05MB1007220945CC70CDACDDBA5D685022(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <DB3PR05MB100724A5040FA029A29E625D1850D2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <09B63703-8BC4-484F-905A-899BA9A72139(a)example.com> <DB3PR05MB10072F836F9FCE2F9F626392D85142(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <BA8A1660-FC7D-4478-9F5F-E8B062B39115(a)example.com> <005d01db659c$cf2a48c0$6d7eda40$@John.Doe@t-online.de> To: John Doe <John.Doe(a)t-online.de> In-Reply-To: <005d01db659c$cf2a48c0$6d7eda40$@Jon.Doe@t-online.de> Message-Id: <A03E3B7A-638A-4482-83D8-C5B297D9953E(a)example.com> -- Protect your environment - close windows and adopt a penguin! Hi All, I have migrated my mailserver (from dovecot 2.2 on debian 10 to dovecot 2.3 provided by the mailcow-dockerized project) by coping over the mailstorage directory "as is". There is now a single mailbox where I have an issue with duplicated mails - the "Sent" folder had approx 400 mails upon migration, it now has 4500 mails with each mail duplicated several times. Below are the header lines of one message, besides the Message-Id the header is exactly the same on all copies. I tried "doveadm force-resync" on the mailbox and the mailbox was removed and recreated from scratch on the mail app but we still get additional copies added - anybody has an idea what is going on here and how to fix this? Oliver From: [1]"presse(a)example.com" [2]<presse(a)example.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_451F3D0B-155E-46EF-9BFB-B8034A7E2AE1" Mime-Version: 1.0 (Mac OS X Mail 16.0 $3826.300.87.4.3$) Subject: Re: EXTERN: Re: Example Mail X-Universally-Unique-Identifier: 6CD82CDA-138B-412E-8D4D-74C8C82B72ED Date: Mon, 13 Jan 2025 11:17:09 +0100 References: [3]<DB3PR05MB100724231A87B9AE130C0EE0C853A2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [4]<DB3PR05MB100725A1F1367C304AC417A9585002(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [5]<DB3PR05MB1007220945CC70CDACDDBA5D685022(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [6]<DB3PR05MB100724A5040FA029A29E625D1850D2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [7]<09B63703-8BC4-484F-905A-899BA9A72139(a)example.com> [8]<DB3PR05MB10072F836F9FCE2F9F626392D85142(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [9]<BA8A1660-FC7D-4478-9F5F-E8B062B39115(a)example.com> [10]<005d01db659c$cf2a48c0$6d7eda40$@John.Doe@t-online.de> To: John Doe [11]<John.Doe(a)t-online.de> In-Reply-To: [12]<005d01db659c$cf2a48c0$6d7eda40$@Jon.Doe@t-online.de> Message-Id: [13]<A03E3B7A-638A-4482-83D8-C5B297D9953E(a)example.com> -- Protect your environment - close windows and adopt a penguin! References Visible links 1. mailto:presse@example.com 2. mailto:presse@example.com 3. mailto:DB3PR05MB100724231A87B9AE130C0EE0C853A2@db3pr05mb10072.eurprd05.prod.outlook.com 4. mailto:DB3PR05MB100725A1F1367C304AC417A9585002@db3pr05mb10072.eurprd05.prod.outlook.com 5. mailto:DB3PR05MB1007220945CC70CDACDDBA5D685022@db3pr05mb10072.eurprd05.prod.outlook.com 6. mailto:DB3PR05MB100724A5040FA029A29E625D1850D2@db3pr05mb10072.eurprd05.prod.outlook.com 7. mailto:09B63703-8BC4-484F-905A-899BA9A72139@example.com 8. mailto:DB3PR05MB10072F836F9FCE2F9F626392D85142@db3pr05mb10072.eurprd05.prod.outlook.com 9. mailto:BA8A1660-FC7D-4478-9F5F-E8B062B39115@example.com 10. mailto:005d01db659c$cf2a48c0$6d7eda40$@John.Doe@t-online.de 11. mailto:John.Doe@t-online.de 12. mailto:005d01db659c$cf2a48c0$6d7eda40$@Jon.Doe@t-online.de 13. mailto:A03E3B7A-638A-4482-83D8-C5B297D9953E@example.com

3 4

doveadm sync across versions
by Joel Mawhorter 04 Oct '25

04 Oct '25

Greetings, How close in versions do dovecot installations need to be in order to use doveadm sync? Exact same version? Same major version? thanks, Joel

3 3

help debugging a dsync panic
by Joel Mawhorter 04 Oct '25

04 Oct '25

Hello all, I'm trying to use deoveadm to sync from a dovecot server running version 2.3.21.1 to a version running 2.4.1. On the side initiating the "doveadm sync", I get the following error: dsync-remote(joel(a)zzzzz.org)<NRNIIBS132iEKgAAoT89Zw>: Panic: file dsync-mailbox-import.c: line 2188 (dsync_mailbox_import_handle_mail): assertion failed: (array_count(&wanted_uids) > 0) dsync-remote(joel(a)zzzzz.org)<NRNIIBS132iEKgAAoT89Zw>: Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 default_fatal_handler[0xffffac4800a0] -> #3 i_panic[0xffffac3a3700] -> #4 [unw_get_proc_name() failed: -10] -> #5 dsync_mailbox_import_changes_finish[0xaaaadf53e804] -> #6 dsync_brain_sync_mails[0xaaaadf53ef4c] -> #7 [unw_get_proc_name() failed: -10] -> #8 [unw_get_proc_name() failed: -10] -> #9 [unw_get_proc_name() failed: -10] -> #10 io_loop_call_io[0xffffac4a1e30] -> #11 io_loop_handler_run_internal[0xffffac4a4420] -> #12 io_loop_handler_run[0xffffac4a4650] -> #13 io_loop_run[0xffffac4a4920] -> #14 [unw_get_proc_name() failed: -10] -> #15 [unw_get_proc_name() failed: -10] -> #16 doveadm_cmd_ver2_to_mail_cmd_wrapper[0xaaaadf518e90] -> #17 doveadm_cmdline_run[0xaaaadf52e824] -> #18 doveadm_cmdline_try_run[0xaaaadf52ef40] -> #19 main[0xaaaadf5051e0] -> #20 [unw_get_proc_name() failed: -10] -> #21 __libc_start_main[0xffffac0a22e0] dsync-local(joel(a)zzzzz.org)<RbkUCxO132hp0QAAVDKehA>: Error: read(mail2.zzzzz.org) failed: EOF (last sent=mail_request (EOL), last recv=mail_change (EOL)) dsync-local(joel(a)zzzzz.org)<RbkUCxO132hp0QAAVDKehA>: Error: Remote command returned error 255: ssh zz.zz.zz.zz doveadm dsync-server -ujoel(a)zzzzz.org Neither server has errors in the log corresponding to this error. Both servers are still running after this error. I'm looking for some help in how to debug this. The above error is entire and only changed to obfuscate domain names and IP addresses. Joel

2 1

IMAPSieve filters don't run on virtual mailboxes
by Ákos Szőts 03 Oct '25

03 Oct '25

Hi everyone, In the following configuration my IMAPSieve script doesn't run on the configured "copy" action when I assign it to a virtual mailbox. However, using the very same config snippet on a regular mailbox, the script suddenly starts to work. Move direction: from virtual to virtual (INBOX/Primary to INBOX/Notification). Do you know how to assign IMAPSieve to virtual mailboxes? Virtual config: namespace virtual-classification { prefix = "INBOX/" separator = / mail_driver = virtual mail_path = /var/lib/dovecot/virtual/classification/en mail_index_path = %{home}/index/virtual/classification/en namespace_subscriptions = no mailbox Notification { auto = subscribe sieve_script classification-move1 { type = before cause = copy append path = /var/lib/dovecot/sieve/imapsieve.d/classification-move.sieve } } mailbox Primary { [...] } } Sieve script: require ["vnd.dovecot.debug"]; debug_log "IMAPSIEVE SCRIPT WAS CALLED!"; Virtual file: virtual/classification/en/Notification/dovecot-virtual: !INBOX KEYWORD classification-notification The same result with "!INBOX" and "INBOX". Inbox namespace (working example): namespace inbox { separator = / inbox = yes mail_path = %{home}/mail mail_index_path = %{home}/index/inbox mailbox "Archive" { special_use = \Archive auto = subscribe sieve_script classification-move1 { type = before cause = copy append path = /var/lib/dovecot/sieve/imapsieve.d/classification-move.sieve } } } In the latter case the script is called properly and I see the debug message in info.log. But in the virtual case, the script doesn't run. Debug logs of failing case: Mailbox INBOX: Mailbox opened Mailbox INBOX/Primary: Mailbox opened Mailbox INBOX: Mailbox opened Namespace inbox: Using permissions from /var/spool/mail/[...]//mail: mode=0700 gid=default Mailbox INBOX: Mailbox opened Mailbox INBOX: imapsieve: MOVE event Mailbox INBOX: UID 2147: Expunge requested Mailbox INBOX/Primary: UID 47: Expunge requested dict(file): dict created (driver=file) dict(file): Looking up 'shared/90b3ed0066c4fe670a000000b7545530/imapsieve/script' dict(file): Lookup finished for 'shared/90b3ed0066c4fe670a000000b7545530/imapsieve/script': not found Mailbox INBOX: imapsieve: Mailbox attribute /shared/imapsieve/script not found dict(file): Looking up 'shared/90b3ed0066c4fe670a000000b7545530/vendor/vendor.dovecot/pvt/server/imapsieve/script' dict(file): Lookup finished for 'shared/90b3ed0066c4fe670a000000b7545530/vendor/vendor.dovecot/pvt/server/imapsieve/script': not found Mailbox INBOX: imapsieve: Server attribute /shared/imapsieve/script not found duplicate db: Initialize sieve: Pigeonhole version 2.4.1-4 (0a86619f) initializing Loading modules from directory: /usr/lib64/dovecot/modules/sieve Module loaded: /usr/lib64/dovecot/modules/sieve/lib90_sieve_extprograms_plugin.so Module loaded: /usr/lib64/dovecot/modules/sieve/lib90_sieve_imapsieve_plugin.so sieve: Sieve Extprograms plugin for Pigeonhole version 2.4.1-4 (0a86619f) loaded sieve: Sieve imapsieve plugin for Pigeonhole version 2.4.1-4 (0a86619f) loaded fts-flatcurve: fts-flatcurve(INBOX): Expunge uid=2147 fts-flatcurve: fts-flatcurve(INBOX): Opened DB (RO) messages=136 version=1 shards=2 fts-flatcurve: fts-flatcurve(INBOX): Opened DB (RW, current.1755771145431021) messages=48 version=1 Mailbox INBOX: UID 2147: Mail expunged fts-flatcurve: fts-flatcurve(INBOX): Committed 1 changes to DB (RW, current.1755771145431021) in 0.003 secs fts-flatcurve: fts-flatcurve: Update transaction completed in 0.004 secs Mailbox INBOX/Primary: Backend mailbox INBOX changed: UIDNEXT changed: 2277 -> 2278 IMAPSieve config seems to work (based on the successful regular mailbox example), so I don't paste the whole sieve config (but in case it's necessary, I'll do it). Ákos

2 1

Message duplication in Sent folder after upgrade
by Oliver Welter 03 Oct '25

03 Oct '25

Hi All, I have migrated my mailserver (from dovecot 2.2 on debian 10 to dovecot 2.3 provided by the mailcow-dockerized project) by coping over the mailstorage directory "as is". There is now a single mailbox where I have an issue with duplicated mails - the "Sent" folder had approx 400 mails upon migration, it now has 4500 mails with each mail duplicated several times. Below are the header lines of one message, besides the Message-Id the header is exactly the same on all copies. I tried "doveadm force-resync" on the mailbox and the mailbox was removed and recreated from scratch on the mail app but we still get additional copies added - anybody has an idea what is going on here and how to fix this? Oliver From: "presse(a)example.com" <presse(a)example.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_451F3D0B-155E-46EF-9BFB-B8034A7E2AE1" Mime-Version: 1.0 (Mac OS X Mail 16.0 $3826.300.87.4.3$) Subject: Re: EXTERN: Re: Example Mail X-Universally-Unique-Identifier: 6CD82CDA-138B-412E-8D4D-74C8C82B72ED Date: Mon, 13 Jan 2025 11:17:09 +0100 References: <DB3PR05MB100724231A87B9AE130C0EE0C853A2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <DB3PR05MB100725A1F1367C304AC417A9585002(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <DB3PR05MB1007220945CC70CDACDDBA5D685022(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <DB3PR05MB100724A5040FA029A29E625D1850D2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <09B63703-8BC4-484F-905A-899BA9A72139(a)example.com> <DB3PR05MB10072F836F9FCE2F9F626392D85142(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <BA8A1660-FC7D-4478-9F5F-E8B062B39115(a)example.com> <005d01db659c$cf2a48c0$6d7eda40$@John.Doe@t-online.de> To: John Doe <John.Doe(a)t-online.de> In-Reply-To: <005d01db659c$cf2a48c0$6d7eda40$@Jon.Doe@t-online.de> Message-Id: <A03E3B7A-638A-4482-83D8-C5B297D9953E(a)example.com> -- Protect your environment - close windows and adopt a penguin! Hi All, I have migrated my mailserver (from dovecot 2.2 on debian 10 to dovecot 2.3 provided by the mailcow-dockerized project) by coping over the mailstorage directory "as is". There is now a single mailbox where I have an issue with duplicated mails - the "Sent" folder had approx 400 mails upon migration, it now has 4500 mails with each mail duplicated several times. Below are the header lines of one message, besides the Message-Id the header is exactly the same on all copies. I tried "doveadm force-resync" on the mailbox and the mailbox was removed and recreated from scratch on the mail app but we still get additional copies added - anybody has an idea what is going on here and how to fix this? Oliver From: [1]"presse(a)example.com" [2]<presse(a)example.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_451F3D0B-155E-46EF-9BFB-B8034A7E2AE1" Mime-Version: 1.0 (Mac OS X Mail 16.0 $3826.300.87.4.3$) Subject: Re: EXTERN: Re: Example Mail X-Universally-Unique-Identifier: 6CD82CDA-138B-412E-8D4D-74C8C82B72ED Date: Mon, 13 Jan 2025 11:17:09 +0100 References: [3]<DB3PR05MB100724231A87B9AE130C0EE0C853A2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [4]<DB3PR05MB100725A1F1367C304AC417A9585002(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [5]<DB3PR05MB1007220945CC70CDACDDBA5D685022(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [6]<DB3PR05MB100724A5040FA029A29E625D1850D2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [7]<09B63703-8BC4-484F-905A-899BA9A72139(a)example.com> [8]<DB3PR05MB10072F836F9FCE2F9F626392D85142(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [9]<BA8A1660-FC7D-4478-9F5F-E8B062B39115(a)example.com> [10]<005d01db659c$cf2a48c0$6d7eda40$@John.Doe@t-online.de> To: John Doe [11]<John.Doe(a)t-online.de> In-Reply-To: [12]<005d01db659c$cf2a48c0$6d7eda40$@Jon.Doe@t-online.de> Message-Id: [13]<A03E3B7A-638A-4482-83D8-C5B297D9953E(a)example.com> -- Protect your environment - close windows and adopt a penguin! References Visible links 1. mailto:presse@example.com 2. mailto:presse@example.com 3. mailto:DB3PR05MB100724231A87B9AE130C0EE0C853A2@db3pr05mb10072.eurprd05.prod.outlook.com 4. mailto:DB3PR05MB100725A1F1367C304AC417A9585002@db3pr05mb10072.eurprd05.prod.outlook.com 5. mailto:DB3PR05MB1007220945CC70CDACDDBA5D685022@db3pr05mb10072.eurprd05.prod.outlook.com 6. mailto:DB3PR05MB100724A5040FA029A29E625D1850D2@db3pr05mb10072.eurprd05.prod.outlook.com 7. mailto:09B63703-8BC4-484F-905A-899BA9A72139@example.com 8. mailto:DB3PR05MB10072F836F9FCE2F9F626392D85142@db3pr05mb10072.eurprd05.prod.outlook.com 9. mailto:BA8A1660-FC7D-4478-9F5F-E8B062B39115@example.com 10. mailto:005d01db659c$cf2a48c0$6d7eda40$@John.Doe@t-online.de 11. mailto:John.Doe@t-online.de 12. mailto:005d01db659c$cf2a48c0$6d7eda40$@Jon.Doe@t-online.de 13. mailto:A03E3B7A-638A-4482-83D8-C5B297D9953E@example.com

1 0

Dovecot 2.3.21 Fallback MOVE to COPY on read-only namespaces
by Maciej Milaszewski 02 Oct '25

02 Oct '25

Hi I’m running Dovecot 2.3.21 with additional namespaces that point to read-only maildir snapshots. The setup works fine for browsing and copying messages, but when using Roundcube Webmail 1.5.3, there is a problem with the IMAP MOVE command. - If I try to move a message from a read-only namespace, Roundcube issues UID MOVE, which fails (as expected, since MOVE = COPY + DELETE, and DELETE is impossible). - What I would need is a way for Roundcube to fallback to COPY when the source/destination namespace is read-only ? I already tested: - `imap_move = false` in Roundcube config - Overriding capabilities in Dovecot (`imap_capability`) to remove MOVE, but this does not fully work. - Using INDEX=MEMORY / CONTROL outside snapshot for namespaces. What I’m looking for: - workaround in Dovecot to hide MOVE capability only for specific namespaces. - or Roundcube plugin or patch that intercepts MOVE and replaces it with COPY for read-only namespaces.

1 0

How to share ONE mailbox with a single user in, and configure auto ACL inheritance and Thunderbird SETACL support, in Dovecot 2.4.1?
by publists＠emailgroups.net 02 Oct '25

02 Oct '25

Hi, I’m working with Dovecot 2.4.1 and the acl plugin. I'm trying to get per-mailbox shared namespace+acl configured and working dynamically. One owner (owner(a)example.com) has a real Maildir folder "TEST_SHARE" at the top level cd /mail/path/example.com/owner/Maildir ls -1 cur/ dovecot-acl-list Drafts/ Junk/ new/ Queue/ Sent/ shared/ TEST_SHARE/ <------------------------ tmp/ Trash/ The goal is to share that TEST_SHARE/ folder with exactly one other user (user(a)example.com) not globally or using the global shared/ namespace. My current config includes It looks like in acl config you can hardwire access for a specific mailbox. Reading the 2.4 docs, using acl global file is deprecated and we're supposed to use acl config. namespace inbox { inbox = yes type = private prefix = separator = / hidden = no list = yes subscriptions = yes mailbox TEST_SHARE { acl owner { rights = lrwstipekxa } acl user=user(a)example.com { rights = lrwstipekx } } } namespace shared { type=shared; prefix=shared/$domain/$username/ } mail_plugin { acl = yes } acl_driver = vfile acl_sharing_map { dict file { path = /etc/dovecot/shared.db } } With that config "user" can see and use "owner’s" TEST_SHARE folder in Thunderbird client. But if "owner" changes the tree in their view, like creates a subfolder under TEST_SHARE in TBird, it does not appear for "user". No dovecot-acl file or acl_sharing_map entry is auto-created for the new subfolder. Reading the acl docs, I think that's because these ACLs are only STATIC configs that are merged with vfile ACLs at runtime? It looks to me like there's no automatic ACL inheritance from the parent to child mailboxes. And the acl.conf ACLs don't seem to cause dovecot-acl files or the acl_sharing_map db to be created or updated. I think "IMAP SETACL" would be needed on the client side. Reading https://support.mozilla.org/en-US/kb/imap-synchronization I can't figure out if Thunderbird does that or not. Can Dovecot server-side be configured to automatically create or update those shared acls/maps? I'm looking for any guidance how to do this, either in Thunderbird or Dovecot 2.4. So that any change to TEST_SHARE by either the owner or the authorized user is immediately pushed and sync'd between both owner and user. Dave

1 0

How to use redis as authentication database on dovecot 2.4.1
by 东山 02 Oct '25

02 Oct '25

How to use redis as authentication database on dovecot 2.4.1 Sir, dovecot is great, thanks. I want to use redis as authentication database on dovecot 2.4.1, but failed. Dict key-value database (Redis, memcached, etc.) is listed on v2.3, but was removed on 2.4.1. As https://doc.dovecot.org/2.4.1/core/config/auth/databases/lua.html , I was trying to auth via lua, like -- local redis = require('redis') -- on a lua file, but dovecot reported - module redis not found. I was trying to apt install dovecot-lua lua5.3 luarocks luaredis , but not work. Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: passdb-lua: script_init() failed: lua_pcall(/etc/dovecot/conf.d/auth_redis.lua) failed: /etc/dovecot/conf.d/auth_redis.lua:1: module 'redis' not found: Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no field package.preload['redis'] Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/share/lua/5.4/redis.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/share/lua/5.4/redis/init.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/lib/lua/5.4/redis.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/lib/lua/5.4/redis/init.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/share/lua/5.4/redis.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/share/lua/5.4/redis/init.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file './redis.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file './redis/init.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/lib/lua/5.4/redis.so' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/lib/x86_64-linux-gnu/lua/5.4/redis.so' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/lib/lua/5.4/redis.so' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/lib/lua/5.4/loadall.so' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file './redis.so' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: stack traceback: Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: [C]: in function 'require' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: /etc/dovecot/conf.d/auth_redis.lua:1: in main chunk Oct 02 11:02:54 debian dovecot[43743]: master: Error: service(auth): command startup failed, throttling for 2.000 secs How to use redis as authentication database on dovecot 2.4.1? How to add redis.so to let dovecot's lua support redis connection? Thanks.

1 0

Re: Using MongoDB as a custom message store via plugin
by Andy Balholm 01 Oct '25

01 Oct '25

I wouldn't be surprised if it would actually be easier to write an IMAP server than to write a Dovecot plugin, especially if you have a good IMAP library to work with. You can do it in the language of your choice, and not need to worry about Dovecot's internals. The server you make can be pretty bare-bones, if you plan to run Dovecot in front of it as an "IMAPC" proxy to add more features. Dovecot lets you turn off a lot of IMAP features in the IMAPC configuration; if Dovecot will be your only client, you don't need to implement the ones that you turn off. (But note that IMAPC works a lot better if you implement the UIDPLUS IMAP extension.) Andy

1 0

[Dovecot] auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied
by mailing＠securitylabs.it 01 Oct '25

01 Oct '25

Hello, just upgraded one of my testing machine from dovecot 1.2.15 to 2.0.7. After some trouble with permissions now all seems working, but when I stop dovecot I have these errors in log: Nov 9 17:08:07 in dovecot: master: Warning: Killed with signal 15 (by pid=20362 uid=0 code=kill) Nov 9 17:08:07 in dovecot: pop3-login: Error: read(anvil) failed: EOF Nov 9 17:08:07 in dovecot: imap-login: Error: read(anvil) failed: EOF Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=410/59361 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=79/26605 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=802/55708 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=258/1242 Nov 9 17:08:07 in dovecot: auth: Error: read(anvil-auth-penalty) failed: EOF Nov 9 17:08:07 in dovecot: auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied dovecot -n: # 2.0.7: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-xen-686 i686 Debian squeeze/sid auth_cache_negative_ttl = 2 mins auth_cache_size = 1000 M auth_cache_ttl = 2 mins auth_master_user_separator = * auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@& disable_plaintext_auth = no dotlock_use_excl = yes first_valid_uid = 100 last_valid_uid = 105 lock_method = dotlock log_timestamp = "%Y-%m-%d %H:%M:%S " login_greeting = Server ready. mail_fsync = never mail_gid = Debian-exim mail_location = maildir:~/Maildir:INDEX=/var/indexes/%d/%n mail_privileged_group = Debian-exim mail_uid = Debian-exim managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date namespace { inbox = yes location = prefix = separator = / type = private } namespace { location = maildir:~/Maildir/expunged prefix = EXPUNGED/ separator = / type = private } namespace { location = maildir:~/Maildir/deleted prefix = DELETED/ separator = / type = private } namespace { location = maildir:~/Maildir/deleted/expunged prefix = DELETED/EXPUNGED/ separator = / type = private } passdb { args = /usr/local/etc/dovecot-sql.conf driver = sql } passdb { args = /usr/local/etc/passwd.masterusers driver = passwd-file master = yes pass = yes } plugin { lazy_expunge = EXPUNGED/ DELETED/ DELETED/EXPUNGED/ mail_log_events = delete expunge mail_log_group_events = quota = maildir quota_warning = storage=80%% /usr/local/bin/dovecot-quota-warning.sh 80 quota_warning2 = storage=90%% /usr/local/bin/dovecot-quota-warning.sh 90 sieve = ~/.dovecot.sieve } pop3_no_flag_updates = yes protocols = imap pop3 service auth { unix_listener auth-userdb { group = Debian-exim mode = 0600 user = Debian-exim } } service imap-login { client_limit = 256 process_limit = 128 process_min_avail = 3 service_count = 1 } service imap { drop_priv_before_exec = yes process_limit = 256 vsz_limit = 256 B } service pop3-login { client_limit = 256 process_limit = 128 process_min_avail = 3 service_count = 1 } service pop3 { drop_priv_before_exec = yes process_limit = 256 vsz_limit = 256 B } ssl_cert = </usr/local/etc/dovecot.crt ssl_key = </usr/local/etc/dovecot.key userdb { args = /usr/local/etc/dovecot-sql.conf driver = sql } protocol imap { mail_max_userip_connections = 10 mail_plugins = " notify quota imap_quota mail_log lazy_expunge" } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = " notify quota mail_log" pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = quota sieve postmaster_address = postmaster(a)securitylabs.it } My /usr/local/var/run/dovecot directory: 4 drwxr-sr-x 4 root staff 4096 Nov 9 17:08 . 4 drwxrwsrwx 3 root staff 4096 Nov 9 17:05 .. 0 srw------- 1 root staff 0 Nov 9 17:05 anvil 0 srw------- 1 root staff 0 Nov 9 17:05 anvil-auth-penalty 0 srw------- 1 root staff 0 Nov 9 17:05 auth-client 0 srw------- 1 dovecot staff 0 Nov 9 17:05 auth-login 0 srw------- 1 root staff 0 Nov 9 17:05 auth-master 0 srw------- 1 Debian-exim Debian-exim 0 Nov 9 17:05 auth-userdb 0 srw------- 1 dovecot staff 0 Nov 9 17:05 auth-worker 0 srw------- 1 root staff 0 Nov 9 17:05 config 0 srw------- 1 root staff 0 Nov 9 17:05 dict 0 srw------- 1 root staff 0 Nov 9 17:05 director-admin 0 srw-rw-rw- 1 root staff 0 Nov 9 17:05 dns-client 0 srw------- 1 root staff 0 Nov 9 17:05 doveadm-server 0 lrwxrwxrwx 1 root staff 35 Nov 9 17:05 dovecot.conf -> /usr/local/etc/dovecot/dovecot.conf 4 drwxr-xr-x 2 root root 4096 Nov 9 17:05 empty 4 drwxr-x--- 2 root dovenull 4096 Nov 9 17:05 login My emails are delivered as user Debian-exim and users are virtual in a MySQL DB. This system is behind a proxy (so the master user)

7 7

Dovecot 2.3 to 2.4 invalid Maildir settings
by User 01 Oct '25

01 Oct '25

Greetings, I am unable to completely migrate my Dovecot 2.3 config to 2.4.1 as I'm unable to get past the following error: Error: Namespace inbox: maildir: maildir settings: Failed to parse configuration: Failed to override configuration from userdb: Invalid maildir=${domain}/${user}/: Setting is a named filter, use 'maildir {' I found a similar encounter at https://www.mail-archive.com/dovecot@dovecot.org/msg90843.html that points to https://doc.dovecot.org/2.4.0/core/config/mailbox/mail_location.html#per-us… yet I still can't get my config to work. I've attached my doveconf at the end, including the ported 2.3 settings that used to work for me (commented out). I would appreciate any advise. # /etc/dovecot/dovecot.conf dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 sql_driver = mysql mysql /run/mysqld/mysqld.sock { user = mail password = mail dbname = mail } passdb sql { query = SELECT username AS user, \ password FROM mailbox WHERE username = '%{user}' AND active='1' default_password_scheme = ARGON2I } userdb sql { query = SELECT maildir, \ 600 AS uid, \ 600 AS gid \ FROM mailbox WHERE username = '%{user}' AND active='1' iterate_query = SELECT username AS user FROM mailbox } # previously: # passdb { # driver = sql # args = /etc/dovecot/dovecot-sql.conf.ext # } # userdb { # driver = sql # args = /etc/dovecot/dovecot-sql.conf.ext # } # disable_plaintext_auth = yes auth_username_format = %{user | lower} # previously: "auth_username_format = %Lu" auth_mechanisms = plain login auth_default_domain = mail.com # previously: "auth_default_realm = mail.com" auth_debug = yes auth_debug_passwords = yes mail_privileged_group = mail # previously: "mail_location = maildir:~/Maildir" mail_driver = maildir mail_path = %{home}/Maildir mail_home = /var/vmail/%{user | domain}/%{user | username} # previously: "mail_home = /var/vmail/%d/%n/" service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { mode = 0600 user = postfix group = postfix } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0660 user = postfix group = postfix } } service stats { unix_listener stats-reader { user = nginx group = nginx mode = 0660 } unix_listener stats-writer { user = nginx group = nginx mode = 0660 } } ssl = required ssl_min_protocol = TLSv1.2 ssl_server_prefer_ciphers = server # previously: "ssl_prefer_server_ciphers = yes" ssl_server { dh_file = /etc/ssl/dovecot/dh.pem cert_file = /etc/ssl/dovecot/tls.pem key_file = /etc/ssl/dovecot/tls.key } # previously: # ssl_dh = </etc/ssl/dovecot/dh.pem # ssl_cert = </etc/ssl/dovecot/tls.pem # ssl_key = </etc/ssl/dovecot/tls.key namespace inbox { inbox = yes mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } } protocols = imap lmtp # previously: /etc/dovecot/dovecot-sql.conf.ext driver = mysql connect = host=localhost dbname=mail user=mail password=mail default_pass_scheme = ARGON2I password_query = SELECT username AS user,password FROM mailbox WHERE username = '%u' AND active='1' user_query = SELECT maildir, 600 AS uid, 600 AS gid FROM mailbox WHERE username = '%u' AND active='1' iterate_query = SELECT username AS user FROM mailbox

5 7

Repository origin
by Christian Celler 01 Oct '25

01 Oct '25

Hi there, maybe this has been discussed on the list before, but a quick search found nothing on this topic. It would be really nice to have an "Origin" (and maybe a Label?) in the InRelease-file for the apt-repositories. Would it be possible to add this to the repositories on repo.dovecot.org, for easier, more comprehensive pinning and stuff? Best regards Christian Celler

1 0

2.3 to 2.4 /proc/self/io) failed: Permission denied
by Don Bowman 01 Oct '25

01 Oct '25

I have a dovecot system running in my kubernetes cluster that i use to gateway some emails to imap that are in turn used by systems that poll for email. No people are involved. Its been running for sometime on 2.3, i've now updated the base container to 2.4 and i have two problems, perhaps related, perhaps not. I'm assuming its related to my config changes for 2.4, but I'm kind of at my wits end. The first issue: Sep 06 15:05:31 imap(support)<443><YIobSSM+MMoKIAIr>: Debug: open(/proc/self/io) failed: Permission denied (euid=1001(support) egid=1001(support) missing +r perm: /proc/self/io) I am seeing errors like this. I can't figure why. I tried "doveadm force-resync -u support /home/support/Maildir/" and it returns no errors. The 2nd error, again, perhaps related, the user doing the poll for new email doesn't see it (despite I see the email delivered to the 'new' dir, it doesn't get picked up and moved to 'cur'). Below is my config file. In /home/support/Maildir i have the new, cur, tmp etc. There's no mention of 'INBOX', which i think my previous had (mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir was previous) Any advice? I'm not sure where to go from here. dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 auth_mechanisms = plain login auth_allow_cleartext = yes #disable_plaintext_auth = no mail_privileged_group = mail #mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir mail_driver = maildir mail_path = /var/mail/%{user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir userdb passwd { fields { home = /home/{%user | username} mail_driver = maildir mail_path = /var/mail/{%user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir } } passdb pam { service_name = dovecot } protocols = " imap" namespace inbox { inbox = yes mailbox Trash { auto = subscribe # autocreate and autosubscribe the Trash mailbox special_use = \Trash } mailbox Sent { auto = subscribe # autocreate and autosubscribe the Sent mailbox special_use = \Sent } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } ssl=yes ssl_server_cert_file = /run/ca/tls.crt ssl_server_key_file = /run/ca/tls.key log_path = /tmp/dc.log mail_debug = yes ssl_min_protocol = TLSv1.2 log_debug = category=email # verbose_ssl=yes #auth_verbose=yes #auth_debug=yes I have a dovecot system running in my kubernetes cluster that i use to gateway some emails to imap that are in turn used by systems that poll for email. No people are involved. Its been running for sometime on 2.3, i've now updated the base container to 2.4 and i have two problems, perhaps related, perhaps not. I'm assuming its related to my config changes for 2.4, but I'm kind of at my wits end. The first issue: Sep 06 15:05:31 imap(support)<443><YIobSSM+MMoKIAIr>: Debug: open(/proc/self/io) failed: Permission denied (euid=1001(support) egid=1001(support) missing +r perm: /proc/self/io) I am seeing errors like this. I can't figure why. I tried "doveadm force-resync -u support /home/support/Maildir/" and it returns no errors. The 2nd error, again, perhaps related, the user doing the poll for new email doesn't see it (despite I see the email delivered to the 'new' dir, it doesn't get picked up and moved to 'cur'). Below is my config file. In /home/support/Maildir i have the new, cur, tmp etc. There's no mention of 'INBOX', which i think my previous had (mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir was previous) Any advice? I'm not sure where to go from here. dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 auth_mechanisms = plain login auth_allow_cleartext = yes #disable_plaintext_auth = no mail_privileged_group = mail #mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir mail_driver = maildir mail_path = /var/mail/%{user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir userdb passwd { fields { home = /home/{%user | username} mail_driver = maildir mail_path = /var/mail/{%user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir } } passdb pam { service_name = dovecot } protocols = " imap" namespace inbox { inbox = yes mailbox Trash { auto = subscribe # autocreate and autosubscribe the Trash mailbox special_use = \Trash } mailbox Sent { auto = subscribe # autocreate and autosubscribe the Sent mailbox special_use = \Sent } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } ssl=yes ssl_server_cert_file = /run/ca/tls.crt ssl_server_key_file = /run/ca/tls.key log_path = /tmp/dc.log mail_debug = yes ssl_min_protocol = TLSv1.2 log_debug = category=email # verbose_ssl=yes #auth_verbose=yes #auth_debug=yes

4 3

Public namespace - configuration help (new to Dovecot) - version 2.3.x
by daniel.botting＠codethink.co.uk 01 Oct '25

01 Oct '25

Hi all, I'm configuring a public namespace for an existing Dovecot install, I have the public namespace configured and working in a basic manner (it can be subscribed to in an MUA and mail can be moved into it for a specified user named in the dovecot-acl file). I've followed the official docs: - https://doc.dovecot.org/2.3/configuration_manual/shared_mailboxes/public_sh… When I configure the MUA (Thunderbird) I can see the public namespace and a subfolder that I've manually created underneath (with new/cur/tmp folders, parent public folders also has a new tmp cur directories, mail cannot be moved into public top level folder), but it is displayed as below when subscribed to: public^subfolder I've resolved this by changing the separator to a / , however as per my doveconf -n below I then received a separator conflict, which I resolved by changing the separator for the default namespace to also be a / . As the default namespace is already using period ( . ) on the production servers, I'd like to continue using this separator and not / separator. The existing install of a couple of hundred mailboxes and I'm concerned I'll break the mailboxes /any existing sieve filters. I would like the public folder to display with an empty prefix as below, but I understand you cannot have two 'prefix =' (empty prefixes) : subfolder doveconf -n output below: # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21.1 (49005e73) # OS: Linux 5.10.0-35-cloud-amd64 x86_64 Debian 11.11 # Hostname: imap-server.hostname.co.uk auth_verbose = yes default_vsz_limit = 0 doveadm_password = # hidden, use -P to show it first_valid_gid = 8 first_valid_uid = 8 last_valid_gid = 8 last_valid_uid = 8 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_gid = 8 mail_location = maildir:~/Maildir mail_plugins = " notify replication acl" mail_uid = 8 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapflags namespace { list = no location = maildir:/srv/vmail/public:INDEXPVT=~/Maildir/public prefix = Public/ separator = / subscriptions = no type = public } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / <--- I'd like this to be a . instead } namespace subscriptions { hidden = yes list = no location = prefix = subscriptions/ <--- had to put something here because inbox namespace was empty subscriptions = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile mail_replica = tcps:other-replica.domain.co.uk:port number sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/common.sieve sieve_dir = ~/sieve sieve_extensions = +editheader +imapflags } postmaster_address = postmaster(a)domain.co.uk protocols = " imap sieve pop3" replication_dsync_parameters = -d -N -l 15 -U -T 10 replication_max_conns = 24 service aggregator { fifo_listener replication-notify-fifo { user = mail } unix_listener replication-notify { user = mail } } service auth { unix_listener /var/run/dovecot-exim-bridge { mode = 0660 user = Debian-exim } } service doveadm { inet_listener { port = <replica port number> ssl = yes } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 512 process_min_avail = 4 service_count = 1 } service imap { process_limit = 1024 } service managesieve-login { inet_listener sieve { port = <port number> } process_min_avail = 1 service_count = 8 vsz_limit = 256 M } service managesieve { process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = <path/to/fullchain.pem ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap override_fields = home=/var/mail/%u uid=mail gid=mail } protocol lda { mail_plugins = " notify replication acl sieve" } protocol imap { mail_max_userip_connections = 32 mail_plugins = " notify replication acl acl" } protocol sieve { mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_line_length = 64 k } Also the public folder is not displayed in Roundcube webmail in folder sections to be subscribed to. doveadm mailbox list -u <username> I appreciate that replication does not work with public mailboxes, I'll have to look at that further. Many thanks Dan

2 6

Using MongoDB as a custom message store via plugin
by The Sixth Serpent 30 Sep '25

30 Sep '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello Dovecot Community! I have recently written a NodeJS-based mail system that I hope to eventually open-source. The SMTP daemon (accepting inbound for delivery/relay) and queue processor (handing off messages to remote MTAs for relay messages) both use MongoDB (utilizing Mongoose Schema) to store/queue the messages (emails). All of this is in-place and working. Now, I turn my attention to making the emails accessible to the end user (i.e., webmail, POP3, and/or IMAP). I already have a working POP3+TLS daemon (NodeJS + Mongoose), though it is unlikely that I'll make the POP3 service available to my users. I'm hoping to make use of RoundCube or other open-source webmail clients. IMAP provides the interface between my message store and webmail/user's clients. I've chosen Dovecot (yay!) to provide this interface (as opposed to the nightmare of writing one from scratch) given that it's open source and it's extensibility via plugins. Does the idea of providing a MongoDB-based message store sound like something that can be done sole via plugins - or might this require modification of the actual Dovecot core? Is support for a MongoDB message store interesting to anyone beyond myself? I'd be happy to share my Mongoose schema (as the intent is to open source the entire project once I get it together). I'll also need Dovecot to authenticate against my MongoDB instance. I have a collection, called "mailboxes" that defines the username and password (hashed with ARGON2), among other things. I'm imagining that custom authentication is something that can be achieved via plugins alone? What does everyone think to be simpler/more appropriate: 1. authentication plugin that connects directly to MongoDB, fetches the authen creds, and verifies the password via ARGON2 2. authentication plugin that accesses a NodeJS-express API endpoint that provides a boolean result From my perspective, option (a) makes the most sense. I consider option (b) in case the plugin system doesn't support MongoDB, or doesn't support ARGON2, or .... Can anyone recommend any good docs/howtos on writing Dovecot plugins? Any plugins' whose source might be of interest to me (i.e., custom message store, custom auth, etc)? Thank you for taking the time to consider these questions! I appreciate any responses. I'll make available, or describe further, any aspect of my system if it will help. Regards, TJ Easter II -- "The Information Age offers much to mankind, and I would like to think that we will rise to the challenges it presents. But it is vital to remember that information - in the sense of raw data - is not knowledge; that knowledge is not wisdom; and that wisdom is not foresight. But information is the first essential step to all of these." -- Arthur C. Clarke; 12/2003 Sent with Proton Mail secure email. -----BEGIN PGP SIGNATURE----- Version: ProtonMail wsC5BAEBCgBtBYJo209sCRDKQ0X/3WTf3EUUAAAAAAAcACBzYWx0QG5vdGF0 aW9ucy5vcGVucGdwanMub3JnOD2KL5NSk5rYX75gCW+d8bYmHLJNP8m5nkVy wnHpCHMWIQTQAEbAbK1F7TqiE2jKQ0X/3WTf3AAAChQH/iXWnG3kBM3oQpfe Yd4Hv2TkN/iduzaXfOwWDBcUCP4Dc2YDnYR2W/6OI6hcFLaPw+RvEWe6FMvu aik7s5wypDdQv8bNugO7FkyyooA4UYDLoffRDNIHv+vTXviAmByjywU64Qor hNwajt+vXCuJZY21+vElXhk0Nnea62DrBhRjrVWjxEQAmj9dNSP0HG5woqcX mCYC/PufJLbQatcortFZV5Eiq0OQCfe7C7AEtPjA+isbx2lzqTpMhcmJ87qn 95FwmMoEUuQPoLiUfrzkbBcFECFRi9EZsMhPr4vwuZLlGr49vIyzzqMgI/gX /XJq4cu6mZ1j0Hp+N2zq1iDG55I= =6CWa -----END PGP SIGNATURE-----

1 0

ENV var expansions work mostly in 2.4, but not in some locations
by publists＠emailgroups.net 29 Sep '25

29 Sep '25

Hi, I'm trying to clean up my migrated v2.4 config. I'm still having a hard time with environment variable expansions :-( They work in most places. But so far for me not in mail_plugin_dir ssl_client_* or ssl_server_* listen= For example, this config using literal file paths works great ssl_server { ca_file = /path/to/CA.crt.pem ... } ssl_client { ca_file = /path/to/CA.crt.pem ... } protocol doveadm { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol imap { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol lmtp { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol sieve { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol submission { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } When I add an env var import_environment { CA_FILE=/path/to/CA.crt.pem } and change any of those /path/to/CA.crt.pem instances to this %{env:CA_FILE} OR this $ENV:CA_FILE I get errors os startup like dovecot[13660]: doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf: ssl_server_request_client_cert=yes, but ssl_server_ca_file not provided If I go back to literal paths, everything works OK. I've read these https://doc.dovecot.org/main/core/settings/variables.html https://doc.dovecot.org/main/core/settings/syntax.html#environment-variables https://doc.dovecot.org/main/core/settings/types.html#file and as far as I can tell this should work. Something's different about these that I'm not understanding. Or there's a list of keys that can't use these vars in values. How do you use ENV var expansion in ssl file paths, listen addresses, etc? Dave

1 0

Enforce LMTP auth with client certs
by rhi＠pengutronix.de 29 Sep '25

29 Sep '25

Hello, I'm trying to get TLS client cert authentication to work on the LMTP socket via TCP port 24 with Dovecot 2.4. I was already able to get TLS working on the LMTP socket, but if I connect to it via 'openssl s_client' from another machine, and type in a few LMTP commands, Dovecot accepts all mail without requesting a client cert from me. The server running Dovecot is behind a firewall, so LMTP connections should only be possible from the SMTP server in the same local network, not from the whole internet. However I want to guard against possible firewall misconfigs by enforcing client certs between the incoming SMTP server and Dovecot for mail delivery. Is there a way to do this in Dovecot? My /etc/dovecot/conf.d/20-lmtp.conf effectively looks like this: lmtp_save_to_detail_mailbox = yes lmtp_add_received_header = yes protocol lmtp { mail_plugins { sieve = yes } ssl = required ssl_server_ca_file = /etc/lmtp-ca/ca.crt ssl_server_cert_file = /etc/lmtp-ca/local.crt ssl_server_key_file = /etc/lmtp-ca/private/local.key ssl_server_request_client_cert = yes # TODO: this should enforce client certs, but it does not work... auth_ssl_require_client_cert = yes ssl_server_require_crl = no log_debug = category=ssl OR category=auth } … and /etc/dovecot/conf.d/10-master.conf has: service lmtp { #unix_listener lmtp { # mode = 0666 #} inet_listener lmtp { # Accept connections from anywhere, but 20-lmtp.conf configures LMTP to require client certs listen = * :: port = 24 inet_listener_ssl = yes # TODO: this should enforce client certs, but it does not work... auth_ssl_require_client_cert = yes } } I also tried enabling ssl_server_request_client_cert = yes and auth_ssl_require_client_cert = yes globally, but this did not make a difference. I already tried looking at the Dovecot source code, but didn't find anything yet. I'm happy for any pointers in the right direction. Thanks, - Roland

2 2

postfix alias and dovecot quota
by Alexandre Ellert 28 Sep '25

28 Sep '25

Hello, Can someone tell me if it’s possible to configure dovecot to answer quota information about real mailbox when I query a postfix alias mailbox (this information is actually in a mysql database) ? Example : doveadm quota get - u alias(a)domain.com doveadm(alias(a)domain.com): Fatal: User doesn't exist doveadm quota get - u realmailbox(a)domain.com Quota name Type Value Limit % user STORAGE 2048853 2048000 100 user MESSAGE 6783 - 0 I’d like to have this result : doveadm quota get - u alias(a)domain.com Quota name Type Value Limit % user STORAGE 2048853 2048000 100 user MESSAGE 6783 - 0 doveadm quota get - u realmailbox(a)domain.com Quota name Type Value Limit % user STORAGE 2048853 2048000 100 user MESSAGE 6783 - 0 Thanks for your help. Alexandre.

6 9

Dovecot 2.4.1 sieve
by Martin Brampton 28 Sep '25

28 Sep '25

Just upgraded mail server from Debian 12 to 13. Fixed a number of issues with changed Dovecot, but stuck getting sieve working. The server uses LMTP. I’ll post some configuration if it helps. But the messages in the log saying the plugin sieve_lmtpsieve is missing seems fundamental and relevant. I can’t find anything called that in the Debian repository. How is it installed? Or am I doing something fundamentally wrong? Martin Just upgraded mail server from Debian 12 to 13. Fixed a number of issues with changed Dovecot, but stuck getting sieve working. The server uses LMTP. I'll post some configuration if it helps. But the messages in the log saying the plugin sieve_lmtpsieve is missing seems fundamental and relevant. I can't find anything called that in the Debian repository. How is it installed? Or am I doing something fundamentally wrong? Martin

7 21

2.4.1 Config woes
by Anthony Mellor 27 Sep '25

27 Sep '25

Hi, greetings Do sing out please if this is the wrong place or style for this mailing list, please - and there's a community somewhere isn't there? spent days not succeeding with these configs. I'm a new install on Trixie and Dovecot 2.4.1 and going round in many circles with nano /etc/dovecot/dovecot.conf nano /etc/dovecot/conf.d/10-auth.conf nano /etc/dovecot/conf.d/auth-sql.conf.ext nano /etc/dovecot/conf.d/10-master.conf MariaDB having tried one million variations of this, so this is just one, being the latest suggestion # Declare named instances of passdb/userdb using the SQL driver passdb sql { } userdb sql { } # Passdb (authentication) SQL settings passdb_sql_driver = mysql # MariaDB uses "mysql" passdb_sql_host = 127.0.0.1 # or: /run/mysqld/mysqld.sock passdb_sql_port = 3306 passdb_sql_dbname = maildb passdb_sql_user = dovecot passdb_sql_password = CHANGEME # Choose the scheme to match your DB: # - MD5-CRYPT for $1$... hashes or {MD5-CRYPT} prefix # - PLAIN-MD5 for 32-hex unsalted MD5 passdb_sql_default_pass_scheme = MD5-CRYPT passdb_sql_password_query = \ SELECT username AS user, password \ FROM users \ WHERE username = '%u' (thought this is now changed) # Userdb (user lookup) SQL settings userdb_sql_driver = mysql userdb_sql_host = 127.0.0.1 userdb_sql_port = 3306 userdb_sql_dbname = maildb userdb_sql_user = dovecot userdb_sql_password = CHANGEME # Must return at least uid, gid and home or mail userdb_sql_user_query = \ SELECT \ 5000 AS uid, 5000 AS gid, \ home, \ CONCAT('maildir:', maildir) AS mail \ FROM users \ WHERE username = '%u' (thought this is now changed) I have never used Dovecot before this install ten days ago - any example files that work will be forever gratefully appreciated to give me a basic starting point. Very frustratingly at one 3am morning I did get it working and the lost it. a t b Anthony _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org

1 0

2.4.1 Config woes
by Anthony Mellor 27 Sep '25

27 Sep '25

Hi, greetings Do sing out please if this is the wrong place or style for this mailing list, please - and there's a community somewhere isn't there? spent days not succeeding with these configs. I'm a new install on Trixie and Dovecot 2.4.1 and going round in many circles with nano /etc/dovecot/dovecot.conf nano /etc/dovecot/conf.d/10-auth.conf nano /etc/dovecot/conf.d/auth-sql.conf.ext nano /etc/dovecot/conf.d/10-master.conf MariaDB having tried one million variations of this, so this is just one, being the latest suggestion # Declare named instances of passdb/userdb using the SQL driver passdb sql { } userdb sql { } # Passdb (authentication) SQL settings passdb_sql_driver = mysql # MariaDB uses "mysql" passdb_sql_host = 127.0.0.1 # or: /run/mysqld/mysqld.sock passdb_sql_port = 3306 passdb_sql_dbname = maildb passdb_sql_user = dovecot passdb_sql_password = CHANGEME # Choose the scheme to match your DB: # - MD5-CRYPT for $1$... hashes or {MD5-CRYPT} prefix # - PLAIN-MD5 for 32-hex unsalted MD5 passdb_sql_default_pass_scheme = MD5-CRYPT passdb_sql_password_query = \ SELECT username AS user, password \ FROM users \ WHERE username = '%u' (thought this is now changed) # Userdb (user lookup) SQL settings userdb_sql_driver = mysql userdb_sql_host = 127.0.0.1 userdb_sql_port = 3306 userdb_sql_dbname = maildb userdb_sql_user = dovecot userdb_sql_password = CHANGEME # Must return at least uid, gid and home or mail userdb_sql_user_query = \ SELECT \ 5000 AS uid, 5000 AS gid, \ home, \ CONCAT('maildir:', maildir) AS mail \ FROM users \ WHERE username = '%u' (thought this is now changed) I have never used Dovecot before this install ten days ago - any example files that work will be forever gratefully appreciated to give me a basic starting point. Very frustratingly at one 3am morning I did get it working and the lost it. a t b Anthony

1 0