- dovecot - dovecot.org

Dovecot sieve, help !
by Tommy Berglund 03 May '26

03 May '26

Hi! I need help and advice on how to get sieve working. Postfix dovecot works to receive and send mail but I can't get sieve to work. Domain and user are virtual in mariadb. Tips are welcome. Doveconf -n attached.

3 4

mail_inbox_path in manual
by Daniel Convissor (business) 01 May '26

01 May '26

Hi: Recently upgraded Debian to version 13/Trixie, which brings Dovecot up to 2.4 (with its significant configuration file changes). As mentioned on this list, Debian decided to manually put mail_inbox_path in their distribution's config files (and set it to /var/mail/%{user}).[1] This resulted in mayhem for me because that's not where our mail is. I assume this has happened to others as well. I figured out the problem by looking at mail.log after adding mail_debug=yes to my local Dovecot config file. Perhaps Dovecot's manual can be updated to clarify the situation, please? The Mail Location page[2] warns admins to not touch this setting. The upgrade page[3] does not mention needing to look out for Debian's choice. (Granted, this is a Debian problem, but the Dovecot manual is where people turn to figure out what is happening.) Thank you, --Dan [1] https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/message/Q6HI… [2] https://doc.dovecot.org/2.4.3/core/config/mail_location.html#mail_inbox_path [3] https://doc.dovecot.org/2.4.3/installation/upgrade/2.3-to-2.4.html -- T H E A N A L Y S I S A N D S O L U T I O N S C O M P A N Y Designing transportation systems everyone can use https://www.AnalysisAndSolutions.com/

1 0

Confusion about ldap in 2.4
by fc26wuqa＠studserv.uni-leipzig.de 28 Apr '26

28 Apr '26

Hello, With dovecot 2.3 it was clear to me, how I should set up ldap: Include `conf.d/auth-ldap.conf.ext` in `conf.d/10-auth.conf` and include `dovecot-ldap.conf.ext` with the usual parameters like hosts, uris, dn, etc. In dovecot 2.4 I am a little bit confused about whats the best practice. I heard about that .ext files being outdated and examples in the documentation saying I should put everything in dovecot.conf? So If in 2.3 my config would look like this: ``` # auth-ldap.conf.ext passdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf.ext } userdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf.ext } ``` ``` # dovecot-ldap.conf.ext hosts = ldap.something.org:636 uris = ldaps://smoething.org dn = cn=something,ou=something,dc=something,dc=org dnspass = somethingsomething auth_bind = yes auth_bind_userdn = uid=%u,ou=something ... ``` I would put something like this in dovecot.conf? Or in auth-ldap.conf.ext? ``` ldap_uris = ldap://ldap.example.org ldap_auth_dn = cn=admin,dc=example,dc=org ldap_auth_dn_password = secret ldap_base = dc=example,dc=org passdb ldap { bind = yes filter = (&(objectClass=posixAccount)(uid=%{user})) fields { user = %{ldap:uid} } } ``` (https://doc.dovecot.org/2.4.3/core/config/auth/databases/ldap.html#dn-lookup)

1 0

Upgrading from 2.4.2 to 2.4.3 broke static password login
by harrison＠hhj.me 28 Apr '26

28 Apr '26

Hey folks, I've got dovecot running via docker on version 2.4.2. Here's what my config extension looks like: ``` # auth_mechanisms = plain login auth_verbose = yes passdb static { password = %{env:USER_PASSWORD} } service lmtp { inet_listener lmtps { port = 31024 ssl = no } } ssl_server_cert_file = /etc/dovecot/ssl/cert.pem ssl_server_key_file = /etc/dovecot/ssl/key.pem ssl = yes auth_allow_cleartext = no namespace inbox { type = private separator = / inbox = yes mailbox Drafts { special_use = \Drafts auto = subscribe } mailbox Junk { special_use = \Junk auto = create } mailbox spam { special_use = \Junk auto = no } mailbox Spam { special_use = \Junk auto = no } mailbox Trash { special_use = \Trash auto = subscribe } mailbox TRASH { special_use = \Trash auto = no } mailbox Sent { special_use = \Sent auto = subscribe } mailbox "Sent Mail" { special_use = \Sent auto = no } mailbox "Sent Messages" { special_use = \Sent auto = no } mailbox Archive { special_use = \Archive auto = create } mailbox "Archives" { special_use = \Archive auto = no } } ``` I have env `USER_PASSWORD` defined in the format of `{PLAIN}REDACTED` This has been humming along fine for a little while. I recently automatically upgraded to 2.4.3 which broke my ability to login via IMAP to retrieve emails (it also broke my local mail transport setup; it was unable to send emails). I could see the following messages in the logs: ``` Apr 27 11:12:09 auth(REDACTED,REDACTED,sasl:plain)<REDACTED>: Info: static: No password returned (and no nopassword) Apr 27 11:12:11 imap-login: Info: Login aborted: Connection closed (auth failed, 1 attempts in 6 secs) (auth_failed): user=<REDACTED>, method=PLAIN, rip=REDACTED, lip=172.17.0.2, TLS, session=<REDACTED> ``` Downgrading back to 2.4.2 "fixed" the problem (I was able to login again; LMTP worked again). I didn't change my config extension between the upgrades. I tried searching https://github.com/search?q=repo%3Adovecot%2Fcore+password&type=issues and I see a few related to passwords but nothing is really jumping out at me. Help? I'm staying pinned on 2.4.2 for now but that's not a long term solution.

2 3

Panic in logs
by Kamil Jońca 26 Apr '26

26 Apr '26

Recently I found in my lda logs: 2025-12-30T07:55:14.717927+01:00 alfa dovecot: lda(kjonca): Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 i_syslog_fatal_handler[0x7f99a2351430] -> #3 i_panic[0x7f99a226d453] -> #4 [unw_get_proc_name() failed: -10] -> #5 [unw_get_proc_name() failed: -10] -> #6 [unw_get_proc_name() failed: -10] -> #7 buffer_append[0x7f99a2345270] -> #8 dregex_code_match_groups[0x7f99a233f1a0] -> #9 [unw_get_proc_name() failed: -10] -> #10 [unw_get_proc_name() failed: -10] -> #11 sieve_match_value[0x7f99a117f770] -> #12 sieve_match[0x7f99a117fa30] -> #13 [unw_get_proc_name() failed: -10] -> #14 sieve_interpreter_continue[0x7f99a117e100] -> #15 sieve_multiscript_run[0x7f99a1190330] -> #16 [unw_get_proc_name() failed: -10] -> #17 mail_deliver[0x7f99a27e54a0] -> #18 main[0x55e371c555e0] -> #19 __libc_start_call_main[0x7f99a1e29f00] -> #20 __libc_start_main_alias_2[0x7f99a1e29fa0] -> #21 _start[0x55e371c566a0] And sadly it seems, that mail is missing (it was passed to pipe program to further processing) KJ -- http://wolnelektury.pl/wesprzyj/teraz/ When you go out to buy, don't show your silver.

4 6

Incorrect ARC signature on emails
by Lafiel Elentari 25 Apr '26

25 Apr '26

Hello. On the mail server, I configured addition of the `Authentication-Results` header with authentication check results. I noticed that emails from the dovecot.org server have an incorrect ARC signature: Authentication-Results: ...; dkim=pass header.d=dovecot.org header.s=... header.b=...; dkim=fail ("body hash did not verify") header.d=... header.s=... header.b=...; arc=reject ("signature check failed: fail, {[1] = sig:dovecot.org:reject}"); spf=pass (...: domain of "dovecot-bounces+...=...(a)dovecot.org" designates ... as permitted sender) smtp.mailfrom="dovecot-bounces+...=...(a)dovecot.org"; dmarc=pass (policy=reject) header.from=dovecot.org ``` -- Best regards, Lafiel Elentari mailto:lafiel@elven.pw

2 2

mbox to maildir migration, same server?
by kjohnson＠eclypse.org 25 Apr '26

25 Apr '26

What is the recommended procedure to migrate from mbox to maildir on a server already running dovecot? Ideally, this procedure would convert messages in an existing mbox INBOX and in ~/mail mboxes (as defined in my dovecot configuration) to storage in a ~/Maildir. Some of the INBOXs are rather large -- 100's of MB (one of the reasons for migrating). What I have tried has not worked for me. Below, I describe what I tried, how I tested before I tried, what went wrong, and the current setup (pre-migration). What I tried: ============= stop exim4 service dovecot stop Make dovecot listen only locally, not to external connections. /etc/dovecot/local.conf protocol imap { listen = 127.0.0.1:143 ssl_listen = 127.0.0.1:993 } protocol pop3 { listen = 127.0.0.1:110 ssl_listen = 127.0.0.1:995 } Modify dovecot configuration for maildir: Watch capitalization! #in 10-mail.conf: mail_location = maildir:/home/%u/Maildir namespace inbox { separator = / } dovecot -n, to confirm results and perform limited syntax checking. service dovecot start for each user, in a bash script: dsync -v -u "$U" mirror "mbox:/home/$U/mail:INBOX=/var/mail/$U" (if the conversion worked for all users, then reconfigure exim to use maildir and restart it; reconfigure dovecot to listen to external interfaces and restart.) How I tested: ============= Before trying this on the real server, I set up a matching (same versions of Debian, Exim, and Dovecot) VM using mbox, with a couple of accounts. One using POP3, one using IMAP. The IMAP account was accessed from Claws and from Outlook. The test accounts had perhaps a dozen messages on the server. I tried the conversion procedure, and everything I tried worked flawlessly. (Yes, next time I will move some real inbox files from the live server). What went wrong: ================ I encountered two types of problems here. The first was several dsync warnings (username changed): dsync(example): Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID 21bfa11a81f11763ac150000d09efc50 (maybe it was just deleted?) As I understand it, this can result in some or all messages being downloaded again by clients. My understanding may be wrong. I also don't understand how the mailbox could have changed -- exim4 was stopped, dovecot is only listening on 127.0.0.1, and I am the only user who uses a local mail client on that system, and this was not my account. The second problem I encountered seems to match Debian Bug report logs - #1011238. In part of the discussion of that report, the reporter mentions adding -1 to the command, as shown: dsync -v -u "$U" mirror -1 "mbox:/home/$U/mail:INBOX=/var/mail/$U" While this seemed to eliminate the dsync panic of #1011238, as far as I can tell, no old messages were actually moved from the old mbox files to the new maildirs. At that point I restored the backup mbox files and undid the changes to dovecot and exim4. Current setup: ============== Debian 11.4 Exim 4.94.2-7 dovecot 1:2.3.13+dfsg1-2 The current setup with Dovecot was a successful migration from IMAP-UW in December 2020. Output from dovecot -n (the list of trusted networks has been removed) # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-16-686-pae i686 Debian 11.4 # Hostname: localhost auth_verbose = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } pop3_uidl_format = %08Xv%08Xu protocols = " imap pop3" ssl_cert = </etc/dovecot/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } Thank you to anyone who read this far. Ken

5 5

Is this a bug of `doveadm mailbox metadata set` with `-A` and `-s ""`
by Zhang Huangbin 24 Apr '26

24 Apr '26

Dear all, Recently i encountered an issue with `doveadm mailbox metadata set` (and `unset`) with either `-A` or `-F <path>`. When i run `doveadm mailbox metadata set` for single user, it correctly generates content in `dovecot-attributes` file: ``` doveadm mailbox metadata set -u <email> -s "" "/private/vendor/vendor.dovecot/http-notify" "user=all" ``` But if i run with `-A`, or `-F <path>`, Dovecot generates incorrect "path" and unreadable characters in `dovecot-attributes` file: ``` # doveadm mailbox metadata set -A -s "" "/private/vendor/vendor.dovecot/http-notify" "user=all" # for i in $(find . -name 'dovecot-attributes'); do echo $i; cat $i; done priv/4898662293abe1690d9a000063130d18/vendor/vendor.dovecot/pvt/server/?????? user=all priv/90e7b40fc8c1e9690924000063130d18/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify user=all priv/60ba353790c1e969f923000063130d18/vendor/vendor.dovecot/pvt/server/endor.dovecot/pvt/server/CV?? user=all ``` It's ok if i specify the mailbox in -s, for example: `-s "INBOX"`, `-s "Sent"`, but it's not what i want, because only emails delivered to specified mailbox will be pushed. Is this a bug?

1 1

[Bug Report] anvil panic: anvil-connection.c:727: unreached triggered by duplicate imap-login handshake with pid=-1
by Jeff Aitken 24 Apr '26

24 Apr '26

Environment: FreeBSD 14.4-RELEASE Dovecot 2.4.3 (e278b1e09b) Pigeonhole 2.4.3 (0bf9ee48) Postfix 3.11.1, rspamd 4.0.0 Description: The dovecot anvil process is crashing repeatedly with a panic in anvil-connection.c at line 727. The panic is triggered by i_unreached() in anvil_connection_destroy(). Total of ~18 crashes in the last 24 hours, happens to multiple users. The anvil process restarts successfully and works as expected other than the crashes. No other symptoms that I can see that appear related. Log messages: dovecot[87542]: anvil: Panic: file anvil-connection.c: line 727: unreached dovecot[87542]: anvil: Fatal: master: service(anvil): child 88408 killed with signal 6 (core not dumped) dovecot[87542]: anvil: Error: connect limit: disconnection for unknown (pid=88756, user=<username>, service=imap, ip=X.X.X.X, ...) dovecot[87542]: anvil: Warning: conn unix:anvil (uid=0): Handshake with duplicate service=imap-login pid=-1 - replacing the old connection Analysis (from claude): In anvil_connection_destroy(), when conn->added_to_hash is true, the code asserts that the connection must still be present in anvil_connections_hash. However, when a duplicate handshake is received for the same (service, pid) key, the old connection appears to be evicted from the hash table without clearing its added_to_hash flag. When the old connection is subsequently destroyed, hash_table_lookup_full() fails to find it, triggering i_unreached(). The pid=-1 in the duplicate handshake warning is also notable — this does not appear to be a valid process ID and may indicate that the handshake is being sent before the imap-login process has fully initialized. Workaround: Setting service_restart_request_count = unlimited and service_process_min_avail = 2 on the imap-login service seems to have reduces process turnover and appears to have reduced the frequency of the crash, but I’ve only got a couple of hours since that change so too early to say for sure. Suggested fix: When a duplicate handshake causes an existing connection to be evicted from anvil_connections_hash, the evicted connection's added_to_hash flag should be cleared to prevent the assertion failure in anvil_connection_destroy(). Appreciate any insight, and happy to provide additional info that would be helpful. —Jeff

1 0

Unable to get Dovecot 2.4 to allow unencrypted connection
by David Koski 24 Apr '26

24 Apr '26

Hello, In spite of: ssl = no auth_allow_cleartext = yes ..in a telnet session, I get: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS LOGINDISABLED AUTH=GSSAPI AUTH=CRAM-MD5] Dovecot (Debian) ready. a1 login ln(a)zample.com <super-secret> * BAD [ALERT] Plaintext authentication not allowed without SSL/TLS, but your client did it anyway. If anyone was listening, the password was exposed. a1 NO [PRIVACYREQUIRED] Plaintext authentication disallowed on non-secure (SSL/TLS) connections. I need to see the network traffic to troubleshoot the way Outlook 2019 handles IMAP folders. Regards, David Koski dkoski(a)sutinen.com

3 9