error service quota-status

[Admin Beckspaced]

dear dovecot users,

trying to setup this quota-status thingy in dovecot so postfix can query 
the quota on the mailbox via following in main.cf

smtpd_recipient_restrictions =
     ...
     check_policy_service inet:127.0.0.1:12340


I got this in my dovecot config

service quota-status {
   client_limit = 1
   executable = quota-status -p postfix
   inet_listener {
     port = 12340
   }
}

plugin {
   ...
   quota_status_nouser = DUNNO
   quota_status_overquota = 552 5.2.2 Mailbox is over quota / Mailbox 
ist voll
   quota_status_success = DUNNO
   ...
}

but whenever I try I get this error:

Apr 24 20:04:32 cx20 dovecot[7236]: 
quota-status(beckidouche at domain.com)<7290><qQpiJzAqo156HAAAct2Jzg>: 
Error: quota check failed: Failed to get quota resource STORAGE_BYTES 
for INBOX: quota-dict: dict_lookup(priv/quota/storage) failed: 
net_connect_unix(/var/run/dovecot/dict) failed: Permission denied 
(euid=303(vmail) egid=303(vmail) missing +r perm: /var/run/dovecot/dict, 
we're not in group 489(dovecot), dir owned by 0:0 mode=0755) (reply took 
0.000 secs (0.000 in dict wait, 0.000 in other ioloops, 0.000 in locks))

what am I missing here?

perhaps too many hours in front of the screen today already ;)

thanks a lot for your time & help
greetings
Becki

/* 
==================================================================================================================================== 
*/

cx20: # doveconf -n

# 2.3.3 (dcead646b): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.5.3 (f018bbab)
# OS: Linux 4.12.14-lp151.28.48-default x86_64  ext4
# Hostname: cx20.domain.com
auth_debug = yes
auth_debug_passwords = yes
auth_mechanisms = plain login cram-md5 apop
auth_verbose = yes
auth_verbose_passwords = yes
dict {
   quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext
}
first_valid_uid = 300
mail_debug = yes
mail_gid = vmail
mail_home = /srv/maildirs/%d/%n
mail_location = maildir:/srv/maildirs/%d/%n
mail_plugins = " quota"
mail_privileged_group = vmail
mail_uid = vmail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope 
encoded-character vacation subaddress comparator-i;ascii-numeric 
relational regex imap4flags copy include variables body enotify 
environment mailbox date index ihave duplicate mime foreverypart extracttext
namespace inbox {
   inbox = yes
   location =
   mailbox Drafts {
     special_use = \Drafts
   }
   mailbox Junk {
     special_use = \Junk
   }
   mailbox Sent {
     special_use = \Sent
   }
   mailbox "Sent Messages" {
     special_use = \Sent
   }
   mailbox Trash {
     special_use = \Trash
   }
   prefix =
   separator = /
   type = private
}
passdb {
   args = /etc/dovecot/dovecot-sql.conf.ext
   driver = sql
}
plugin {
   quota = dict:User quota::proxy::quota
   quota_grace = 10%%
   quota_rule = *:bytes=102400000
   quota_rule2 = Trash:storage=+100M
   quota_status_nouser = DUNNO
   quota_status_overquota = 552 5.2.2 Mailbox is over quota / Mailbox 
ist voll
   quota_status_success = DUNNO
   quota_warning = storage=95%% quota-warning 95 %u
   quota_warning2 = storage=80%% quota-warning 80 %u
   sieve = file:~/sieve;active=~/.dovecot.sieve
}
protocols = imap pop3 lmtp sieve
service auth {
   unix_listener auth-userdb {
     mode = 0777
   }
}
service imap-login {
   inet_listener imap {
     port = 143
   }
   inet_listener imaps {
     port = 993
     ssl = yes
   }
}
service lmtp {
   unix_listener /var/spool/postfix/private/dovecot-lmtp {
     group = postfix
     mode = 0666
     user = postfix
   }
}
service pop3-login {
   inet_listener pop3 {
     port = 110
   }
   inet_listener pop3s {
     port = 995
     ssl = yes
   }
}
service quota-status {
   client_limit = 1
   executable = quota-status -p postfix
   inet_listener {
     port = 10042
   }
}
service quota-warning {
   executable = script /usr/local/bin/quota-warning.sh
   unix_listener quota-warning {
     group = vmail
     mode = 0660
     user = vmail
   }
   user = vmail
}
ssl_cert = </etc/dehydrated/certs/webmail.domain.com/fullchain.pem
ssl_cipher_list = 
ALL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW at STRENGTH
ssl_dh = # hidden, use -P to show it
ssl_key = # hidden, use -P to show it
ssl_options = no_compression
ssl_prefer_server_ciphers = yes
userdb {
   driver = prefetch
}
userdb {
   args = /etc/dovecot/dovecot-sql.conf.ext
   driver = sql
}
verbose_proctitle = yes
protocol imap {
   mail_plugins = " quota imap_quota"
}


/* 
==================================================================================================================================== 
*/