- dovecot - dovecot.org

When does dovecot use sendmail_path?
by Joseph Tam 26 Jul '25

26 Jul '25

I'm trying to plug up all the holes where local mail leaves our mail system without a DKIM signature. One avenue is bounce messages. I wrote a small sendmail wrapper to add DKIM signatures, and defined it as the value for dovecot's sendmail_path. I presume Dovecot invokes this executable when it has to send a send message. Under what circumstances does this happen? I tried to provoke a mailout by sending messages to recipients with full quotas and permission locked mailbox files, but could … [View More]

2 1

Lots of problems with Dovecot 2.4
by sev+dovecot＠sev.monster 25 Jul '25

25 Jul '25

Hello all, I am trying to get Dovecot 2.4 running on Alpine Edge x86-64. But a myriad of problems have occurred that make it impossible to do so. First of all was the recent off-by-one bug that was recently fixed, which caused an unavoidable segfault on start under musl libc, which Alpine uses: https://gitlab.alpinelinux.org/alpine/aports/-/issues/17050 Then, I saw that the shadow driver was removed, which necessitated the installation of PAM and my learning about it... I haven't needed it … [View More]before, so I'd never used it. I guess I understand why the decision was made to use PAM, though I still don't like it. After resolving those issue, I've run into new ones: 1. The passwd userdb does not seem to work correctly. It is able to get the first user and its information correctly, but any attempts to look up any user after that will seemingly always use the information from the first matched user. Setting max auths to 1 so that the auth process is discarded afterwards does not seem to help. For example, if the first user to log in to Dovecot is bob, and then user joe logs in, the information returned from the passwd userdb will all be that of user bob, not joe. This continues for all subsequent userdb lookups until Dovecot is restarted, and a new userdb lookup is persisted. Changing to passwd-file instead works and does not experience this problem. 2. Why is the only available username field for the passwd driver %{passwd:system_groups_user}? I understand what the purpose of the field is based on the docs, but shouldn't more than this be exposed? The fields available through passwd are also not documented, and I had to read the source to find them out. This should either be documented or a more standard username field be additionally exposed as with other drivers. Can this field even be relied on to use as the username, if the driver otherwise worked? 3. It seems the Exim auth driver is no longer able to successfully authenticate with Dovecot 2.4 against Exim 4.98.2. It works fine in the last version of 2.3.21.1. Has the authentication framework changed along with the other modifications that 2.4 underwent? Has any effort been made with the Exim team to resolve any incompatibilities? Can I somehow diagnose this issue if it's otherwise supposed to work? 4. The ldap driver can no longer look up missing fields from LDAP users. Some (but not all) of my users have the rfc2307bis schema posixAccount supplemental objectClass, and as such contain the posixHome, uidNumber, and gidNumber attributes—but even if I specify a default value, if one of the attributes is not queryable for the returned user, the lookup errors out and the login fails. This is a regression/undocumented change from 2.3.x, where instead of erroring out, the default_fields value would be used. Based on my interpretation of the design goals for 2.4, I would imagine the default filter would ignore the missing attribute error and set the default value like default_fields used to, no? Or am I missing something? 5. passdb_ldap_filter is always required for the ldap passdb driver, even if passdb_ldap_bind is enabled. Not only does this go against the docs, but the value is unused and it doesn't matter what it's set to. This is a regression from 2.3.x. Overall I am very unimpressed by 2.4. It clearly needed a lot more time in the oven and much more thorough testing. Relevant minimal config from my working 2.3.21.1 install: auth_username_format = %Ln auth_mechanisms = plain login passdb { driver = shadow } userdb { driver = passwd override_fields = gid=mail home=/var/mail/%Ln } passdb { driver = ldap args = /etc/dovecot/ldap-passdb.conf.ext #uris = ldapi://%2frun%2fopenldap%2fslapd.sock #base = ou=accounts,dc=ldap #auth_bind = yes #auth_bind_userdn = uid=%Ln,ou=accounts,dc=ldap } userdb { driver = ldap default_fields = uid=mail gid=mail home=/var/mail/%Ln args = /etc/dovecot/ldap-userdb.conf.ext #uris = ldapi://%2frun%2fopenldap%2fslapd.sock #dn = cn=dovecot,dc=ldap #dnpass = "some pw" #base = ou=accounts,dc=ldap #iterate_filter = (objectClass=inetOrgPerson) #iterate_attrs = uid=username #user_filter = (&(objectClass=inetOrgPerson)(uid=%Ln)) #user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid } mail_location = maildir:/var/mail/%Ln mail_plugins = $mail_plugins virtual namespace inbox { inbox = yes mailbox INBOX { auto = subscribe } } namespace virtual { type = private separator = . prefix = "Search Folders." location = virtual:/etc/dovecot/virtual:INDEX=~/dovecot-virtual.cache:CONTROL=~/dovecot-virtual.cache:VOLATILEDIR=~/dovecot-virtual.cache # virtual/All/dovecot-virtual: #!INBOX #* #-Junk #-Junk* #-Spam #-Spam* #-Trash #-Trash* #-Deleted #-Deleted* #-Deleted Items #-Deleted Items* # all hidden = yes list = children subscriptions = no mailbox All { auto = subscribe special_use = \All comment = All messages, excluding Junk and Trash } } namespace virtual-user { type = private separator = . prefix = "User Search Folders." location = virtual:~/.virtual:INDEX=~/dovecot-virtual-user.cache:CONTROL=~/dovecot-virtual-user.cache:VOLATILEDIR=~/dovecot-virtual-user.cache:LAYOUT=maildir++ hidden = yes list = children subscriptions = no } service auth { unix_listener auth-userdb { # restrict userdb to dovecot user/group only instead of world read/write mode = 0660 user = $default_internal_user group = $default_internal_group } unix_listener auth-client { # give Exim access to native authentication mode = 0660 group = exim } } service auth-worker { # no need to run as root user = $default_internal_user # allow pam passdb to read /etc/shadow group = shadow } !include_try /usr/share/dovecot/protocols.d/*.conf protocol imap { mail_max_userip_connections = 25 } protocol pop3 { mail_max_userip_connections = 25 } Converted config for 2.4: dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 mail_home = /var/mail/%{user | username | lower } mail_driver = maildir mail_path = $SET:mail_home mail_plugins = virtual auth_username_format = %{user | username | lower } auth_mechanisms = plain login passdb pam { failure_show_msg = yes max_requests = 1 } userdb passwd-file { passwd_file_path = /etc/passwd fields { gid = mail } } # BUG: doesn't work right #userdb passwd { # fields { # gid = mail # } #} passdb ldap { ldap_uris = ldapi://%2frun%2fopenldap%2fslapd.sock ldap_connection_group = login ldap_base = ou=accounts,dc=ldap ldap_bind = yes ldap_bind_userdn = uid=%{user | username | lower },ou=accounts,dc=ldap # XXX: thought this wasnt needed with bind? ldap_filter = z } userdb ldap { ldap_uris = ldapi://%2frun%2fopenldap%2fslapd.sock ldap_auth_dn = cn=dovecot,dc=ldap ldap_auth_dn_password = "some pw" ldap_base = ou=accounts,dc=ldap ldap_filter = (&(objectClass=inetOrgPerson)(uid=%{user | username | lower })) fields { username = %{ldap:uid} # BUG: causes errors if rfc2307bis posixAccount objectClass is not set home = %{ldap:homeDirectory | default($SET:mail_home)} uid = %{ldap:uidNumber | default(mail)} gid = %{ldap:gidNumber | default(mail)} } ldap_iterate_filter = (objectClass=inetOrgPerson) iterate_fields { username = %{ldap:uid} } } namespace inbox { inbox = yes mailbox INBOX { auto = subscribe } } namespace virtual { type = private separator = . prefix = "Search Folders." mail_driver = virtual mail_path = /etc/dovecot/virtual # virtual/All/dovecot-virtual: #!INBOX #* #-Junk #-Junk* #-Spam #-Spam* #-Trash #-Trash* #-Deleted #-Deleted* #-Deleted Items #-Deleted Items* # all mail_index_path = ~/dovecot-virtual.cache mail_control_path = ~/dovecot-virtual.cache mail_volatile_path = ~/dovecot-virtual.cache hidden = yes list = children subscriptions = no mailbox All { auto = subscribe special_use = \All comment = All messages, excluding Junk and Trash } } namespace virtual-user { type = private separator = . prefix = "User Search Folders." mail_driver = virtual mail_path = ~/dovecot-virtual-user mail_index_path = ~/dovecot-virtual-user.cache mail_control_path = ~/dovecot-virtual-user.cache mail_volatile_path = ~/dovecot-virtual-user.cache mailbox_list_layout = Maildir++ hidden = yes list = children subscriptions = no } service auth { unix_listener auth-userdb { # restrict userdb to dovecot user/group only instead of world read/write mode = 0660 } unix_listener auth-client { # give Exim access to native authentication mode = 0660 group = exim } } service auth-worker { # no need to run as root user = $SET:default_internal_user # allow pam passdb to read /etc/shadow group = shadow } protocols = imap pop3 protocol imap { mail_max_userip_connections = 25 } protocol pop3 { mail_max_userip_connections = 25 } In addition to help with the noted issues, I'd also love if anyone more knowledgeable on Dovecot 2.4 could give any pointers on my config and if I could improve the translation in any way, given I have been fumbling around with it for weeks and am not really sure if my various decisions are correct. Best regards. [View Less]

5 5

siebe settings in 2.4.0
by Helmut K. C. Tessarek 23 Jul '25

23 Jul '25

I've been reading the docs and the migration docs for hours, but the sieve config is a mess. In 2.3.x I am using: plugin { sieve = ~/.sieve sieve_dir = ~/.sieve_storage } and this is how it looks in my home dir: $ ls -la .sie* lrwxrwxrwx 32 a b c d .sieve -> .sieve_storage/MailFilters.sieve .rw------- 0 a b c d .sieve.log .rw------- 17,414 a b c d 2025-07-08 03:00 .sieve.svbin So How do I do the same in 2.4.x? I've come so far as: sieve_script personal { driver = … [View More]

4 6

discarded vacation reply to own address <xxxx> (as specified using :addresses argument)
by Marc 23 Jul '25

23 Jul '25

Did I configure this? Or is this default behaviour of dovecot? How can I turn this off if this is a standard config?

2 1

dovecot RHEL 10 packages
by burnzerog＠gmail.com 23 Jul '25

23 Jul '25

Hi, I see only RHEL 8 and 9 packages but not for RHEL 10 in repo.dovecot.org. Do you think it can be released soon? Thank you.

2 1

Re: Strange mailq errors
by Xavier Humbert 23 Jul '25

23 Jul '25

Le 22/07/2025 16:28, Odhiambo Washington a écrit : > > > On Tue, Jul 22, 2025 at 4:42 PM Xavier Humbert via dovecot > <dovecot(a)dovecot.org> wrote: > > Hi, > > I recently experienced strange errors in mailq : > > [root@numenor ~]# mailq > -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- > 56BF31C9391 2320 Fri Jul 18 03:42:33 info(a)quora.com > (temporary failure. Command output: lda(… [View More]postfix): Error: > net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission > denied) > postfix(a)groumpf.org > > All other messages are getting in without error. > Furthermore these are probably spam which shouldn't get in, since > postfix@ is not in the authorized recipients > > When it happens, it is always spam for postfix@ > > Any idea ? > > > Check your dovecot config for the permissions: Postfix user needs > access to /var/run/dovecot/stats-writer > > V2.4: > service stats { > unix_listener stats-writer { > mode = 0660 > user = ?? > } > } > > v2.3 > unix_listener stats-writer { > user = ?? > group = ?? > mode = 0660 > } > } > > > -- > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > In an Internet failure case, the #1 suspect is a constant: DNS. > "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) > [How to ask smart questions: > http://www.catb.org/~esr/faqs/smart-questions.html] Here is the relevant part of dovecot config : service stats { unix_listener stats-reader { user = $default_internal_user group = $default_internal_user mode = 0660 } unix_listener stats-writer { user = $default_internal_user group = $default_internal_user mode = 0660 } } All other mails get in without problem. I suspect it gets in, then confuses the mail system because of proxy:unix:passwd.byname in postfix config local_recipient_maps I don't need this btw. Xavier -- Xavier HUMBERT - Unix/Win/MacOSX Sysadmin/Network Engineer https://www.amdh.fr Le 22/07/2025 16:28, Odhiambo Washington a ecrit : On Tue, Jul 22, 2025 at 4:42PM Xavier Humbert via dovecot <[1]dovecot(a)dovecot.org> wrote: Hi, I recently experienced strange errors in mailq : [root@numenor ~]# mailq -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- 56BF31C9391 2320 Fri Jul 18 03:42:33 [2]info(a)quora.com (temporary failure. Command output: lda(postfix): Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission denied) [3]postfix(a)groumpf.org All other messages are getting in without error. Furthermore these are probably spam which shouldn't get in, since postfix@ is not in the authorized recipients When it happens, it is always spam for postfix@ Any idea ? Check your dovecot config for the permissions: Postfix user needs access to /var/run/dovecot/stats-writer V2.4: service stats { unix_listener stats-writer { mode = 0660 user = ?? } } v2.3 unix_listener stats-writer { user = ?? group = ?? mode = 0660 } } -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' -\_(Tu)_/- :-) [How to ask smart questions: [4]http://www.catb.org/~esr/faqs/smart-questions.html] Here is the relevant part of dovecot config : service stats { unix_listener stats-reader { user = $default_internal_user group = $default_internal_user mode = 0660 } unix_listener stats-writer { user = $default_internal_user group = $default_internal_user mode = 0660 } } All other mails get in without problem. I suspect it gets in, then confuses the mail system because of proxy:unix:passwd.byname in postfix config local_recipient_maps I don't need this btw. Xavier -- Xavier HUMBERT - Unix/Win/MacOSX Sysadmin/Network Engineer [5]https://www.amdh.fr References Visible links 1. mailto:dovecot@dovecot.org 2. mailto:info@quora.com 3. mailto:postfix@groumpf.org 4. http://www.catb.org/~esr/faqs/smart-questions.html 5. https://www.amdh.fr/ [View Less]

2 1

Anyone have working examples of how one might go about *debugging* a userdb/passdb LUA script for authentication?
by Andy Baugh 22 Jul '25

22 Jul '25

Howdy, I've been working on upgrading the version cPanel ships to Dovecot 2.4. It appears that the "dict" driver for passdb/authdb has been removed per your documentation, with a recommendation to use a lua script instead. As such I've followed the online documentation to do so and wound up with a userdb/passdb section that looks like so: passdb cpauthd { driver = lua lua_file = /usr/local/cpanel/etc/dovecot/cpauthd.lua lua_settings { … [View More]socket = /usr/local/cpanel/var/cpdoveauthd.sock } result_internalfail = continue result_failure = return-fail } userdb cpauthd { driver = lua lua_file = /usr/local/cpanel/etc/dovecot/cpauthd.lua } My prospective lua script only takes from the socket arg passed in and reads from the socket, delivering back the same kind of answer we would have previously got from the auth dict driver (converting password_key/user_key to auth_passdb/userdb_get_cache_key in script as appears to be suggested). Unfortunately, I'm thinking that this entire setup is being ignored, as when I do: doveadm -D -o auth_debug=yes auth lookup for a user I know to be valid on the system with the previous 2.3 setup, I don't even see any indication that the lua authentication database is even consulted. Jul 18 12:32:30 Debug: auth-master: passdb lookup(zippy(a)cptest.local): Started passdb lookup Jul 18 12:32:30 Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting Jul 18 12:32:30 Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=800187,uid=0): Client connected (fd=9) Jul 18 12:32:30 Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=800187,uid=0): auth input: Jul 18 12:32:30 Error: auth-master: passdb lookup(zippy(a)cptest.local): Auth PASS lookup failed Jul 18 12:32:30 Debug: auth-master: passdb lookup(zippy(a)cptest.local): auth PASS input: Jul 18 12:32:30 Debug: auth-master: passdb lookup(zippy(a)cptest.local): Passdb lookup failed Jul 18 12:32:30 Error: cmd auth lookup: passdb lookup failed for zippy(a)cptest.local Jul 18 12:32:30 Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=800187,uid=0): Disconnected: Connection closed (fd=9) Similarly, in my lua script, I try to use the "dovecot.auth.log_debug/log_info" etc. functions in documentation within the scope of auth_passdb_lookup or auth_userdb_lookup, yet I never see any debug prints even if I add a debug line to the start of the function to indicate entry. What I would like to know is whether there is some debug flag I'm missing to see the routing from config -> lua script. Does this actually exist? I didn't see anything enlightening in the man pages or online documentation. Hopefully I'm just missing something simple. Cheers, -- Thomas "Andy" Baugh | Software Development Engineer IV andy.baugh(a)webpros.com www.webpros.com [View Less]

1 1

Strange mailq errors
by Xavier Humbert 22 Jul '25

22 Jul '25

Hi, I recently experienced strange errors in mailq : [root@numenor ~]# mailq -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- 56BF31C9391 2320 Fri Jul 18 03:42:33 info(a)quora.com (temporary failure. Command output: lda(postfix): Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission denied) &… [View More]

1 0

dovecot internal auth cache expires soon
by Burn Zero 21 Jul '25

21 Jul '25

Hi, I am new to dovecot and I am trying to prepare a POC environment. I have dovecot installed with postfix to perform SASL authentication. I'm using postgresql as auth backend which is working fine. But I am facing an issue with dovecot's internal auth cache. The internal auth cache just expires in 5 minutes. There is only one login (it's me testing) and there are no other logins. OS version: Almalinux 10 Postfix: postfix-3.8.5-8.el10.x86_64 system memory: 4 GB CPU: 2 auth_cache_size = 10M … [View More]auth_cache_ttl = 1800secs auth_cache_negative_ttl = 300secs ( I have tried this setting to 0 but it does not change anything ) Here's the dovecot -n: # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf # OS: Linux 6.12.0-55.9.1.el10_0.x86_64 x86_64 AlmaLinux release 10.0 (Purple Lion) # Hostname: localhostvm auth_cache_size = 10 M auth_cache_verify_password_with_worker = yes auth_debug = yes auth_mechanisms = plain login auth_verbose = yes login_log_format = %$: %s %f passdb { args = /etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } protocols = service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = prefetch } Here's the cache hit log: Jul 14 11:53:35 localhostvm postfix/submission/smtpd[107852]: connect from remote-server Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client in: AUTH#0112#011LOGIN#011service=smtp#011nologin#011lip=192.168.100.12#011rip=192.168.100.25 Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client passdb out: CONT#0112#011VXNlcm5hbWU6 Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client in: CONT<hidden> Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client passdb out: CONT#0112#011UGFzc3dvcmQ6 Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client in: CONT<hidden> Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: sql(user(a)tld,192.168.100.25): Performing passdb lookup Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: sql(user(a)tld,192.168.100.25): cache hit: <hidden>#011user=user@tld Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: sql(user(a)tld,192.168.100.25): cache: validating password on worker Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: Loading modules from directory: /usr/lib64/dovecot/auth Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_pgsql.so Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: sqlpool(pgsql): Creating new connection Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: sqlpool(pgsql): Creating new connection Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: conn unix:auth-worker (pid=107856,uid=97): Server accepted connection (fd=15) Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: conn unix:auth-worker (pid=107856,uid=97): Sending version handshake Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: conn unix:auth-worker (pid=107856,uid=97): auth-worker<1>: Handling PASSW request Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: conn unix:auth-worker (pid=107856,uid=97): auth-worker<1>: Finished Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: sql(user(a)tld,192.168.100.25): Finished passdb lookup Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: auth(user(a)tld,192.168.100.25): Auth request finished Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client passdb out: OK#0112#011user=user@tld Jul 14 11:53:37 localhostvm postfix/submission/smtpd[107852]: 81GFE2083CH9: client=remote-server[192.168.100.25], sasl_method=LOGIN, sasl_username=user@tld I am not sure what is causing the cache to disappear in 5 min although I have set it to 1800s. Thank you. [View Less]

3 2

GhettoForge is Moving
by Peter 20 Jul '25

20 Jul '25

For those of you who get dovecot from the GhettoForge repository please note that GhettoForge is moving to a new domain, GhettoForge.net. You will need to take some action in order to continue to receive dovecot updates from GhetttoForge. For further information please see: http://www.ghettoforge.net/index.php/Moving Peter

1 0