Kahibaro
Discord Login Register ☰
☰
Previous
Up
Next

IMAP/POP3 with Dovecot

Table of Contents

Understanding Dovecot’s Role

Dovecot is a high‑performance IMAP/POP3 server commonly paired with MTAs like Postfix. For this chapter, assume:

Here we focus on:

Examples assume a typical Linux server (e.g., Debian/Ubuntu or RHEL‑like). Paths may vary slightly by distribution.

Installing and Enabling Dovecot

On a Debian/Ubuntu system: 

sudo apt update
sudo apt install dovecot-imapd dovecot-pop3d

On a RHEL/Fedora‑like system: 

sudo dnf install dovecot

Enable and start the service: 

sudo systemctl enable --now dovecot
sudo systemctl status dovecot

Check that it is listening (IMAP: 143, IMAPS: 993, POP3: 110, POP3S: 995): 

sudo ss -tlnp | grep dovecot

Core Dovecot Configuration Layout

Dovecot typically uses a modular config under /etc/dovecot:

Always validate syntax after changes: 

sudo dovecot -n     # show current running config
sudo dovecot -a     # all settings (including defaults)

If there is a syntax error, Dovecot will show it when you run dovecot -n.

Enabling IMAP and POP3 Services

Dovecot can serve:

Service Definitions

Services are controlled in conf.d/10-master.conf.

Typical defaults (simplified): 

service imap-login {
  inet_listener imap {
    port = 143
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}
service pop3-login {
  inet_listener pop3 {
    port = 110
  }
  inet_listener pop3s {
    port = 995
    ssl = yes
  }
}

To disable POP3 entirely, you can: 

protocols = imap

To enable both: 

protocols = imap pop3

After editing, reload: 

sudo systemctl reload dovecot

Mailbox Formats and Locations

Dovecot supports several storage formats. The two most common:

For new deployments, Maildir is almost always preferred.

Configuring Mail Location

Set in conf.d/10-mail.conf with the mail_location setting.

Maildir Example (per‑user home directory)

mail_location = maildir:~/Maildir

This means:

System‑Wide Maildir Example

If your MTA delivers into /var/mail/vhosts/example.com/alice/: 

mail_location = maildir:/var/mail/vhosts/%d/%n

%d = domain, %n = local part (user). These variables let Dovecot map virtual users to directories.

mbox Example

If you must support legacy /var/mail/username mbox plus per‑user folders in ~/mail: 

mail_location = mbox:~/mail:INBOX=/var/mail/%u

Where %u is the full username.

Indexes and Performance

Dovecot maintains index/cache files (for performance) in a parallel directory. Often: 

mail_location = maildir:~/Maildir
# Optional: separate index dir
# mail_location = maildir:~/Maildir:INDEX=/var/dovecot-indexes/%u

Indexes speed up IMAP search, sort, and flag handling.

Basic Authentication Configuration

Dovecot supports many auth backends (system users, SQL, LDAP, etc.). This chapter focuses on system users (/etc/passwd//etc/shadow) and simple virtual users as the most common setups.

Using System Users (Simple Setup)

In conf.d/10-auth.conf: 

disable_plaintext_auth = yes
auth_mechanisms = plain login
!include auth-system.conf.ext

System auth uses PAM (or passwd/shadow) depending on your distro’s Dovecot build.

Ensure that:

Virtual Users (Overview)

For domains with many users or where users should not have shell accounts, you typically use:

Example snippet for passwd‑file (conceptual): 

!include auth-passwdfile.conf.ext

And in auth-passwdfile.conf.ext: 

passdb {
  driver = passwd-file
  args = scheme=SHA512-CRYPT /etc/dovecot/users
}
userdb {
  driver = static
  args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n
}

The /etc/dovecot/users file then lists users and hashed passwords. The vmail user owns the mail directories.

Details of SQL and virtual user management are generally covered under more advanced mail server design; here you just need to recognize how Dovecot fits in.

TLS/SSL for IMAP and POP3

You should never allow unencrypted passwords over the Internet. Best practice:

Settings are in conf.d/10-ssl.conf.

Minimal TLS Configuration

ssl = required
ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
ssl_key  = </etc/letsencrypt/live/mail.example.com/privkey.pem

ssl = required forces clients to use TLS (STARTTLS or SSL ports).

If you serve both cleartext and SSL ports but want to forbid auth before STARTTLS on cleartext, disable_plaintext_auth = yes in 10-auth.conf enforces that.

STARTTLS vs SSL Ports

Many modern clients use IMAPS (993) by default; make sure imaps/pop3s listeners are configured in 10-master.conf.

IMAP‑Specific Features in Dovecot

IMAP is folder‑ and state‑aware; Dovecot implements a robust set of IMAP features.

Enabling IMAP Protocol

conf.d/20-imap.conf typically contains: 

protocol imap {
  mail_max_userip_connections = 10
}

Ensure protocols in dovecot.conf includes imap.

Namespaces and Folders (High Level)

Namespaces allow you to define which folders users see and how.

Example: classic private namespace (often default): 

namespace inbox {
  inbox = yes
  separator = /
  prefix =
}

This makes:

More complex shared/public namespace setups are used for shared mailboxes; they rely on Dovecot namespaces and ACLs beyond the basics of this chapter.

IMAP IDLE (Push‑like Notifications)

IDLE allows clients to stay connected and receive new‑mail notifications without polling.

Dovecot supports IDLE by default in IMAP. Ensure your firewall and connection limits allow long‑lived IMAP connections.

POP3‑Specific Features in Dovecot

POP3 is simpler and usually used just for downloading and optionally deleting mail from INBOX.

Enabling POP3 Protocol

In conf.d/20-pop3.conf: 

protocol pop3 {
  mail_max_userip_connections = 3
}

Ensure protocols contains pop3 if you want POP3.

POP3 UIDL and Message State

POP3 clients depend on UIDL strings to identify which messages已 been downloaded.

Dovecot generates stable UIDLs; altering message storage or indexes can affect UIDLs, which may cause clients to re‑download mail. Avoid deleting Dovecot index files unnecessarily on an active POP3 system.

Leave Messages on Server vs Delete

The POP3 protocol itself is simple; it’s the client that decides whether to:

Server‑side, Dovecot doesn’t “know” about that policy; it just applies the POP3 commands sent by the client.

Integrating Dovecot with Local Delivery

Typically, your MTA delivers mail into mailboxes that Dovecot later serves.

Common patterns:

Delivery method specifics (LDA/LMTP, plus interaction with Postfix) are usually covered in the SMTP/Postfix sections; with Dovecot you just need consistent mailbox paths and permissions.

Basic Monitoring and Troubleshooting

Checking Logs

Dovecot logs via syslog or journald. Common paths:

Look for:

Example: 

sudo journalctl -u dovecot -e

Testing IMAP/POP3 Manually

With `openssl s_client` (IMAPS/POP3S)

IMAPS: 

openssl s_client -connect mail.example.com:993 -quiet
A1 LOGIN alice@example.com supersecret
A2 LIST "" "*"
A3 LOGOUT

POP3S: 

openssl s_client -connect mail.example.com:995 -quiet
USER alice@example.com
PASS supersecret
LIST
QUIT

If TLS is working, you’ll see a certificate handshake and encrypted session. Authentication failures will be logged.

Common Issues

Hardening and Best Practices

For more advanced topics like full virtual domain setups, dovecot‑lmtp, Sieve filtering, and integration with spam/AV systems, see the broader email architecture and security chapters.

Previous
Up
Next

Views: 28

Comments

Please login to add a comment.

Don't have an account? Register now!

© 2025 Kahibaro

Visitors: 1511 / 24h

Impressum / Imprint

Datenschutz / Data Policy