Dovecot

Last reviewed Sep 13, 2026 · 818 words

Almost nobody should install Dovecot by hand, and almost everybody self-hosting mail is running it. Both statements are true. Dovecot is the IMAP and POP3 server inside Mailu, Mailcow, docker-mailserver, iRedMail and Mail-in-a-Box; when your phone fetches a message from your own server, Dovecot is the process that answered. The bundles exist because a correct Dovecot config sits next to Postfix, a spam filter, Sieve, TLS, and authentication, and getting the five to agree takes a "Hard" difficulty rating honestly. This guide is about understanding the piece well enough to fix it when the bundle breaks.

Dovecot only does mailbox access, and that is the point

Dovecot stores mail and serves it to clients over IMAP on ports 143 and 993 and POP3 on 110 and 995. It does not accept mail from the internet, does not relay outbound mail, and does not filter spam. Postfix, or another MTA, receives the message and hands it to Dovecot for delivery via LMTP, at which point Dovecot writes it into Maildir or its own mdbox format and indexes it. It is 24 years old, written in C, and has run the mailboxes of large ISPs for most of that time; in practice it is the most reliable component of any stack you build, which is why the bugs you meet are nearly always in how it was told to talk to its neighbours. Postfix is the usual partner and I would not pick a different one for a first server.

The four settings that decide everything

Everything else in /etc/dovecot/conf.d/ is detail. First, the mail location: maildir:~/Maildir is the format you can inspect with ls and back up with rsync; mdbox is faster on huge folders but opaque. Second, the auth backend: system users, a passwd-file, SQL, or LDAP, and it must match what Postfix uses for SASL through the shared socket in /var/spool/postfix/private/auth. Third, the LMTP socket that Postfix delivers into, so that Sieve rules and quotas run on arrival. Fourth, TLS: the ssl_cert and ssl_key paths, pointed at the same certificate your reverse proxy renews. Run doveconf -n to print the effective config without defaults and doveadm log errors when clients cannot log in; those two commands solve most incidents.

Version 2.4 changed the config format

Dovecot 2.4 rewrote the configuration syntax. Old snippets on forums use mail_location; the new files use mail_path and mail_driver and several plugins were renamed. Copying a 2.2-era answer into a 2.4 install produces a parse error at best and a silently wrong path at worst, so check which version your distribution or bundle ships before you paste anything. The community edition also lost the dsync replication feature in that release, at last check, so the "two Dovecots mirroring each other" high-availability pattern now needs the commercial edition or a storage-level solution.

Sieve and full-text search are the features worth turning on

Server-side filtering through the Pigeonhole plugin is what makes IMAP on 3 devices bearable: rules run at delivery, so a message filed into a folder on the server is filed everywhere. Most bundles enable Pigeonhole and expose the rules through Roundcube or a ManageSieve client on port 4190. Full-text search is the other one: without an FTS plugin, searching message bodies in a 40,000-message folder means Dovecot reading every file, and mobile clients time out. The Xapian or Flatcurve backends fix that at the cost of an index roughly 20 percent of mailbox size.

Backups are files, which is the good news

Because Maildir is one file per message, backup is rsync or restic against the mail directory plus the Dovecot index directory, and restore is copying it back and running doveadm force-resync. For a migration between servers, doveadm backup or doveadm sync over SSH moves mailboxes with flags and folder structure intact. That is easier than any commercial mail platform's export, and it is the strongest argument for owning the mailbox layer at all, which the honest email post covers before recommending you think twice about the sending side.

What I'd do

Run Dovecot through Mailu or docker-mailserver rather than by hand, keep Maildir as the format, and turn on Pigeonhole and an FTS backend on day one. Learn doveconf -n, doveadm log errors, and doveadm backup so you can diagnose and move mailboxes without the bundle's help. The email category lists the bundles; pick one that has already made the jump to Dovecot 2.4 so you are not maintaining two config dialects. If all you want is IMAP for archived mail with no sending at all, a bare Dovecot with a passwd-file and 128 MB RAM is a perfectly good weekend project.