Dovecot IMAP and POP3 Server

Synopsis #

Dovecot is a secure and high-performance mail delivery agent (MDA) and IMAP/POP3 server. It is commonly used alongside a mail transfer agent (MTA) such as smtpd(8), Postfix, or Exim to provide access to local mailboxes via IMAP or POP3 protocols. Dovecot supports standard mailbox formats (mbox, Maildir), secure authentication (including BSD authentication and optional SQL backends), and strong TLS integration.

This chapter explains how to install, configure, and enable Dovecot on OpenBSD for common deployment scenarios, including local delivery, virtual mailboxes, and secure IMAP access.

Features #

• IMAP4rev1 and POP3 protocols with full TLS support
• Mailbox format support: mbox, Maildir, dbox
• Authentication via BSD authentication or passwd-file, with separate user databases
• Integrated LMTP server for local delivery
• Support for virtual users and chrooted mail storage
• Built-in sieve filtering (via plugin)
• Efficient indexing and fast mail access
• Compatible with smtpd(8), Postfix, and Exim

Installing Dovecot #

Dovecot is not included in the OpenBSD base system. Install it using pkg_add(1):

doas pkg_add dovecot

OpenBSD 7.9 packages Dovecot 2.3; these examples use 2.3 configuration syntax. This installs the Dovecot daemon and example configuration files under /etc/dovecot/.

Enabling the Service #

Enable Dovecot to start at boot:

doas rcctl enable dovecot
doas rcctl start dovecot

The main configuration file is /etc/dovecot/dovecot.conf. Additional configuration is located in /etc/dovecot/conf.d/.

Configuration #

Dovecot provides a modular configuration system. Each major subsystem (e.g., protocols, authentication, mail storage) has a separate configuration file in conf.d/. These files are included from the main dovecot.conf using !include conf.d/*.conf.

Example dovecot.conf #

log_path = /var/log/dovecot.log
protocols = imap pop3 lmtp
disable_plaintext_auth = yes
!include conf.d/*.conf

Mail Location #

Define the mailbox storage format and location. For system users using Maildir under their home directory:

File: /etc/dovecot/conf.d/10-mail.conf

mail_location = maildir:~/Maildir

Alternatively, for mbox:

mail_location = mbox:~/mail:INBOX=/var/mail/%u

Ensure each user has a Maildir/ or mail/ directory initialized.

Authentication #

File: /etc/dovecot/conf.d/10-auth.conf

To authenticate system users (from /etc/passwd):

disable_plaintext_auth = yes
auth_mechanisms = plain login
!include auth-system.conf.ext

The packaged auth-system.conf.ext enables passdb { driver = bsdauth } and the system user database. PAM is not built into this OpenBSD package.

For virtual users (e.g., SQL or passwd-style files), refer to auth-passwdfile.conf.ext.

TLS Configuration #

File: /etc/dovecot/conf.d/10-ssl.conf

ssl = required
ssl_cert = </etc/ssl/mail.example.org.crt
ssl_key  = </etc/ssl/private/mail.example.org.key

Certificates may be obtained via [acme-client(1)] or another ACME implementation. Dovecot opens the certificate and key before dropping root privileges, so keep the private key readable only by root (for example, mode 0600).

Listener Configuration #

File: /etc/dovecot/conf.d/10-master.conf

Defines the socket listeners for IMAP, POP3, and LMTP.

To listen on all interfaces:

service imap-login {
  inet_listener imap {
    port = 143
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}

service pop3-login {
  inet_listener pop3 {
    port = 110
  }
  inet_listener pop3s {
    port = 995
    ssl = yes
  }
}

To disable POP3:

protocols = imap lmtp

LMTP Delivery from smtpd or Postfix #

File: /etc/dovecot/conf.d/10-master.conf

service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    mode = 0600
    user = _postfix
    group = _postfix
  }
}

That socket is for Postfix and requires its _postfix account. Set mailbox_transport = lmtp:unix:private/dovecot-lmtp in Postfix for local system-user delivery.

For OpenSMTPD with system-user mailboxes, use its Maildir delivery directly and configure Dovecot to read the same ~/Maildir:

action "local" maildir
match from local for local action "local"

This does not use the Postfix LMTP socket. An OpenSMTPD LMTP deployment needs a deliberate delivery identity, socket access policy, and recipient mapping; do not reuse the _postfix socket configuration unchanged. Test actual message delivery and IMAP access before enabling inbound mail.

Mailbox Initialization #

Each user must have a properly initialized mailbox directory. For Maildir:

mkdir -p ~/Maildir/cur ~/Maildir/new ~/Maildir/tmp
chmod -R go-rwx ~/Maildir

Dovecot will automatically create missing subdirectories when the user logs in.

Testing the Configuration #

Check Dovecot’s configuration for syntax errors:

doas dovecot -n
doas dovecot -a

Tail the log for authentication or mail access issues:

doas tail -f /var/log/dovecot.log

Using TLS #

Verify IMAP over TLS using openssl:

openssl s_client -connect mail.example.org:993

Dovecot will show a log entry upon successful connection and authentication.

User Authentication Examples #

System Users #

Use the packaged BSD authentication configuration and confirm each account is permitted to authenticate. Test both authentication and the selected mail location.

Virtual Users with passwd-file #

Create a dedicated storage account and directory before using a static user database:

doas useradd -m -d /var/vmail -s /sbin/nologin vmail

Create /etc/dovecot/users. The static user database below supplies the UID, GID, and home, so the password file contains only the login and password hash:

user1@example.org:{SHA512-CRYPT}replace-with-doveadm-pw-output

File: /etc/dovecot/conf.d/auth-passwdfile.conf.ext

passdb {
  driver = passwd-file
  args = /etc/dovecot/users
}

userdb {
  driver = static
  args = uid=vmail gid=vmail home=/var/vmail/%d/%n
}

Generate a password hash with doveadm pw -s SHA512-CRYPT, enable auth-passwdfile.conf.ext in place of system authentication, and keep mail_location = maildir:~/Maildir. Using both domain and local part in the home avoids collisions between domains.

Set ownership and permissions:

doas chown _dovecot:_dovecot /etc/dovecot/users
doas chmod 0600 /etc/dovecot/users

Dovecot Sieve Support #

Install sieve support via plugin:

doas pkg_add dovecot-pigeonhole

Edit /etc/dovecot/conf.d/20-managesieve.conf:

protocols = $protocols sieve

service managesieve-login {
  inet_listener sieve {
    port = 4190
  }
}

plugin {
  sieve = ~/.dovecot.sieve
  sieve_dir = ~/sieve
}

Enable Sieve for the actual LMTP delivery protocol as well:

protocol lmtp {
  mail_plugins = $mail_plugins sieve
}

Validate with doas dovecot -n, then restart Dovecot. A ManageSieve listener alone does not execute scripts during delivery.

Administrative Tools #

• doveadm user — list known users
• doveadm mailbox list — show user mailboxes
• doveadm auth test — verify login authentication
• doveadm log errors — show recent errors
• doveadm stats — show performance metrics
• doveadm reload — reload configuration
• doveadm kick — disconnect users

Example:

doas doveadm auth test alice@example.org password

Example output:

passdb: alice@example.org auth succeeded

File Locations #

Security and Hardening #

• Do not allow plaintext logins unless under TLS (disable_plaintext_auth = yes)
• Preserve the packaged privilege separation; mailbox processes use the configured mailbox identity
• Use strong TLS certificates
• Test mailbox ownership and authentication isolation for virtual users
• Restrict file permissions on sensitive files such as /etc/dovecot/users