## Dovecot configuration file<\/p>\n
# If you’re in a hurry, see http:\/\/wiki.dovecot.org\/QuickConfiguration<\/p>\n
# “dovecot -n” command gives a clean output of the changed settings. Use it
\n# instead of copy&pasting this file when posting to the Dovecot mailing list.<\/p>\n
# ‘#’ character and everything after it is treated as comments. Extra spaces
\n# and tabs are ignored. If you want to use either of these explicitly, put the
\n# value inside quotes, eg.: key = “# char and trailing whitespace ”<\/p>\n
# Default values are shown for each setting, it’s not required to uncomment
\n# any of the lines.<\/p>\n
# Base directory where to store runtime data.
\n#base_dir = \/var\/run\/dovecot\/<\/p>\n
# Protocols we want to be serving: imap imaps pop3 pop3s # IP or host address where to listen in for connections. It’s not currently # Disable LOGIN command and all other plaintext authentications unless # Should all IMAP and POP3 processes be killed when Dovecot master process ## # Log file to use for error messages, instead of sending them to syslog. # Log file to use for informational and debug messages. # Prefix for each line written to log file. % codes are in strftime(3) # Syslog facility to use if you’re logging to syslog. Usually if you don’t ## # IP or host address where to listen in for SSL connections. Defaults # Disable SSL\/TLS support. # PEM encoded X.509 SSL\/TLS certificate and private key. They’re opened before # If key file is password protected, give the password here. Alternatively # File containing trusted SSL certificate authorities. Usually not needed. # Request client to send a certificate. If you also want to require it, set # How often to regenerate the SSL parameters file. Generation is quite CPU # SSL ciphers to use # Show protocol level SSL errors. ## #<\/p>\n # Directory where authentication process places authentication UNIX sockets # chroot login process to the login_dir. Only reason not to do this is if you # User to use for the login process. Create a completely new user for this, # Set max. process size in megabytes. If you don’t use # Should each login be processed in it’s own process (yes), or should one # Number of login processes to keep for listening new connections. # Maximum number of login processes to create. The listening process count # Maximum number of connections allowed per each login process. This setting # Greeting message for clients. # Space-separated list of elements we want to log. The elements which have # Login log format. %$ contains login_log_format_elements string, %s contains ## # Location for users’ mailboxes. This is the same as the old default_mail_env # If you need to set multiple mailbox locations or want to change default # Prefix required to access this namespace. This needs to be different for # Physical location of the mailbox. This is in same format as # There can be only one INBOX, and this setting defines which namespace # If namespace is hidden, it’s not advertised to clients via NAMESPACE # Group to enable temporarily for privileged operations. Currently this is # Grant access to these supplementary groups for mail processes. Typically # Allow full filesystem access to clients. There’s no access checks other than ## # Enable mail process debugging. This can help you figure out why Dovecot # Log prefix for mail processes. See doc\/wiki\/Variables.txt for list of # Max. number of lines a mail process is allowed to log per second before it’s # Don’t use mmap() at all. This is required if you store indexes to shared # Don’t write() to mmaped files. This is required for some operating systems # Rely on O_EXCL to work when creating dotlock files. The default is to use # Don’t use fsync() or fdatasync() calls. This makes the performance better # Locking method for index files. Alternatives are fcntl, flock and dotlock. # Drop all privileges before exec()ing the mail process. This is mostly # Show more verbose process titles (in ps). Currently shows user name and # Valid UID range for users, defaults to 500 and above. This is mostly # Valid GID range for users, defaults to non-root\/wheel. Users having # Maximum number of running mail processes. When this limit is reached, # Set max. process size in megabytes. Most of the memory goes to mmap()ing # Maximum allowed length for mail keyword name. It’s only forced when trying # ‘:’ separated list of directories under which chrooting is allowed for mail # Default chroot directory for mail processes. This can be overridden for ## # Space-separated list of fields to initially save into cache file. Currently # Space-separated list of fields that Dovecot should never save to cache file. # The minimum number of mails in a mailbox before updates are done to cache # When IDLE command is running, mailbox is checked once in a while to see if # Save mails with CR+LF instead of plain LF. This makes sending those mails ## # By default LIST command returns all entries in maildir beginning with a dot. # When copying a message, do it with hard links whenever possible. This makes # When copying a message, try to preserve the base filename. Only if the ## # Which locking methods to use for locking mbox. There are four available: # Maximum time in seconds to wait for lock (all of them) before aborting. # If dotlock exists but the mailbox isn’t modified in any way, override the # When mbox changes unexpectedly we have to fully read it to find out what # Like mbox_dirty_syncs, but don’t do full syncs even with SELECT, EXAMINE, # Delay writing mbox headers until doing a full write sync (EXPUNGE and CHECK # If mbox size is smaller than this (in kilobytes), don’t write index files. ## # Maximum dbox file size in kilobytes until it’s rotated. # Minimum dbox file size in kilobytes before it’s rotated # Maximum dbox file age in days until it’s rotated. Day always begins from ## protocol imap { # IMAP executable location. Changing this allows you to execute other # Maximum IMAP command line length in bytes. Some clients generate very long # Support for dynamically loadable plugins. mail_plugins is a space separated # Send IMAP capabilities in greeting message. This makes it unnecessary for # Override the IMAP CAPABILITY response. # Workarounds for various client bugs: ## protocol pop3 { # POP3 executable location. See IMAP’s mail_executable above for examples # Don’t try to set mails non-recent or seen with POP3 sessions. This is # Support LAST command which exists in old POP3 specs, but has been removed # If mail has X-UIDL header, use it as the mail’s UIDL. # Keep the mailbox locked for the entire POP3 session. # POP3 UIDL (unique mail identifier) format to use. You can use following # POP3 logout format string: # Support for dynamically loadable plugins. mail_plugins is a space separated # Workarounds for various client bugs: ## protocol lda { # Hostname to use in various parts of sent mails, eg. in Message-Id. # Support for dynamically loadable plugins. mail_plugins is a space separated # Binary to use for sending mails. # UNIX socket path to master authentication server to find users. ## # Executable location # Set max. process size in megabytes. # Authentication cache size in kilobytes. 0 means it’s disabled. # Space separated list of realms for SASL authentication mechanisms that need # Default realm\/domain to use if none was specified. This is used for both # List of allowed characters in username. If the user-given username contains # Username character translations before it’s looked up from databases. The # Username formatting before it’s looked up from databases. You can use # If you want to allow master users to log in by specifying the master # Username to use for users logging in with ANONYMOUS SASL mechanism # More verbose logging. Useful for figuring out why authentication isn’t # Even more verbose logging for debugging purposes. Shows for example SQL # In case of password mismatches, log the passwords and used scheme so the # Maximum number of dovecot-auth worker processes. They’re used to execute # Host name to use in GSSAPI principal names. The default is to use the # Kerberos keytab to use for the GSSAPI mechanism. Will use the system auth default { # # Users can be temporarily disabled by adding a passdb with deny=yes. #passdb passwd-file { # PAM authentication. Preferred nowadays by most systems. # System users (NSS, \/etc\/passwd, or similiar) # Shadow passwords for system users (NSS, \/etc\/shadow or similiar). # PAM-like authentication for OpenBSD. # passwd-like file with specified location # checkpassword executable authentication # SQL database # LDAP database # vpopmail authentication # # System users (NSS, \/etc\/passwd, or similiar). In many systems nowadays this # passwd-like file with specified location # static settings generated from template # SQL database # LDAP database # vpopmail # “prefetch” user database means that the passdb already provided the # User to use for the process. This user needs access to only user and # Directory where to chroot the process. Most authentication backends don’t # Number of authentication processes to create # Require a valid SSL client certificate or the authentication fails. # Take the username from client’s SSL certificate, using # It’s possible to export the authentication interface to other programs: # If you wish to use another authentication server than dovecot-auth, you can ## # Dictionary can be used by some plugins to store key=value lists. dict { ## plugin { # Quota plugin. Multiple backends are supported: # ACL plugin. vfile backend reads ACLs from “dovecot-acl” file from maildir # Convert plugin. If set, specifies the source storage path which is # Lazy expunge plugin. Currently works only with maildirs. When a user ## Dovecot configuration file # If you’re in a hurry, see http:\/\/wiki.dovecot.org\/QuickConfiguration # & … <\/p>\n
\n# If you only want to use dovecot-auth, you can set this to “none”.
\n#protocols = imap imaps pop3 pop3s
\nprotocols = imaps pop3s<\/span><\/strong><\/p>\n
\n# possible to specify multiple addresses. “*” listens in all IPv4 interfaces.
\n# “[::]” listens in all IPv6 interfaces, but may also listen in all IPv4
\n# interfaces depending on the operating system.
\n#
\n# If you want to specify ports for each service, you will need to configure
\n# these settings inside the protocol imap\/pop3 { … } section, so you can
\n# specify different ports for IMAP\/POP3. For example:
\n# protocol imap {
\n# listen = *:10143
\n# ssl_listen = *:10943
\n# ..
\n# }
\n# protocol pop3 {
\n# listen = *:10100
\n# ..
\n# }
\n#listen = [::]<\/p>\n
\n# SSL\/TLS is used (LOGINDISABLED capability). Note that if the remote IP
\n# matches the local IP (ie. you’re connecting from the same computer), the
\n# connection is considered secure and plaintext authentication is allowed.
\n#disable_plaintext_auth = no<\/p>\n
\n# shuts down. Setting this to “no” means that Dovecot can be upgraded without
\n# forcing existing client connections to close (although that could also be
\n# a problem if the upgrade is eg. because of a security fix). This however
\n# means that after master process has died, the client processes can’t write
\n# to log files anymore.
\n#shutdown_clients = yes<\/p>\n
\n## Logging
\n##<\/p>\n
\n# \/dev\/stderr can be used to log into stderr.
\n#log_path =<\/p>\n
\n# Default is the same as log_path.
\n#info_log_path =<\/p>\n
\n# format.
\n#log_timestamp = “%b %d %H:%M:%S ”<\/p>\n
\n# want to use “mail”, you’ll use local0..local7. Also other standard
\n# facilities are supported.
\n#syslog_facility = mail<\/p>\n
\n## SSL settings
\n##<\/p>\n
\n# to above if not specified.
\n#ssl_listen =<\/p>\n
\nssl_disable = no<\/span><\/strong><\/p>\n
\n# dropping root privileges, so keep the key file unreadable by anyone but
\n# root. Included doc\/mkcert.sh can be used to easily generate self-signed
\n# certificate, just make sure to update the domains in dovecot-openssl.cnf
\n#ssl_cert_file = \/etc\/pki\/dovecot\/certs\/dovecot.pem
\n#ssl_key_file = \/etc\/pki\/dovecot\/private\/dovecot.pem
\nssl_cert_file = \/etc\/pki\/tls\/certs\/mail.pem<\/span><\/strong>
\n ssl_key_file = \/etc\/pki\/tls\/certs\/mail.pem<\/span><\/strong><\/p>\n
\n# give it when starting dovecot with -p parameter. Since this file is often
\n# world-readable, you may want to place this setting instead to a different
\n# root owned 0600 file by using !include_try .
\n#ssl_key_password =<\/p>\n
\n# The CAfile should contain the CA-certificate(s) followed by the matching
\n# CRL(s). CRL checking is new in dovecot .rc1
\n#ssl_ca_file =<\/p>\n
\n# ssl_require_client_cert=yes in auth section.
\n#ssl_verify_client_cert = no<\/p>\n
\n# intensive operation. The value is in hours, 0 disables regeneration
\n# entirely.
\n#ssl_parameters_regenerate = 168<\/p>\n
\n#ssl_cipher_list = ALL:!LOW<\/p>\n
\n#verbose_ssl = no<\/p>\n
\n## Login processes
\n##<\/p>\n
\n# which login needs to be able to connect to. The sockets are created when
\n# running as root, so you don’t have to worry about permissions. Note that
\n# everything in this directory is deleted when Dovecot is started.
\n#login_dir = \/var\/run\/dovecot\/login<\/p>\n
\n# wish to run the whole Dovecot without roots.
\n#login_chroot = yes<\/p>\n
\n# and don’t use it anywhere else. The user must also belong to a group where
\n# only it has access, it’s used to control access for authentication process.
\n# Note that this user is NOT used to access mails.
\n#login_user = dovecot<\/p>\n
\n# login_process_per_connection you might need to grow this.
\n#login_process_size = 64<\/p>\n
\n# login process be allowed to process multiple connections (no)? Yes is more
\n# secure, espcially with SSL\/TLS enabled. No is faster since there’s no need
\n# to create processes all the time.
\n#login_process_per_connection = yes<\/p>\n
\n#login_processes_count = 3<\/p>\n
\n# usually stays at login_processes_count, but when multiple users start logging
\n# in at the same time more extra processes are created. To prevent fork-bombing
\n# we check only once in a second if new processes should be created – if all
\n# of them are used at the time, we double their amount until the limit set by
\n# this setting is reached.
\n#login_max_processes_count = 128<\/p>\n
\n# is used only if login_process_per_connection=no. Once the limit is reached,
\n# the process notifies master so that it can create a new login process.
\n# You should make sure that the process has at least
\n# 16 + login_max_connections * 2 available file descriptors.
\n#login_max_connections = 256<\/p>\n
\n#login_greeting = Dovecot ready.<\/p>\n
\n# a non-empty variable value are joined together to form a comma-separated
\n# string.
\n#login_log_format_elements = user= method=%m rip=%r lip=%l %c<\/p>\n
\n# the data we want to log.
\n#login_log_format = %$: %s<\/p>\n
\n## Mailbox locations and namespaces
\n##<\/p>\n
\n# setting. The default is empty, which means that Dovecot tries to find the
\n# mailboxes automatically. This won’t work if the user doesn’t have any mail
\n# yet, so you should explicitly tell Dovecot the full location.
\n#
\n# If you’re using mbox, giving a path to the INBOX file (eg. \/var\/mail\/%u)
\n# isn’t enough. You’ll also need to tell Dovecot where the other mailboxes are
\n# kept. This is called the “root mail directory”, and it must be the first
\n# path given in the mail_location setting.
\n#
\n# There are a few special variables you can use, eg.:
\n#
\n# %u – username
\n# %n – user part in user@domain, same as %u if there’s no domain
\n# %d – domain part in user@domain, empty if there’s no domain
\n# %h – home directory
\n#
\n# See doc\/wiki\/Variables.txt for full list. Some examples:
\n#
\n# mail_location = maildir:~\/Maildir
\n# mail_location = mbox:~\/mail:INBOX=\/var\/mail\/%u
\n# mail_location = mbox:\/var\/mail\/%d\/%1n\/%n:INDEX=\/var\/indexes\/%d\/%1n\/%n
\n#
\n#
\n#
\nmail_location = maildir:~\/Maildir<\/span><\/strong><\/p>\n
\n# namespace settings, you can do it by defining namespace sections.
\n# NOTE: Namespaces currently work ONLY with IMAP! POP3 and LDA currently ignore
\n# namespaces completely, they use only the mail_location setting.
\n#
\n# You can have private, shared and public namespaces. The only difference
\n# between them is how Dovecot announces them to client via NAMESPACE
\n# extension. Shared namespaces are meant for user-owned mailboxes which are
\n# shared to other users, while public namespaces are for more globally
\n# accessible mailboxes.
\n#
\n# REMEMBER: If you add any namespaces, the default namespace must be added
\n# explicitly, ie. mail_location does nothing unless you have a namespace
\n# without a location setting. Default namespace is simply done by having a
\n# namespace with empty prefix.
\n#namespace private {
\n# Hierarchy separator to use. You should use the same separator for all
\n# namespaces or some clients get confused. ‘\/’ is usually a good one.
\n# The default however depends on the underlying mail storage format.
\n#separator =<\/p>\n
\n# all namespaces. For example “Public\/”.
\n#prefix =<\/p>\n
\n# mail_location, which is also the default for it.
\n#location =<\/p>\n
\n# has it.
\n#inbox = yes<\/p>\n
\n# extension or shown in LIST replies. This is mostly useful when converting
\n# from another server with different namespaces which you want to depricate
\n# but still keep working. For example you can create hidden namespaces with
\n# prefixes “~\/mail\/”, “~%u\/mail\/” and “mail\/”.
\n#hidden = yes
\n#}<\/p>\n
\n# used only for creating mbox dotlock files when creation fails for INBOX.
\n# Typically this is set to “mail” to give access to \/var\/mail.
\n#mail_privileged_group =<\/p>\n
\n# these are used to set up access to shared mailboxes. Note that it may be
\n# dangerous to set these if users can create symlinks (e.g. if “mail” group is
\n# set here, ln -s \/var\/mail ~\/mail\/var could allow a user to delete others’
\n# mailboxes, or ln -s \/secret\/shared\/box ~\/mail\/mybox would allow reading it).
\n#mail_access_groups =<\/p>\n
\n# what the operating system does for the active UID\/GID. It works with both
\n# maildir and mboxes, allowing you to prefix mailboxes names with eg. \/path\/
\n# or ~user\/.
\n#mail_full_filesystem_access = no<\/p>\n
\n## Mail processes
\n##<\/p>\n
\n# isn’t finding your mails.
\n#mail_debug = no<\/p>\n
\n# possible variables you can use.
\n#mail_log_prefix = “%Us(%u): ”<\/p>\n
\n# throttled. 0 means unlimited. Typically there’s no need to change this
\n# unless you’re using mail_log plugin, which may log a lot.
\n#mail_log_max_lines_per_sec = 10<\/p>\n
\n# filesystems (NFS or clustered filesystem).
\n#mmap_disable = no<\/p>\n
\n# which use separate caches for them, such as OpenBSD.
\n#mmap_no_write = no<\/p>\n
\n# hard linking. O_EXCL makes the dotlocking faster, but it doesn’t always
\n# work with NFS.
\n#dotlock_use_excl = no<\/p>\n
\n# at the cost of potential data loss if the server (or the file server)
\n# goes down.
\n#fsync_disable = no<\/p>\n
\n# Dotlocking uses some tricks which may create more disk I\/O than other locking
\n# methods. NFS users: flock doesn’t work, remember to change mmap_disable.
\n#lock_method = fcntl<\/p>\n
\n# meant for debugging, otherwise you don’t get core dumps. It could be a small
\n# security risk if you use single UID for multiple users, as the users could
\n# ptrace() each others processes then.
\n#mail_drop_priv_before_exec = no<\/p>\n
\n# IP address. Useful for seeing who are actually using the IMAP processes
\n# (eg. shared mailboxes or if same uid is used for multiple accounts).
\n#verbose_proctitle = no<\/p>\n
\n# to make sure that users can’t log in as daemons or other system users.
\n# Note that denying root logins is hardcoded to dovecot binary and can’t
\n# be done even if first_valid_uid is set to 0.
\n#first_valid_uid = 500
\n#last_valid_uid = 0<\/p>\n
\n# non-valid GID as primary group ID aren’t allowed to log in. If user
\n# belongs to supplementary groups with non-valid GIDs, those groups are
\n# not set.
\n#first_valid_gid = 1
\n#last_valid_gid = 0<\/p>\n
\n# new users aren’t allowed to log in.
\n#max_mail_processes = 1024<\/p>\n
\n# files, so it shouldn’t harm much even if this limit is set pretty high.
\n#mail_process_size = 256<\/p>\n
\n# to create new keywords.
\n#mail_max_keyword_length = 50<\/p>\n
\n# processes (ie. \/var\/mail will allow chrooting to \/var\/mail\/foo\/bar too).
\n# This setting doesn’t affect login_chroot or auth chroot variables.
\n# WARNING: Never add directories here which local users can modify, that
\n# may lead to root exploit. Usually this should be done only if you don’t
\n# allow shell access for users.
\n#valid_chroot_dirs =<\/p>\n
\n# specific users in user database by giving \/.\/ in user’s home directory
\n# (eg. \/home\/.\/user chroots into \/home). Note that usually there is no real
\n# need to do chrooting, Dovecot doesn’t allow users to access files outside
\n# their mail directory anyway.
\n#mail_chroot =<\/p>\n
\n## Mailbox handling optimizations
\n##<\/p>\n
\n# these fields are allowed:
\n#
\n# flags, date.sent, date.received, size.virtual, size.physical
\n# mime.parts, imap.body, imap.bodystructure
\n#
\n# Different IMAP clients work in different ways, so they benefit from
\n# different cached fields. Some do not benefit from them at all. Caching more
\n# than necessary generates useless disk I\/O, so you don’t want to do that
\n# either.
\n#
\n# Dovecot attempts to automatically figure out what client wants and it keeps
\n# only that. However the first few times a mailbox is opened, Dovecot hasn’t
\n# yet figured out what client needs, so it may not perform optimally. If you
\n# know what fields the majority of your clients need, it may be useful to set
\n# these fields by hand. If client doesn’t actually use them, Dovecot will
\n# eventually drop them.
\n#
\n# Usually you should just leave this field alone. The potential benefits are
\n# typically unnoticeable.
\n#mail_cache_fields =<\/p>\n
\n# Useful if you want to save disk space at the cost of more I\/O when the fields
\n# needed.
\n#mail_never_cache_fields =<\/p>\n
\n# file. This allows optimizing Dovecot’s behavior to do less disk writes at
\n# the cost of more disk reads.
\n#mail_cache_min_mail_count = 0<\/p>\n
\n# there are any new mails or other changes. This setting defines the minimum
\n# time in seconds to wait between those checks. Dovecot can also use dnotify,
\n# inotify and kqueue to find out immediately when changes occur.
\n#mailbox_idle_check_interval = 30<\/p>\n
\n# take less CPU, especially with sendfile() syscall with Linux and FreeBSD.
\n# But it also creates a bit more disk I\/O which may just make it slower.
\n# Also note that if other software reads the mboxes\/maildirs, they may handle
\n# the extra CRs wrong and cause problems.
\n#mail_save_crlf = no<\/p>\n
\n## Maildir-specific settings
\n##<\/p>\n
\n# Enabling this option makes Dovecot return only entries which are directories.
\n# This is done by stat()ing each entry, so it causes more disk I\/O.
\n# (For systems setting struct dirent->d_type, this check is free and it’s
\n# done always regardless of this setting)
\n#maildir_stat_dirs = no<\/p>\n
\n# the performance much better, and it’s unlikely to have any side effects.
\n#maildir_copy_with_hardlinks = no<\/p>\n
\n# destination mailbox already contains the same name (ie. the mail is being
\n# copied there twice), a new name is given. The destination filename check is
\n# done only by looking at dovecot-uidlist file, so if something outside
\n# Dovecot does similar filename preserving copies, you may run into problems.
\n# NOTE: This setting requires maildir_copy_with_hardlinks = yes to work.
\n#maildir_copy_preserve_filename = no<\/p>\n
\n## mbox-specific settings
\n##<\/p>\n
\n# dotlock: Create .lock file. This is the oldest and most NFS-safe
\n# solution. If you want to use \/var\/mail\/ like directory, the users
\n# will need write access to that directory.
\n# fcntl : Use this if possible. Works with NFS too if lockd is used.
\n# flock : May not exist in all systems. Doesn’t work with NFS.
\n# lockf : May not exist in all systems. Doesn’t work with NFS.
\n#
\n# You can use multiple locking methods; if you do the order they’re declared
\n# in is important to avoid deadlocks if other MTAs\/MUAs are using multiple
\n# locking methods as well. Some operating systems don’t allow using some of
\n# them simultaneously.
\n#mbox_read_locks = fcntl
\n#mbox_write_locks = fcntl<\/p>\n
\n#mbox_lock_timeout = 300<\/p>\n
\n# lock file after this many seconds.
\n#mbox_dotlock_change_timeout = 120<\/p>\n
\n# changed. If the mbox is large this can take a long time. Since the change
\n# is usually just a newly appended mail, it’d be faster to simply read the
\n# new mails. If this setting is enabled, Dovecot does this but still safely
\n# fallbacks to re-reading the whole mbox file whenever something in mbox isn’t
\n# how it’s expected to be. The only real downside to this setting is that if
\n# some other MUA changes message flags, Dovecot doesn’t notice it immediately.
\n# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK
\n# commands.
\n#mbox_dirty_syncs = yes<\/p>\n
\n# EXPUNGE or CHECK commands. If this is set, mbox_dirty_syncs is ignored.
\n#mbox_very_dirty_syncs = no<\/p>\n
\n# commands and when closing the mailbox). This is especially useful for POP3
\n# where clients often delete all mails. The downside is that our changes
\n# aren’t immediately visible to other MUAs.
\n#mbox_lazy_writes = yes<\/p>\n
\n# If an index file already exists it’s still read, just not updated.
\n#mbox_min_index_size = 0<\/p>\n
\n## dbox-specific settings
\n##<\/p>\n
\n#dbox_rotate_size = 2048<\/p>\n
\n# (overrides dbox_rotate_days)
\n#dbox_rotate_min_size = 16<\/p>\n
\n# midnight, so 1 = today, 2 = yesterday, etc. 0 = check disabled.
\n#dbox_rotate_days = 0<\/p>\n
\n## IMAP specific settings
\n##<\/p>\n
\n# Login executable location.
\n#login_executable = \/usr\/libexec\/dovecot\/imap-login<\/p>\n
\n# binaries before the imap process is executed.
\n#
\n# This would write rawlogs into ~\/dovecot.rawlog\/ directory:
\n# mail_executable = \/usr\/libexec\/dovecot\/rawlog \/usr\/libexec\/dovecot\/imap
\n#
\n# This would attach gdb into the imap process and write backtraces into
\n# \/tmp\/gdbhelper.* files:
\n# mail_executable = \/usr\/libexec\/dovecot\/gdbhelper \/usr\/libexec\/dovecot\/imap
\n#
\n#mail_executable = \/usr\/libexec\/dovecot\/imap<\/p>\n
\n# command lines with huge mailboxes, so you may need to raise this if you get
\n# “Too long argument” or “IMAP command line too large” errors often.
\n#imap_max_line_length = 65536<\/p>\n
\n# list of plugins to load.
\n#mail_plugins =
\n#mail_plugin_dir = \/usr\/lib\/dovecot\/imap<\/p>\n
\n# clients to request it with CAPABILITY command, so it saves one round-trip.
\n# Many clients however don’t understand it and ask the CAPABILITY anyway.
\n#login_greeting_capability = no<\/p>\n
\n#imap_capability =<\/p>\n
\n# delay-newmail:
\n# Send EXISTS\/RECENT new mail notifications only when replying to NOOP
\n# and CHECK commands. Some clients ignore them otherwise, for example OSX
\n# Mail ( # may show user “Message no longer in server” errors. Note that OE6 still
\n# breaks even with this workaround if synchronization is set to
\n# “Headers Only”.
\n# outlook-idle:
\n# Outlook and Outlook Express never abort IDLE command, so if no mail
\n# arrives in half a hour, Dovecot closes the connection. This is still
\n# fine, except Outlook doesn’t connect back so you don’t see if new mail
\n# arrives.
\n# netscape-eoh:
\n# Netscape 4.x breaks if message headers don’t end with the empty “end of
\n# headers” line. Normally all messages have this, but setting this
\n# workaround makes sure that Netscape never breaks by adding the line if
\n# it doesn’t exist. This is done only for FETCH BODY[HEADER.FIELDS..]
\n# commands. Note that RFC says this shouldn’t be done.
\n# tb-extra-mailbox-sep:
\n# With mbox storage a mailbox can contain either mails or submailboxes,
\n# but not both. Thunderbird separates these two by forcing server to
\n# accept ‘\/’ suffix in mailbox names in subscriptions list.
\n# The list is space-separated.
\n#imap_client_workarounds = outlook-idle
\n}<\/p>\n
\n## POP3 specific settings
\n##<\/p>\n
\n# Login executable location.
\n#login_executable = \/usr\/libexec\/dovecot\/pop3-login<\/p>\n
\n# how this could be changed.
\n#mail_executable = \/usr\/libexec\/dovecot\/pop3<\/p>\n
\n# mostly intended to reduce disk I\/O. With maildir it doesn’t move files
\n# from new\/ to cur\/, with mbox it doesn’t write Status-header.
\n#pop3_no_flag_updates = no<\/p>\n
\n# from new ones. Some clients still wish to use this though. Enabling this
\n# makes RSET command clear all \\Seen flags from messages.
\n#pop3_enable_last = no<\/p>\n
\n#pop3_reuse_xuidl = no<\/p>\n
\n#pop3_lock_session = no<\/p>\n
\n# variables:
\n#
\n# %v – Mailbox’s IMAP UIDVALIDITY
\n# %u – Mail’s IMAP UID
\n# %m – MD5 sum of the mailbox headers in hex (mbox only)
\n# %f – filename (maildir only)
\n#
\n# If you want UIDL compatibility with other POP3 servers, use:
\n# UW’s ipop3d : %08Xv%08Xu
\n# Courier version 0 : %f
\n# Courier version 1 : %u
\n# Courier version 2 : %v-%u
\n# Cyrus (= 2.1.4) : %v.%u
\n# Older Dovecots : %v.%u
\n# tpop3d : %Mf
\n#
\n# Note that Outlook 2003 seems to have problems with %v.%u format which was
\n# Dovecot’s default, so if you’re building a new server it would be a good
\n# idea to change this. %08Xu%08Xv should be pretty fail-safe.
\n#
\n# NOTE: Nowadays this is required to be set explicitly, since the old
\n# default was bad but it couldn’t be changed without breaking existing
\n# installations. %08Xu%08Xv will be the new default, so use it for new
\n# installations.
\n#
\n#pop3_uidl_format = %08Xu%08Xv<\/p>\n
\n# %t – number of TOP commands
\n# %p – number of bytes sent to client as a result of TOP command
\n# %r – number of RETR commands
\n# %b – number of bytes sent to client as a result of RETR command
\n# %d – number of deleted messages
\n# %m – number of messages (before deletion)
\n# %s – mailbox size in bytes (before deletion)
\n#pop3_logout_format = top=%t\/%p, retr=%r\/%b, del=%d\/%m, size=%s<\/p>\n
\n# list of plugins to load.
\n#mail_plugins =
\n#mail_plugin_dir = \/usr\/lib\/dovecot\/pop3<\/p>\n
\n# outlook-no-nuls:
\n# Outlook and Outlook Express hang if mails contain NUL characters.
\n# This setting replaces them with 0x80 character.
\n# oe-ns-eoh:
\n# Outlook Express and Netscape Mail breaks if end of headers-line is
\n# missing. This option simply sends it if it’s missing.
\n# The list is space-separated.
\n#pop3_client_workarounds =
\n}<\/p>\n
\n## LDA specific settings
\n##<\/p>\n
\n# Address to use when sending rejection mails.
\npostmaster_address = postmaster@example.com<\/p>\n
\n# Default is the system’s real hostname.
\n#hostname =<\/p>\n
\n# list of plugins to load.
\n#mail_plugins =
\n#mail_plugin_dir = \/usr\/lib\/dovecot\/lda<\/p>\n
\n#sendmail_path = \/usr\/lib\/sendmail<\/p>\n
\n#auth_socket_path = \/var\/run\/dovecot\/auth-master
\n}<\/p>\n
\n## Authentication processes
\n##<\/p>\n
\n#auth_executable = \/usr\/libexec\/dovecot\/dovecot-auth<\/p>\n
\n#auth_process_size = 256<\/p>\n
\n# Note that bsdauth, PAM and vpopmail require cache_key to be set for caching
\n# to be used.
\n#auth_cache_size = 0
\n# Time to live in seconds for cached data. After this many seconds the cached
\n# record is no longer used, *except* if the main database lookup returns
\n# internal failure. We also try to handle password changes automatically: If
\n# user’s previous authentication was successful, but this one wasn’t, the
\n# cache isn’t used. For now this works only with plaintext authentication.
\n#auth_cache_ttl = 3600<\/p>\n
\n# them. You can leave it empty if you don’t want to support multiple realms.
\n# Many clients simply use the first one listed here, so keep the default realm
\n# first.
\n#auth_realms =<\/p>\n
\n# SASL realms and appending @domain to username in plaintext logins.
\n#auth_default_realm =<\/p>\n
\n# a character not listed in here, the login automatically fails. This is just
\n# an extra check to make sure user can’t exploit any potential quote escaping
\n# vulnerabilities with SQL\/LDAP databases. If you want to allow all characters,
\n# set this value to empty.
\n#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@<\/p>\n
\n# value contains series of from -> to characters. For example “#@\/@” means
\n# that ‘#’ and ‘\/’ characters are translated to ‘@’.
\n#auth_username_translation =<\/p>\n
\n# the standard variables here, eg. %Lu would lowercase the username, %n would
\n# drop away the domain if it was given, or “%n-AT-%d” would change the ‘@’ into
\n# “-AT-“. This translation is done after auth_username_translation changes.
\n#auth_username_format =<\/p>\n
\n# username within the normal username string (ie. not using SASL mechanism’s
\n# support for it), you can specify the separator character here. The format
\n# is then . UW-IMAP uses “*” as the
\n# separator, so that could be a good choice.
\n#auth_master_user_separator =<\/p>\n
\n#auth_anonymous_username = anonymous<\/p>\n
\n# working.
\n#auth_verbose = no<\/p>\n
\n# queries.
\n#auth_debug = no<\/p>\n
\n# problem can be debugged. Requires auth_debug=yes to be set.
\n#auth_debug_passwords = no<\/p>\n
\n# blocking passdb and userdb queries (eg. MySQL and PAM). They’re
\n# automatically created and destroyed as needed.
\n#auth_worker_max_count = 30<\/p>\n
\n# name returned by gethostname().
\n#auth_gssapi_hostname =<\/p>\n
\n# default (usually \/etc\/krb5.keytab) if not specified.
\n#auth_krb5_keytab =<\/p>\n
\n# Space separated list of wanted authentication mechanisms:
\n# plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi
\n# NOTE: See also disable_plaintext_auth setting.
\nmechanisms = plain<\/p>\n
\n# Password database is used to verify user’s password (and nothing more).
\n# You can have multiple passdbs and userdbs. This is useful if you want to
\n# allow both system users (\/etc\/passwd) and virtual users to login without
\n# duplicating the system users into virtual database.
\n#
\n#
\n#
\n# By adding master=yes setting inside a passdb you make the passdb a list
\n# of “master users”, who can log in as anyone else. Unless you’re using PAM,
\n# you probably still want the destination user to be looked up from passdb
\n# that it really exists. This can be done by adding pass=yes setting to the
\n# master passdb.<\/p>\n
\n# If the user is found from that database, authentication will fail.
\n# The deny passdb should always be specified before others, so it gets
\n# checked first. Here’s an example:<\/p>\n
\n# File contains a list of usernames, one per line
\n#args = \/etc\/dovecot.deny
\n#deny = yes
\n#}<\/p>\n
\n# Note that PAM can only be used to verify if user’s password is correct,
\n# so it can’t be used as userdb. If you don’t want to use a separate user
\n# database (passwd usually), you can use static userdb.
\n# REMEMBER: You’ll need \/etc\/pam.d\/dovecot file created for PAM
\n# authentication to actually work.
\npassdb pam {
\n# [blocking=yes] [session=yes] [setcred=yes]
\n# [cache_key=] []
\n#
\n# By default a new process is forked from dovecot-auth for each PAM lookup.
\n# Setting blocking=yes uses the alternative way: dovecot-auth worker
\n# processes do the PAM lookups.
\n#
\n# session=yes makes Dovecot open and immediately close PAM session. Some
\n# PAM plugins need this to work, such as pam_mkhomedir.
\n#
\n# setcred=yes makes Dovecot establish PAM credentials if some PAM plugins
\n# need that. They aren’t ever deleted though, so this isn’t enabled by
\n# default.
\n#
\n# cache_key can be used to enable authentication caching for PAM
\n# (auth_cache_size also needs to be set). It isn’t enabled by default
\n# because PAM modules can do all kinds of checks besides checking password,
\n# such as checking IP address. Dovecot can’t know about these checks
\n# without some help. cache_key is simply a list of variables (see
\n# doc\/wiki\/Variables.txt) which must match for the cached data to be used.
\n# Here are some examples:
\n# %u – Username must match. Probably sufficient for most uses.
\n# %u%r – Username and remote IP address must match.
\n# %u%s – Username and service (ie. IMAP, POP3) must match.
\n#
\n# If service name is “*”, it means the authenticating service name
\n# is used, eg. pop3 or imap (\/etc\/pam.d\/pop3, \/etc\/pam.d\/imap).
\n#
\n# Some examples:
\n# args = session=yes *
\n# args = cache_key=%u dovecot
\n#args = dovecot
\n}<\/p>\n
\n# In many systems nowadays this uses Name Service Switch, which is
\n# configured in \/etc\/nsswitch.conf.
\n#passdb passwd {
\n# [blocking=yes] – See userdb passwd for explanation
\n#args =
\n#}<\/p>\n
\n# Deprecated by PAM nowadays.
\n#
\n#passdb shadow {
\n# [blocking=yes] – See userdb passwd for explanation
\n#args =
\n#}<\/p>\n
\n#
\n#passdb bsdauth {
\n# [cache_key=] – See cache_key in PAM for explanation.
\n#args =
\n#}<\/p>\n
\n#
\n#passdb passwd-file {
\n# Path for passwd-file
\n#args =
\n#}<\/p>\n
\n# NOTE: You will probably want to use “userdb prefetch” with this.
\n#
\n#passdb checkpassword {
\n# Path for checkpassword binary
\n#args =
\n#}<\/p>\n
\n#passdb sql {
\n# Path for SQL configuration file, see doc\/dovecot-sql-example.conf
\n#args =
\n#}<\/p>\n
\n#passdb ldap {
\n# Path for LDAP configuration file, see doc\/dovecot-ldap-example.conf
\n#args =
\n#}<\/p>\n
\n#passdb vpopmail {
\n# [cache_key=] – See cache_key in PAM for explanation.
\n#args =
\n#}<\/p>\n
\n# User database specifies where mails are located and what user\/group IDs
\n# own them. For single-UID configuration use “static”.
\n#
\n#
\n#<\/p>\n
\n# uses Name Service Switch, which is configured in \/etc\/nsswitch.conf.
\n#
\nuserdb passwd {
\n# [blocking=yes] – By default the lookups are done in the main dovecot-auth
\n# process. This setting causes the lookups to be done in auth worker
\n# proceses. Useful with remote NSS lookups that may block.
\n# NOTE: Be sure to use this setting with nss_ldap or users might get
\n# logged in as each others!
\n#args =
\n}<\/p>\n
\n#
\n#userdb passwd-file {
\n# Path for passwd-file
\n#args =
\n#}<\/p>\n
\n#userdb static {
\n# Template for the fields. Can return anything a userdb could normally
\n# return. For example:
\n#
\n# args = uid=500 gid=500 home=\/var\/mail\/%u
\n#
\n# If you use deliver, it needs to look up users only from the userdb. This
\n# of course doesn’t work with static because there is no list of users.
\n# Normally static userdb handles this by doing a passdb lookup. This works
\n# with most passdbs, with PAM being the most notable exception. If you do
\n# the user verification another way, you can add allow_all_users=yes to
\n# the args in which case the passdb lookup is skipped.
\n#
\n#args =
\n#}<\/p>\n
\n#userdb sql {
\n# Path for SQL configuration file, see doc\/dovecot-sql-example.conf
\n#args =
\n#}<\/p>\n
\n#userdb ldap {
\n# Path for LDAP configuration file, see doc\/dovecot-ldap-example.conf
\n#args =
\n#}<\/p>\n
\n#userdb vpopmail {
\n#}<\/p>\n
\n# needed information and there’s no need to do a separate userdb lookup.
\n# This can be made to work with SQL and LDAP databases, see their example
\n# configuration files for more information how to do it.
\n#
\n#userdb prefetch {
\n#}<\/p>\n
\n# password databases, nothing else. Only shadow and pam authentication
\n# requires roots, so use something else if possible. Note that passwd
\n# authentication with BSDs internally accesses shadow files, which also
\n# requires roots. Note that this user is NOT used to access mails.
\n# That user is specified by userdb above.
\nuser = root<\/p>\n
\n# work if this is set, and there’s no point chrooting if auth_user is root.
\n# Note that valid_chroot_dirs isn’t needed to use this setting.
\n#chroot =<\/p>\n
\n#count = 1<\/p>\n
\n#ssl_require_client_cert = no<\/p>\n
\n# X509_NAME_get_text_by_NID() which returns the subject’s DN’s
\n# CommonName.
\n#ssl_username_from_cert = no<\/p>\n
\n#socket listen {
\n#master {
\n# Master socket provides access to userdb information. It’s typically
\n# used to give Dovecot’s local delivery agent access to userdb so it
\n# can find mailbox locations.
\n#path = \/var\/run\/dovecot\/auth-master
\n#mode = 0600
\n# Default user\/group is the one who started dovecot-auth (root)
\n#user =
\n#group =
\n#}
\n#client {
\n# The client socket is generally safe to export to everyone. Typical use
\n# is to export it to your SMTP server so it can do SMTP AUTH lookups
\n# using it.
\n#path = \/var\/run\/dovecot\/auth-client
\n#mode = 0660
\n#}
\n#}
\n}<\/p>\n
\n# use connect sockets. They are assumed to be already running, Dovecot’s master
\n# process only tries to connect to them. They don’t need any other settings
\n# than the path for the master socket, as the configuration is done elsewhere.
\n# Note that the client sockets must exist in the login_dir.
\n#auth external {
\n# socket connect {
\n# master {
\n# path = \/var\/run\/dovecot\/auth-master
\n# }
\n# }
\n#}<\/p>\n
\n## Dictionary server settings
\n##<\/p>\n
\n# Currently this is only used by dict quota backend. The dictionary can be
\n# used either directly or though a dictionary server. The following dict block
\n# maps dictionary names to URIs when the server is used. These can then be
\n# referenced using URIs in format “proxy:”.<\/p>\n
\n#quota = mysql:\/etc\/dovecot-dict-quota.conf
\n}<\/p>\n
\n## Plugin settings
\n##<\/p>\n
\n# Here you can give some extra environment variables to mail processes.
\n# This is mostly meant for passing parameters to plugins. %variable
\n# expansion is done for all values.<\/p>\n
\n# dirsize: Find and sum all the files found from mail directory.
\n# Extremely SLOW with Maildir. It’ll eat your CPU and disk I\/O.
\n# dict: Keep quota stored in dictionary (eg. SQL)
\n# maildir: Maildir++ quota
\n# fs: Read-only support for filesystem quota
\n#quota = maildir<\/p>\n
\n# directory. You can also optionally give a global ACL directory path where
\n# ACLs are applied to all users’ mailboxes. The global ACL directory contains
\n# one file for each mailbox, eg. INBOX or sub.mailbox.
\n#acl = vfile:\/etc\/dovecot-acls<\/p>\n
\n# converted to destination storage (mail_location) when the user logs in.
\n# The existing mail directory is renamed to<\/p>\n
\n# plugin automatically deletes the oldest mails from configured mailboxes
\n# until the message can be saved within quota limits. The configuration file
\n# is a text file where each line is in format:
\n# Mails are first deleted in lowest -> highest priority number order
\n#trash = \/etc\/dovecot-trash.conf<\/p>\n
\n# expunges mails, the mails are moved to a mailbox in another namespace
\n# (1st). When a mailbox is deleted, the mailbox is moved to another namespace
\n# (2nd) as well. Also if the deleted mailbox had any expunged messages,
\n# they’re moved to a 3rd namespace. The mails won’t be counted in quota,
\n# and they’re not deleted automatically (use a cronjob or something).
\n#lazy_expunge = .EXPUNGED\/ .DELETED\/ .DELETED\/.EXPUNGED\/
\n}<\/p>\n","protected":false},"excerpt":{"rendered":"