2026年11月13日

Dovecot Install and IMAP/POP3 Setup with TLS and Postfix

DNS & Mail Servers

This article is a localized edition of the Japanese original. Read the Japanese original

Dovecot is an IMAP/POP3 server that lets you read mail delivered to your server from a mail client or a smartphone. Using an Ubuntu/Debian VPS as the example, this article walks through installing Dovecot, configuring the mailbox location, authentication and TLS, connecting it to Postfix, and getting to the point where an external mail client can receive mail.

It assumes that an MTA (a mail transfer server that handles sending and receiving) such as Postfix is already running and that your MX record points to this server. If you have not set up Postfix yet, do that first.

What to decide before you start

Deciding the following three points before touching the configuration files will save you confusion.

Account type: Use Linux system users directly as mail accounts, or use virtual users (accounts managed in files or a database that cannot log in to the OS)? This article uses the simpler system-user approach.
Mailbox format: Maildir (one file per message) or mbox (one file per folder)? For concurrent access and easier backups, Maildir is the easier choice for a new build.
Protocol: IMAP if you want to share read status across multiple devices, POP3 if you download to one device and delete from the server. Today it is common to open only IMAP over TLS (port 993).

When working on a production server, back up /etc/dovecot/ and /etc/postfix/ and, if possible, try the changes in a staging environment first.

About Dovecot versions

In the Dovecot 2.4 series, the names and syntax of many settings changed significantly (as of October 2026). For example, 2.4 requires a configuration version declaration at the top of the configuration file, and the mailbox location and certificate settings use different setting names. The standard package in Ubuntu 24.04 LTS is the 2.3 series, and newer distributions may ship the 2.4 series.

The configuration examples below use 2.3 syntax. First check your version with the following command, and if it is 2.4, use the migration guide in the official documentation to map the setting names.

dovecot --version

Installation

On Ubuntu/Debian, the packages are split by feature. This example installs IMAP and LMTP, which is used for delivery from Postfix. If you need POP3, also add dovecot-pop3d.

sudo apt update
sudo apt install dovecot-core dovecot-imapd dovecot-lmtpd
sudo systemctl enable --now dovecot

The configuration starts at /etc/dovecot/dovecot.conf, which loads the files under conf.d/. If you write changes in a file per purpose, they are easier to find when you look back later. You can list the currently active settings (the parts changed from the defaults) with the following command.

sudo doveconf -n

Set the mailbox location (10-mail.conf)

In /etc/dovecot/conf.d/10-mail.conf, specify that Dovecot should use a Maildir under each user's home directory.

mail_location = maildir:~/Maildir

If the location specified here differs from where Postfix writes mail, you end up with mail that has arrived but does not show up in the mail client. If you use the LMTP integration described below, Dovecot does the writing as well, so this mismatch is much less likely.

Configure authentication (10-auth.conf)

In /etc/dovecot/conf.d/10-auth.conf, forbid sending passwords over unencrypted connections.

disable_plaintext_auth = yes
auth_mechanisms = plain login

plain sends the password as is, but it is allowed only over a TLS-encrypted channel, so combined with the setting above it is safe to use. login is for old mail clients. In the 2.4 series, the setting name equivalent to disable_plaintext_auth has changed, so check it against your version.

With the system-user approach, authentication uses the Linux password through PAM. For users who are only for mail, specify /usr/sbin/nologin so they cannot log in to a shell. That way, if a mail password leaks, you avoid having SSH taken over as well.

Configure TLS (10-ssl.conf)

In /etc/dovecot/conf.d/10-ssl.conf, specify the certificate and make TLS mandatory. This is an example where a Let's Encrypt certificate for mail.example.com has already been obtained.

ssl = required
ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.example.com/privkey.pem
ssl_min_protocol = TLSv1.2

The < before the path means "read the contents of this file," and forgetting it causes an error. The server name you set in the mail client must match the host name in the certificate. If you connect by IP address or another name, you will get a certificate warning.

After the certificate is renewed, Dovecot needs to reload it. If you make the certbot deploy hook run systemctl reload dovecot, you avoid the problem of Dovecot continuing to serve the old certificate after renewal.

Integrate with Postfix (10-master.conf)

There are two main ways to integrate with Postfix. One is to have Postfix hand the mail it receives to Dovecot over LMTP; the other is to use Dovecot's authentication for Postfix's sending authentication (SMTP AUTH). In both cases you create sockets in a place visible to Postfix in /etc/dovecot/conf.d/10-master.conf.

service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    mode = 0600
    user = postfix
    group = postfix
  }
}

service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0660
    user = postfix
    group = postfix
  }
}

Configure the Postfix side with postconf -e. Postfix may run in a chroot, so put the sockets under /var/spool/postfix/ and refer to them from Postfix with relative paths such as private/....

sudo postconf -e 'mailbox_transport = lmtp:unix:private/dovecot-lmtp'
sudo postconf -e 'smtpd_sasl_type = dovecot'
sudo postconf -e 'smtpd_sasl_path = private/auth'
sudo postconf -e 'smtpd_sasl_auth_enable = yes'
sudo systemctl reload postfix
sudo systemctl restart dovecot

Normally, enable sending authentication only on port 587 (submission). Avoid accepting authentication on port 25, because it becomes an easy target for brute-force attacks. Enable submission in /etc/postfix/master.cf.

Firewall and ports

If you use only IMAP over TLS, open port 993. For POP3 over TLS, it is port 995. Ports 143 and 110, which start in plain text, are best closed if you do not use them.

sudo ufw allow 993/tcp
sudo ufw status

Some VPS providers have a packet filter in their control panel in addition to the OS firewall. Check that the port is allowed in both.

Verify that it works

After applying the settings, check from the outside in.

Configuration syntax: Does sudo doveconf -n print without errors?
Authentication: Does password authentication pass with sudo doveadm auth test username? On success it prints auth succeeded.
TLS connection: From another machine, connect with the following command and check the certificate's host name and expiry date.

openssl s_client -connect mail.example.com:993 -servername mail.example.com

Delivery: Send a test mail from an external address and check whether a file is added to ~/Maildir/new/.
Mail client: Connect by specifying the host name, port 993 and SSL/TLS as the incoming server.

If it does not work, look at journalctl -u dovecot and the mail log (on Debian/Ubuntu, /var/log/mail.log; in environments without rsyslog, only the journal). Common patterns are the following.

auth failed keeps appearing: Besides a wrong password, the mail client may be connecting without encryption while disable_plaintext_auth = yes is set.
Permission denied: The Maildir is not owned by the user. This tends to happen when you use a directory created by root as is.
connect to private/dovecot-lmtp: No such file or directory on the Postfix side: The socket location specified in Postfix and Dovecot does not match.

Operational notes

A mail server becomes a target of password brute-forcing right after it goes public. Installing something like Fail2ban that blocks IPs with repeated authentication failures for a set time reduces load and risk. In case an administrator is blocked by mistake, set up an allow list for SSH and keep a way in through the console in your VPS control panel.

Also, because Maildir stores each message as one file, it works well with file-level backups, but the number of files becomes huge as the volume grows. Set a limit with the quota plugin or monitor disk usage to prevent mail reception from stopping because the disk is full.

Summary

Dovecot is the server that lets you read delivered mail over IMAP/POP3. Setting names differ between the 2.3 and 2.4 series, so check the version first.
Set the mailbox location in 10-mail.conf, disable plaintext authentication in 10-auth.conf, and require TLS in 10-ssl.conf.
Integrate with Postfix through LMTP and SASL authentication sockets, and place the sockets under /var/spool/postfix/private/.
Verify in the order doveconf -n, doveadm auth test, openssl s_client, from the outside in.
After going public, prepare brute-force protection and a recovery path so that the administrator is not locked out.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)