Introduction

SMTP transfers messages; IMAP and POP3 let users access delivered mail. Dovecot commonly provides mailbox access and authentication integration for an MTA.

What you should be able to do after this lesson:

Distinguish IMAP and POP3 behavior.
Locate and inspect Dovecot configuration.
Configure protocols, mailbox location, authentication, and TLS.
Use doveconf and doveadm for validation and administration.
Diagnose common access failures.

Big Idea: Delivery and Access Meet at the Mailbox

The MTA or delivery agent writes a message into a mailbox. Dovecot authenticates a user and reads that same mailbox through IMAP or POP3. The two services must agree on path, format, ownership, namespace, and quota:

SMTP acceptance -> local delivery -> mailbox storage -> Dovecot -> mail client

A successful SMTP delivery does not prove that Dovecot can locate or read the message.

IMAP and POP3

IMAP keeps server-side folders and message state synchronized across clients.
POP3 primarily retrieves messages and offers a simpler mailbox model.

Encrypted ports commonly include 993 for IMAPS and 995 for POP3S. Plain protocol ports can also be upgraded with STARTTLS.

Dovecot Configuration

Files commonly live below /etc/dovecot/, with dovecot.conf including fragments.

doveconf -n
doveconf -a

doveconf -n displays non-default effective settings and is useful for reviews.

Basic areas include:

protocols = imap pop3
mail_location = maildir:~/Maildir
ssl = required

Mailbox formats include Maildir, where messages are individual files, and mbox, where messages share files.

Authentication

Dovecot can authenticate local users or integrate with SQL, LDAP, PAM, and other sources. Disable cleartext authentication on unencrypted remote sessions.

When Postfix uses Dovecot authentication for submission, a Unix socket can connect the services without exposing an extra network listener.

TLS

Configure certificate and private-key files and require suitable protocol security. Test the presented certificate and protocol:

openssl s_client -connect mail.example.test:993
openssl s_client -starttls imap -connect mail.example.test:143

Administration

doveadm who
doveadm auth test alice
doveadm mailbox list -u alice
doveadm search -u alice mailbox INBOX ALL

Use doveadm with appropriate privileges and avoid printing credentials in shell history.

Quota state and indexes may also be managed through Dovecot plugins and doveadm. Treat index files as implementation data rather than user messages, and use administrative tools instead of deleting them blindly during troubleshooting.

Troubleshooting Order

Validate effective configuration.
Confirm the process listens on the intended addresses and ports.
Test TLS and certificate names.
Test authentication independently.
Confirm mailbox path, ownership, and quota.
Review Dovecot and authentication logs.

Courier is another IMAP/POP implementation; know its role even when Dovecot is used.

Guided Practice: Trace a Mailbox Login

On an isolated mail lab, inspect effective configuration:

doveconf -n
ss -ltnp | grep -E ':(143|993|110|995)\b'
doveadm auth test <test-user>
doveadm mailbox list -u <test-user>

Connect with openssl s_client using the intended host name and protocol. Verify certificate identity, TLS negotiation, and server greeting before testing credentials. Deliver one controlled message, locate it through doveadm search, and retrieve it with a test client.

Compare the configured mail_location with the delivery agent's destination and filesystem ownership. Never expose a real user's password in command history or captured output.

Troubleshooting Scenario

SMTP logs report successful local delivery, but IMAP shows an empty INBOX. Postfix writes Maildir under /var/vmail/<domain>/<user>, while Dovecot expects ~/Maildir for a different system account.

Choose one mailbox mapping, align user database and mail_location, verify permissions, and reindex through supported tools if needed. Reopening firewall port 993 cannot repair two services reading different directories.

Exam Focus

Distinguish SMTP transport from POP3 and IMAP mailbox access.
Know /etc/dovecot/, dovecot.conf, doveconf, and doveadm.
Understand Maildir versus mbox, authentication backends, quotas, and basic TLS.
Recognize Courier as an alternative mailbox-access implementation.

Recap

IMAP/POP mailbox access is separate from SMTP transport.
doveconf -n shows important effective changes.
Authentication, TLS, and mailbox permissions should be tested independently.
doveadm is the main Dovecot administration interface.

211.3 Managing Mailbox Access