Dovecot Pro 3.1.0

Upgrading Information:

Upgrading from OX Dovecot Pro 3.0.x to Dovecot Pro 3.1.0

Status

First Customer Shipment	2025-XX-XX
Support End	TBD
Current Support Status

Release Notes

Previous Version

Dovecot Pro v3.0.2

This is the first major release of Dovecot Pro v3.1.

This release introduces the new Dovecot configuration syntax. See the Upgrade page (link above) for details on the necessary conversion needed from pre-3.1 configurations.

As a major release, in addition to bug fixes and optimizations, this release contains new features as well as removals of existing features.

Known Issues

Deploying Dovecot Pro Palomar Controller with docker-compose is experimental.

Dovecot

New Features

DOV-6263: Support inline ACLs in config file, see ACL for more information.
DOV-6325: Added %{system:cpu_count} variable.
DOV-6383: Support TLS Application-Layer Protocol Negotiation (ALPN).
DOV-7275: Add support for indexing attachments in FTS with Apache Tika. See Dovecot FTS Tika Support.
DOV-7330: Support PLUS variants of SCRAM-SHA-1 and SCRAM-SHA-256 mechanisms.
DOV-7336: sieve: Add simple "i;unicode-casemap" comparator. It cannot do character decomposition.
DOV-7350: Added support for IMAP REPLACE extension (RFC 8508).
DOV-7351: Added support for IMAP LIST-MYRIGHTS extension (RFC 8440).
DOV-7407: obox: The aws-s3 driver now also supports IAM on EKS. See IAM Authentication.

Changes

DOV-6004: All settings now support %{variables}, except for log_timestamp, listen, and inet_listener { address }.
DOV-6004: Unset service { ... } settings now default to the global service_* settings. The "0" values no longer mean "default" values - instead they're treated as invalid values. The default_process_limit, default_client_limit, default_idle_kill, and default_vsz_limit settings were removed. Use the global service_process_limit, service_client_limit, service_idle_kill, and service_vsz_limit settings instead.
DOV-6004: postmaster_address setting that is explicitly set to empty no longer generates an address. Keep the setting as default (unset) instead to preserve the old behavior.
DOV-6019: namespace { alias_for } now points to the namespace name, not the prefix.
DOV-6019: Empty submission_backend_capabilities value now means to propagate backend's capabilities. To disable all capabilities, use "-".
DOV-6027: Added "list of booleans" setting type. Settings that use it are: protocols, mail_plugins, auth_mechanisms, and passdb_mechanisms.
DOV-6040: Renamed ssl_verify_client_cert setting to ssl_request_client_cert.
DOV-6040: Split ssl_client_ca out of ssl_ca. ssl_ca is now used only for verifying client certificates, while ssl_client_ca is used in addition to ssl_client_ca_file/ssl_client_ca_dir.
DOV-6040: passdb imap no longer has "ssl_ca_dir", "ssl_ca_file", or "allow_invalid_cert" args. Instead, the global ssl_client_ca_file/ssl_client_ca_dir and ssl_client_require_valid_cert settings can be used.
DOV-6040: passdb and userdb event fields changed: "passdb" and "userdb" fields were renamed to "passdb_driver" and "userdb_driver". "passdb_name" and "userdb_name" were renamed to replace the original "passdb" and "userdb".
DOV-6073: auth client, auth server, login: Renamed "service" event field to "protocol", which more correctly describes the value. Note that storage events still have a "service".
DOV-6073: auth, login: Renamed %s and %{service} variables to %{protocol}, which more correctly describes the value. Note that storage variables still have %{service}.
DOV-6073: oauth2: Rename "X-Dovecot-Auth-Service" HTTP header to "X-Dovecot-Auth-Protocol".
DOV-6095: Enable SNI for SMTP and LMTP. Reload local_name config sections for the specified server name.
DOV-6110: auth_policy_server_timeout_msecs setting replaced by auth_policy { http_client_request_absolute_timeout }.
DOV-6110: fs-auth "-R" parameter replaced by fs_auth { http_client_rawlog_dir }.
DOV-6110: fs_auth_request_timeout setting replaced by fs_auth { http_client_request_timeout }.
DOV-6110: fs_auth_request_max_retries setting replaced by fs_auth { http_client_max_attempts }.
DOV-6110: oauth2 uses now the global http_client_* and ssl_* settings. The old settings were removed from the .conf.ext file.
DOV-6112: notify status: Change notify_status_dict into a filter-name. notify_mailbox_status is now called mailbox_notify_status and is disabled by default, it can be enabled per mailbox or using a mailbox filter name wildcard.
DOV-6114: Replace mail_attachment_fs with mail_attachment { ... } named filter.
DOV-6114: doveadm fs: Change "fs-driver" & "fs-args" parameters to filter-name.
DOV-6114: doveadm dict: Change "dict-uri" parameter to filter-name.
DOV-6114: Replace obox_fs with obox { ... } named filter. Replace obox_index_fs with metacache { ... } named filter.
DOV-6114: Replace fs_server_backend with fs_server { ... } named filter.
DOV-6114: obox fs-drivers' settings are now individual normal fs_* settings, not encoded in the URLs or elsewhere. Some of the fs-drivers' default settings have also been changed.
DOV-6114: obox fs-drivers' HTTP User-Agent header no longer contains obox/version.
DOV-6114: Replace fts_dovecot_fs with fts_dovecot { ... } named filter.
DOV-6114: Replace intercept_fs with intercept { ... } named filter.
DOV-6118: push-notification: Change push_notification into a filter-name. Push notification settings now require a push_notification_driver key that identifies the appropriate driver, as well as specifically named options per driver.
DOV-6119: lazy_expunge plugin settings converted to normal lazy_expunge_* settings.
DOV-6120: mail_compress_save plugin setting is replaced by mail_compress_write_method. mail_compress_save_level plugin setting is replaced by compression method specific settings: compress_gz_level, compress_deflate_level, compress_bz2_block_size_100k, and compress_zstd_level.
DOV-6120: fs-compress: The compression method parameter is replaced by fs_compress_write_method setting. An empty setting means writing with plaintext. The old "maybe-" prefix is replaced by fs_compress_read_plain_fallback setting.
DOV-6169: mail_crypt_* plugin settings converted to normal crypt_* settings.
DOV-6263: ACL settings have changed. See ACL for more information.
DOV-6278: Split mail_location setting into separate settings:
- "format:path" prefix split to mail_driver and mail_path settings
- INBOX: mail_inbox_path
- INDEX: mail_index_path
- INDEXPVT: mail_index_private_path
- INDEXCACHE: mail_cache_path
- CONTROL: mail_control_path
- ALT: mail_alt_path
- ALTNOCHECK: mail_alt_check
- LAYOUT: mailbox_list_layout
- SUBSCRIPTIONS: mailbox_subscriptions_filename
- DIRNAME & FULLDIRNAME: mailbox_directory_name & mailbox_directory_name_legacy
- MAILBOXDIR: mailbox_root_directory_name
- VOLATILEDIR: mail_volatile_path
- LISTINDEX: mailbox_list_index_prefix
- BROKENCHAR: mailbox_list_visible_escape_char
- KEEP-NOSELECT: mailbox_list_drop_noselect
- NO-FS-VALIDATION: mailbox_list_validate_fs_names
- ITERINDEX: mailbox_list_iter_from_index_dir
- UTF-8: mailbox_list_utf8
DOV-6278: mailbox { driver } setting replaced by mailbox { mail_driver }.
DOV-6278: listescape plugin was removed, and its functionality was replaced by the mailbox_list_storage_escape_char setting.
DOV-6278: doveadm sync/backup: The destination parameter is now in a simple "mail_driver:mail_path" format. For additional options use "-p" parameter to specify any destination-specific storage options (similarly to how "-o" parameter would be used for source-specific storage options).
DOV-6278: doveadm import: The source location parameter is now in a simple "mail_driver:mail_path" format. For additional options use "-p" parameter to specify any source-specific storage options (similarly to how "-o" parameter would be used for destination-specific storage options).
DOV-6278: Rename mail_attachment* settings related to external attachment files to mail_ext_attachment*. Also rename mail_attachment_dir to mail_ext_attachment_path.
DOV-6291: Removed namespace { location } setting. Use namespace { mail_location } instead.
DOV-6295: Removed the example configuration and replaced it with an automatically installed minimum configuration.
DOV-6304: fts settings have changed. See fts plugin.
DOV-6304: fts-solr settings have changed. See fts-solr plugin.
DOV-6304: fts-dovecot settings have changed. See fts-dovecot plugin.
DOV-6305: import_environment setting is now a string list. The values are expanded from the calling environment on Dovecot startup.
DOV-6305: imap_id_send setting is now a string list. New distribution attributes are available in the configuration via the %{dovecot:<key>} syntax.
DOV-6306: passdb { default_fields } and passdb { override_fields } are now string lists.
DOV-6306: Added passdb_default_password_scheme, passdb_use_worker, and userdb_use_worker settings. These are the new standard ways of changing these settings rather than having passdb/userdb-specific settings.
DOV-6307: quota_clone plugin settings converted to normal quota_clone* settings
DOV-6313: stats_http_rawlog_dir replaced by stats_server { http_server_rawlog_dir }.
DOV-6313: doveadm_http_rawlog_dir replaced by doveadm_server { http_server_rawlog_dir }.
DOV-6325: %{pid}, %{uid} and %{gid} variables are now prefixed with process:, e.g. %{process:pid}. %{hostname} is now prefixed with system:, i.e. %{system:hostname}.
DOV-6325: Renamed %{pid} to %{client_pid} in auth variables.
DOV-6326: Replace inet_listener { address } with inet_listener { listen }.
DOV-6365: Moved Sieve plugin settings to global settings. Invalid Sieve plugin and extension configuration now causes errors and Sieve interpreter failures, instead of just warnings and disabling of the involved plugin or extension.
DOV-6379: service { service_count } renamed to service_restart_request_count.
DOV-6383: Pre-login settings are applied based on SNI.
DOV-6391: fts_languages setting has been converted into language xx { ... }. blocks. See language.
DOV-6391: fts_filters setting has been changed and split into converted into language_filters, language_filter_normalizer_icu_id, and language_filter_stopwords_dir. See Filter Configuration.
DOV-6391: fts_tokenizers setting has been changed and split into language_tokenizers, language_tokenizer_address_token_maxlen, language_tokenizer_generic_algorithm, language_tokenizer_generic_token_maxlen, language_tokenizer_generic_wb5a, language_tokenizer_kuromoji_icu_id, language_tokenizer_kuromoji_split_compounds, and language_tokenizer_kuromoji_token_maxlen. See Tokenizer Configuration.
DOV-6421: dict { .. } string list was converted to dict_server { dict { .. } ... } filter settings. See dictionary.
DOV-6424: passdb/userdb passwd-file args parameter converted to separate settings:
- "scheme": passdb_default_password_scheme
- "username_format": auth_username_format
- "path": passwd_file_path
DOV-6446: oauth2 settings are now inlined. See OAuth2 Authentication Database.
DOV-6447: OAuth2 mechanism no longer use passdb to validate tokens, instead a new setting auth_oauth2_config_file is used.
DOV-6453: passdb/userdb static args parameter converted to separate settings:
- "password": passdb_static_password
- "allow_all_users": userdb_static_allow_all_users
DOV-6454: passdb/userdb passwd args parameter converted to separate settings:
- "blocking": passdb_use_worker and userdb_use_worker
DOV-6455: lib-lua: Add lua_file and lua_settings global settings. These settings are now used by passdb-lua, userdb-lua, push-notification-lua, and mail-lua.
DOV-6455: Introduce mail_lua setting filter.
DOV-6455: Remove push_notification_lua_path, it can now be configured using the lua_file setting.
DOV-6455: passdb/userdb lua args parameter converted to separate settings:
- "scheme": passdb_default_password_scheme
- "file": lua_file
- generic args: lua_settings
- "blocking": userdb_use_worker and passdb_use_worker
- "cache_key": The setting is removed, it can now be set from the auth lua script itself implementing auth_userdb_get_cache_key() and auth_passdb_get_cache_key().
DOV-6456: passdb imap: Replace args-based settings with generic imapc_* settings.
DOV-6456: Change default value of imapc_max_line_length to unlimited. Make "0" an explicit configuration error.
DOV-6457: LDAP external config file has been converted into ldap_*, passdb_ldap_*, and userdb_ldap_* settings.
DOV-6458: passdb/userdb pam args parameter converted to separate settings:
- "blocking": passdb_use_worker and userdb_use_worker
- "session": passdb_pam_session
- "setcred": passdb_pam_setcred
- "failure_show_msg": passdb_pam_failure_show_msg
- "max_requests": passdb_pam_max_requests
- service name parameter: passdb_pam_service_name; "cache_key" parameter was removed.
DOV-6459: passdb bsdauth: replace "blocking" argument with global use_worker setting.
DOV-6459: passdb bsdauth lookups are cached by default now, previously this needed a specific passdb argument.
DOV-6471: Converted ssl settings to file type:
- ssl_cert: ssl_cert_file
- ssl_alt_cert: ssl_alt_cert_file
- ssl_key: ssl_key_file
- ssl_alt_key: ssl_alt_key_file
- ssl_client_cert: ssl_client_cert_file
- ssl_client_key: ssl_client_key_file
- ssl_dh: ssl_dh_file
- ssl_ca: ssl_ca_file
- ssl_client_ca and ssl_client_ca_file: merged into ssl_client_ca_file
DOV-6471: Converted mail-crypt settings to file type:
- crypt_private_key: crypt_private_key_file
- crypt_global_public_key: crypt_global_public_key_file
DOV-6483: sql connect string was split into individual mysql_*, pgsql_*, sqlite_*, and cassandra_* settings.
DOV-6542: passdb/userdb sql: external config file was moved to regular settings:
- "connect": individual sql-driver specific settings
- "password_query": passdb_sql_query
- "user_query": userdb_sql_query
- "update_query": passdb_sql_update_query
- "iterate_query": userdb_sql_iterate_query
- "default_pass_scheme": passdb_default_password_scheme
DOV-6551: Referring to a $setting in config file must now be prefixed with "$SET:", i.e. $SET:setting.
DOV-6552: External dict-sql configuration file was converted to regular settings.
DOV-6556: dict { .. } is renamed to dict_legacy { ... } for now; this will be removed entirely later.
DOV-6556: dict_driver=<value> setting is replaced by dict <value> { }.
DOV-6559: Split fts_enforced setting:
- fts_enforced=no (default): fts_search_add_missing=body-search-only, fts_search_read_fallback=yes
- fts_enforced=yes: fts_search_add_missing=yes, fts_search_read_fallback=no
- fts_enforced=body: fts_search_add_missing=body-search-only, fts_search_read_fallback=no
DOV-6693: The "driver" field in dict events was renamed to "dict_driver".
DOV-6901: Renamed ":protected" passdb/userdb field suffix to ":default".
DOV-6909: welcome plugin now uses global settings and execute { .. } settings.
DOV-6912: Setting names for Dovecot's Lua HTTP client have changed.
DOV-6917: Default quota grace changed from "10%" to "10 MB".
DOV-6924: Variable syntax has been changed. See Settings Variables.
DOV-6984: Converted last_login, mail_log, virtual, apparmor, charset_alias, pop3_migration, and trash plugin settings to global settings.
DOV-6999: Various changes to metric and event exporter settings.
DOV-7069: Renamed service_idle_kill setting to service_idle_kill_interval.
DOV-7070: Shared namespace prefix "%%variables" were changed to "$variables".
DOV-7071: Renamed passdb_mechanisms to passdb_mechanisms_filter. Rename "none" value to "lookup".
DOV-7187: Converted metacache and obox plugin settings to global settings. Added metacache_pull setting. Renamed settings:
- metacache_disable_bundle_list_cache: metacache_bundle_list_cache
- metacache_disable_secondary_indexes: metacache_secondary_indexes
- obox_refresh_index_once_after: metacache_refresh_index_once_after
- obox_rescan_mails_once_after: metacache_rescan_mails_once_after
- obox_no_pop3_backend_uidls: obox_pop3_backend_uidls
- obox_dont_use_object_ids: obox_use_object_ids
DOV-7187: mail_prefetch_count defaults to "10" now for obox format.
DOV-7187: Moved obox_lost_mailbox_prefix setting to mailbox_list_lost_mailbox_prefix core setting.
DOV-7197: Intercept plugin settings and environment variables are now global settings.
DOV-7199: encrypt and decrypt filters are now always available for %variables.
DOV-7203: Convert pop3-uidl-migrate, vault, and nfs-hostchange plugin settings to globals.
DOV-7240: doveadm and dovecot-lda no longer log an error if they can't connect to stats-writer socket due to permission errors.
DOV-7242: Renamed fts_index_timeout to fts_search_timeout.
DOV-7251: Dovecot no longer enables any protocols (imap, pop3 or lmtp) by default. You need to enable the ones you want explicitly with the protocols setting.
DOV-7255: Replace in-URL authentication configuration for azure storage.
- Adds fs_azure_account_name, fs_azure_container_name, fs_azure_legacy_auth_secret, and fs_azure_service_sas_secret.
- Remove the no_sas_auth URL Parameter. It is replaced by fs_azure_auth_type which defaults to "user-sas".
DOV-7255: To configure User SAS, the URL Parameter based configuration is replaced by the following settings:
- "auth_tenant_id": fs_azure_auth_user_sas_tenant_id
- "auth_client_id": fs_azure_auth_user_sas_client_id
- "client_secret": fs_azure_user_sas_client_secret
DOV-7255: Replace in-URL authentication configuration for S3 storage.
- Adds fs_s3_access_key and fs_s3_secret.
DOV-7302: ssl_cipher_list for outgoing SSL client connections is now empty (OpenSSL default).
DOV-7305: Added "ssl_server_" prefix to SSL server settings: ssl_server_ca_file, ssl_server_cert_file, ssl_server_alt_cert_file, ssl_server_key_file, ssl_server_alt_key_file, ssl_server_key_password, ssl_server_dh_file, ssl_server_cert_username_field, ssl_server_require_crl, ssl_server_request_client_cert, ssl_server_prefer_ciphers.
DOV-7431: auth-lua: Passdb and userdb lookups can no longer return a space-separated string of "key=values". They must return a table of "key=values" now instead.
DOV-7436: auth_failure_delay=0 removes auth failure delay now entirely, effectively behaving the same as using "nodelay=yes" passdb extra field.
DOV-7526: imap-master socket is now owned by dovecot internal user by default.
DOV-7527: Change the default lmtp_user_concurrency_limit from "0" (unlimited) to "10". Also "0" is now an invalid value, use "unlimited" instead.
DOV-7671: DNS lookup timeouts are now configured via dns_client_timeout setting.
DOV-7714: The anvil UNIX socket listener's default group changed to default_internal_group and mode to 0660. This allows all processes launched via the Dovecot master process to access the anvil socket.
DOV-7769: obox: Introduce fs_http_url_suffix setting. This can be used to configure a suffix to the fs-http based storage used in obox, metacache, or fts_dovecot filters. https://doc.dovecotpro.com/3.1.0/storage/configuration.html#fs_http_url_suffix
DOV-7788: Removed the concept of user groups from Palomar.
DOV-7819: dovecot-pro-cluster package now installs dovecot-pro-obox package as package dependency
DOV-7873: Giving unknown settings as -o command line parameters fails now.
DOV-7873: Added "set/" prefix for userdb extra fields to explicitly specify that the field is intended to be a setting. Unknown settings with the "set/" prefix will cause a failure.
DOV-7887: $SET is now expanded to the value at the end of configuration parsing instead of what it was at the $SET parsing time. This fixes using $SET inside settings groups.
DOV-8001: doveadm's "table" formatter prints empty fields now as "-".
DOV-8081: Changed metacache_pull_finished event: Removed exit_code; added files_count and import_count.
DOV-8116: Add cluster_director_transition_config setting. It can be used to configure user logins to do a additional lookup for the backend that they lived on in the director based setup they are targeted to be migrated from. See cluster_director_transition_config.

Removed Items

DOV-5767: config_cache_size setting, which is now unnecessary.
DOV-6040: verbose_ssl setting. Replaced by log_debug = category=ssl.
DOV-6114: obox-fs.sh script. "doveadm mail fs" commands replace this.
DOV-6119: lazy_expunge no longer supports namespaces as destination.
DOV-6169: fs-mail-crypt plugin. The fs-crypt plugin works for the same purposes now.
DOV-6169: mail_crypt plugin no longer supports writing version 1 files.
DOV-6263: Global ACL directory support has been fully removed.
DOV-6278: passwd-file: Remove support for "old" format which used mail_location setting in the "shell" field.
DOV-6278: doveadm sync/backup: Removed "-d" (default-destination) and "-E" (legacy-dsync) parameters.
DOV-6306: passdb { pass } setting. Use "result_success=continue" instead.
DOV-6456: Remove imapc_ssl_verify setting. Use ssl_client_require_valid_cert instead.
DOV-6542: userdb_warning_disable setting was removed.
DOV-6901: passdb/userdb default_fields { ... } and override_fields { ... }. These are replaced by the more generic fields { ... }. Default fields can be set by adding ":default" to the field name.
DOV-6917: Maildir++ quota: Remove support for reading quota limits from an existing maildirsize file. Quota limits must be explicitly configured in Dovecot.
DOV-6924: Old variable aliases have been removed.
DOV-6924: Old one letter variables are no longer supported.
DOV-7173: doveconf "-m", "-p", and "-S" parameters.
DOV-7187: Removed unnecessary settings: metacache_socket_path, obox_username.
DOV-7431: auth-lua: Removed auth_request#response_from_template(). Return the table instead with the necessary auth_request#var_expand() calls.

Improvements

DOV-5767: Added "local_name" field to pre-login client event.
DOV-6004: Added "unlimited" value for number, size, and time interval setting types. Some of the service { idle_kill } defaults now shows up as "unlimited".
DOV-6110: Added global http_client_* settings.
DOV-6114: Add "doveadm mail fs" commands. These are similar to "doveadm fs" commands, but they're run in the mail user context. This way all user-specific settings are applied and process uid/gid is also set properly.
DOV-6114: Add "doveadm mail dict" commands. These are similar to "doveadm dict" commands, but they're run in the mail user context. This way all user-specific settings are applied and process uid/gid is also set properly.
DOV-6313: Added global http_server_* settings.
DOV-6485: Added passdb_fields { ... } and userdb_fields { ... } that can be used to specify passdb/userdb extra fields. These can refer to the passdb/userdb lookup's results using %variables. These make the old "default_fields" and "override_fields" parameters unnecessary.
DOV-6525: Clarify warning reason if a query takes longer than cassandra_warn_timeout.
DOV-6529: Empty passdb/userdb_driver settings default to passdb_name/userdb_name settings. This allows using, e.g., passdb passwd-file { ... } without specifying the driver setting again.
DOV-6693: Added "sql_driver" field to sql events.
DOV-6710: Added support for groups includes in configuration file. See Groups Includes.
DOV-7076: Added built-in "@fs_dictmap_defaults", "@cluster_defaults", and "@metric_defaults" groups, which can be included in configuration files to pull required/recommended default settings.
DOV-7174: You can now iterate users from variable passwd-file paths if enough variables are provided.
DOV-7197: Added %{generate:guid}, %{generate:guid128}, and %{generate:uuid} variables.
DOV-7199: %variable encryption supports hashed key material generation with salt.
DOV-7302: Added ssl_client and ssl_server named filters for giving client/server-specific SSL settings.
DOV-7338: Default folder names can be changed easily in userdb by returning, e.g., "namespace/inbox/mailbox/trash/name=RenamedTrash".
DOV-7368: lua: Add event.set_forced_debug() and event.unset_forced_debug().
DOV-7399: Added proxy_session_reconnecting event when login-proxy fails to login to remote proxy, but it will try to reconnect again. Also log this event as a warning. This could help indicate, e.g., network packet loss and other random failures that otherwise silently increase user-visible login latency.
DOV-7445: passdb_user_worker=yes & userdb_use_worker=yes can be set now with PostgreSQL and Cassandra drivers to run them in auth-worker processes.
DOV-7515: Added "@mailbox_defaults=english" settings group.
DOV-8018: Support site/backend IDs in all doveadm cluster commands' site/backend name parameters.
DOV-8131: Added acl_dict_index setting. This should be used with SQL/CQL based dict to more efficiently update ACL maps. Without it the whole table is iterated whenever updating a user's ACL mapping.

Fixed Issues

DOV-5767: "-o" command line parameter expanded %variables for aliased settings. Mainly this meant "-o mail=..." expanded %variables, while "-o mail_location=..." didn't.
DOV-5892: Login processes ignored protocol-specific settings (e.g. imap_capability) specified inside local_name sections.
DOV-5893: local_name { ... } config filter couldn't be used for any post-login settings.
DOV-6991: If backend was removed, users could no longer login. Instead, Lua exception would be raised.
DOV-7307: fs-[aws-]s3: Do not automatically follow HTTP redirects. This is supposed to help discover misconfiguration. To allow redirects set fs_s3/http_client_auto_redirect=yes.
DOV-7384: Restore the counters for the imap_logout_format message when unhibernating.
DOV-7429: Azure FS driver was leaking memory. v3.0.1 regression.
DOV-7436: auth_failure_delay setting still affected auth requests that failed with internal failure, as well as the auth_internal_failure_delay setting.
DOV-7440: Submission: Pipelining AUTH with initial SASL response could have caused a hang.
DOV-7480: Wildcards didn't work in local_name *.example.com { ... }. v3.0 regression.
DOV-7496: OpenSSL 3 lib-dcrypt can cause SSL connection failure.
DOV-7593: Certain patterns would cause sieve to crash with Panic.
- Fixes: Panic: file bits.c: line 17 (nearest_power): assertion failed: (num <= ((size_t)1 << (CHAR_BIT*sizeof(size_t) - 1)))
- Fixes: Panic: file mempool.c: line 16 (pool_get_exp_grown_size): assertion failed: (old_size < min_size)
DOV-7675: Using "$SET:setting_key" as a setting value didn't work correctly inside setting filters.
DOV-7763: Sieve editheader handling may have crashed.
- Fixes: Panic: file istream.c: line 358 (i_stream_read_memarea): assertion failed: (!stream->blocking)
DOV-7768: LMTP proxy client can crash during connection loss at DATA stage when more than a single RCPT command was accepted earlier.
DOV-7784: Login processes may have crashed in some situations.
- Fixes: Panic: epoll_ctl(del, ...) failed: Bad file descriptor
DOV-7787: IMAP COMPRESS handling on proxies caused hangs sometimes. For now COMPRESS on proxies is disabled by default; use imap_compress_on_proxy=yes to enable it. (v3.0 regression)
DOV-7871: Configuration parsing and doveconf output had various issues when using @groups containing named [list] filters and overriding parts of them explicitly in the config.
DOV-7873: @group include in config file may have wrongly overridden a userdb or -o command line parameter settings override.
DOV-8054: fs-s3, fs-scality, fs-azure: Bulk deletes may have caused crashes in some situations.
DOV-8056: Metacache pull didn't close doveadm connection to source server.
DOV-8081: doveadm metacache pull crashed when trying to pull a user with an empty home directory.
DOV-8089: doveadm metacache pull didn't update metacache size tracking.
DOV-8093: metacache pull may have caused excessive memory usage in doveadm-server.
DOV-8114: doveadm metacache pull didn't pull FTS indexes.

Dovecot Cluster Controller

New Features

DOV-8115: Controller settings USER_MOVE_START_TIMEOUT_SECS and USER_MOVE_FINISH_TIMEOUT_SECS are now configurable with helm values "controller.userMoves.startTimeout" and "controller.userMoves.finishTimeout" respectively.
DOV-8149: New HOST_FAILURE_FORCE_MOVE_PERCENTAGE_INCREASE_INTERVAL_SECONDS setting for cluster controller to control time interval between increases in percentage of users when a Backend is being evacuated in a force-move operation. This value is configurable with Helm value "hostFailure.forceMovePercentageIncreaseInterval" for kubernetes installations.

Changes

DOV-7799: Normalize default geodb keyspace to 'geodb' and default dictmap keyspace to 'mails'.
DOV-7816: Cluster controller now gives up offling backends or moving users if 50% of all backends in the site are unhealthy (instead of 75% previously).
DOV-7902: Backend names are now unique across all sites. Prometheus scrapes only unique backends (with site suffix in the name).
DOV-7947: Cluster Controller's Redis images now switched to bitnamilegacy as a short-term work-around for the changes introduced by bitnami.
DOV-8033: JSON logger added automatic task name injection.
DOV-8142: func_name in logs are now populated with caller function when necessary.
DOV-8144: Default value for setting HOST_FAILURE_BACKEND_NUM_THRESHOLD reduced to "0.3".

Removed Items

DOV-7780: There is no product support for connecting to external Prometheus service, so remove configuration that implied this was possible.
DOV-7812: There is no product support for connecting to external Redis service, so remove configuration that implied this was possible.

Improvements

DOV-7809: Cleanup stale geodb entries in site_reachability, proxy_dest_stats, user_groups, and backend_stats tables.
DOV-7810: Function names are now logged as prefix to the Controller log messages.
DOV-8020: Controller now sends the reason for user moves to Backends for better logging.

Fixed Issues

DOV-7939: Correctly handle external Prometheus addresses in controller.

Kubernetes Deployments

Changes

DOV-7712: Dovecot containers deployed with Kubernetes (currently, Controller ONLY) are now run as a non-root user for stricter security. All Dovecot processes are run as vmail user and root file system is read-only except for few selected paths where processes need write access.

Lua Support

These versions of Lua are supported:

Lua 5.3

Obox Testing

AWS S3

Testing Date	2025-XX
Testing Region(s)	eu-central-1
API Version(s) Tested	2006-03-01
API Documentation (at time of testing)	https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html

Azure Blob

Testing Date	2025-XX
Testing Region(s)	northeurope
API Version(s) Tested	2023-08-03
API Documentation (at time of testing)	https://learn.microsoft.com/en-us/rest/api/storageservices/version-2023-08-03

Scality sproxyd

Testing Date	2025-XX
API Version(s) Tested	8.5.8.6
API Documentation (at time of testing)	https://documentation.scality.com/RING/8.5.8/reference/connectors/sproxyd/index.html

Kubernetes Components

Kubernetes Support

Supported Kubernetes versions: 1.31, 1.30

Cluster Controller

Cluster Controller Installation