If the destination for proxying matches any of the IP addresses listed\nhere, proxying is not performed when proxy_maybe=yes is returned.
This parameter isn't normally needed; its main use is if the\ndestination IP address belongs to, for instance, a load-balancer rather\nthan the server itself.
\n" }, "fs": { "tags": [ "fs" ], "values": [ { "label": "Named List Filter", "url": "Named List Filter" } ], "seealso": [ "Dovecot Filesystems", "fs_name",
"fs_driver"
],
"text": "Create a new fs to the list of filesystems. The filter name refers\nto fs_name setting.
Example:
\nfs posix {\n # ...\n}Since an empty fs_driver default to fs_name there is no\nneed to specify fs_driver explicitly.
It's possible to specify the same fs multiple times by separating the\nfs_name and fs_driver settings:
fs compress1 {\n fs_driver = compress\n}\nfs compress2 {\n fs_driver = compress\n}fs",
"fs_driver"
],
"text": "Name of the fs. The fs_driver setting default to this.
fs_name",
"seealso": [
"fs",
"fs_name"
],
"text": "The fs driver to use. Defaults to fs_name.
no",
"seealso": [
"fs-compress plugin"
],
"text": "By default fs-compress plugin fails if the file wasn't compressed. If this\nsetting is enabled the file is returned as-is (i.e. allows reading plaintext\nfiles).
\n" }, "fs_compress_write_method": { "tags": [ "fs-compress" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "Compression Methods" ], "text": "Which Compression Method to use for\nwriting new files. Empty value means that compression is disabled.
\n" }, "fs_crypt_read_plain_fallback": { "tags": [ "fs-crypt" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"text": "If enabled files that are not encrypted are returned as-is. By default it\nresults in a read error.
\n" }, "fs_dict_value_encoding": { "tags": [ "fs-dict" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "raw", "hex", "base64" ], "default": "raw",
"text": "How to encode file contents into the dict value.
\n" }, "fs_posix_lock_method": { "advanced": true, "tags": [ "fs-posix" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "flock", "dotlock" ], "default": "flock",
"text": "Lock method to use for locking files. Currently nothing uses lib-fs\nlocking.
Directory prefix where files are read from/written to.
\nINFO
\nThe trailing / is not automatically added, so using e.g. /tmp/foo as\nprefix will cause /tmp/foofilename to be created.
0600",
"text": "Mode to use for creating files.
\n" }, "fs_posix_autodelete_empty_directories": { "tags": [ "fs-posix" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "advanced": true, "default": "no",
"text": "If the last file in a directory is deleted, should the parent directory be\nautomatically deleted?
\nINFO
\nUsing this setting makes the POSIX filesystem behave more like an object\nstorage would.
\nWARNING
\nThis setting can cause the POSIX filesystem to also delete the parent directory\nhierarchy farther up than anticipated.
\nyes",
"text": "Configure whether fsync() is called after writes to guarantee that the file\nis written to disk.
no",
"text": "Configure whether utimes() is called after writes to guarantee microsecond\nprecision timestamps for files. By default Linux updates the mtime only on\ntimer interrupts, which is not remotely close to microsecond precision.
proxy-notify",
"values": [
{
"label": "String",
"url": "string"
}
],
"advanced": true,
"text": "Path to proxy-notify pipe.
\nLogin Variables can be used.
\n" }, "mail_cache_max_header_name_length": { "added": [ { "version": "Added: 3.0.0" } ], "default": "100",
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"advanced": true,
"text": "Maximum header name length stored in the cache, where 0 stands for unlimited\n(which is also the former behavior).
\nWhen enabled, the cache truncates the names to this length in memory and on\nfile. While the header name remains unchanged in the storage, all the headers\nsharing the first mail_cache_max_header_name_length prefix\ncharacters are de facto aliased and will be considered as the same header on\ncache fetch.
Also, attempting to fetch a specific aliased header will succeed even if\nthe header does not actually exist (this does NOT happen when the feature\nis disabled with explicitly with mail_cache_max_header_name_length = unlimited)
Example: (mail_cache_max_header_name_length = 5)
If the mail contains the header X-name: value, attempting to fetch\nX-nam or X-names will also produce X-name: value as a result\n(with the original header name, not the requested one).
Trying to fetch the mail text or the mail headers will properly return only\nX-name: value.
100",
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"advanced": true,
"text": "Maximum number of headers in yes/temp cache decision before the cache\nrefuses to promote more header decisions from no to temp, where 0\nstands for unlimited (which is also the former behavior).
When entries are rejected, the event mail_cache_decision_rejected\nis emitted.
Also, while the cache's headers count is saturated, the effective value of\nmail_cache_unaccessed_field_drop is reduced to 1/4 of\nof the specified one, in order to aid the cache to return within the limits.
1G",
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"advanced": true,
"text": "If dovecot.index.cache becomes larger than this, it's truncated\nto empty size.
WARNING
\nThe maximum value is 1 GB because the cache file format can't currently\nsupport larger sizes.
\nOnly update cache file when the mailbox contains at least this many messages.
\nWith a setting other than 0, you can optimize behavior for fewer disk\nwrites at the cost of more disk reads.
200",
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"advanced": true,
"text": "Compress the cache file when n% of records are deleted (by count, not by size).
\nFor example 200 means that the record has 2 continued rows, i.e. it\nexists in 3 separate segments in the cache file.
20",
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"advanced": true,
"text": "Compress the cache file when n% of records are deleted (by count, not by\nsize).
\n" }, "mail_cache_purge_header_continue_count": { "default": "4",
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"advanced": true,
"text": "Compress the cache file when we need to follow more than n next_offsets to\nfind the latest cache header.
\n" }, "mail_cache_purge_min_size": { "default": "32k",
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"advanced": true,
"text": "Only compress cache file if it is larger than this size.
\n" }, "mail_cache_record_max_size": { "default": "64k",
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"advanced": true,
"text": "If a cache record becomes larger than this, don't add it to the cache file.
\n" }, "mail_cache_unaccessed_field_drop": { "default": "30days",
"seealso": [
"mail cache configuration"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"advanced": true,
"text": "Specifies when cache decisions are downgraded.
\nChange caching decision from YES to TEMP after this much time has passed.\nDrop the field entirely after twice this much time has passed,\nregardless of whether the cache decision was YES or TEMP previously.
\nIf the cache header count is capped to\nmail_cache_max_headers_count then the effective value is reduced\nto 1/4 of the configured value until enough headers expire for the cache to\nfall back inside the limits.
1M",
"seealso": [
"mail_index_log_rotate_min_age",
"mail_index_log_rotate_min_size"
],
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"advanced": true,
"text": "Always rotate transaction log after it exceeds this size.
\n" }, "mail_index_log_rotate_min_age": { "default": "5mins",
"seealso": [
"mail_index_log_rotate_max_size"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"advanced": true,
"text": "Rotate transaction log if it is older than this value and is larger than\nmail_index_log_rotate_min_size.
32k",
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"advanced": true,
"text": "Rotate transaction log if it is larger than this size and is older than\nmail_index_log_rotate_min_age.
2days",
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"advanced": true,
"text": "Delete .log.2 index file when older than this value.
Older .log.2 files are useful for QRESYNC and dsync, so this value\nshould not be too low.
128k",
"seealso": [
"mail_index_rewrite_min_log_bytes"
],
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"advanced": true,
"text": "Rewrite the index when the number of bytes that needs to be read from the\n.log index file on refresh is between these min/max values.
\n" }, "mail_index_rewrite_min_log_bytes": { "default": "8k",
"seealso": [
"mail_index_rewrite_max_log_bytes"
],
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"advanced": true,
"text": "Rewrite the index when the number of bytes that needs to be read from the\n.log index file on refresh is between these min/max values.
\n" }, "managesieve_client_workarounds": { "tags": [ "managesieve", "sieve" ], "values": [ { "label": "Boolean List", "url": "Boolean List" } ], "advanced": true, "text": "Enables various workarounds for ManageSieve clients. Currently there are\nnone.
\n" }, "managesieve_implementation_string": { "tags": [ "managesieve", "sieve" ], "default": "Dovecot Pigeonhole",
"values": [
{
"label": "String",
"url": "string"
}
],
"advanced": true,
"text": "Sets the ManageSieve implementation string returned by the IMPLEMENTATION\ncapability.
bytes=%{input}/%{output}",
"values": [
{
"label": "String Without Variables",
"url": "String without variables"
}
],
"text": "Specifies the string pattern used to compose the logout message of an\nauthenticated session. The following substitutions are available:
\n| Variable Name | \nDescription | \n
|---|---|
%{input} | \nTotal number of bytes read from client | \n
%{output} | \nTotal number of bytes sent to client | \n
%{put_count} | \nNumber of scripts uploaded by client using PUTSCRIPT command | \n
%{put_bytes} | \nNumber of bytes with script data sent by client using PUTSCRIPT command | \n
%{get_count} | \nNumber of scripts downloaded by client using GETSCRIPT command | \n
%{get_bytes} | \nNumber of bytes with script data sent to client using GETSCRIPT command | \n
%{check_count} | \nNumber of scripts checked by client using CHECKSCRIPT command | \n
%{check_bytes} | \nNumber of bytes with script data sent by client using CHECKSCRIPT command | \n
%{deleted_count} | \nNumber of scripts deleted by client using DELETESCRIPT command | \n
%{renamed_count} | \nNumber of scripts renamed by client using RENAMESCRIPT command | \n
%{session} | \nThe client session ID | \n
5",
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"advanced": true,
"text": "The maximum number of compile errors that are returned to the client upon\nscript upload or script verification.
\n" }, "managesieve_max_line_length": { "tags": [ "managesieve", "sieve" ], "default": "64k",
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"advanced": true,
"text": "The maximum ManageSieve command line length in bytes.
\nSince long command lines are very unlikely with ManageSieve, changing this\nwill generally not be useful.
\n" }, "managesieve_notify_capability": { "tags": [ "managesieve", "sieve" ], "default": "<dynamically determined>",
"values": [
{
"label": "Boolean List",
"url": "Boolean List"
}
],
"advanced": true,
"text": "NOTIFY capabilities reported by the ManageSieve service before\nauthentication.
This does normally not need to be configured. If left unassigned, these will be\nassigned dynamically according to what the Sieve interpreter is configured to\nsupport using the global sieve_extensions setting (after login this\nmay differ depending on the settings applicable to the authenticated user).
<dynamically determined>",
"values": [
{
"label": "Boolean List",
"url": "Boolean List"
}
],
"advanced": true,
"text": "SIEVE capabilities reported by the ManageSieve service before\nauthentication.
This does normally not need to be configured. If left unassigned, these will be\nassigned dynamically according to what the Sieve interpreter is configured to\nsupport using the global sieve_extensions setting (after login this\nmay differ depending on the settings applicable to the authenticated user).
Creates a new Sieve script storage to the list of script storages. The filter\nname refers to the sieve_script_storage setting.
Example:
\nsieve_script personal {\n [...]\n}The identifier of the Sieve script storage. This is used only in configurations\nand by command line tools - it's not visible to the user. The\nsieve_script filter refers to this setting.
personal",
"seealso": [
"Script storage"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The (default) name of a Sieve script retrieved from this storage. If the\nname of the Sieve script cannot be derived somehow from the storage (e.g. from\na file name) and the storage for a single script is specified, this option is\nrequired (e.g. for dict locations that must point to a particular script).
\nIf the name of the script is derived from the storage, the value of the\nsieve_script_name setting overrides that name. If the Sieve\ninterpreter explicitly queries for a specific name (e.g. to let the Sieve\nSieve include extension retrieve a script from the\nglobal script storage),\nthis setting has no effect.
For the Sieve script storage with type\ndefault, the name is required to make\nthe default script visible in ManageSieve. See\n'Sieve visible default script'
\n", "plugin_link": "sieve plugin" }, "sieve_script_type": { "tags": [ "sieve-storage" ], "plugin": [ "sieve" ], "default": "personal",
"seealso": [
"Script storage types"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The type of the configured Sieve script storage. See\nScript storage types.
\n", "plugin_link": "sieve plugin" }, "sieve_script_cause": { "tags": [ "sieve-storage", "imap-sieve" ], "plugin": [ "sieve" ], "default": "delivery",
"seealso": [
"Script storage"
],
"values": [
{
"label": "Boolean List",
"url": "Boolean List"
}
],
"text": "The causes for executing Sieve scripts from this storage. This is currently only\nrelevant for the IMAPSieve plugin. For standard Sieve execution at message\ndelivery the cause is "delivery". Other causes can be append, copy and\nflag.
infinite",
"seealso": [
"Script storage"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"text": "The precedence of this Sieve storage in the configuration. Normally, script\nstorages with matching type and cause are accessed in the order these are\nspecified in the configuration. This setting can be used to configure an\nexplicit order. Storages will be accessed with lower precedence first.
\n", "plugin_link": "sieve plugin" }, "sieve_script_driver": { "tags": [ "sieve-storage" ], "plugin": [ "sieve" ], "default": "file",
"seealso": [
"Script storage"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The Sieve script storage driver to use. See Script storage drivers.
\n", "plugin_link": "sieve plugin" }, "sieve_script_bin_path": { "tags": [ "sieve-storage" ], "plugin": [ "sieve" ], "default": "personal",
"seealso": [
"Script storage"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "Points to the directory where the compiled binaries for this script\nlocation are stored. This directory is created automatically if possible.
\nIf this setting is not configured, the behavior depends on the storage driver.\nFor the file storage driver, the binaries are for\nexample stored in the same directory as the corresponding sieve scripts.
\nDon't specify the same directory for multiple script storages (e.g. with\ndifferent types), as this will result in undefined behavior. For one, the same\nscript name could point to different scripts for different storages, leading to\na conflict, because the storages will try to use the same binary file. Multiple\nmail users can share a single script directory if the associated script storage\nconfiguration is identical between users and all users share the same system\ncredentials (uid, gid). All users will then use the same scripts for that\nstorage type.
\n", "plugin_link": "sieve plugin" }, "sieve_script_path": { "tags": [ "sieve-storage-file" ], "plugin": [ "sieve" ], "default": "~/sieve",
"seealso": [
"File storage driver"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "A file system path pointing to a Sieve script file or a directory containing one\nor more Sieve script files with names structured as <script-name>.sieve.\nThis setting only applies when sieve_script_driver = file
~/.dovecot.sieve",
"seealso": [
"File storage driver"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "When ManageSieve server is used, one script in the storage can\nbe active; i.e., evaluated at delivery.
\nThis setting only applies when sieve_script_driver = file. For that\nstorage driver, the active script in the storage directory is pointed to by a\nsymbolic link.
This setting configures where this symbolic link is located. If the\nsieve_script_path setting points to a regular file, this setting has\nno effect (and ManageSieve cannot be used).
The name of the attribute containing the Sieve script.
\n", "plugin_link": "sieve plugin" }, "sieve_script_ldap_modified_attribute": { "tags": [ "sieve-storage-ldap" ], "plugin": [ "sieve" ], "seealso": [ "LDAP storage driver" ], "values": [ { "label": "String", "url": "string" } ], "text": "The name of the attribute used to detect modifications to the LDAP entry.
\n", "plugin_link": "sieve plugin" }, "sieve_script_ldap_filter": { "tags": [ "sieve-storage-ldap" ], "plugin": [ "sieve" ], "seealso": [ "LDAP storage driver" ], "values": [ { "label": "String", "url": "string" } ], "text": "The LDAP search filter that is used to find the entry containing the Sieve\nscript.
\nThese variables can be used:
\n| Variable | \nDescription | \n
|---|---|
%{user} | \nusername | \n
%{user | username} | \nuser part in user@domain, same as %{user} if there's no domain | \n
%{user | domain} | \ndomain part in user@domain, empty if user there's no domain | \n
%{home} | \nuser's home directory | \n
%{name} | \nname of the Sieve script | \n
<see description>",
"values": [
{
"label": "Boolean List",
"url": "Boolean List"
}
],
"text": "The Sieve language extensions available to users.
\nBy default, all supported extensions are available, except for deprecated\nextensions, extensions that add the ability to change messages, extensions\nthat require explicit configuration, or extensions that are still under\ndevelopment.
\nSome system administrators may want to disable certain Sieve extensions or\nenable those that are not available by default.
\nSupported extensions are listed at Sieve extensions.
\nExample:
\n# Enable the vacation-seconds extension in addition to all\n# extensions enabled by default.\nsieve_extensions {\n vacation-seconds = yes\n}sieve_extensions",
"values": [
{
"label": "Boolean List",
"url": "Boolean List"
}
],
"text": "Which Sieve language extensions are only available in global scripts.
\nThis can be used to restrict the use of certain Sieve extensions to\nadministrator control, for instance when these extensions can cause\nsecurity concerns.
\nThis setting has higher precedence than sieve_extensions, meaning\nthat the extensions enabled with this setting are never available to the\nuser's personal script no matter what is specified for the\nsieve_extensions setting.
The syntax of this setting is identical to sieve_extensions, with\nthe difference that extensions are enabled or disabled for exclusive use in\nglobal scripts.
Currently, no extensions are marked as such by default.
\n", "plugin_link": "sieve plugin" }, "sieve_implicit_extensions": { "tags": [ "sieve" ], "plugin": [ "sieve" ], "values": [ { "label": "String", "url": "string" } ], "text": "WARNING
\nDo not use this setting unless you really need to!
\nThe Sieve language extensions implicitly available to users.
\nThe extensions listed in this setting do not need to be enabled explicitly\nusing the Sieve "require" command.
\nThis behavior directly violates the Sieve standard, but can be necessary\nfor compatibility with some existing implementations of Sieve (notably\njSieve).
\nThe syntax and semantics of this setting are otherwise identical to\nsieve_extensions.
32",
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"text": "The maximum number of actions that can be performed during a single script\nexecution.
\nIf set to 0, no limit on the total number of actions is enforced.
30s",
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "The maximum amount of CPU time that a Sieve script is allowed to use while\nexecuting. If the execution exceeds this resource limit, the script ends with\nan error, causing the implicit "keep" action to be executed.
\nThis limit is not only enforced for a single script execution, but also\ncumulatively for the last executions within a configurable timeout\n(see sieve_resource_usage_timeout).
4",
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"text": "The maximum number of redirect actions that can be performed during a\nsingle script execution.
\n0 means redirect is prohibited.
1h",
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "To prevent abuse, the Sieve interpreter can record resource usage of a Sieve\nscript execution in the compiled binary if it is significant. Currently, this\nhappens when CPU system + user time exceeds 1.5 seconds for one execution.\nSuch high resource usage is summed over time in the binary and once that\ncumulative resource usage exceeds the limits (sieve_max_cpu_time),\nthe Sieve script is disabled in the binary for future execution, even if an\nindividual execution exceeded no limits.
If the last time high resource usage was recorded is older than\nsieve_resource_usage_timeout, the resource usage in the binary is\nreset. This means that the Sieve script is only disabled when the limits are\ncumulatively exceeded within this timeout. With the default configuration this\nmeans that the Sieve script is only disabled when the total CPU time of Sieve\nexecutions that lasted more than 1.5 seconds exceeds 30 seconds in the last\nhour.
A disabled Sieve script can be reactivated by the user by uploading a new\nversion of the Sieve script after the excessive resource usage times out. An\nadministrator can force reactivation by forcing a script compile (e.g. using\nthe sievec command line tool).
\n", "plugin_link": "sieve plugin" }, "sieve_max_script_size": { "tags": [ "sieve", "managesieve_quota" ], "plugin": [ "sieve" ], "default": "1M",
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"advanced": true,
"text": "The maximum size of a Sieve script. The compiler will refuse to compile any\nscript larger than this limit.
\nIf set to 0, no limit on the script size is enforced.
The Pigeonhole Sieve interpreter can have plugins of its own.
\nUsing this setting, the used plugins can be specified.
\nCheck Sieve plugins for available plugins.
\n", "plugin_link": "sieve plugin" }, "sieve_redirect_envelope_from": { "tags": [ "sieve" ], "plugin": [ "sieve" ], "default": "sender",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "Specifies what envelope sender address is used for redirected messages.
\nNormally, the Sieve redirect command copies the sender address for the\nredirected message from the processed message So, the redirected message\nappears to originate from the original sender.
The following options are supported for this setting:
\n| Option | \nDescription | \n
|---|---|
sender | \nThe sender address is used | \n
recipient | \nThe final recipient address is used | \n
orig_recipient | \nThe original recipient is used | \n
user_email | \nThe user's primary address is used. This is configured with the sieve_user_email setting. If that setting is not configured, user_email is equal to sender. | \n
postmaster | \nThe postmaster_address configured for LDA/LMTP. | \n
<user@domain> | \nRedirected messages are always sent from user@domain. The angle brackets are mandatory. The null <> address is also supported. | \n
When the envelope sender of the processed message is the null address\n<>, the envelope sender of the redirected message is also always\n<>, irrespective of what is configured for this setting.
no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"seealso": [
"Sieve trace debugging"
],
"text": "Enables showing byte code addresses in the trace output, rather than only\nthe source line numbers.
\n", "plugin_link": "sieve plugin" }, "sieve_trace_debug": { "tags": [ "sieve-trace" ], "plugin": [ "sieve" ], "default": "no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"seealso": [
"Sieve trace debugging"
],
"text": "Enables highly verbose debugging messages that are usually only useful for\ndevelopers.
\n", "plugin_link": "sieve plugin" }, "sieve_trace_dir": { "tags": [ "sieve-trace" ], "plugin": [ "sieve" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "Sieve trace debugging" ], "text": "The directory where trace files are written.
\nTrace debugging is disabled if this setting is not configured or if the\ndirectory does not exist.
\nIf the path is relative or it starts with ~/ it is interpreted relative\nto the current user's home directory.
The verbosity level of the trace messages. Trace debugging is disabled if\nthis setting is not configured. Options are:
\n| Option | \nDescription | \n
|---|---|
actions | \nOnly print executed action commands, like keep, fileinto, reject, and redirect. | \n
commands | \nPrint any executed command, excluding test commands. | \n
tests | \nPrint all executed commands and performed tests. | \n
matching | \nPrint all executed commands, performed tests and the values matched in those tests. | \n
unlimited",
"text": "The maximum number of personal Sieve scripts a single user can have.
\n", "plugin_link": "sieve plugin" }, "sieve_quota_storage_size": { "tags": [ "sieve", "managesieve_storage" ], "plugin": [ "sieve" ], "values": [ { "label": "Size", "url": "size", "default_required": true } ], "default": "unlimited",
"text": "The maximum amount of disk storage a single user's scripts may occupy.
\n", "plugin_link": "sieve plugin" }, "sieve_user_email": { "tags": [ "sieve" ], "plugin": [ "sieve" ], "values": [ { "label": "String", "url": "string" } ], "text": "The primary e-mail address for the user.
\nThis is used as a default when no other appropriate address is available\nfor sending messages.
\nIf this setting is not configured, either the postmaster or null <>\naddress is used as a sender, depending on the action involved.
This setting is important when there is no message envelope to extract\naddresses from, such as when the script is executed in IMAP.
\n", "plugin_link": "sieve plugin" }, "sieve_user_log_path": { "tags": [ "sieve" ], "plugin": [ "sieve" ], "values": [ { "label": "String", "url": "string" } ], "text": "The path to the file where the user log file is written.
\nA default location is used if this setting is not explicitly configured:
\nIf the main user's personal Sieve script storage (as configured with\nsieve_script uses the File storage driver, the logfile is\nset to <filename>.log by default.
If the script is not stored as a file, the default user log file is ~/.dovecot.sieve.log.
14d",
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"seealso": [
"Sieve duplicate extension"
],
"advanced": true,
"text": "Default period after which tracked values are purged from the duplicate\ntracking database.
\n", "plugin_link": "sieve plugin" }, "sieve_duplicate_max_period": { "tags": [ "sieve", "sieve-duplicate" ], "plugin": [ "sieve" ], "default": "7d",
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"seealso": [
"Sieve duplicate extension"
],
"advanced": true,
"text": "Maximum period after which tracked values are purged from the duplicate\ntracking database.
\n", "plugin_link": "sieve plugin" }, "sieve_editheader_header_forbid_add": { "tags": [ "sieve", "sieve-editheader" ], "plugin": [ "sieve" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "Sieve editheader extension" ], "text": "A space-separated list of headers that cannot be added to the message header.
\nAddition of the Subject: header cannot be prohibited, as required by\nthe RFC specification. Therefore, adding this header to this setting has no\neffect.
A space-separated list of headers that cannot be deleted from the message\nheader.
\nDeleting the Received: and Auto-Submitted: fields is always\nforbidden, while removing the Subject: header cannot be prohibited, as\nrequired by the RFC specification. Therefore, adding one of these headers\nto this setting has no effect.
2k",
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"seealso": [
"Sieve editheader extension"
],
"text": "The maximum size in bytes of a header field value passed to the addheader\ncommand.
\nThe minimum value for this setting is 1024 bytes.
This named list filter creates a new list definition for the ":list" match type\nin Sieve (extlists extension). The filter name refers to the\nsieve_extlists_list_name setting. That is the name of the list as it\nwill be accessible from the Sieve. A dict definition that is placed inside\nthe scope of this list filter will serve as the lookup for this extlists list.\nSo, values from Sieve are looked up in the defined dict. This is often used to\ndefine an address book or whitelist external to the Sieve script. If no dict is\npresent, the list will function as an empty list.
Example:
\nsieve_extlists_list :addrbook:default {\n dict proxy {\n name = addressbook\n }\n}The name of the list as it will be accessible through the Sieve ":list" match\ntype (extlists extension). According to the standard, this name must be a valid\nURI. This implementation further limits that to a valid URN or TAG URI. Note\nthat the standard URN and TAG equality rules dictate that at least parts of\nthese URIs are case-sensitive, so it is best to consider the configured name\ncase-sensitive entirely.
\nThe sieve_extlists_list filter refers to this setting.
1k",
"seealso": [
"Sieve extlists extension"
],
"text": "The maximum size of a value looked up from this Sieve extlists list. If the\nvalue is too large, the lookup will be skipped and will yield no result. Note\nthat individual lists may have different limits, meaning that lookups in other\nlists may still succeed.
\n", "plugin_link": "sieve plugin" }, "sieve_notify_mailto_envelope_from": { "tags": [ "sieve", "sieve-enotify" ], "plugin": [ "sieve" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "sieve_redirect_envelope_from",
"Sieve notifications extensions"
],
"text": "Defines the source of the notification sender address for e-mail\nnotifications.
\n", "plugin_link": "sieve plugin" }, "sieve_include_max_includes": { "tags": [ "sieve", "sieve-include" ], "plugin": [ "sieve" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": "255",
"seealso": [
"Sieve include extension"
],
"advanced": true,
"text": "The maximum number of scripts that may be included. This is the total\nnumber of scripts involved in the include tree.
\n", "plugin_link": "sieve plugin" }, "sieve_include_max_nesting_depth": { "tags": [ "sieve", "sieve-include" ], "plugin": [ "sieve" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": "10",
"seealso": [
"Sieve include extension"
],
"advanced": true,
"text": "The maximum nesting depth for the include tree.
\n", "plugin_link": "sieve plugin" }, "sieve_spamtest_score_max_header": { "tags": [ "sieve", "sieve-spamtest" ], "plugin": [ "sieve" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "Sieve spamtest extension" ], "text": "Value format: <header-field> [ ":" <regexp> ]
Some spam scanners include the maximum score value in one of their status\nheaders. Using this setting, this maximum can be extracted from the message\nitself instead of specifying the maximum manually using the setting\nsieve_spamtest_score_max_value.
The syntax is identical to the sieve_spamtest_status_header\nsetting. This setting cannot be used together with\nsieve_spamtest_score_max_value.
This statically specifies the maximum value a numeric spam score can have. This\nsetting cannot be used together with\nsieve_spamtest_score_max_header.\nThis setting can specify a fractional score with a decimal point.
Value format: <header-field> [ ":" <regexp> ]
This specifies the header field that contains the result information of the\nspam scanner and it may express the syntax of the content of the header.
\nIf no matching header is found in the message, the spamtest command will\nmatch against 0.
This is a structured setting. The first part specifies the header field\nname. Optionally, a POSIX regular expression follows the header field\nname, separated by a colon. Any white space directly following the colon is\nnot part of the regular expression. If the regular expression is omitted,\nany header content is accepted and the full header value is used. When a\nregular expression is used, it must specify one match value (inside\nbrackets) that yields the desired spam scanner result.
\nIf the header does not match the regular expression or if no value match is\nfound, the spamtest test will match against 0 during Sieve script\nexecution.
This specifies the type of status result that the spam/virus scanner\nproduces.
\nThis can either be a numeric score (score), a string of identical\ncharacters (strlen), e.g. '*******', or a textual description\n(text), e.g. 'Spam' or 'Not Spam' (see\nsieve_spamtest_text_value).
When the sieve_spamtest_status_type setting is set to\ntext, this setting specifies what values the spamtest test will match\nagainst to obtain the score value. For each recognized numeric score value this\nstring list setting yields the text to match against. Score values between 0\nand 10 are recognized.
Example:
\nsieve_spamtest_status_header = X-Spam-Verdict\nsieve_spamtest_status_type = text\nsieve_spamtest_text_value {\n 1 = Not Spam\n 10 = Spam\n}7d",
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"seealso": [
"Sieve vacation extension"
],
"text": "Specifies the default period that is used when no :days or :seconds\ntag is specified.
The configured value must lie between sieve_vacation_min_period\nand sieve_vacation_max_period.
yes",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"seealso": [
"Sieve vacation extension"
],
"text": "This setting determines whether the checks for implicit delivery are performed.\nIf this is skipped, this means that the vacation command does not verify that\nthe message is explicitly addressed at the recipient.
\nUse this option with caution. Specifying no will violate the Sieve\nstandards and can cause vacation replies to be sent for messages not\ndirectly addressed at the recipient.
60d",
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"seealso": [
"Sieve vacation extension"
],
"text": "Specifies the maximum period that can be specified for the :days tag of\nthe vacation command.
The configured value must be larger than sieve_vacation_min_period.
A value of 0 has a special meaning: it indicates that there is no upper\nlimit.
1d",
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"seealso": [
"Sieve vacation extension"
],
"text": "Specifies the minimum period that can be specified for the :days and\n:seconds tags of the vacation command.
A minimum of 0 indicates that users are allowed to make the Sieve\ninterpreter send a vacation response message for every incoming message\nthat meets the other reply criteria (refer to RFC 5230). A value of zero\nis not recommended.
no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"seealso": [
"Sieve vacation extension"
],
"text": "This setting determines whether vacation messages are sent with the SMTP\nMAIL FROM envelope address set to the recipient address of the Sieve\nscript owner.
Normally this is set to <>, which is the default as recommended in the\nspecification. This is meant to prevent mail loops. However, there are\nsituations for which a valid sender address is required and this setting\ncan be used to accommodate for those.
no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"seealso": [
"Sieve vacation extension"
],
"text": "This specifies whether the original envelope recipient should be used in\nthe check for implicit delivery.
\nThe vacation command checks headers of the incoming message, such as\nTo: and Cc: for the address of the recipient, to verify that the\nmessage is explicitly addressed at the recipient. If the recipient address\nis not found, the vacation action will not trigger a response to prevent\nsending a reply when it is not appropriate.
Normally only the final recipient address is used in this check. This\nsetting allows including the original recipient specified in the SMTP\nsession if available.
\nThis is useful to handle mail accounts with aliases. Use this option with\ncaution: if you are using aliases that point to more than a single account,\nas senders can get multiple vacation responses for a single message.
\nUse the LDA -a\noption or the LMTP/LDA lda_original_recipient_header setting to\nmake the original SMTP recipient available to Sieve.
255",
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"seealso": [
"Sieve vacation extension"
],
"advanced": true,
"text": "The maximum number of variables that can be declared in a scope.
\nThere are currently two variable scopes: the normal script scope and the\nglobal scope created by the Sieve include extension.
\nThe minimum value for this setting is 128.
4k",
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"seealso": [
"Sieve variables extension"
],
"advanced": true,
"text": "The maximum allowed size for the value of a variable. If exceeded at\nruntime, the value is always truncated to the configured maximum.
\nThe minimum value for this setting is 4000 bytes.
Value Format: <header-field> [ ":" <regexp> ]
Some spam scanners include the maximum score value in one of their status\nheaders. Using this setting, this maximum can be extracted from the message\nitself instead of specifying the maximum manually using the setting\nsieve_virustest_score_max_value.
The syntax is identical to sieve_virustest_status_header. This\nsetting cannot be used together with\nsieve_virustest_score_max_value.
This statically specifies the maximum value a numeric spam score can have. This\nsetting cannot be used together with\nsieve_virustest_score_max_header.\nThis setting can specify a fractional score with a decimal point.
Value Format: <header-field> [ ":" <regexp> ]
This specifies the header field that contains the result information of the\nspam scanner and it may express the syntax of the content of the header.
\nIf no matching header is found in the message, the spamtest command will\nmatch against 0.
This is a structured setting. The first part specifies the header field\nname. Optionally, a POSIX regular expression follows the header field name,\nseparated by a colon. Any white space directly following the colon is not\npart of the regular expression. If the regular expression is omitted, any\nheader content is accepted and the full header value is used. When a\nregular expression is used, it must specify one match value (inside\nbrackets) that yields the desired spam scanner result.
\nIf the header does not match the regular expression or if no value match is\nfound, the spamtest test will match against 0 during Sieve script\nexecution.
This specifies the type of status result that the spam/virus scanner produces.
\nThis can either be a numeric score (score), a string of identical\ncharacters (strlen), e.g. '*******', or a textual description\n(text), e.g. 'Spam' or 'Not Spam' (see\nsieve_virustest_text_value).
When the sieve_virustest_status_type setting is set to\ntext, this setting specifies what values the spamtest test will match\nagainst to obtain the score value. For each recognized numeric score value this\nstring list setting yields the text to match against. Score values between 0\nand 10 are recognized.
Example:
\nsieve_virustest_status_header = X-VirusCheck\nsieve_virustest_status_type = text\nsieve_virustest_text_value {\n 1 = Clean\n 2 = Presumed Clean\n 3 = Not sure\n 4 = Almost Certain\n 5 = Definitely\n}Only execute the administrator Sieve scripts for the mailbox configured\nwith sieve_script and type before\nor after when the message originates from the\nindicated mailbox. The filter name refers to the imapsieve_from_name\nsetting. Therefore, the contained sieve_script blocks only apply\nwhen the source mailbox of the IMAP action match this filter.
The name of the source mailbox for IMAPSieve\nbefore or\nafter scripts. The imapsieve_from\nfilter refers to this setting.
If set, support for user Sieve scripts in IMAP is enabled.
\nThe value is an URL pointing to the ManageSieve server that users must use\nto upload their Sieve scripts.
\nLeave this setting empty if you don't want users to have the ability to\nassociate Sieve scripts with mailboxes.
\nThis has no effect on the administrator-controlled Sieve scripts.
\nimapsieve_url = sieve://sieve.example.comno",
"text": "This setting determines whether de IMAPSieve plugin implicitly also expunges\nmessages that were discarded by the executed Sieve script sequence; i.e., Sieve\nyielded no (implicit) keep.
\n", "plugin_link": "imap-sieve plugin" }, "sieve_pipe_socket_dir": { "plugin": [ "sieve-extprograms" ], "values": [ { "label": "String", "url": "string" } ], "text": "Points to a directory relative to the base_dir where\nthe plugin looks for script service sockets for the vnd.dovecot.pipe\nextension.
Points to a directory relative to the base_dir where\nthe plugin looks for script service sockets for the vnd.dovecot.filter\nextension.
Points to a directory relative to the base_dir where\nthe plugin looks for script service sockets for the vnd.dovecot.execute\nextension.
Points to a directory where the plugin looks for programs (shell\nscripts) to execute directly and pipe messages to for the vnd.dovecot.pipe\nextension.
Points to a directory where the plugin looks for programs (shell\nscripts) to execute directly and filter messages through for the\nvnd.dovecot.filter extension.
Points to a directory where the plugin looks for programs (shell\nscripts) to execute directly for the vnd.dovecot.execute extension.
10s",
"plugin": [
"sieve-extprograms"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "Configures the maximum execution time after which the program run by the\nvnd.dovecot.pipe extension is forcibly terminated.
10s",
"plugin": [
"sieve-extprograms"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "Configures the maximum execution time after which the program run by the\nvnd.dovecot.filter extension is forcibly terminated.
10s",
"plugin": [
"sieve-extprograms"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "Configures the maximum execution time after which the program run by the\nvnd.dovecot.execute extension is forcibly terminated.
crlf",
"plugin": [
"sieve-extprograms"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"crlf",
"lf"
],
"text": "Determines the end-of-line character sequence used for the data piped\nto external programs run by the vnd.dovecot.pipe extension. The default is\ncurrently "crlf", which represents a sequence of the carriage return (CR) and\nline feed (LF) characters. This matches the Internet Message Format\n(RFC 5322) and what Sieve itself uses as a line ending. Set this setting to\n"lf" to use a single LF character instead.
crlf",
"plugin": [
"sieve-extprograms"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"crlf",
"lf"
],
"text": "Determines the end-of-line character sequence used for the data piped\nto external programs run by the vnd.dovecot.filter extension. The default is\ncurrently "crlf", which represents a sequence of the carriage return (CR) and\nline feed (LF) characters. This matches the Internet Message Format\n(RFC 5322) and what Sieve itself uses as a line ending. Set this setting to\n"lf" to use a single LF character instead.
crlf",
"plugin": [
"sieve-extprograms"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"crlf",
"lf"
],
"text": "Determines the end-of-line character sequence used for the data piped\nto external programs run by the vnd.dovecot.execute extension. The default\nis currently "crlf", which represents a sequence of the carriage return (CR) and\nline feed (LF) characters. This matches the Internet Message Format\n(RFC 5322) and what Sieve itself uses as a line ending. Set this setting to\n"lf" to use a single LF character instead.
acl_id",
"acl_rights"
],
"text": "Specifies an ACL entry on global, namespace or mailbox level. The filter name\nrefers to the acl_id setting.
Has two settings:
\nacl_idacl_rightsThe ACL driver to use. This setting is REQUIRED - if empty, the acl\nplugin is disabled.
\nCurrently, there is a single driver available: vfile. This driver\nsupports two ways of defining the ACL configuration:
global: ACL rules are applied to all users.
\nper-mailbox: Each mailbox has separate ACL rules. They are stored in a\ndovecot-acl file in each mailbox (or mail_control_path)\ndirectory. This is the default.
acl",
"ACL File Format"
],
"text": "Specifies identity to match. See ACL File Format for values. The\nacl filter name refers to this setting.
yes",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Should ACL dict updates assume that there is a reverse lookup index. This\nshould be used with SQL/CQL based dicts.
\n", "plugin_link": "acl plugin" }, "acl_rights": { "added": [ { "version": "Added: 3.1.0" } ], "plugin": [ "acl" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "acl",
"ACL File Format"
],
"text": "Specifies rights for this acl. See ACL File Format for values. This is\nusually used in acl block.
acl"
],
"text": "Location of global ACL configuration file. This option is deprecated, you\nshould use acl instead.
no",
"plugin": [
"acl"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, the default ACLs for private and shared namespaces (but not\npublic namespaces) are taken from the INBOX. This means that giving\nsomebody access to your INBOX will give them access to all your other\nmailboxes as well, unless the specific mailboxes' ACLs override the\nINBOX's.
\n", "plugin_link": "acl plugin" }, "acl_globals_only": { "default": "no",
"plugin": [
"acl"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, don't try to find dovecot-acl files from mailbox\ndirectories. This reduces unnecessary disk I/O when only global ACLs are\nused.
A comma-separated string which contains all the groups the user belongs to.
\nA user's UNIX groups have no effect on ACLs (you can enable them by using a\nspecial post-login scripting.
\nThe default ACL for mailboxes is to give the mailbox owner all permissions\nand other users none. Mailboxes in public namespaces don't have owners, so\nby default no one can access them.
\n", "plugin_link": "acl plugin" }, "acl_ignore": { "added": [ { "version": "Added: 3.1.0" } ], "plugin": [ "acl" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"text": "Can be used in global config, namespace, or mailbox level to ignore ACLs.
\nnamespace ignore {\n acl_ignore = yes\n}A shared mailbox dictionary that defines which users may LIST mailboxes\nshared by other users.
\nSee shared mailbox listing for further details on the contents\nof the dictionary entries.
\nExample:
\nacl_sharing_map {\n dict file {\n path = /var/lib/dovecot/shared-mailboxes\n }\n}See auth_master_user_separator for the format of this setting.
List of AppArmor "hats" to change to when a user is loaded.
\nExample:
\napparmor_hats {\n hat_name = yes\n another_hat = yes\n}List of <from>=<to> charsets. The "from" charsets\nwill be treated as "to" charsets when decoding to UTF-8.
Example:
\ncharset_aliases {\n shift_jis = sjis-win\n euc-jp = eucjp-win\n iso-2022-jp = iso-2022-jp-3\n}Configures the used fts driver to perform fts plugin indexing. If not\nspecified, FTS is disabled. The filter name refers to the\nfts_driver setting.
Example:
\nfts solr {\n # ...\n}no",
"plugin": [
"fts"
],
"seealso": [
"fts_autoindex_max_recent_msgs"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, index mail as it is delivered or appended.
\nIt can be overridden at the mailbox level, e.g. you can disable autoindexing\nfor selected mailboxes using this setting:
\nExample:
\nfts_autoindex = yes\n\n# ...\n\nmailbox trash {\n special_use = Trash\n fts_autoindex = no\n}\n\nmailbox spam {\n special_use = Junk\n fts_autoindex = no\n}\n\nmailbox storage/* {\n fts_autoindex = no\n}fts_autoindex"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"default": 0,
"text": "To exclude infrequently accessed mailboxes from automatic indexing, set\nthis value to the maximum number of Recent flagged messages that exist\nin the mailbox.
A value of 0 means to ignore this setting.
Mailboxes with more flagged Recent messages than this value will not\nbe autoindexed, even though they get deliveries or appends. This is useful\nfor, e.g., inactive Junk folders.
Any folders excluded from automatic indexing will still be indexed, if a\nsearch on them is performed.
\nExample:
\nfts_autoindex_max_recent_msgs = 999Optional setting. If set, decode attachments to plaintext using the selected\nservice and index the resulting plaintext.
\n", "plugin_link": "fts plugin" }, "fts_decoder_script_socket_path": { "changed": [ { "text": "Renamed from fts_decoder.
Name of the script service used to decode the attachments.\nWe strongly recommend using fts_decoder_driver = tika instead.
Example:
\nfts_decoder_driver = script\nfts_decoder_script_socket_path = fts-decoder\n\nservice fts-decoder {\n executable = script /path/to/fts-decoder.sh\n user = vmail\n unix_listener fts-decoder {\n\tmode = 0666\n }\n}Configures the used fts driver to perform fts plugin indexing. The\nfts filter name refers to this setting.
body-search-only",
"text": "Should missing mails be added to FTS indexes before search?
\nWith body-search-only this is done only when the search query requests\nsearching message bodies, i.e. header searches are not updating the FTS index.
The unindexed mails are searched without FTS, i.e. either getting the headers\nfrom dovecot.index.cache or by opening the emails if the headers aren't in\ncache. This may be a useful optimization if the user's client only uses header\nsearches.
INFO
\nOnly the yes option guarantees consistent search results. Otherwise it's\npossible that the search results will be different depending on whether the\nsearch was performed via FTS index or not.
no",
"text": "If FTS lookup or indexing fails, fall back to searching without FTS (i.e.\npossibly opening all emails). This may timeout for large mailboxes and/or slow\nstorage.
\n", "changed": [ { "text": "Default changed from yes to no.
The list of headers to include or exclude.
\nincludes take precedence over excludes: if a header matches both,\nit is indexed.* at the end of a header name matches anything starting\nwith that header name.Example:
\nfts_header_excludes {\n Received = yes\n DKIM-* = yes\n X-* = yes\n Comments = yes\n}\n\nfts_header_includes {\n X-Spam-Status = yes\n Comments = yes\n}Received headers, all DKIM- headers and all X- experimental\nheaders are excluded, with the following exceptions:
Comments and X-Spam-Status are indexed anyway, as they match\nboth excludes and includes lists.Example:
\nfts_header_excludes {\n * = yes\n}\n\nfts_header_includes {\n From = yes\n To = yes\n Cc = yes\n Bcc = yes\n Subject = yes\n Message-ID = yes\n In-* = yes\n X-CustomApp-* = yes\n}includes.fts_header_excludes"
],
"plugin_link": "fts plugin"
},
"fts_search_timeout": {
"default": "30s",
"plugin": [
"fts"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "When the full text search driver detects that the index isn't up-to-date,\nthe indexer is told to index the messages and is given this much time to do\nso. If this time limit is reached, an error is returned, indicating that\nthe search timed out during waiting for the indexing to complete:\nNO [INUSE] Timeout while waiting for indexing to finish.
A value of 0 means no timeout.
unlimited",
"added": [
{
"version": "Added: 3.0.0"
}
],
"plugin": [
"fts"
],
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"text": "Maximum body size that is processed by fts.
\n", "plugin_link": "fts plugin" }, "fts_decoder_tika": { "plugin": [ "fts" ], "values": [ { "label": "Named Filter", "url": "Named Filter", "no_default": true } ], "seealso": [ "fts_decoder_tika_url"
],
"text": "Named filter used for Apache Tika HTTP lookups.\nFor example:
\nfts_decoder_tika {\n http_client_request_timeout = 10s\n}Basic authentication support (via URL) is added.
\n", "version": "Added: 3.0.0" } ], "changed": [ { "text": "Renamed from fts_tika.
fts_decoder_tika"
],
"text": "URL for Apache Tika decoder for attachments.
\nExample:
\nfts_decoder_driver = tika\nfts_decoder_tika_url = http://tikahost:9998/tika/<textcat dir>",
"values": [
{
"label": "String",
"url": "string"
}
],
"seealso": [
"language"
],
"text": "Path to the textcat/exttextcat configuration file, which lists the\nsupported languages.
\nThis is recommended to be changed to point to a minimal version of a\nconfiguration that supports only the languages listed in\nlanguage.
Doing this improves language detection performance during indexing and also\nmakes the detection more accurate.
\nExample:
\ntextcat_config_path = /usr/share/libexttextcat/fpdb.conf<textcat dir>",
"values": [
{
"label": "Named List Filter",
"url": "Named List Filter"
}
],
"dependencies": [
"language_default"
],
"seealso": [
"textcat_config_path",
"FTS Tokenization"
],
"text": "Defines a language to be used in tokenization.
\nAt least one language must be specified and one single language must be flagged\nas the default language using language_default = yes.
The language listed first is the default and is used when language\nrecognition fails.
\nThe filters used for stemming and stopwords are language dependent.
\nTIP
\nFor better performance it's recommended to synchronize this setting with the\ntextcat configuration file; see textcat_config_path.
Example:
\nlanguage en {\n default = yes\n}\nlanguage de {\n}no",
"dependencies": [
"language"
],
"seealso": [
"FTS Tokenization"
],
"text": "The language marked as default will be used when language detection cannot\nidentify the proper language of the text being processed.
\nExactly one language must be marked with this flag.
\n", "plugin_link": "fts plugin" }, "language_filters": { "plugin": [ "fts" ], "values": [ { "label": "Boolean List", "url": "Boolean List" } ], "seealso": [ "FTS Tokenization", "Filter Configuration" ], "text": "The list of filters to apply.
\nSee Filter Configuration for configuration information.
\n", "plugin_link": "fts plugin" }, "language_tokenizers": { "plugin": [ "fts" ], "values": [ { "label": "Boolean List", "url": "Boolean List" } ], "default": "generic email-address",
"seealso": [
"FTS Tokenization",
"Tokenizer Configuration"
],
"text": "The list of tokenizers to use.
\nSee Tokenizer Configuration for configuration information.
\n", "plugin_link": "fts plugin" }, "language_filter_normalizer_icu_id": { "plugin": [ "fts" ], "tags": [ "language-filter-normalizer-icu" ], "values": [ { "label": "String", "url": "string" } ], "default": "Any-Lower; NFKD; [: Nonspacing Mark :] Remove; [\\x20] Remove",
"text": "Description of the normalizing/transliterating rules to use.
\nSee\nNormalizer Format\nfor syntax.
\n", "plugin_link": "fts plugin" }, "language_filter_stopwords_dir": { "plugin": [ "fts" ], "tags": [ "language-filter-stopwords-dir" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "FTS Tokenization" ], "text": "Path to the directory containing stopword files. The files inside the directory\nhave names with the form /stopwords_<lang>.txt.
See Languages for the list of stopword files that are currently\ndistributed with Dovecot.
\nMore languages can be obtained from:
\n250",
"seealso": [
"FTS Tokenization"
],
"text": "Maximum length of token, before an arbitrary cut off is made.
\n", "plugin_link": "fts plugin" }, "language_tokenizer_generic_algorithm": { "plugin": [ "fts" ], "tags": [ "language-tokenizer-generic" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "simple", "tr29" ], "default": "simple",
"seealso": [
"FTS Tokenization"
],
"text": "Defines the method for finding word boundaries.
\n| Value | \nDescription | \n
|---|---|
simple | \nFaster algorithm that works for many texts, especially using the latin alphabets, but leaves corner cases. | \n
tr29 | \nImplements a version of Unicode technical report 29 word boundary lookup. It might work better with texts containing e.g. Katakana or Hebrew characters, but it is not possible to use a single algorithm for all existing languages. | \n
30",
"seealso": [
"FTS Tokenization"
],
"text": "Maximum length of token, before an arbitrary cut off is made.
\n", "plugin_link": "fts plugin" }, "language_tokenizer_generic_wb5a": { "plugin": [ "fts" ], "tags": [ "language-tokenizer-generic" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"seealso": [
"FTS Tokenization"
],
"text": "Unicode TR29 rule WB5a setting to the tr29 tokenizer. Splits prefixing\ncontracted words from base word. E.g. l'homme -> l and homme.\nTogether with a language specific stopword list unnecessary contractions can\nthus be filtered away. This is disabled by default and only works with the TR29\nalgorithm.
Enable by declaring:
\n\n", "plugin_link": "fts plugin" }, "language_tokenizer_kuromoji_icu_id": { "plugin": [ "fts" ], "values": [ { "label": "String", "url": "string" } ], "default": "Any-NFKC",
"seealso": [
"FTS Tokenization"
],
"text": "Description of the normalizing/transliterating rules to use. See\nNormalizer Format\nfor syntax.
\nDefaults to Any-NFKC which is quite good for CJK text mixed with latin\nalphabet languages. It transforms CJK characters to full-width encoding and\ntransforms latin ones to half-width. The NFKC transformation is described\nabove.
WARNING
\nIf this setting is changed, existing FTS indexes will produce unexpected\nresults. The FTS indexes should be recreated in this case.
\nyes",
"seealso": [
"FTS Tokenization"
],
"text": "This setting enables search mode in the Atilika Kuromoji library. The\nsetting defaults to enabled and should not be changed unless there is a\ncompelling reason.
WARNING
\nIf this setting is changed, existing FTS indexes will produce unexpected\nresults. The FTS indexes should be recreated in this case.
\n1024",
"seealso": [
"FTS Tokenization"
],
"text": "Maximum length of token, before an arbitrary cut off is made.
\n", "plugin_link": "fts plugin" }, "fts_solr_batch_size": { "plugin": [ "fts-solr" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": "1000",
"text": "Configures the number of mails sent to Solr in a single request.
\nfts_autoindex = yes each new mail gets separately indexed on\narrival, so fts_solr_batch_size only matters during the initial indexing\nof a mailbox.fts_autoindex = no new mails don't get indexed on arrival, so\nfts_solr_batch_size is used when indexing is triggered.yes",
"seealso": [
"FTS Solr: Soft Commits"
],
"text": "Controls whether new mails are immediately searchable via Solr.
\n", "plugin_link": "fts-solr plugin" }, "fts_solr_url": { "plugin": [ "fts-solr" ], "values": [ { "label": "String", "url": "string" } ], "text": "Required base URL for Solr.
\nINFO
\nRemember to add your core name if using solr 7+: /solr/dovecot.
Example:
\nfts_solr_url = http://solr.example.org:8983/solr/dovecot/\nfts_solr_batch_size = 1000no",
"text": "By default Dovecot doesn't allow using the IMAP anyone or\nauthenticated identifier, because it would be an easy way to spam\nother users in the system.
If mail-crypt plugin is used, users who have different set of encryption\nkeys cannot share mails, but sharing is possible within the scope of a key.
\n", "plugin_link": "imap-acl plugin" }, "last_login": { "plugin": [ "last-login" ], "values": [ { "label": "Named Filter", "url": "Named Filter", "no_default": true } ], "text": "Named filter for initializing dictionary used to store last login information.
\nExample:
\nredis_host = 127.0.0.1\nredis_port = 6379\nlast_login {\n dict redis {\n }\n}last-login/%{user}",
"plugin": [
"last-login"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The key that is updated in the dictionary with the last login information.
\n", "plugin_link": "last-login plugin" }, "last_login_precision": { "default": "s",
"plugin": [
"last-login"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"s",
"ms",
"us",
"ns"
],
"text": "Precision for last login timestamp.
\n", "plugin_link": "last-login plugin" }, "lazy_expunge_mailbox": { "plugin": [ "lazy-expunge" ], "seealso": [ "lazy-expunge storage locations" ], "values": [ { "label": "String", "url": "string" } ], "text": "The mailbox to move messages to when expunged. This setting MUST be defined or\nelse lazy-expunge plugin will not be active.
\nlazy_expunge_mailbox = .EXPUNGED\nnamespace inbox {\n mailbox Drafts {\n lazy_expunge_mailbox =\n }\n namespace \"External accounts\" {\n lazy_expunge_mailbox =\n }\n}yes",
"changed": [
{
"text": "Changed from no to yes.
If yes, only move to expunged storage if this is the last copy of the\nmessage in the user's account. This prevents the same mail from being\nduplicated in the lazy-expunge folder as the mail becomes expunged from\nall the folders it existed in.
This setting prevents copying mail to the lazy-expunge folder when using\nthe IMAP MOVE command. When using COPY/EXPUNGE, this setting prevents\nduplicates only with the following mailbox formats:
\nmaildir_copy_with_hardlinks = yes, which is\nthe default)9",
"text": "The compression block size to use. Must be between 1 (100 000 bytes)\nand 9 (900 000 bytes).
6",
"text": "The compression level to use for deflate compression. Must be between 0 (no compression) and 9.
6",
"text": "The compression level to use for gz compression. Must be between 0 (no compression) and 9.
3",
"text": "The compression level to use for zstd compression. Must be between 1 and\n22.
The Compression Method to use for\nwriting new mails. If empty, new mails are written without compression. Old\nmails can still be read.
\n", "plugin_link": "mail-compress plugin" }, "crypt_acl_require_secure_key_sharing": { "plugin": [ "mail-crypt" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"text": "If enabled, you cannot share a key to groups or someone without a public key.
\n", "plugin_link": "mail-crypt plugin" }, "crypt_user_key_curve": { "plugin": [ "mail-crypt" ], "values": [ { "label": "String", "url": "string" } ], "text": "Defines the elliptic curve to use for key generation. A key pair is generated\nfor the user, and a key pair is generated for each folder. The folder key is\nencrypted using the user key.
\nThis must be set if you wish to use folder keys\nrather than global keys. With global keys\n(either RSA or EC keys), all keying material is taken from the global key\nsettings and no key generation is performed.
\nAny valid curve supported by the underlying cryptographic library is allowed.
\nExample:
\ncrypt_user_key_curve = secp521r1For EdDSA, you need to use X448 or X25519, case sensitive.
\n", "plugin_link": "mail-crypt plugin" }, "crypt_global_public_key_file": { "plugin": [ "mail-crypt" ], "values": [ { "label": "File", "url": "File" } ], "text": "Public key to encrypt files. Key must be in\nPEM pkey format. The PEM key may\nadditionally be base64-encoded into a single line, which can make it easier to\nstore into userdb extra fields.
\n", "plugin_link": "mail-crypt plugin" }, "crypt_global_private_key": { "plugin": [ "mail-crypt" ], "values": [ { "label": "Named List Filter", "url": "Named List Filter" } ], "seealso": [ "crypt_private_key_file",
"crypt_private_key_password"
],
"text": "List of global private key(s) to decrypt mails. Add\ncrypt_private_key_file and optionally\ncrypt_private_key_password inside each filter.
crypt_private_key_file",
"crypt_private_key_password"
],
"text": "List of private key(s) to decrypt user's master private key. Add\ncrypt_private_key_file and optionally\ncrypt_private_key_password inside each filter.
Password to decrypt user's master private key.
\n", "plugin_link": "mail-crypt plugin" }, "crypt_user_key_require_encrypted": { "plugin": [ "mail-crypt" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"seealso": [
"crypt_user_key_password",
"crypt_user_key_encryption_key"
],
"text": "If yes, require user's master private key to be encrypted with\ncrypt_user_key_password or\ncrypt_user_key_encryption_key. If they are unset new user key\ngeneration will fail. This setting doesn't affect already existing\nnon-encrypted keys.
aes-256-gcm-sha256",
"text": "Set the encryption algorithm for newly written mails. If empty, new mails are\nnot encrypted. Existing encrypted mails (with any algorithm) can be decrypted\nregardless of this setting.
\n", "plugin_link": "mail-crypt plugin" }, "crypt_private_key_name": { "plugin": [ "mail-crypt" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "crypt_global_private_key",
"crypt_user_key_encryption_key"
],
"text": "Name of the private key inside crypt_global_private_key or\ncrypt_user_key_encryption_key.
crypt_global_private_key",
"crypt_user_key_encryption_key"
],
"text": "Private key in Mail Crypt Plugin: Converting EC key to PKEY. The PEM key may\nadditionally be base64-encoded into a single line, which can make it easier to\nstore into userdb extra fields.
\nUsed inside crypt_global_private_key and\ncrypt_user_key_encryption_key lists.
crypt_private_key_file"
],
"text": "Password to decrypt crypt_private_key_file.
no",
"plugin": [
"mail-log"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, everything except save event will log only the fields that\ncan be looked up from cache. This improves performance if some of the\nfields aren't cached and it's not a strict requirement to log them.
List of events to log.
\nAvailable events:
\ndeleteundeleteexpungesavecopymailbox_createmailbox_deletemailbox_renameflag_changeList of fields to log.
\n| Field | \nRestrictions | \n
|---|---|
uid | \n\n |
box | \n\n |
msgid | \n\n |
size | \nOnly available for expunge and copy events. | \n
vsize | \nOnly available for expunge and copy events. | \n
vsize | \n\n |
flags | \n\n |
from | \n\n |
subject | \n\n |
lua_file",
"lua_settings"
],
"text": "Named filter for initializing mail_lua plugin settings.
\nExample:
\nmail_lua {\n lua_file = /etc/dovecot/user.lua\n lua_settings {\n extra_param = %{userdb:extra_param}\n }\n}no",
"text": "Whether notifications for a single mailbox or mailbox wildcards are enabled.
\nExample:
\nmailbox INBOX {\n notify_status = yes\n}\nmailbox Spam {\n notify_status = yes\n}\nmailbox *BOX {\n notify_status = yes\n}The URI of the dictionary to use. This MUST be set for the plugin to be active.
\nSee dictionary for how to configure dictionaries.
\nnotify_status {\n dict proxy {\n name = notify_status\n socket_path = dict-async\n }\n}{"messages":%{messages},"unseen":%{unseen}}",
"plugin": [
"notify-status"
],
"values": [
{
"label": "String Without Variables",
"url": "String without variables"
}
],
"text": "A template of the string that will be written to the dictionary.
\nThe template supports variable substitution of the form\n%{variable_name}.
Supported variable substitutions:
\n| Field | \nValue | \n
|---|---|
first_recent_uid | \nFirst recent UID | \n
highest_modseq | \nHighest modification sequence number | \n
highest_pvt_modseq | \nHighest private modification sequence number | \n
mailbox | \nMailbox name | \n
messages | \nNumber of messages | \n
recent | \nNumber of recent messages (deprecated) | \n
uidnext | \nPredicted next UID value | \n
uidvalidity | \nCurrent UID validity | \n
unseen | \nNumber of unseen messages | \n
username | \nUsername (user@domain) | \n
no",
"plugin": [
"pop3-migration"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "By default it's assumed that POP3 contains the same messages as IMAP INBOX.\nIf there are any unexpected mails, the migration fails. If the POP3 server\nincludes other folders' contents in POP3 as well, this setting needs to be\nenabled. It causes Dovecot to try to match POP3 messages in all the migrated\nfolders, not just INBOX. There is no warning logged if any POP3 UIDLs are\nmissing or if POP3 has messages that aren't found from IMAP.
\n", "plugin_link": "pop3-migration plugin" }, "pop3_migration_ignore_extra_uidls": { "default": "no",
"plugin": [
"pop3-migration"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If IMAP INBOX has all messages that exist in POP3, but POP3 still has some\nadditional messages, the migration fails. Enable this setting to log it as\na warning and continue anyway. This could happen if there's a race condition\nwhere a new mail is just delivered and it shows up in POP3 but not in IMAP.
\n", "plugin_link": "pop3-migration plugin" }, "pop3_migration_ignore_missing_uidls": { "default": "no",
"plugin": [
"pop3-migration"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If POP3 has messages that aren't found from IMAP INBOX, and IMAP INBOX also\nhas messages not found from POP3, the migration fails. Enable this setting\nto log it as a warning and continue anyway.
\n", "plugin_link": "pop3-migration plugin" }, "pop3_migration_mailbox": { "default": "no",
"plugin": [
"pop3-migration"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "This setting points to the POP3 INBOX in the configured pop3c namespace.\nThis setting is required for the plugin to be active.
\npop3_migration_mailbox = POP3-MIGRATION-NS/INBOXno",
"plugin": [
"pop3-migration"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "IMAP and POP3 messages are attempted to be matched by the message sizes by\ndefault. This is the most efficient way of matching the messages, since both\nIMAP and POP3 listings can usually be looked up from indexes/caches. If the\nIMAP INBOX and POP3 listings don't match exactly, or if two adjacent\nmessages have the same size, the rest of the messages are matched by reading\ntheir headers.
\nIf this setting is enabled, the message size check is skipped entirely and\nonly headers are matched. This may be necessary for reliability if it's\nknown that the IMAP and POP3 messages cannot be matched by size anyway.
\n", "plugin_link": "pop3-migration plugin" }, "pop3_migration_skip_uidl_cache": { "default": "no",
"plugin": [
"pop3-migration"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If imapc is configured with persistent indexes, the POP3 UIDLs are stored\ninto the imapc mailbox's dovecot.index.cache files. Any following\nincremental migrations use these cached UIDLs if possible. This setting\ncan be used to disable this in case there are any problems with the cache.\nThis setting is unlikely to be ever needed.
\n", "plugin_link": "pop3-migration plugin" }, "push_notification": { "plugin": [ "push-notification" ], "values": [ { "label": "String", "url": "string" } ], "text": "The configuration value is a named filter for a specified driver, see\nPush Notifications for their names and their supported options.
\n", "plugin_link": "push-notification plugin" }, "push_notification_driver": { "plugin": [ "push-notification" ], "filter": "push_notification", "dependencies": [ "push_notification"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The name of the driver. This value determines the available options and the\nbehavior. See Push Notifications for the list of supported drivers and\noptions.
\n", "plugin_link": "push-notification plugin" }, "quota_clone": { "plugin": [ "quota-clone" ], "added": [ { "version": "Added: 3.1.0" } ], "values": [ { "label": "Named Filter", "url": "Named Filter", "no_default": true } ], "seealso": [ "dictionary" ], "text": "Named filter for initializing dictionary used to update with quota clone\ninformation.
\nredis_host = 127.0.0.1\nredis_port = 6379\nquota_clone {\n dict redis {\n }\n}no",
"advanced": true,
"text": "Unset quota information before updating. This is needed with some dict\ndrivers that do not support upserting, such as SQL with older SQLite.
\n", "plugin_link": "quota-clone plugin" }, "quota": { "plugin": [ "quota" ], "values": [ { "label": "Named List Filter", "url": "Named List Filter" } ], "seealso": [ "Quota Root" ], "text": "Create a new quota root. The filter name refers\nto quota_name setting.
Globally configured quota roots are used only for private namespaces.\nTo use quota for public namespaces, configure it inside the public namespace.
\nExample:
\nquota \"User quota\" {\n storage_size = 1G\n}count",
"seealso": [
"Quota Drivers"
],
"text": "Quota driver to use. See Quota Drivers.
\n", "plugin_link": "quota plugin" }, "quota_enforce": { "plugin": [ "quota" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "yesquota_imapc { no }",
"text": "If disabled, the quota limit isn't actually enforced. The quota is still\ntracked and the current quota usage is visible to IMAP GETQUOTA commands.
\n", "plugin_link": "quota plugin" }, "quota_exceeded_message": { "plugin": [ "quota" ], "values": [ { "label": "String", "url": "string" } ], "default": "Quota exceeded (mailbox for user is full)",
"text": "The message specified here is passed on to a user who goes over quota.\nThere are also other messages, which are currently hard coded:
\nquota_mail_size:\nMail size is larger than the maximum size allowed by server configurationquota_mailbox_message_count:\nToo many messages in the mailboxno",
"text": "If yes, use filesystem quota's inode limit as the message count limit.\nThis can be useful with Maildir or sdbox. Used only with\nQuota Driver: Filesystem.
\n", "plugin_link": "quota plugin" }, "quota_fs_mount_path": { "plugin": [ "quota" ], "values": [ { "label": "String", "url": "string" } ], "tags": [ "quota-fs" ], "text": "If specified, enable FS quota for the specified mount path. Only mailboxes\nexisting in this mount path have the quota enabled. Empty value looks up the\nmountpoint automatically. Used only with Quota Driver: Filesystem.
\n", "plugin_link": "quota plugin" }, "quota_fs_type": { "plugin": [ "quota" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "tags": [ "quota-fs" ], "values_enum": [ "any", "user", "group" ], "default": "any",
"text": "Using any attempts to use the user quota first, with a fallback to group\nquota. Using user or group only attempts to use the user or the group\nquota, with a fallback to unlimited quota limit. Used only with\nQuota Driver: Filesystem.
no",
"text": "If yes, hide the quota root from IMAP GETQUOTA commands.
\n", "plugin_link": "quota plugin" }, "quota_ignore": { "plugin": [ "quota" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"text": "If yes, don't include this mailbox or namespace in quota calculations.
\nExample:
\nnamespace inbox {\n mailbox Trash {\n quota_ignore = yes\n }\n}\nnamespace secondary {\n quota_ignore = yes\n}no",
"text": "If yes, ignore the quota root entirely if it has no quota limits. This means\nno tracking of the quota, and not making it visible to IMAP GETQUOTA commands.
\n", "plugin_link": "quota plugin" }, "quota_imapc_mailbox_name": { "plugin": [ "quota" ], "values": [ { "label": "String", "url": "string" } ], "tags": [ "quota-imapc" ], "seealso": [ "quota_imapc_root_name"
],
"default": "INBOX",
"text": "If non-empty, use GETQUOTAROOT <mailbox> to get the imapc quota root.\nUsed only with Quota Driver: Imapc.
quota_imapc_mailbox_name"
],
"default": "",
"text": "If quota_imapc_mailbox_name is empty, use GETQUOTA <name>\nto get the imapc quota.
Some servers may have an empty quota root name. This is why if this setting and\nquota_imapc_mailbox_name both have empty values, this setting is\nused. Used only with Quota Driver: Imapc.
unlimited",
"plugin": [
"quota"
],
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"tags": [
"storage_size_limits"
],
"seealso": [
"Quota: Maximum Saved Mail Size"
],
"text": "The maximum message size that is allowed to be saved (e.g. by LMTP, IMAP\nAPPEND or doveadm save). If configured, will also be advertized with\nAPPENDLIMIT extensions for IMAP clients, and SIZE extension for LMTP clients.
unlimited",
"plugin": [
"quota"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"tags": [
"storage_size_limits"
],
"seealso": [
"Quota: Maximum Mailbox Count"
],
"added": [
{
"version": "Added: 3.0.0"
}
],
"text": "Maximum number of mailboxes that can be created. Each namespace is tracked\nseparately, so e.g. shared mailboxes aren't counted towards the user's own\nlimit.
\n", "plugin_link": "quota plugin" }, "quota_mailbox_message_count": { "default": "unlimited",
"plugin": [
"quota"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"tags": [
"storage_size_limits"
],
"added": [
{
"version": "Added: 3.0.0"
}
],
"text": "Maximum number of messages that can be created in a single mailbox.
\n", "plugin_link": "quota plugin" }, "quota_message_count": { "default": "unlimited",
"plugin": [
"quota"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"seealso": [
"quota_message_percentage",
"quota_storage_size",
"Quota Root"
],
"tags": [
"storage_size_limits"
],
"text": "Maximum number of messages for the Quota Root. This value is still\nmultiplied by quota_message_percentage to get the final value\n(in this mailbox or namespace). This is reported as the MESSAGE limit in IMAP\nGETQUOTA commands. Using 0 as the value means the same as unlimited.
100",
"plugin": [
"quota"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"seealso": [
"quota_message_count"
],
"text": "Multiplier for the quota_message_count setting (in this\nmailbox/namespace).
This may be useful to exceed the regular quota limit in some mailboxes, such as\nallowing clients that move messages with IMAP COPY+EXPUNGE to Trash folder to\ntemporarily exceed the quota.
\nExample:
\nquota_message_count = 10000\nnamespace inbox {\n mailbox Trash {\n # 110% * 10000 = 11000 limit\n quota_message_percentage = 110\n }\n}quota",
"Quota Root"
],
"text": "Name of the quota root. The quota filter name\nrefers to this setting.
The quota root name is just an arbitrary string that is sent to IMAP\nclients, which in turn may show it to the user. The name has no meaning.
\n", "plugin_link": "quota plugin" }, "quota_over_status": { "plugin": [ "quota" ], "values": [ { "label": "Named Filter", "url": "Named Filter", "no_default": true } ], "seealso": [ "Quota: Overquota Flag" ], "text": "Named filter for executing the overquota-flag script. The execute\nsetting is required to be specified inside the filter.
An identifier that indicates whether the overquota-flag is active for a user.
\nThis identifier is compared against quota_over_status_mask to\ndetermine if the overquota-flag should be set for the user.
Usually, this value will be loaded via userdb.
\n", "plugin_link": "quota plugin" }, "quota_over_status_lazy_check": { "default": "no",
"plugin": [
"quota"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, overquota-flag is checked only when current quota usage is\ngoing to already be checked anyway. This prevents any additional storage I/O\nthat would be caused by the overquota-flag check.
\n", "plugin_link": "quota plugin" }, "quota_over_status_mask": { "plugin": [ "quota" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "Quota: Overquota Flag" ], "text": "The search string to match against quota_over_status_current to\ndetermine if the overquota-flag is set for the user.
Wildcards can be used in a generic way, e.g. *yes or *TRUE*.
REJECT Unknown user",
"plugin": [
"quota"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"tags": [
"quota-status-service"
],
"seealso": [
"Quota Status Service"
],
"text": "Quota Status Service: Response when asking quota for a nonexistent\nusers.
\n", "plugin_link": "quota plugin" }, "quota_status_overquota": { "default": "554 5.2.2 %{error}",
"plugin": [
"quota"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"tags": [
"quota-status-service"
],
"seealso": [
"Quota Status Service"
],
"text": "Quota Status Service: Response when asking quota for a user that is\nover the quota. The %{error} variable expands to the more detailed reason,\nwhich is generally quota_exceeded_message.
OK",
"plugin": [
"quota"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"tags": [
"quota-status-service"
],
"seealso": [
"Quota Status Service"
],
"text": "Quota Status Service: Response when asking quota for a user that is\nunder the quota.
\n", "plugin_link": "quota plugin" }, "quota_status_toolarge": { "default": "quota_status_overquota",
"plugin": [
"quota"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"tags": [
"quota-status-service"
],
"seealso": [
"Quota Status Service"
],
"text": "Quota Status Service: Response when asking quota for a mail that is\nlarger than user's quota_storage_size or\nquota_mail_size. Empty value defaults to\nquota_status_overquota.
0",
"plugin": [
"quota"
],
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"seealso": [
"quota_storage_size",
"quota_storage_percentage",
"Quota Root"
],
"text": "If set, increase the quota_storage_size (for the mailbox/namespace)\nby this amount. This is an alternative to using\nquota_storage_percentage, although both can also be used.
This may be useful to exceed the regular quota limit in some mailboxes, such as\nallowing clients that move messages with IMAP COPY+EXPUNGE to Trash folder to\ntemporarily exceed the quota.
\nExample:
\nquota_storage_size = 1G\nnamespace inbox {\n mailbox Trash {\n # 1G + 100M = 1100M\n quota_storage_extra = 100M\n }\n}10 M",
"plugin": [
"quota"
],
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"seealso": [
"Quota Root"
],
"text": "If set, allows message deliveries (LDA, LMTP) to exceed quota once by this\namount. After the quota is already over the limit, the grace no longer applies.\nThis prevents a situation where some smaller mails may still become delivered,\nbut larger mail deliveries fail, and the user may not have received any warning\nabout reaching the quota limit.
\n", "plugin_link": "quota plugin" }, "quota_storage_percentage": { "default": "100",
"plugin": [
"quota"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"seealso": [
"quota_storage_size",
"quota_storage_extra",
"Quota Root"
],
"text": "Multiplier for the quota_storage_size setting (in this\nmailbox/namespace). This is an alternative to using\nquota_storage_extra, although both can also be used.
This may be useful to exceed the regular quota limit in some mailboxes, such as\nallowing clients that move messages with IMAP COPY+EXPUNGE to Trash folder to\ntemporarily exceed the quota.
\nExample:
\nquota_storage_size = 1G\nnamespace inbox {\n mailbox Trash {\n # 110% * 1G = 1100M\n quota_storage_percentage = 110\n }\n}unlimited",
"plugin": [
"quota"
],
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"seealso": [
"quota_storage_extra",
"quota_storage_percentage",
"quota_message_count",
"Quota Root"
],
"tags": [
"storage_size_limits"
],
"text": "Quota storage size limit for the Quota Root. This value is still\nmultiplied by quota_storage_percentage and then increased by\nquota_storage_extra to get the final value (in this mailbox or\nnamespace). This is reported as the STORAGE limit in IMAP GETQUOTA commands.\nUsing 0 as the value means the same as unlimited.
Create a new quota warning. The filter name\nrefers to quota_warning_name setting. The execute\nsetting is required to be specified inside the filter.
The order of quota_warning filters in the configuration is important:\nOnly the first warning that matches the rules is executed. This means you must\nconfigure the highest limits first.
Name of the quota warning. The\nquota_warning filter name refers to this setting. This name is\nonly used within the configuration to identify the quota warning - it has no\nmeaning otherwise.
storage",
"tags": [
"quota-warning"
],
"text": "Which quota resource the quota warning is tracking.
\n", "plugin_link": "quota plugin" }, "quota_warning_threshold": { "plugin": [ "quota" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "seealso": [ "Quota Warning Scripts" ], "values_enum": [ "over", "under" ], "default": "over",
"tags": [
"quota-warning"
],
"text": "Should the quota warning be executed when quota grows over the limit, or\nwhen it drops under the limit.
\n", "plugin_link": "quota plugin" }, "trash_priority": { "plugin": [ "trash" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": 0, "text": "If non-zero, enables the trash plugin for the mailbox with the specified\npriority. Mailboxes with smaller priority number are emptied before mailboxes\nwith a larger priority number. If there are multiple mailboxes with the same\npriority, expunge the oldest mail from them first.
\nExample where Trash is emptied before Spam:
\nnamespace inbox {\n mailbox Trash {\n trash_priority = 1\n }\n mailbox Spam {\n trash_priority = 2\n }\n}64",
"plugin": [
"virtual"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"advanced": true,
"text": "How many mailboxes to open in virtual plugin.
\n", "plugin_link": "virtual plugin" }, "welcome_script": { "plugin": [ "welcome" ], "values": [ { "label": "Named Filter", "url": "Named Filter", "no_default": true } ], "seealso": [ "welcome" ], "text": "Named filter for configuring the welcome execute script.
welcome {\n execute welcome {\n args = %{user}\n }no",
"seealso": [
"welcome"
],
"text": "If enabled, wait for the script to finish. By default, the welcome script\nis run asynchronously.
\n", "plugin_link": "welcome plugin" }, "cassandra_connect_timeout": { "tags": [ "sql-cassandra" ], "values": [ { "label": "Time (milliseconds)", "url": "time (milliseconds)", "default_required": true } ], "default": "5s",
"text": "Connection timeout.
\n" }, "cassandra_debug_queries": { "tags": [ "sql-cassandra" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"text": "Whether to log CQL queries.
\n" }, "cassandra_delete_consistency": { "tags": [ "sql-cassandra" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "any", "local-serial", "serial", "one", "two", "three", "local-quorum", "quorum", "each-quorum", "all" ], "default": "local-quorum",
"seealso": [
"Cassandra: Consistency"
],
"text": "Write consistency when deleting from the database. See\nCassandra: Consistency.
\n" }, "cassandra_delete_fallback_consistency": { "tags": [ "sql-cassandra" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "any", "local-serial", "serial", "one", "two", "three", "local-quorum", "quorum", "each-quorum", "all" ], "default": "local-quorum",
"seealso": [
"Cassandra: Consistency"
],
"text": "Write consistency when deleting from the database fails with primary\nconsistency.
\n" }, "cassandra_execution_retry_interval": { "tags": [ "sql-cassandra" ], "values": [ { "label": "Time (milliseconds)", "url": "time (milliseconds)", "default_required": true } ], "default": 0, "text": "If the driver supports speculative execution policy, configures constant\nspeculative execution policy. See\nhttps://docs.datastax.com/en/developer/java-driver/latest/manual/core/speculative_execution/index.html
\nWARNING
\nIf Cassandra is completely unavailable and speculative execution is used,\nCassandra cpp-driver library starts hanging all queries due to a bug. This may\ncause problems in the dict process even after Cassandra is back online.\nWhen this happens, "Dict server timeout" errors are being logged.
\nIf the driver supports speculative execution policy, configures constant\nspeculative execution policy. See\nhttps://docs.datastax.com/en/developer/java-driver/latest/manual/core/speculative_execution/index.html
\nWARNING
\nIf Cassandra is completely unavailable and speculative execution is used,\nCassandra cpp-driver library starts hanging all queries due to a bug. This may\ncause problems in the dict process even after Cassandra is back online.\nWhen this happens, "Dict server timeout" errors are being logged.
\n30s",
"text": "How often to send keepalive packets to cassandra nodes.
\n" }, "cassandra_hosts": { "tags": [ "sql-cassandra" ], "values": [ { "label": "Boolean List", "url": "Boolean List" } ], "text": "List of hosts or IP addresses to connect.
\n" }, "cassandra_idle_timeout": { "tags": [ "sql-cassandra" ], "values": [ { "label": "Time (milliseconds)", "url": "time (milliseconds)", "default_required": true } ], "default": "0",
"text": "How long to idle before disconnecting.
\n" }, "cassandra_keyspace": { "tags": [ "sql-cassandra" ], "values": [ { "label": "String", "url": "string" } ], "text": "Specifies the keyspace name to use.
\n" }, "cassandra_latency_aware_routing": { "tags": [ "sql-cassandra" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"text": "When turned on, latency-aware routing tracks the latency of queries to avoid\nsending new queries to poorly performing Cassandra nodes.
\n" }, "cassandra_log_level": { "tags": [ "sql-cassandra" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "critical", "error", "warn", "info", "debug", "trace" ], "default": "warn",
"text": "Driver log level.
\n" }, "cassandra_log_retries": { "tags": [ "sql-cassandra" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"text": "Whether to log about failed requests that are retried (which may or may\nnot succeed after the retry).
\n" }, "cassandra_metrics": { "tags": [ "sql-cassandra" ], "values": [ { "label": "String", "url": "string" } ], "text": "Path where to write JSON metrics. See Cassandra: Metrics.
\n" }, "cassandra_io_thread_count": { "tags": [ "sql-cassandra" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": "[driver dependent]",
"text": "Set number of IO threads to handle query requests.
\n" }, "cassandra_page_size": { "tags": [ "sql-cassandra" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": 0, "text": "When a query returns many rows, it can be sometimes inefficient to return them\nas a single response message. Instead, the driver can break the results into\npages which get returned as they are needed.
\nThis setting controls the size of each page.
\nSet to 0 to disable.
Password for authentication.
\n" }, "cassandra_port": { "tags": [ "sql-cassandra" ], "values": [ { "label": "Port Number", "url": "Port Number", "default_required": true } ], "default": "9042",
"text": "CQL port to use.
\n" }, "cassandra_read_consistency": { "tags": [ "sql-cassandra" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "any", "local-serial", "serial", "one", "two", "three", "local-quorum", "quorum", "each-quorum", "all" ], "default": "local-quorum",
"seealso": [
"Cassandra: Consistency"
],
"text": "Read consistency.
\n" }, "cassandra_read_fallback_consistency": { "tags": [ "sql-cassandra" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "any", "local-serial", "serial", "one", "two", "three", "local-quorum", "quorum", "each-quorum", "all" ], "default": "local-quorum",
"seealso": [
"Cassandra: Consistency"
],
"text": "Read consistency if primary consistency fails.
\n" }, "cassandra_request_timeout": { "tags": [ "sql-cassandra" ], "values": [ { "label": "Time (milliseconds)", "url": "time (milliseconds)", "default_required": true } ], "default": "60s",
"text": "How long to wait for a query to finish.
\n" }, "cassandra_ssl": { "tags": [ "sql-cassandra" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "default": "no",
"values_enum": [
"no",
"cert-only",
"cert-ip"
],
"seealso": [
"SSL configuration",
"ssl_client_require_valid_cert"
],
"text": "Whether to use SSL when connecting to Cassandra, and how to verify the\ncertificate:
\nnocert-onlycert-ipYou can also skip certificate validation by setting\nssl_client_require_valid_cert = yes. The cassandra_ssl setting\nvalue must something else than no.
Configure SSL certificates using the ssl_client_* settings. See\nSSL configuration.
Username for authentication.
\n" }, "cassandra_protocol_version": { "tags": [ "sql-cassandra" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ 3, 4, 5 ], "default": "depends on driver version",
"text": "Cassandra protocol version to use. It is good idea to specify this to avoid\nwarnings about version handshake if the driver supports a higher protocol\nversion than the server.
\nINFO
\nIf you want to use server-side prepared statements, you need to\nuse at least 4.
5s",
"text": "Emit warning if query takes longer than this.
\n" }, "cassandra_write_consistency": { "tags": [ "sql-cassandra" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "any", "local-serial", "serial", "one", "two", "three", "local-quorum", "quorum", "each-quorum", "all" ], "default": "local-quorum",
"seealso": [
"Cassandra: Consistency"
],
"text": "Write consistency when updating or inserting to the database.
\n" }, "cassandra_write_fallback_consistency": { "tags": [ "sql-cassandra" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "any", "local-serial", "serial", "one", "two", "three", "local-quorum", "quorum", "each-quorum", "all" ], "default": "local-quorum",
"seealso": [
"Cassandra: Consistency"
],
"text": "Write consistency when updating or inserting to the database fails with primary\nconsistency.
\n" }, "mysql": { "tags": [ "sql-mysql" ], "values": [ { "label": "Named List Filter", "url": "Named List Filter" } ], "seealso": [ "mysql_host"
],
"text": "Creates a new MySQL/MariaDB connection. If more than one is specified, the connections\nare automatically used for load balancing and for failover. The filter name\nrefers to the mysql_host setting.
Flags to use when connecting to the database, provided as base-10 number. See\nhttps://dev.mysql.com/doc/c-api/8.0/en/mysql-real-connect.html
\n" }, "mysql_connect_timeout": { "tags": [ "sql-mysql" ], "values": [ { "label": "Time", "url": "time", "default_required": true } ], "default": "5s",
"text": "How long to wait for connection.
\n" }, "mysql_connection_limit": { "tags": [ "sql-mysql" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": "5",
"text": "Maximum number of parallel connections. Currently MySQL queries are blocking,\nso only a single connection can be used in parallel.
\n" }, "mysql_dbname": { "tags": [ "sql-mysql" ], "values": [ { "label": "String", "url": "string" } ], "text": "Database name to connect to.
\n" }, "mysql_host": { "tags": [ "sql-mysql" ], "values": [ { "label": "String", "url": "string" } ], "default": "localhost",
"text": "Host or UNIX socket path to connect to. The mysql setting defaults\nto this.
INFO
\nMySQL drivers can default to using UNIX socket connection when host is\nlocalhost and port is 0 (default). To force it to use TCP connection,\nset mysql_host = 127.0.0.1 or set mysql_port explicitly.
File to read for client library specific configuration.
\n" }, "mysql_option_group": { "tags": [ "sql-mysql" ], "values": [ { "label": "String", "url": "string" } ], "text": "Section name to read from mysql_option_file.
Password for authentication.
\n" }, "mysql_port": { "tags": [ "sql-mysql" ], "values": [ { "label": "Port Number", "url": "Port Number", "default_required": true } ], "default": "0 (defaults to 3306 for TCP connections)",
"text": "Port to connect to.
\n" }, "mysql_read_timeout": { "tags": [ "sql-mysql" ], "values": [ { "label": "Time", "url": "time", "default_required": true } ], "default": "30s",
"text": "Timeout when reading data from server.
\n" }, "mysql_ssl": { "tags": [ "sql-mysql" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"seealso": [
"SSL"
],
"text": "Whether to use SSL when connecting to MySQL. Configure it using the\nssl_client_* settings. See SSL.
Username for authentication.
\n" }, "mysql_write_timeout": { "tags": [ "sql-mysql" ], "values": [ { "label": "Time", "url": "time", "default_required": true } ], "default": "30s",
"text": "Timeout in seconds when writing data to server.
\n" }, "pgsql": { "tags": [ "sql-postgresql" ], "values": [ { "label": "Named List Filter", "url": "Named List Filter" } ], "seealso": [ "pgsql_host"
],
"text": "Creates a new PostgreSQL connection. If more than one is specified, the\nconnections are automatically used for load balancing and for failover. The\nfilter name refers to the pgsql_host setting.
5",
"text": "Maximum number of parallel connections.
\n" }, "pgsql_host": { "tags": [ "sql-postgresql" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "pgsql"
],
"text": "Host to connect to. The pgsql setting defaults to this.
List of key/value settings passed to PostgreSQL. See\nhttps://www.postgresql.org/docs/current/libpq-connect.html for available\nparameters.
\n" }, "sqlite_path": { "tags": [ "sql-sqlite" ], "values": [ { "label": "String", "url": "string" } ], "text": "Path to the sqlite database.
\n" }, "sqlite_journal_mode": { "tags": [ "sql-sqlite" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "delete", "wal" ], "default": "wal",
"text": "Allows using write-ahead logging mode for database.
\n" }, "sqlite_synchronous": { "tags": [ "sql-sqlite" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "added": [ { "version": "Added: 3.2.0" } ], "values_enum": [ "default", "off", "normal", "full", "extra" ], "default": "default",
"text": "Sets the synchronization mode for SQlite database. See https://sqlite.org/pragma.html#pragma_synchronous for full explanation of values. This has no effect if database is opened in read-only mode. Setting special value default elides pragma call.
no",
"text": "Specifies that this database is read-only and should not be attempted to be\ncreated or written to.
\n" }, "lua_file": { "tags": [ "lua" ], "values": [ { "label": "File", "url": "File" } ], "seealso": [ "mail-lua plugin", "push-notification-lua plugin", "Lua authentication database" ], "text": "Path to lua script to be used. This is used by
\n\n" }, "lua_settings": { "tags": [ "lua" ], "values": [ { "label": "String List", "url": "String List" } ], "seealso": [ "lua_file"
],
"text": "Key-value pairs that are passed as a table to lua script_init() functions.
no",
"added": [
{
"version": "Added: 3.0.0"
}
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Controls whether password schemes marked as weak are allowed to be used.\nSee Password Schemes for disabled by default schemes.
\nIf enabled, will emit warning to logs. If a disabled scheme is used,\nan error is logged.
\nNotably, any explicitly cleartext schemes (such as PLAIN), CRAM-MD5, and\nDIGEST-MD5 are not affected by this setting.
\n" }, "auth_anonymous_username": { "default": "anonymous",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "This specifies the username to be used for users logging in with the\nANONYMOUS SASL mechanism.
\n" }, "auth_allow_cleartext": { "default": "no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"added": [
{
"version": "Added: 3.0.0"
}
],
"text": "If no, disables the LOGIN command and all other cleartext\nauthentication unless SSL/TLS is used (LOGINDISABLED capability) or the\nconnection is secured (see ssl).
See SSL configuration for more detailed explanation of how\nthis setting interacts with the ssl setting.
This setting replaces the disable_plaintext_auth setting.
1hour",
"tags": [
"auth_cache"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "This sets the time to live for negative hits to passdb or userdb (i.e.,\nwhen the user is not found or there is a password mismatch).
\nThe value 0 completely disables caching of these hits.
The authentication cache size (e.g., 10M).
auth_cache_size = 0 disables use of the authentication cache.
A typical passdb cache entry is around 50 bytes and a typical userdb cache\nentry is around 100-200 bytes, depending on the amount of information your\nuser and password database lookups return.
\n" }, "auth_cache_ttl": { "default": "1hour",
"tags": [
"auth_cache"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "Time to live for cache entries.
\nAfter the TTL expires, the cached record is no longer used, unless the main\ndatabase look-up returns internal failure.
\nEntries are removed from the cache only when the cache is full and a new\nentry is to be added.
\n" }, "auth_cache_verify_password_with_worker": { "default": "no",
"tags": [
"auth_cache"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "The auth master process by default is responsible for the hash\nverifications. Setting this to yes moves the verification to auth-worker\nprocesses. This allows distributing the hash calculations to multiple CPU\ncores, which could make sense if strong hashes are used.
no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"deprecated": [
{
"text": "The setting is obsolete, and kept only for backwards compatibility.
\nUse log_debug = category=auth instead.
Enables all authentication debug logging (also enables\nauth_verbose).
Passwords are logged as <hidden>.
no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "This setting adjusts log verbosity. In the event of password\nmismatches, the passwords and the scheme used are logged so that the\nproblem can be debugged.
\nNote: You also need to enable log_debug = category=auth.
no",
"text": "This setting indicates the default realm/domain to use if none has\nbeen specified. The setting is used for both SASL realms\nand appending an @domain element to the username in cleartext logins.
2secs",
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"seealso": [
"auth_internal_failure_delay"
],
"text": "This is the delay before replying to failed authentication attempts. Using\npassdb: nodelay Extra Field bypasses this setting.
\nThis setting defines the interval for which the authentication process\nflushes all auth failures. Thus, this is the maximum interval a user may\nencounter. However, there can be additional delays added by\nauthentication penalty.
\nThis setting doesn't affect internal failures. See\nauth_internal_failure_delay.
<name returned by gethostname()>",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "This supplies the hostname to use in Generic Security Services API\n(GSSAPI) principal names.
\nUse "$ALL" (with the quotation marks) to allow all keytab entries.
2secs",
"values": [
{
"label": "Time (milliseconds)",
"url": "time (milliseconds)",
"default_required": true
}
],
"added": [
{
"version": "Added: 3.0.0"
}
],
"seealso": [
"auth_failure_delay"
],
"text": "The delay before replying to client when authentication fails with\ninternal failure. An additional 0..50% delay is added on top of this to\nprevent thundering herd issues.
\nThis setting is intended to prevent clients from hammering the server with\nimmediate retries.
\n" }, "auth_krb5_keytab": { "default": "<system default (e.g. /etc/krb5.keytab)>",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "This specifies the Kerberos keytab to use for the GSSAPI mechanism.
\nNote: You may need to set the auth service to run as root in order for\nthis file to be readable.
\n", "advanced": true }, "auth_master_user_separator": { "values": [ { "label": "String", "url": "string" } ], "text": "The separator to use to enable master users to login by specifying the\nmaster username within the normal username string (i.e., not using the SASL\nmechanism's master support).
\nExample:
\n# Allows master login of the format <username>*<masteruser>\n# E.g. if user = foo, and master_user = muser,\n#\tlogin username = foo*muser\nauth_master_user_separator = *plain",
"values": [
{
"label": "Boolean List",
"url": "Boolean List"
}
],
"seealso": [
"authentication mechanisms"
],
"text": "Here you can supply a space-separated list of the authentication\nmechanisms you wish to use.
\nExample:
\nauth_mechanisms = plain loginFilter for auth policy specific settings.
\n", "no_default": true }, "auth_policy_check_after_auth": { "default": "yes",
"tags": [
"auth_policy"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"seealso": [
"auth_policy_server_url"
],
"text": "Do policy lookup after authentication is completed?
\n" }, "auth_policy_check_before_auth": { "default": "yes",
"tags": [
"auth_policy"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"seealso": [
"auth_policy_server_url"
],
"text": "Do policy lookup before authentication is started?
\n" }, "auth_policy_hash_mech": { "default": "sha256",
"tags": [
"auth_policy"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"md4",
"md5",
"sha1",
"sha256",
"sha512"
],
"seealso": [
"auth_policy_server_url"
],
"text": "Hash mechanism to use for password.
\n" }, "auth_policy_hash_nonce": { "tags": [ "auth_policy" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "auth_policy_server_url"
],
"text": "Cluster-wide nonce to add to hash.
\nThis should contain a secret randomly generated string, which is the\nsame for each Dovecot server within the cluster.
\nREQUIRED configuration when you want to use authentication policy.
\nExample:
\nauth_policy_hash_nonce = <localized_random_string>12",
"tags": [
"auth_policy"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"seealso": [
"auth_policy_server_url"
],
"advanced": true,
"text": "How many bits to use from password hash when reporting to policy server.
\n" }, "auth_policy_log_only": { "default": "no",
"tags": [
"auth_policy"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"seealso": [
"auth_policy_server_url"
],
"text": "Only log what the policy server response would do?
\nIf yes, no request is made to the policy server.
no",
"tags": [
"auth_policy"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"seealso": [
"auth_policy_server_url"
],
"text": "If policy request fails for some reason, should users be rejected?
\n" }, "auth_policy_report_after_auth": { "default": "yes",
"tags": [
"auth_policy"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Report authentication result?
\nIf no, there will be no report for the authentication result.
login=%{requested_username} pwhash=%{hashed_password} remote=%{remote_ip} device_id=%{client_id} protocol=%{protocol} session_id=%{session} fail_type=%{fail_type}",
"changed": [
{
"text": "Default has changed.
\n", "version": "Changed: 3.0.0" } ], "tags": [ "auth_policy" ], "values": [ { "label": "String List", "url": "String List" } ], "seealso": [ "auth_policy_server_url"
],
"text": "Request attributes specification.
\nSee Auth Policy Variables for variables that can be used for this\nsetting.
\n" }, "auth_policy_server_api_header": { "tags": [ "auth_policy" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "auth_policy_server_url"
],
"text": "Header and value to add to request (for API authentication).
\nNote: See https://en.wikipedia.org/wiki/Basic_access_authentication#Client_side
\nThis can be used when you are using the weakforced policy server and the\nweb listener password is "super":
\n$ echo -n wforce:super | base64\nd2ZvcmNlOnN1cGVyThen the correct value for this setting is:
\nauth_policy_server_api_header = Authorization: Basic d2ZvcmNlOnN1cGVyURL of the policy server.
\nURL is appended with ?command=allow/report. If URL ends with &, the\n? is not appended.
REQUIRED configuration when you want to use authentication policy.
\nExample:
\nauth_policy_server_url = http://example.com:4001/This setting supplies a list of realms for those SASL authentication mechanisms\nthat need them. Realms are an integral part of Digest-MD5.
\nYou will need to specify realms you want to advertise to the client in the\nconfig file:
\nExample:
\nauth_realms = example.com another.example.com fooauth-userdb",
"advanced": true,
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The UNIX socket path to the master authentication server for finding users.
\nThis must be set to cluster-userdb in Palomar cluster configurations, for\nboth proxies and backends.
auth-master",
"advanced": true,
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The UNIX socket path to the master authentication server for finishing\nuser logins.
\nIt is usually neither necessary nor advisable to change the default.
\n" }, "auth_ssl_require_client_cert": { "default": "no",
"seealso": [
"ssl_server_ca_file",
"ssl_server_request_client_cert",
"SSL configuration"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If yes, authentication fails when a valid SSL client certificate is not\nprovided.
no",
"seealso": [
"ssl_server_cert_username_field"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Setting to yes indicates that the username should be taken from the\nclient's SSL certificate.
Generally, this will be either commonName or x500UniqueIdentifier.
The text is looked up from subject DN's specified field using OpenSSL's\nX509_NAME_get_text_by_NID() function. By default the CommonName field is\nused. You can change the field with\nssl_server_cert_username_field = name setting (parsed using OpenSSL's\nOBJ_txt2nid() function).
x500UniqueIdentifier is a common choice.
no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "By default, the NTLM mechanism is handled internally.
\nIf yes, perform NTLM and GSS-SPNEGO authentication with Samba's winbind\ndaemon and ntlm_auth helper.
This option is useful when you need to authenticate users against a Windows\ndomain (either AD or NT).
\n", "advanced": true }, "auth_username_chars": { "default": "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The list of the characters allowed in a username.
\nIf the user-supplied username contains a character not listed here, login\nautomatically fails.
\nThis is an additional check to make sure the user can't exploit any\nquote-escaping vulnerabilities that may be connected with SQL/LDAP\ndatabases.
\nIf you want to allow all characters, leave the value empty.
\n" }, "auth_username_format": { "default": "%{user | lower}",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "When this setting is used globally, it changes the username, including\n%{user} variable, for all passdb and userdb lookups.
This setting can also be used in passdb/userdb\npasswd_file { auth_username_format } to change the username for the duration\nof the lookup. The %{user} variable is not changed. If used inside other\npassdbs/userdbs the setting is ignored.
You can use the standard variables here.
\nExamples:
\n%{user | lower}: Lowercases the username%{user | username}: Drops the domain if one was supplied%{user | username}-AT-%{user | domain}: Changes the "@" symbol into "-AT-" before lookupThis translation is done after the changes specified with the\nauth_username_translation setting.
If set, performs username character translations before querying the auth\ndatabase.
\nThe value is a string formed of sets of from and to characters\nalternating.
A value of #@/@ means that # and / will both be translated to\nthe @ character.
no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Adjust log verbosity.
\nIf yes, log unsuccessful authentication attempts and why they failed.
no",
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"no",
"yes",
"plain",
"sha1"
],
"text": "In case of password mismatches, log the attempted password. You can also\ntruncate the logged password to n chars by appending :n (e.g.\nsha1:6).
Available transformations:
\nplain, yes: Output cleartext password (NOT RECOMMENDED)sha1: Output SHA1 hashed passwordThis setting tells the system the path for Samba's ntlm_auth helper binary.
\nExample:
\nauth_winbind_helper_path = /usr/bin/ntlm_auth/var/run/dovecot/",
"values": [
{
"label": "String",
"url": "string"
}
],
"advanced": true,
"text": "The base directory in which Dovecot should store runtime data.
\nThis can be used to override the base directory determined at compile time.
\n" }, "debug_log_path": { "default": "info_log_path",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The log file to use for debug messages.
\n" }, "default_client_limit": { "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": "1000",
"text": "Default value for service_client_limit, if not overridden by\nservice-specific configuration.
1 min",
"text": "Default value for service_idle_kill_interval, if not overridden by\nservice-specific configuration.
dovecot",
"seealso": [
"default_internal_user",
"mail_access_groups"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "Define the default internal group. The\nmail_access_groups uses this as the default for giving mail\nprocesses UNIX socket access to various services. For proper security, no files\nor directories should be made writable for this group.
dovecot",
"seealso": [
"default_internal_group"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "Define the default internal user.
\nUnprivileged processes run under the ID of the internal user. This\nuser should be distinct from the login user, to prevent login processes\nfrom disturbing other processes.
\n" }, "default_login_user": { "default": "dovenull",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The user the login process should run as.
\nThis is the least trusted user in Dovecot: this user should not have access\nto anything at all.
\n" }, "default_process_limit": { "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": "100",
"text": "Default value for service_process_limit, if not overridden by\nservice-specific configuration.
1 G",
"text": "Default value for service_vsz_limit, if not overridden by\nservice-specific configuration.
msgid=%{msgid}: %{message}",
"values": [
{
"label": "String Without Variables",
"url": "String without variables"
}
],
"text": "The format to use for logging mail deliveries.
\nVariables that can be used for this setting (see Global variables):
| Variable Name | \nDescription | \n
|---|---|
%{message} | \nDelivery status message (e.g., saved to INBOX) | \n
%{msgid} | \n\n |
%{subject} | \nSubject | \n
%{from} | \nFrom address | \n
%{from_envelope} | \nSMTP FROM envelope | \n
%{size} | \nPhysical size | \n
%{vsize} | \nVirtual size | \n
%{to_envelope} | \nRCPT TO envelope | \n
%{delivery_time} | \nHow many milliseconds to deliver the mail | \n
%{session_time} | \nLMTP session duration, not including %{delivery_time} | \n
%{storage_id} | \nBackend-specific ID for mail, e.g. Maildir filename | \n
Example:
\ndeliver_log_format = stime=%{session_time} msgid=%{msgid}: %{message}dict_name",
"dict_driver"
],
"text": "Creates a new dict. The filter name refers to the dict_name\nsetting.
Example:
\ndict file {\n # ...\n}Since an empty dict_driver defaults to dict_name, there\nis no need to specify the dict_driver setting explicitly.
dict_driver"
],
"text": "Name of the dict. The dict_driver setting defaults to this.
<dict_name>",
"text": "The dict driver to use. Defaults to dict_name.
Path for the dictionary file.
\n" }, "dict_proxy_name": { "tags": [ "dict", "dict-proxy" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "dict_name"
],
"text": "Name of the dict to access in the dict server. This refers to the\ndict_name setting.
dict",
"text": "Points to the dict server's UNIX socket. The path is relative to the the\nbase_dir setting. This should be changed to dict-async if the\ndict driver supports asynchronous lookups (e.g. ldap, pgsql, cassandra, NOT\nmysql). The dict-async service allows more than one client, so this\nconfiguration prevents creating unnecessarily many dict processes.
How long to keep the connection open to dict server before disconnecting. 0\nmeans immediate disconnection after finishing the operation.
5s",
"text": "Log a warning about dict lookups that take longer than this interval.
\n" }, "redis_socket_path": { "tags": [ "dict", "dict-redis" ], "values": [ { "label": "String", "url": "string" } ], "text": "UNIX socket path to the Redis server. This is preferred over\nredis_host if both are set.
127.0.0.1",
"text": "Redis server host.
\n" }, "redis_port": { "tags": [ "dict", "dict-redis" ], "values": [ { "label": "Port Number", "url": "Port Number", "default_required": true } ], "default": "6379",
"text": "Redis server port.
\n" }, "redis_password": { "tags": [ "dict", "dict-redis" ], "values": [ { "label": "String", "url": "string" } ], "text": "Redis server password.
\n" }, "redis_db_id": { "tags": [ "dict", "dict-redis" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": 0, "text": "Database number.
\n" }, "redis_key_prefix": { "tags": [ "dict", "dict-redis" ], "values": [ { "label": "String", "url": "string" } ], "text": "Prefix to add to all keys.
\n" }, "redis_expire": { "tags": [ "dict", "dict-redis" ], "values": [ { "label": "Time", "url": "time", "default_required": true } ], "default": "infinite",
"text": "Expiration value for all keys.
\n" }, "redis_request_timeout": { "tags": [ "dict", "dict-redis" ], "values": [ { "label": "Time (milliseconds)", "url": "time (milliseconds)", "default_required": true } ], "default": "30s",
"text": "How long to wait for answer before aborting request.
\n" }, "dict_map": { "tags": [ "dict", "dict-sql", "dict-ldap" ], "values": [ { "label": "Named List Filter", "url": "Named List Filter" } ], "seealso": [ "dict_map_pattern"
],
"text": "Creates a new dict mapping. The filter name refers to the\ndict_map_pattern setting.
Pattern that is matched to the accessed dict keys. The dict_map\nfilter name refers to this setting. If the pattern matches the key, this dict\nmap (and no other) is used. The dict maps are processed in the order listed in\nthe configuration file.
SQL table to use for accessing this dict map.
\n" }, "dict_map_username_field": { "tags": [ "dict", "dict-sql" ], "values": [ { "label": "String", "url": "string" } ], "text": "Field in the SQL table to use for accessing private dict keys in this dict map.\nThis setting is optional if only shared keys are accessed.
\n" }, "dict_map_expire_field": { "tags": [ "dict", "dict-sql" ], "values": [ { "label": "String", "url": "string" } ], "text": "Field in the SQL table to use for tracking dict key expiration. This field is\noptional if no expiration is used by the code accessing the dict map.
\n" }, "dict_map_value_field": { "tags": [ "dict", "dict-sql", "dict-ldap" ], "values": [ { "label": "Named List Filter", "url": "Named List Filter" } ], "seealso": [ "dict_map_value_field_name"
],
"text": "sql: Creates a new value for the dict map. The filter name refers to the\ndict_map_value_field_name setting. Dict supports reading/writing multiple\nvalues for the same key.
ldap: Value to be returned from an ldap search, as a variable-expression
\ndict_map_pattern"
],
"text": "Creates a new field for the dict map. The filter name refers to the\ndict_map_key_field_value setting. The fields are part of the SQL\nquery looking up the dict key.
dict_map_value_field"
],
"text": "Field in the SQL table to use for the dict_map_value_field.
string",
"seealso": [
"dict_map_value_field"
],
"text": "Type of the field in the SQL table for the dict_map_value_field.
dict_map_pattern",
"dict_map_key_field"
],
"text": "Variable in the dict_map_pattern that maps to this\ndict_map_key_field. The value must always begin with $.
dict_map_key_field"
],
"text": "Field in the SQL table to use for the dict_map_key_field.
string",
"seealso": [
"dict_map_key_field"
],
"text": "Type of the field in the SQL table for the dict_map_key_field.
dict"
],
"text": "Named filter for the dict server settings. Add the available named dicts for\nthe dict server under this filter using the dict settings.
For example:
\ndict_server {\n dict quota {\n driver = sql\n # ...\n }\n dict acl {\n driver = file\n # ...\n }\n}dns-client",
"text": "UNIX socket path to the dns-client service.
\n" }, "dns_client_timeout": { "tags": [ "dns", "dns_client" ], "values": [ { "label": "Time (milliseconds)", "url": "time (milliseconds)", "default_required": true } ], "default": "10s",
"text": "Timeout for DNS lookups.
\n" }, "dotlock_use_excl": { "default": "yes",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If yes, rely on O_EXCL to work when creating dotlock files.
NFS has supported O_EXCL since version 3, so yes should be safe to use\nby default.
ALL",
"values": [
{
"label": "Boolean List",
"url": "Boolean List"
}
],
"text": "Lists the commands that the client may use with the doveadm server.
\nThe setting ALL allows all commands.
WARNING
\nThis setting provides rather weak security. Do not assume that it is safe to\ngive doveadm access to untrusted users by simply limiting the allowed commands.\nMany commands (especially sync, backup and import) have parameters\nthat cannot safely be accessed by untrusted users.
doveadm_password"
],
"text": "Set an API key for use of the HTTP API for the doveadm server.
\nIf set, this allows HTTP clients to authenticate to the doveadm HTTP server\nusing the X-API-Key header, which contains the API key base64 encoded.
\nThis API key must be kept secret. The doveadm API allows doing almost anything\nin the server, including accessing users' mailboxes.
\nIt's possible to use both doveadm_password and API key. This\nallows clients to use either method to authenticate.
doveadm_api_key"
],
"text": "Specify the password, which is used by both doveadm server and client.\nThe client sends this password to the server for authentication, and the\nserver accepts only this password. Alternatively, doveadm HTTP API can be\nauthenticated to using doveadm_api_key.
This password must be kept secret. The doveadm API allows doing almost anything\nin the server, including accessing users' mailboxes.
\nIf doveadm server is accessed via UNIX socket that has 0600 permissions, the\nauthentication is skipped. However, the doveadm HTTP API always requires\nauthentication.
\n" }, "doveadm_port": { "default": 0, "values": [ { "label": "Port Number", "url": "Port Number", "default_required": true } ], "text": "The destination port to be used for the next doveadm proxying hop.\nThis implicitly enables doing a passdb lookup for finding the proxy settings.
\nA value of 0 means that proxying is not in use. This also means no passdb\nlookup is done - only userdb lookup.
This setting is required with Palomar cluster configuration even in backends,\nbecause the backend may still ask proxy to reject the connection and proxy\nthe user to another backend.
\n" }, "doveadm_server": { "values": [ { "label": "Named Filter", "url": "Named Filter", "no_default": true } ], "text": "Filter for doveadm server specific settings.
\n", "no_default": true }, "doveadm_socket_path": { "default": "doveadm-server",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The UNIX socket or host (host:port syntax is allowed) for connecting to\nthe doveadm server.
no",
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"no",
"ssl",
"starttls"
],
"text": "TODO
\n" }, "doveadm_username": { "default": "doveadm",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The username for authentication to the doveadm service.
\n" }, "doveadm_worker_count": { "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": 0, "text": "If the worker count set here is non-zero, mail commands are run via this\nmany connections to the doveadm service.
\nIf 0, commands are run directly in the same process.
Dovecot configuration version. It uses the same versioning as Dovecot in\ngeneral, e.g. 3.0.5. This must be the first setting in the\nconfiguration file. It specifies the configuration syntax, the used setting\nnames and the expected default values.
When there are default configuration changes in newer Dovecot versions, the\nexisting installations will continue to work the same as before with the same\ndefault settings until this version number is increased. If there are other\nconfiguration changes, the old configuration will either keep working or there\nwill be a clear failure at startup.
\n" }, "dovecot_storage_version": { "values": [ { "label": "String", "url": "string" } ], "added": [ { "version": "Added: 3.0.0" } ], "text": "Dovecot storage file format version. It uses the same versioning as Dovecot in\ngeneral, e.g. 3.0.5. It specifies the oldest Dovecot version\nthat must be able to read files written by this Dovecot instance. The intention\nis that when upgrading Dovecot cluster, this setting is first kept as the old\nDovecot version. Once the cluster is fully upgraded to a new version and\nthere is no intention to rollback to the old version anymore, this version\nnumber can be increased.
_",
"tags": [
"dsync"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "When the source and destination mailbox formats are different, it's\npossible for a mailbox name to exist on one source that isn't valid for\nthe destination. Any invalid characters are replaced with the\ncharacter indicated here.
\n" }, "dsync_commit_msgs_interval": { "default": "100",
"tags": [
"dsync"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"text": "Dsync will commit this number of messages incrementally, to avoid huge\ntransactions that fail.
\n" }, "dsync_features": { "tags": [ "dsync" ], "values": [ { "label": "String", "url": "string" } ], "text": "This setting specifies features and workarounds that can be used with\ndsync. Options are specified in this setting via a space-separated list.
\nAvailable options:
\nempty-header-workaroundno-header-hashesDate Message-ID",
"values": [
{
"label": "String",
"url": "string"
}
],
"advanced": true,
"text": "Which email headers are used in incremental syncing for checking whether\nthe local email matches the remote email?
\nFormat: a space-separated list of headers.
\nThis list should only include headers that can be efficiently downloaded\nfrom the remote server.
\n" }, "event_exporter": { "tags": [ "event-export" ], "values": [ { "label": "Named List Filter", "url": "Named List Filter" } ], "seealso": [ "event_exporter_name"
],
"text": "Creates a new event exporter. The filter name refers to the\nevent_exporter_name setting.
log",
"seealso": [
"Event Export: Drivers"
],
"text": "The event exporter driver to use.
\n" }, "event_exporter_http_post_url": { "tags": [ "event-export" ], "values": [ { "label": "String", "url": "string" } ], "text": "Target URL for event_exporter_driver = http-post.
Path to event log file with event_exporter_driver = file.
Format used for serializing the event.
\n" }, "event_exporter_name": { "tags": [ "event-export" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "metric_exporter"
],
"text": "Name of the event exporter. It is referred by the metric_exporter\nsettings.
rfc3339",
"seealso": [
"Event Export: Formats"
],
"text": "rfc3339YYYY-MM-DDTHH:MM:SS.uuuuuuZ).unix250ms",
"seealso": [
"event_exporter_unix_path"
],
"text": "Timeout when connecting to unix socket with\nevent_exporter_driver = unix.
event_exporter_unix_connect_timeout"
],
"text": "Path to event unix socket with event_exporter_driver = unix.
Configure external execution script. Used by various different features, such\nas welcome. Currently only a single execute block (per feature) is\nallowed.
\n" }, "execute_args": { "tags": [ "execute" ], "values": [ { "label": "String", "url": "string" } ], "text": "External execution script arguments. The parameters are split by space\ncharacters. Currently escape characters are not supported.
\n" }, "execute_driver": { "tags": [ "execute" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "unix", "fork", "tcp" ], "seealso": [ "Execute Scripts" ], "text": "How to execute the external script:
\nunixscript service listening in\nexecute_unix_socket_path.forkexecute_fork_path binary directly.tcpscript service listening in\nexecute_tcp_host:execute_tcp_port.execute_name",
"text": "Path to the binary that is executed with execute_driver = fork.
Name of the execution script. This is the execute named filter\nname. It is also used to provide a default driver-specific settings:
unixexecute_unix_socket_path.forkexecute_fork_path.tcpexecute_tcp_host:execute_tcp_port.execute_name = host:",
"text": "TCP host where to connect to with execute_driver = tcp.
execute_name = :port",
"text": "TCP port where to connect to with execute_driver = tcp.
execute_name",
"text": "UNIX socket path where to connect to with execute_driver = unix.
service",
"fifo_listener_path"
],
"text": "Creates a new FIFO listener for a service. The filter name refers\nto the fifo_listener_path setting.
base_dir",
"fifo_listener"
],
"text": "Path to the FIFO, relative to base_dir setting. The\nfifo_listener filter name refers to this setting.
Listener type. This string value has service-specific meaning and is used to\ndistinguish different listener types that one service may employ.
\n" }, "fifo_listener_mode": { "tags": [ "service" ], "values": [ { "label": "Octal Unsigned Integer", "url": "octal unsigned integer", "default_required": true } ], "default": "0600",
"text": "Mode of the file. Note that 0600 is an octal value, while 600 is a\ndifferent decimal value. Setting mode to 0 disables the listener.
Owner of the listener file. Empty (default) means UID 0 (root).
\n" }, "fifo_listener_group": { "tags": [ "service" ], "values": [ { "label": "String", "url": "string" } ], "text": "Group of the listener file. Empty (default) means GID 0 (root/wheel).
\n" }, "first_valid_gid": { "default": "1",
"seealso": [
"last_valid_gid"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"text": "This setting and last_valid_gid specify the valid GID\nrange for users.
A user whose primary GID is outside this range is not allowed to log in.
\nIf the user belongs to any supplementary groups, the corresponding IDs are\nnot set.
\n" }, "first_valid_uid": { "default": "500",
"seealso": [
"last_valid_uid"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"text": "This setting and last_valid_uid specify the valid UID\nrange for users.
A user whose UID is outside this range is not allowed to log in.
\n" }, "haproxy_timeout": { "default": "3secs",
"tags": [
"haproxy"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "When to abort the HAProxy connection when no complete header has been\nreceived.
\n" }, "haproxy_trusted_networks": { "tags": [ "haproxy" ], "values": [ { "label": "String", "url": "string" } ], "text": "A space-separated list of trusted network ranges for HAProxy connections.
\nConnections from networks outside these ranges to ports that are configured\nfor HAProxy are aborted immediately.
\n" }, "hostname": { "default": "<system's real hostname@domain.tld>",
"tags": [
"submission"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The hostname to be used in email messages sent out by the local delivery\nagent (such as the Message-ID: header), in LMTP replies, and as the\nhostname advertised by submission SMTP service.
\n" }, "http_client_auto_redirect": { "advanced": true, "tags": [ "http", "http_client" ], "added": [ { "version": "Added: 3.1.0" } ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "yes",
"seealso": [
"http_client_request_max_redirects"
],
"text": "If this setting is yes redirects are handled as long as\nhttp_client_request_max_redirects isn't reached. If no the\nredirect responses are handled as regular failure responses.
WARNING
\nThis setting should likely be changed only in the code, never in configuration.
\nyes",
"seealso": [
"http_client_request_max_attempts"
],
"text": "If this setting is no requests are not automatically retried by the generic\nHTTP client code. It's still possible to retry the requests with explicit\nhttp_client_request_try_retry() calls as long as\nhttp_client_request_max_attempts isn't reached.
WARNING
\nThis setting should likely be changed only in the code, never in configuration.
\n1 min",
"text": "Maximum backoff time for retries.
\n" }, "http_client_connect_backoff_time": { "advanced": true, "tags": [ "http", "http_client" ], "added": [ { "version": "Added: 3.1.0" } ], "values": [ { "label": "Time (milliseconds)", "url": "time (milliseconds)", "default_required": true } ], "default": "100 ms",
"text": "Initial backoff time for retries. It's doubled at each connection failure.
\n" }, "http_client_connect_timeout": { "tags": [ "http", "http_client" ], "values": [ { "label": "Time (milliseconds)", "url": "time (milliseconds)", "default_required": true } ], "added": [ { "version": "Added: 3.1.0" } ], "default": 0, "seealso": [ "http_client_request_timeout"
],
"text": "Max time to wait for TCP connect and SSL handshake to finish before retrying.\n0 = use http_client_request_timeout.
http_client_request_max_attempts"
],
"text": "If non-zero, override http_client_request_max_attempts for\nDELETE requests.
http_client_request_timeout"
],
"text": "If non-zero, override http_client_request_timeout for\nDELETE requests.
30 mins",
"text": "How long to cache DNS entries.
\n" }, "http_client_max_auto_retry_delay": { "advanced": true, "tags": [ "http", "http_client" ], "added": [ { "version": "Added: 3.1.0" } ], "values": [ { "label": "Time", "url": "time", "default_required": true } ], "default": 0, "text": "Maximum acceptable delay for automatically retrying/redirecting requests. If a\nserver sends a response with a Retry-After header that causes a delay\nlonger than this, the request is not automatically retried and the response is\nreturned.
Maximum number of connection attempts to a host before all associated requests fail.
\nIf non-zero, the maximum will be enforced across all IPs for that host, meaning\nthat IPs may be tried more than once eventually if the number of IPs is smaller\nthan the specified maximum attempts. If the number of IPs is higher than the\nmaximum attempts not all IPs are tried.
\nIf 0, all IPs are tried at most once.
Maximum time a connection will idle. If parallel connections are idle, the\nduplicates will end earlier based on how many idle connections exist to that\nsame service.
\n" }, "http_client_max_parallel_connections": { "tags": [ "http", "http_client" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "added": [ { "version": "Added: 3.1.0" } ], "default": "1",
"text": "Maximum number of parallel connections per peer.
\n" }, "http_client_max_pipelined_requests": { "tags": [ "http", "http_client" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "added": [ { "version": "Added: 3.1.0" } ], "default": "1",
"text": "Maximum number of pipelined requests per connection.
\n" }, "http_client_proxy_password": { "tags": [ "http", "http_client" ], "values": [ { "label": "String", "url": "string" } ], "added": [ { "version": "Added: 3.1.0" } ], "text": "Password for HTTP proxy.
\n" }, "http_client_proxy_socket_path": { "tags": [ "http", "http_client" ], "values": [ { "label": "String", "url": "string" } ], "added": [ { "version": "Added: 3.1.0" } ], "seealso": [ "http_client_proxy_url"
],
"text": "UNIX socket path for HTTP proxy. Overrides http_client_proxy_url.
yes",
"text": "If no the HTTP proxy delegates SSL negotiation to proxy, rather than\ncreating a CONNECT tunnel through the proxy for the SSL link.
http_client_proxy_socket_path"
],
"text": "URL for HTTP proxy. Ignored if http_client_proxy_socket_path is\nset.
Username for HTTP proxy.
\n" }, "http_client_rawlog_dir": { "tags": [ "http", "http_client" ], "values": [ { "label": "String", "url": "string" } ], "added": [ { "version": "Added: 3.1.0" } ], "text": "Directory for writing raw log data for debugging purposes.
\nWARNING
\nMust be writable by the process creating this log.
\nhttp_client_request_max_attempts"
],
"text": "If non-zero, override http_client_request_max_attempts for GET\nand HEAD requests.
http_client_request_timeout"
],
"text": "If non-zero, override http_client_request_timeout for GET and\nHEAD requests.
Max total time to wait for HTTP request to finish, including all retries. 0\nmeans no limit.
1",
"text": "Maximum number of attempts for a request.
\n" }, "http_client_request_max_redirects": { "tags": [ "http", "http_client" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": 0, "added": [ { "version": "Added: 3.1.0" } ], "text": "Maximum number of redirects for a request. 0 = redirects refused.
1 min",
"text": "Max time to wait for HTTP requests to finish before retrying.
\n" }, "http_client_response_hdr_max_field_size": { "advanced": true, "tags": [ "http", "http_client" ], "added": [ { "version": "Added: 3.1.0" } ], "values": [ { "label": "Size", "url": "size", "default_required": true } ], "default": "8k",
"text": "Response header limit: Max size for an individual field.
\n" }, "http_client_response_hdr_max_fields": { "advanced": true, "tags": [ "http", "http_client" ], "added": [ { "version": "Added: 3.1.0" } ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": "50",
"text": "Response header limit: Max number of fields.
\n" }, "http_client_response_hdr_max_size": { "advanced": true, "tags": [ "http", "http_client" ], "added": [ { "version": "Added: 3.1.0" } ], "values": [ { "label": "Size", "url": "size", "default_required": true } ], "default": "200k",
"text": "Response header limit: Max size for the entire response header.
\n" }, "http_client_socket_recv_buffer_size": { "advanced": true, "tags": [ "http", "http_client" ], "added": [ { "version": "Added: 3.1.0" } ], "values": [ { "label": "Size", "url": "size", "default_required": true } ], "default": 0, "text": "The kernel receive buffer size for the connection sockets. 0 = kernel\ndefaults.
The kernel send buffer size for the connection sockets. 0 = kernel\ndefaults.
Time to wait for TCP connect and SSL handshake to finish for the first\nconnection before trying the next IP in parallel. 0 = wait until current\nconnection attempt finishes.
User-Agent: header to send.
http_client_request_max_attempts"
],
"text": "If non-zero, override http_client_request_max_attempts for PUT\nand POST requests.
http_client_request_timeout"
],
"text": "If non-zero, override http_client_request_timeout for PUT and\nPOST requests.
Overwrite the local hostname with http_server_default_host.
\n" }, "http_server_max_idle_time": { "tags": [ "http", "http-server" ], "values": [ { "label": "Time (milliseconds)", "url": "time (milliseconds)", "default_required": true } ], "default": 0, "text": "Maximum time a connection will idle.
\n" }, "http_server_max_payload_size": { "advanced": true, "tags": [ "http", "http-server" ], "values": [ { "label": "Size", "url": "size", "default_required": true } ], "default": "10G",
"text": "Request payload limit: Max size for the request payload.
\n" }, "http_server_max_pipelined_requests": { "tags": [ "http", "http-server" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": "1",
"text": "Maximum number of pipelined requests per connection.
\n" }, "http_server_max_target_length": { "advanced": true, "tags": [ "http", "http-server" ], "values": [ { "label": "Size", "url": "size", "default_required": true } ], "default": "8k",
"text": "Request target limit: Maximum length of the request target.
\n" }, "http_server_request_hdr_max_field_size": { "advanced": true, "tags": [ "http", "http-server" ], "values": [ { "label": "Size", "url": "size", "default_required": true } ], "default": "8k",
"text": "Request header limit: Max size for an individual field.
\n" }, "http_server_request_hdr_max_fields": { "advanced": true, "tags": [ "http", "http-server" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": "50",
"text": "Request header limit: Max number of fields.
\n" }, "http_server_request_hdr_max_size": { "advanced": true, "tags": [ "http", "http-server" ], "values": [ { "label": "Size", "url": "size", "default_required": true } ], "default": "200k",
"text": "Request header limit: Max size for the entire request header.
\n" }, "http_server_socket_recv_buffer_size": { "advanced": true, "tags": [ "http", "http-server" ], "values": [ { "label": "Size", "url": "size", "default_required": true } ], "default": 0, "text": "The kernel receive buffer size for the connection sockets. 0 = kernel\ndefaults.
0",
"text": "The kernel send buffer size for the connection sockets. 0 = kernel\ndefaults.
Directory for writing raw log data for debugging purposes.
\n" }, "imap_capability": { "tags": [ "imap" ], "values": [ { "label": "Boolean List", "url": "Boolean List" } ], "text": "Override the IMAP CAPABILITY response.
\nExample of modifying capability banner by adding QUOTA and ACL, and removing IDLE:
\nimap_capability {\n QUOTA = yes\n ACL = yes\n IDLE = no\n}Example of setting capability banner to exactly IMAP4rev1 SASL-IR IDLE:
\nimap_capability = IMAP4rev1 SASL-IR IDLEWorkarounds for various IMAP client bugs can be enabled here.
\nThe following values are currently supported:
\ndelay-newmailtb-extra-mailbox-sepmailbox_list_layout = fs (mbox and dbox) confuses\nThunderbird, causing extra / suffixes to mailbox names, Dovecot can be told\nto ignore the superfluous character instead of judging the mailbox name to\nbe invalid.tb-lsub-flagsmailbox_list_layout = fs aren't\nselectable, and users may receive pop-ups with not selectable errors.\nShowing \\Noselect flags for these replies (e.g., in mbox use) causes them\nto be grayed out.disconnect-immediately",
"tags": [
"imap"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"disconnect-after",
"disconnect-immediately",
"no-after"
],
"text": "Behavior when IMAP FETCH fails due to some internal error. Options:
\ndisconnect-immediatelyThe FETCH is aborted immediately and the IMAP client is disconnected.
\ndisconnect-afterThe FETCH runs for all the requested mails returning as much data as\npossible. The client is finally disconnected without a tagged reply.
\nno-afterSame as disconnect-after, but tagged NO reply is sent instead of\ndisconnecting the client.
\nIf the client attempts to FETCH the same failed mail more than once,\nthe client is disconnected.
\nThis is to avoid clients from going into infinite loops trying to FETCH\na broken mail.
\n30secs",
"tags": [
"imap"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "How long to wait while the client is in IDLE state before moving the\nconnection to the hibernate process, to save on memory use, and close the\nexisting IMAP process.
\nIf nothing happens for this long while client is IDLEing, move the\nconnection to imap-hibernate process and close the old imap process. This\nsaves memory, because connections use very little memory in imap-hibernate\nprocess. The downside is that recreating the imap process back uses some\nadditional system resources.
\n" }, "imap_id_retain": { "default": "no",
"tags": [
"imap"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "When proxying IMAP connections to other hosts, this variable must be\nenabled to forward the IMAP ID command provided by the client.
\nThis setting enables the %{client_id} variable for auth processes. See\nAuthentication variables.
name=%{dovecot:name}",
"tags": [
"imap"
],
"values": [
{
"label": "String List",
"url": "String List"
}
],
"text": "Which ID field names and values to send to clients.
\nYou can access the default values by using\nDistribution Variables.
\nimap_id_send {\n name = %{dovecot:name}\n version = %{dovecot:version}\n support-url = http://example.com/\n}2mins",
"tags": [
"imap"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"advanced": true,
"text": "The amount of time to wait between "OK Still here" untagged IMAP responses\nwhen the client is in IDLE operation.
\n" }, "imap_literal_minus": { "default": "no",
"tags": [
"imap"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Enable IMAP LITERAL- (RFC 7888) extension (replaces LITERAL+)?
\n" }, "imap_logout_format": { "default": "in=%{input} out=%{output} deleted=%{deleted} expunged=%{expunged} trashed=%{trashed} hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes}",
"tags": [
"imap"
],
"values": [
{
"label": "String Without Variables",
"url": "String without variables"
}
],
"text": "This setting specifies the IMAP logout format string. Supported variables,\nin addition to Mail user variables are:
| Variable Name | \nDescription | \n
|---|---|
%{input} | \nTotal number of bytes read from client | \n
%{output} | \nTotal number of bytes sent to client | \n
%{fetch_hdr_count} | \nNumber of mails with mail header data sent to client | \n
%{fetch_hdr_bytes} | \nNumber of bytes with mail header data sent to client | \n
%{fetch_body_count} | \nNumber of mails with mail body data sent to client | \n
%{fetch_body_bytes} | \nNumber of bytes with mail body data sent to client | \n
%{deleted} | \nNumber of mails where client added Deleted flag | \n
%{expunged} | \nNumber of mails that client expunged, which does not include automatically expunged mails | \n
%{autoexpunged} | \nNumber of mails that were automatically expunged after client disconnected | \n
%{trashed} | \nNumber of mails that client copied/moved to the special_use=Trash mailbox. | \n
%{appended} | \nNumber of mails saved during the session | \n
64k",
"tags": [
"imap"
],
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"advanced": true,
"text": "Maximum IMAP command line length. Some clients generate very long command\nlines with huge mailboxes, so you may need to raise this if you get\nToo long argument or IMAP command line too large errors often.
\n" }, "imap_metadata": { "default": "no",
"tags": [
"imap",
"metadata"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Dovecot supports the IMAP METADATA extension (RFC 5464), which allows\nper-mailbox, per-user data to be stored and accessed via IMAP commands. Set\nthis parameter's value to yes if you wish to activate the IMAP METADATA\ncommands.
Note: If activated, a dictionary needs to be configured, via the\nmail_attribute setting.
Example:
\n# Store METADATA information within user's Maildir directory\nmail_attribute {\n dict file {\n path = %{home}/Maildir/dovecot-attributes\n }\n}\n\nprotocol imap {\n imap_metadata = yes\n}Specifies the host used for URLAUTH URLs. Only this host is accepted in\nthe client-provided URLs. Using * value (not recommended) allows all\nhosts and the generated URLs use hostname as the host.
An empty value disables the URLAUTH extension entirely.
\nWARNING
\nURLAUTH in current versions of Dovecot is broken in several ways.\nThis will be fixed in the future, but activating URLAUTH support on\nproduction systems is not recommended.
\nINFO
\nThis setting is REQUIRED for the URLAUTH (RFC 4467) extension to\nbe active.
\nin=%{input} out=%{output}",
"seealso": [
"imap_urlauth_host"
],
"tags": [
"imap"
],
"values": [
{
"label": "String Without Variables",
"url": "String without variables"
}
],
"text": "Specifies the logout format used with the URLAUTH extension in IMAP\noperation.
\nWARNING
\nThis setting is currently not used.
\nVariables allowed:
\n| Name | \nDescription | \n
|---|---|
%{input} | \nTotal number of bytes read from the client | \n
%{output} | \nTotal number of bytes sent to the client | \n
143",
"seealso": [
"imap_urlauth_host"
],
"tags": [
"imap"
],
"values": [
{
"label": "Port Number",
"url": "Port Number",
"default_required": true
}
],
"text": "The port is used with the URLAUTH extension in IMAP operation.
\n" }, "imapc_cmd_timeout": { "default": "5 mins",
"tags": [
"imapc"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "How long to wait for a reply to an IMAP command sent to the remote IMAP\nserver before disconnecting and retrying.
\n" }, "imapc_connection_timeout_interval": { "tags": [ "imapc" ], "values": [ { "label": "Time (milliseconds)", "url": "time (milliseconds)", "default_required": true } ], "default": "30secs",
"text": "How long to wait before considering a connection attempt as timed out.
\n" }, "imapc_connection_retry_count": { "default": "1",
"tags": [
"imapc"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"text": "How many times to retry connection against a remote IMAP server?
\n" }, "imapc_connection_retry_interval": { "default": "1 secs",
"tags": [
"imapc"
],
"values": [
{
"label": "Time (milliseconds)",
"url": "time (milliseconds)",
"default_required": true
}
],
"text": "How long to wait between retries against a remote IMAP server?
\n" }, "imapc_features": { "tags": [ "imapc" ], "changed": [ { "text": "Several features are now automatically enabled and the respective flags\ndropped. In their place new flags to disable these features were added.
\n", "version": "Changed: 3.0.0" } ], "values": [ { "label": "Boolean List", "url": "Boolean List" } ], "text": "List of features, optimizations, and workarounds that can be enabled.
\nChanged: 3.2.0 Any remote IMAP server\nextension can now be disabled by using no- prefixed with the capability\nname. For example no-sort, no-sort=display or no-quota.
no-aclIf the imap-acl plugin is loaded, the imapc acl feature is\nautomatically enabled. With it IMAP ACL commands (MYRIGHTS, GETACL,\nSETACL, DELETEACL) are proxied to the imapc remote location. Note\nthat currently these commands are attempted to be used even if the\nremote IMAP server doesn't advertise the ACL capability.
\nTo disable this feature either unload the imap-acl plugin or\nprovide this feature.
\nChanged: 3.0.0
\nEarlier versions had an "acl" feature, which is now enabled by default.
\nno-delay-loginImmediately connect to the remote server. By default this is\ndelayed until a command requires a connection.
\nChanged: 3.0.0
\nEarlier versions had a "delay-login" feature, which is now enabled\nby default.
\ngmail-migrationX-GM-MSGID as POP3 UIDL.\nAdd $GMailHaveLabels keyword to mails that have X-GM-LABELS\nexcept for Muted keyword (to be used for migrating only archived\nemails in All Mails). Add pop3_deleted_flag to\nmails that don't exist in POP3 server.no-modseqDisable access to MODSEQ and HIGHESTMODSEQ fields. By default\nthese fields are available if the remote server advertises the\nCONDSTORE or the QRESYNC capability. If modseqs are disabled, or not\nsupported by the new server, they can still be used if imapc is\nconfigured to have local index files.
Changed: 3.0.0
\nEarlier versions had a "modseq" feature, which is now enabled by\ndefault.
\nproxyauthPROXYAUTH command to do master\nuser authentication. Normally this would be done using the SASL PLAIN\nauthentication.send-idx-session-ext-id parameter. If\nlogin_trusted_networks on the target host is\nconfigured to trust the connecting imapc IP, the session ID is\npreserved as the new imapc connection's session ID prefix.throttle:<INIT>:<MAX>:<SHRINK>When receiving [THROTTLED] response (from GMail), throttling is\napplied.
\nINIT = initial throttling msecs (default: 50 ms), afterwards each\nsubsequent [THROTTLED] doubles the throttling until MAX is reached\n(default: 16000 ms). When [THROTTLED] is not received for a while,\nit's shrunk again. The initial shrinking is done after SHRINK\n(default: 500 ms). If [THROTTLED] is received again within this\ntimeout, it's doubled, otherwise both throttling and the next\nshrinking timeout is shrank to 3/4 the previous value.
\nno-fetch-bodystructureDisable fetching of IMAP BODY and BODYSTRUCTURE from the\nremote server. Instead, the whole message body is fetched to\nregenerate them.
Changed: 3.0.0
\nEarlier versions had a "fetch-bodystructure" feature, which is now\nenabled by default.
\nno-fetch-headersDisable fetching of specific message headers from the remote server\nusing the IMAP FETCH BODY.PEEK[HEADER.FIELDS(...)] command.\nInstead, the whole header is fetched and the wanted headers are\nparsed from it.
Changed: 3.0.0
\nEarlier versions had a "fetch-headers" feature, which is now enabled\nby default.
\nno-fetch-sizeDisable fetching of message sizes from the remote server using the\nIMAP FETCH RFC822.SIZE command. Instead, the whole message body\nis fetched to calculate the size.
Changed: 3.0.0
\nEarlier versions had a "rfc822.size" feature, which is now enabled\nby default.
\nno-metadataMETADATA capability from the\nremote server. The client will receive a NO [UNAVAILABLE]\nresponse for any request that requires access to metadata on the\nremote server (the same happens if the server does not announce\nthe capability at all).no-searchDisable searching messages using the IMAP SEARCH command.\nInstead, all the message headers/bodies are fetched to perform\nthe search locally.
Changed: 3.0.0
\nEarlier versions had a "search" feature, which is now enabled by\ndefault.
\nfetch-fix-broken-mailsIf a FETCH returns NO (but not NO [LIMIT] or NO [SERVERBUG]), assume the mail is broken in server and just treat\nit as if it were an empty email.
DANGER
\nThis is often a dangerous option! It's not safe to assume that NO\nmeans a permanent error rather than a temporary error. This feature\nshould be enabled only for specific users who have been determined\nto be broken.
fetch-msn-workaroundsFETCH replies\nwhenever possible, preferring to use the returned UID number instead.no-examineSELECT instead of EXAMINE even when we don't want to\nmodify anything in the mailbox. This is a Courier-workaround where\nit didn't permanently assign UIDVALIDITY to an EXAMINEd\nmailbox, but assigned it for SELECTed mailbox.no-qresync Added: 3.0.0zimbra-workaroundsBODY.PEEK[HEADER] BODY.PEEK[TEXT]\ninstead of just BODY.PEEK[] because the header differs between\nthese two when there are illegal control chars or 8bit chars.\nThis mainly caused problems with dsync, but this should no longer\nbe a problem and there's probably no need to enable this workaround.The remote IMAP host to connect to.
\n" }, "imapc_list_prefix": { "tags": [ "imapc" ], "values": [ { "label": "String", "url": "string" } ], "text": "Access only mailboxes under this prefix.
\nExample, for a source IMAP server that uses an INBOX namespace prefix:
\nimapc_list_prefix = INBOXimapc_password",
"imapc_user"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The master username to authenticate as on the remote IMAP host.
\nTo authenticate as a master user but use a separate login user, the\nfollowing configuration should be employed, where the credentials are\nrepresented by masteruser and masteruser-secret:
\nimapc_user = %{user}\nimapc_master_user = masteruser\nimapc_password = masteruser-secretMail user variables can be used.
29 mins",
"tags": [
"imapc"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "Send a command to the source IMAP server as a keepalive after no other\ncommand has been sent for this amount of time.
\nDovecot will send either NOOP or DONE to the source IMAP server.
unlimited",
"text": "The maximum line length to accept from the remote IMAP server.
\nThis setting is used to limit maximum memory usage.
\n" }, "imapc_password": { "tags": [ "imapc" ], "seealso": [ "imapc_master_user",
"imapc_user",
"imapc_sasl_mechanisms"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The authentication password for the remote IMAP server.
\nIf using master users, this setting will be the password of the master user.
\n" }, "imapc_port": { "default": "143",
"tags": [
"imapc",
"imapc-auth"
],
"values": [
{
"label": "Port Number",
"url": "Port Number",
"default_required": true
}
],
"text": "The port on the remote IMAP host to connect to.
\n" }, "imapc_rawlog_dir": { "seealso": [ "rawlog" ], "tags": [ "imapc", "imapc-auth" ], "values": [ { "label": "String", "url": "string" } ], "text": "Log all IMAP traffic input/output to this directory.
\n" }, "imapc_sasl_mechanisms": { "default": "plain",
"tags": [
"imapc"
],
"values": [
{
"label": "Boolean List",
"url": "Boolean List"
}
],
"text": "The SASL mechanisms to use for authentication when connection to a\nremote IMAP server.
\nThe first one advertised by the remote IMAP sever is used.
\nimapc_sasl_mechanisms {\n external = yes\n plain = yes\n login = yes\n}Supported mechanisms are:
\nNote that imapc_password is ignored for ANONYMOUS and EXTERNAL mechanisms.\nFor OAUTHBEARER and XOAUTH2 imapc_password should be bearer token.
no",
"tags": [
"imapc",
"imapc-auth"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"no",
"imaps",
"starttls"
],
"text": "Use TLS to connect to the remote IMAP server.
\n| Value | \nDescription | \n
|---|---|
no | \nNo TLS | \n
imaps | \nExplicitly connect to remote IMAP port using TLS | \n
starttls | \nUse IMAP STARTTLS command to switch to TLS connection | \n
Dropped in favor of using the global\nssl_client_require_valid_cert.
yes",
"tags": [
"imapc"
],
"seealso": [
"imapc_ssl"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Verify remote IMAP TLS certificate?
\nVerification may be disabled during testing, but should be enabled during\nproduction use.
\nOnly used if imapc_ssl is enabled.
imapc_master_user",
"imapc_password",
"imapc_sasl_mechanisms"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"default": "%{owner_user}",
"text": "The user identity to be used for performing a regular IMAP LOGIN to the\nsource IMAP server.
\nMail user variables can be used.
\nTZ=%{env:TZ} CORE_OUTOFMEM=%{env:CORE_OUTOFMEM} CORE_ERROR=%{env:CORE_ERROR}\nPATH=%{env:PATH} MALLOC_MMAP_THRESHOLD_=131072\n
\n
\nAlso systemd environments: LISTEN_PID=%{env:LISTEN_PID} LISTEN_FDS=%{env:LISTEN_FDS} NOTIFY_SOCKET=%{env:NOTIFY_SOCKET}\n",
"values": [
{
"label": "String List",
"url": "String List"
}
],
"text": "A list of environment key=value pairs, that are preserved and passed to all\nchild processes.
\nThe value can be determined from the existing environment upon Dovecot startup or directly specified.
\nExample:
\nimport_environment {\n TZ = :/etc/localtime\n TMPDIR = /dovecot-tmp\n}service",
"inet_listener_name"
],
"text": "Creates a new network socket listener for a service. The filter\nname refers to the inet_listener_name setting.
inet_listener_type",
"inet_listener"
],
"text": "Name of this listener. It is meant to be descriptive for humans (e.g. imap,\nimaps), but it is also used by services to determine the socket type,\nunless inet_listener_type overrides it. The\ninet_listener filter name refers to this setting.
Listener type. This string value has service-specific meaning and is used to\ndistinguish different listener types that one service may employ.
\n" }, "inet_listener_port": { "tags": [ "service" ], "values": [ { "label": "Port Number", "url": "Port Number", "default_required": true } ], "seealso": [ "listen"
],
"default": 0,
"text": "Port number where to listen. 0 disables the listener.
no",
"seealso": [
"ssl"
],
"text": "If yes, the listener does an immediate SSL/TLS handshake after accepting a\nconnection. This is needed for e.g. the imaps and pop3s ports.
INFO
\nAll listeners with ssl=yes will be removed if the global ssl\nsetting is no.
Regardless of the value for listener's ssl setting, some services will still\ntry to initialize encryption if the global ssl is yes. This is\nfor example done to accommodate STARTTLS commands for IMAP/SUBMISSION/LMTP\nprotocols. In other words, SSL is truly disabled only when the global\nssl is no.
Note: Do not confuse this with the ssl setting. When used as\ninet_listener { ssl }, it expands to this inet_listener_ssl setting.
no",
"text": "If yes, this listener is configured for use with HAProxy. It expects a\nProxy Protocol header right after accepting the connection. Connections are\naborted immediately if this protocol is violated.
log_path",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The log file to use for informational messages.
\n" }, "instance_name": { "default": "dovecot",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "For multi-instance setups, supply the unique name of this Dovecot instance.
\nThis simplifies use of commands such as doveadm: rather than using -c\nand the config path, you can use the -i flag with the relevant instance\nname.
first_valid_gid"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"default": "unlimited",
"text": "This setting and first_valid_gid specify the valid GID\nrange for users.
A user whose primary GID is outside this range is not allowed to log in.
\nIf the user belongs to any supplementary groups, the corresponding IDs are\nnot set.
\n" }, "last_valid_uid": { "seealso": [ "first_valid_uid"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"default": "unlimited",
"text": "This setting and first_valid_uid specify the valid UID\nrange for users.
A user whose UID is outside this range is not allowed to log in.
\n" }, "lda_mailbox_autocreate": { "default": "no",
"tags": [
"lda"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Should LDA create a nonexistent mailbox automatically when attempting to\nsave a mail message?
\n" }, "lda_mailbox_autosubscribe": { "default": "no",
"tags": [
"lda"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Should automatically created mailboxes be subscribed to?
\n" }, "lda_original_recipient_header": { "tags": [ "lda" ], "default": "<lda/lmtp specific>",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The header from which the original recipient address (used in the SMTP RCPT\nTO: address) is obtained if that address is not available elsewhere.
\nWith LDA the default is based on the username in -d parameter.\nWith LMTP Server the default is the same as RCPT TO.
Example:
\nlda_original_recipient_header = X-Original-To/usr/libexec/dovecot",
"values": [
{
"label": "String",
"url": "string"
}
],
"advanced": true,
"text": "The directory from which you execute commands via doveadm-exec.
\n" }, "listen": { "default": "*, ::",
"values": [
{
"label": "IP Address(es)",
"url": "IP addresses"
}
],
"text": "A comma-separated list of IP addresses or hostnames on which external network\nconnections will be handled.
\n* listens at all IPv4 interfaces, and :: listens at all IPv6\ninterfaces.
Example:
\nlisten = 127.0.0.1, 192.168.0.1This setting can be used also inside an inet_listener to override\nthe listener address, e.g.:
service imap-login {\n inet_listener imap {\n listen = 192.168.0.1\n }\n}yes",
"tags": [
"lmtp"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Controls if "Received:" header should be added to delivered mails.
\n" }, "lmtp_client_workarounds": { "tags": [ "lmtp" ], "values": [ { "label": "Boolean List", "url": "Boolean List" } ], "text": "Configures the list of active workarounds for LMTP client bugs. Supported\nworkaround identifiers are:
\nwhitespace-before-pathmailbox-for-pathfinal",
"tags": [
"lmtp"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"alternative",
"final",
"none"
],
"text": "The recipient address to use for the "Delivered-To:" header and the\nrelevant "Received:" header.
\nOptions:
\nalternativefinalnoneno",
"seealso": [
"proxy passdb"
],
"tags": [
"lmtp"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If yes, LMTP sessions perform a passdb lookup to see if the user should be\nproxied. The user is proxied only if the proxy extra field is returned.\nThe proxy destination is determined via returned passdb extra fields.
This setting is required with Palomar cluster configuration even in backends,\nbecause the backend may still ask proxy to reject the connection and proxy\nthe user to another backend.
\n" }, "lmtp_proxy_rawlog_dir": { "seealso": [ "rawlog" ], "tags": [ "lmtp" ], "values": [ { "label": "String", "url": "string" } ], "text": "Directory location to store raw LMTP proxy protocol traffic logs.
\nMail service user variables can be used. However, because LMTP session\nstarts without a user, all user-specific variables expand to empty.
Directory location to store raw LMTP protocol traffic logs.
\nMail service user variables can be used. However, because LMTP session\nstarts without a user, all user-specific variables expand to empty.
no",
"tags": [
"lmtp"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Should quota be verified before a reply to RCPT TO is issued?
\nIf active, this creates a small amount of extra overhead so it is disabled\nby default.
\n" }, "lmtp_save_to_detail_mailbox": { "default": "no",
"tags": [
"lmtp"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If the recipient address includes a detail element / role (as in user+detail\nformat), save the message to the detail mailbox.
\n" }, "lmtp_user_concurrency_limit": { "tags": [ "lmtp", "user_concurrency_limits" ], "changed": [ { "text": "Changed from unlimited to 10.
10",
"text": "Limit the number of concurrent deliveries to a single user to this maximum\nvalue.
\nIt is useful if one user is receiving numerous mail messages and thereby\ncausing delays to other deliveries.
\nTo prevent limiting concurrent user deliveries set this to unlimited.
no",
"tags": [
"lmtp"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"advanced": true,
"text": "This setting makes the replies returned to the client much more verbose.\nCurrently, this only applies when the LMTP proxy is involved, for which\ne.g. backend connection errors are returned in full detail.
\nNormally, these errors are replaced by a more generic error message to\nprevent leaking system details to the clients (e.g. IP addresses and ports).\nIt is therefore not recommended to enable this setting beyond troubleshooting\nefforts.
\n" }, "lock_method": { "default": "fcntl",
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"fcntl",
"flock",
"dotlock"
],
"text": "Specify the locking method to use for index files.
\nOptions:
\ndotlockmailboxname.lock file created by almost all software when writing to\nmboxes. This grants the writer an exclusive lock over the mbox, so it's\nusually not used while reading the mbox so that other processes can also\nread it at the same time. So while using a dotlock typically prevents\nactual mailbox corruption, it doesn't protect against read errors if\nmailbox is modified while a process is reading.flockfcntlCrash after logging a matching event. The syntax of the filter is described\nin Global Metric Filters.
\nFor example:
\nlog_core_filter = category=errorwill crash any time an error is logged, which can be useful for debugging.
\n" }, "log_debug": { "values": [ { "label": "String", "url": "string" } ], "text": "Filter to specify what debug logging to enable. The syntax of the filter is\ndescribed in Global Metric Filters.
\nINFO
\nThis will eventually replace mail_debug and\nauth_debug settings.
syslog",
"seealso": [
"debug_log_path",
"info_log_path"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "Specify the log file to use for error messages.
\nOptions:
\nsyslog: Log to syslog/dev/stderr: Log to stderrIf you don't want to use syslog, or if you just can't find the Dovecot's\nerror logs, you can make Dovecot log elsewhere as well:
\nlog_path = /var/log/dovecot.logIf you don't want errors, info, and debug logs all in one file, specify\ninfo_log_path or debug_log_path as well:
log_path = /var/log/dovecot.log\ninfo_log_path = /var/log/dovecot-info.log%b %d %H:%M:%S",
"values": [
{
"label": "String Without Variables",
"url": "String without variables"
}
],
"text": "The prefix for each line written to the log file.
\n% variables are in strftime(3) format.
Default socket path for all services' login processes. Can be overridden by\npassing a parameter to the login executable.
\nThis must be set to cluster in Palomar cluster configurations, for\nboth proxies and backends.
Dovecot ready.",
"values": [
{
"label": "String",
"url": "string"
}
],
"advanced": true,
"text": "The greeting message displayed to clients.
\nVariables allowed:
\nMail service user variablesLogin variables%{message}: %{elements}",
"values": [
{
"label": "String Without Variables",
"url": "String without variables"
}
],
"text": "The formatting of login log messages.
\nVariables allowed (in addition to Global variables):
| Variable Name | \nDescription | \n
|---|---|
%{elements} | \nA login_log_format_elements string | \n
%{message} | \nThe log data | \n
user=<%{user}> method=%{mechanism} rip=%{remote_ip} lip=%{local_ip} mpid=%{mail_pid} %{secured} session=<%{session}>",
"values": [
{
"label": "String Without Variables",
"url": "String without variables"
}
],
"text": "A space-separated list of elements of the login log formatting.
\nElements that have a non-empty value are joined together to form a\ncomma-separated string.
\nLogin variables can be used.
/usr/lib64/dovecot/login",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "Location of the login plugin directory.
\n" }, "login_plugins": { "values": [ { "label": "Boolean List", "url": "Boolean List" } ], "text": "List of plugins to load for IMAP and POP3 login processes.
\n" }, "login_proxy_max_disconnect_delay": { "values": [ { "label": "Time", "url": "time", "default_required": true } ], "default": "30 secs",
"text": "Specify the delayed disconnection interval of clients when there is a\nserver mass-disconnect.
\nFor prevention of load spikes when a backend server fails or is restarted,\ndisconnection is spread over the amount of time indicated.
\n0 disables the delay.
3",
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"text": "How many times login proxy will attempt to reconnect to destination server\non connection failures (3 reconnects = total 4 connection attempts).
\nReconnecting is done for most types of failures, except for regular\nauthentication failures.
\nThere is a 1 second delay between each reconnection attempt.
\nIf login_proxy_timeout is reached, further reconnects\naren't attempted.
Login processes write rawlogs for proxied connections to this directory for\ndebugging purposes. Note that login processes are usually chrooted, so the\ndirectory is relative to $base_dir/login/.
Changed: 3.2.0 You can use Login Variables with this setting.
\n" }, "login_proxy_timeout": { "default": "30 secs",
"values": [
{
"label": "Time (milliseconds)",
"url": "time (milliseconds)",
"default_required": true
}
],
"text": "Timeout for login proxy failures.
\nThe timeout covers everything from the time connection is started until a\nsuccessful login reply is received.
\nThis can be overwritten by proxy passdb passdb extra field.
\nThis setting applies only to proxying via login processes, not to lmtp or\ndoveadm processes.
\n" }, "login_source_ips": { "values": [ { "label": "IP Address(es)", "url": "IP addresses" } ], "text": "Value Format: List of trusted network ranges, see\nBoolean List.
\nA list of hosts / IP addresses that are used in a round-robin manner for\nthe source IP address when the proxy creates TCP connections.
\nExample:
\nlogin_source_ips {\n proxy-sources.example.com = yes\n}Value Format: List of trusted network ranges, see\nBoolean List.
\nThis setting is used for a few different purposes, but most importantly it\nallows the client connection to tell the server what the original client's\nIP address was. This original client IP address is then used for logging\nand authentication checks.
\nClient connections from trusted networks are also treated as secured unless\nssl = required. Plaintext authentication is always allowed for\nsecured connections (auth_allow_cleartext is ignored).
Localhost connections are secured by default, but they are not\ntrusted by default. If you want localhost to be trusted, it needs to be\nincluded in this setting.
\nThe details of how this setting works depends on the used protocol:
\nID command can be used to override:
\n%{remote_ip}, %{remote_port})%{local_ip}, %{local_port})forward_* fields can be sent to auth process's passdb lookup
The trust is always checked against the connecting IP address.\nExcept if HAProxy is used, then the original client IP address is used.
\nXCLIENT command can be used to override:
\n%{remote_ip}, %{remote_port})%{local_ip}, %{local_port})forward_* fields can be sent to auth process's passdb lookup
The trust is always checked against the connecting IP address.\nExcept if HAProxy is used, then the original client IP address is used.
\nXCLIENT command can be used to override:
\n%{remote_ip}, %{remote_port})%{local_ip}, %{local_port})The trust is always checked against the connecting IP address.\nExcept if HAProxy is used, then the original client IP address is used.
\nXCLIENT command can be used to override:
\n%{remote_ip}, %{remote_port})%{local_ip}, %{local_port})forward_* fields can be sent to auth process's passdb lookup
The trust is always checked against the connecting IP address.\nExcept if HAProxy is used, then the original client IP address is used.
\nXCLIENT command can be used to override:
\n%{remote_ip}, %{remote_port})mail_max_lock_timeout)%{local_ip}, %{local_port})The trust is always checked against the connecting IP address.\nExcept if HAProxy is used, then the original client IP address is used.
\ndefault_internal_group",
"seealso": [
"mail_privileged_group",
"service_extra_groups"
],
"changed": [
{
"text": "Changed from empty to default_internal_group.
Supplementary groups that are granted access for mail processes (imap, pop3,\nlmtp, etc.) The default is to include default_internal_group to\nallow UNIX socket access to various internal Dovecot services. For proper\nsecurity, there should be no regular files or directories writable for the\ndefault_internal_group.
WARNING
\nIt may be dangerous to use access groups if (untrusted) users can create\nsymlinks to any paths the mail processes access.
\nFor example if using mail_access_groups = mail:
ln -s /var/mail ~/mail/var could allow a user to delete others'\nmailboxes, orln -s /secret/shared/box ~/mail/mybox would allow reading others' mail.mail_cache_fields",
"mail_never_cache_fields"
],
"values": [
{
"label": "Boolean List",
"url": "Boolean List"
}
],
"text": "The fields specified here are always added to cache when saving mails, even\nif the client never accesses these fields.
\nSee mail cache configuration for details and for the list of fields.
\n", "default": "\nflags hdr.date hdr.subject hdr.from hdr.sender hdr.reply-to hdr.to hdr.cc hdr.bcc hdr.in-reply-to hdr.message-id date.received size.virtual imap.bodystructure mime.parts hdr.references hdr.importance hdr.x-priority hdr.x-open-xchange-share-url pop3.uidl pop3.order",
"changed": [
{
"text": "The default fields were changed. They used to be empty.
\n", "version": "Changed: 3.1.0" } ] }, "mail_attachment_detection_options": { "changed": [ { "text": "The default was set.
\n", "version": "Changed: 3.2.0" }, { "text": "The Maildir default was reverted to empty.
\n", "version": "Changed: 3.2.0" } ], "values": [ { "label": "Boolean List", "url": "Boolean List" } ], "default": "\n- mbox, imapc, maildir: <empty>
 \n- others: add-flags content-type=!application/signature",
"text": "Settings to control adding $HasAttachment or $HasNoAttachment\nkeywords. By default, all MIME parts with Content-Disposition=attachment\nor inlines with filename parameter are considered attachments.
To enable this feature, this setting needs at least one option specified.\nMultiple options can be added in a space-separated list.
\nOptions:
\nadd-flagsmime.parts and\nimap.bodystructure has to be in cache already, or if mail body is\nopened in any case.add-flags no-flags-on-fetchcontent-type=<type|!type>content-type=!foo/* content-type=foo/bar).exclude-inlinedThe directory in which to store mail attachments.
\nWith sdbox and mdbox, mail attachments can be saved to\nexternal files, which also allows single-instance storage of them.
\nIf no value is specified, attachment saving to external files is disabled.
\nMail user variables and ~/ can be used.
fs_driver",
"mail_ext_attachment_path"
],
"text": "Named filter for initializing FS Driver for external attachments.
\nCommonly used options:
\nposixNo single-instance storage (SIS) done (this option might simplify the\nfilesystem's own de-duplication operations).
\nsisSIS with immediate byte-by-byte comparison during saving.
\nSIS is deprecated and writing of SIS files is disabled. Reading is\nsupported for now, any missing SIS attachments are replaced with files\nfilled with spaces.
\nsis-queueSIS with delayed comparison and de-duplication.
\nChanged: 3.1.0 SIS is deprecated\nand writing SIS files is disabled. Reading is supported for now. Any\nmissing SIS attachments are replaced with files filled with spaces.
\n%{sha1}",
"seealso": [
"mail_ext_attachment_path"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"%{md4}",
"%{md5}",
"%{sha1}",
"%{sha256}",
"%{sha512}",
"%{size}"
],
"advanced": true,
"text": "The hash format to use in attachment filenames when saving attachments\nexternally.
\nVariables and additional text can be included in this string.
\nThe syntax allows truncation of any variable. For example %{sha256:80}\nwill return only the first 80 bits of the SHA256 output.
128k",
"seealso": [
"mail_ext_attachment_path"
],
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"text": "Attachments below this size will not be saved externally.
\n" }, "mail_attribute": { "seealso": [ "imap_metadata"
],
"tags": [
"metadata"
],
"values": [
{
"label": "Named Filter",
"url": "Named Filter",
"no_default": true
}
],
"text": "Named filter for initializing dict driver for server and mailbox\nattributes (key=value).
This is used by the URLAUTH and METADATA extensions, as well as various other\nfeatures.
\nExample:
\nmail_attribute {\n dict file {\n path = %{home}/dovecot-attributes\n }\n}The default fields were changed. They used to be just "flags".
\n", "version": "Changed: 3.1.0" } ], "default": "\nflags hdr.date hdr.subject hdr.from hdr.sender hdr.reply-to hdr.to hdr.cc hdr.bcc hdr.in-reply-to hdr.message-id date.received size.virtual imap.bodystructure mime.parts hdr.references hdr.importance hdr.x-priority hdr.x-open-xchange-share-url pop3.uidl pop3.order",
"seealso": [
"mail_always_cache_fields",
"mail_never_cache_fields"
],
"values": [
{
"label": "Boolean List",
"url": "Boolean List"
}
],
"text": "The default list of fields that are added to cache if no other caching\ndecisions exist yet. This setting is used only when creating the initial\nINBOX for the user. Other folders get their defaults from the INBOX.
\nSee mail cache configuration for details and for the list of fields.
\n" }, "mail_chroot": { "values": [ { "label": "String", "url": "string" } ], "text": "The default chroot directory for mail processes.
\nThis chroots all users globally into the same directory.
\nMail service user variables can be used.
no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "This setting adjusts log verbosity. It enables mail-process debugging. This\ncan help you figure out the reason if Dovecot isn't finding certain mail\nmessages.
\n" }, "mail_fsync": { "default": "never for obox; optimized for others",
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"always",
"optimized",
"never"
],
"text": "Specify when to use fsync() or fdatasync() calls.
\nUsing fsync waits until the data is written to disk before it continues,\nwhich is used to prevent corruption or data loss in case of server crashes.
\nThis setting applies to mail files and index files on the filesystem. This\nsetting doesn't apply to object storage operations.
\nOptions:
\nalwaysUse fsync after all disk writes.
\nRecommended for NFS to make sure there aren't any delayed write()s.
\noptimizedUse fsync after important disk writes.
\nFor example cache file writes aren't fsynced, because they can be\nregenerated if necessary.
\nneverNever fsync any disk writes.
\nThis provides the best performance, but risks losing recently saved emails\nin case of a crash with most mailbox formats.
\nno",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"advanced": true,
"seealso": [
"mailbox_list_validate_fs_names"
],
"text": "Allow full filesystem access to clients?
\nIf enabled, no access checks are performed other than what the operating\nsystem does for the active UID/GID. This also disables the\nmailbox_list_validate_fs_names setting.
This setting works with both Maildir and mbox, allowing you\nto prefix mailbox names with /path/ or ~user/ indicators.
mail_uid"
],
"values": [
{
"label": "String",
"url": "string"
},
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"default": "vmail",
"text": "The system group ID used for accessing mail messages.
\nCan be either a numeric ID or a group name.
\nThis can be overridden via the gid userdb field.
mail_path",
"Home Directories for Virtual Users"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "User's home directory. This is used as the root for some of the user-specific\nfiles and directories. The %{home} variable expands to this value. Also\nsome path settings expand ~/ to this value.
There are various possible ways of specifying this parameter and\nmail_path.
The following example is one option when home is in /var/vmail/domain/user/\nand mails are in /var/vmail/domain/user/mail/:
mail_home = /var/vmail/%{user | domain}/%{user | username}\nmail_path = ~/mailMail service user variables can be used.
%{service}(%{user})<%{process:pid}><%{session}>: ",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "You can specify a log prefix for mail processes here.
\nMail service user variables can be used.
50",
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"advanced": true,
"text": "The maximum length allowed for a mail keyword name.
\nCompliance is enforced only during attempts to create new keywords.
\n" }, "mail_max_lock_timeout": { "default": "0",
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "This value is used as a timeout for tempfailing mail connections. It\ncan be set globally, for application to all Dovecot services, but\nis normally better to set it in only certain protocol blocks. You\nmay wish to set a value for this for LMTP and LDA while leaving it at\nthe global default of 0 for IMAP and POP3 connections, which\ntolerate tempfailing less well.
10",
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"tags": [
"user_concurrency_limits"
],
"text": "The maximum number of IMAP connections allowed for a user from each IP\naddress.
\nThis setting is checked only by backends, not proxies.
\nNote that for this to work, any username changes must be done already by\npassdb lookup (not by userdb lookup).
\nUnique users are identified via case-sensitive comparison.
\n" }, "mail_never_cache_fields": { "default": "imap.envelope",
"seealso": [
"mail_always_cache_fields",
"mail_cache_fields"
],
"values": [
{
"label": "Boolean List",
"url": "Boolean List"
}
],
"text": "List of fields that should never be cached.
\nThis should generally never include anything other than imap.envelope,\nwhich isn't needed because it can be generated from the cached header\nfields.
See mail cache configuration for details and for the list of fields.
\n" }, "mail_nfs_index": { "default": "no",
"seealso": [
"mail_nfs_storage",
"mail_fsync"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "This setting attempts to flush NFS caches when accessing index files. The\nintention was that it would allow accessing the same user's index files in\nmultiple servers at the same time. However, this couldn't be made to work\nperfectly due to the way Linux and BSD kernels work internally. The setting\nexists for now, but it is not a supported way of running Dovecot.
\nWhen using this setting, be sure also to use mmap_disable = yes\nand mail_fsync = optimized.
no",
"seealso": [
"mail_nfs_index"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "This setting attempts to flush NFS caches when accessing mail storage. The\nintention was that it would allow accessing the same user's mails in\nmultiple servers at the same time. However, this couldn't be made to work\nperfectly due to the way Linux and BSD kernels work internally. The setting\nexists for now, but it is not a supported way of running Dovecot.
\n" }, "mail_plugin_dir": { "default": "/usr/lib64/dovecot",
"seealso": [
"mail_plugins"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The directory in which to search for Dovecot mail plugins.
\n" }, "mail_plugins": { "seealso": [ "mail_plugin_dir"
],
"values": [
{
"label": "Boolean List",
"url": "Boolean List"
}
],
"text": "A list of mail plugins to load.
\n" }, "mail_prefetch_count": { "default": "10 for obox; 0 for others",
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"text": "The number of messages to try to prefetch whenever possible. 0 means that\nno prefetching is done. Depending on the (remote) storage latency, this may\nsignificantly speed up performance when reading many mails. The exact behavior\ndepends on the mailbox format:
sdbox, Maildir: Call\nposix_fadvise(POSIX_FADV_WILLNEED) on mail files to instruct kernel to\nread the whole files into memory.
imapc: Combine multiple mail reads into the same remote imapc FETCH\ncommand. For example with mail_prefetch_count = 0 reading two mails\nwould result in FETCH 1 BODY.PEEK[] and FETCH 2 BODY.PEEK[]\ncommands, while with mail_prefetch_count = 1 they would be\ncombined into a single FETCH 1:2 BODY.PEEK[] command. The downside is\nthat each mail uses a file descriptor and disk space in\nmail_temp_dir. A good value is likely between 10..100.
obox: Number of mails to download concurrently from object storage.
\nmail_access_groups"
],
"text": "This group is enabled temporarily for privileged operations. Currently,\nthis is used only with the mbox format with INBOX when either its\ninitial creation or dotlocking fails.
\nTypically, this is set to mail to give access to /var/mail when using\nthe mbox format.
You can give Dovecot access to mail group by setting\nmail_privileged_group = mail.
no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"advanced": true,
"text": "Save message with CR+LF line endings?
\nMessages are normally saved with LF line endings.
\nEnabling this makes saving messages less CPU-intensive, especially with the\nsendfile() system call used in Linux and FreeBSD. However, enabling comes at\nthe cost of slightly increased disk I/O, which could decrease the speed in\nsome deployments.
\n" }, "mail_server_admin": { "seealso": [ "imap_metadata"
],
"tags": [
"metadata"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The method for contacting the server administrator.
\nPer the METADATA standard (RFC 5464), this value MUST be a URI (e.g., a\nmailto: or tel: URL), but that requirement is not enforced by Dovecot.
\nThis value is accessible to authenticated users through the\n/shared/admin IMAP METADATA server entry.
Example:
\nmail_server_admin = mailto:admin@example.comimap_metadata"
],
"tags": [
"metadata"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "A comment or note that is associated with the server.
\nThis value is accessible to authenticated users through the\n/shared/comment IMAP METADATA server entry.
no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "This setting determines whether a shared INBOX should be visible as\n"shared/user" or as "shared/user/INBOX" instead.
\n" }, "mail_sort_max_read_count": { "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": "100 for obox; 0 for others",
"text": "The number of slow mail accesses an IMAP SORT can perform before it returns\nfailure to the client.
\nOn failure, the untagged SORT reply is retuned, but it is likely not correct.
\nThe IMAP reply returned to the client is:
\nNO [LIMIT] Requested sort would have taken too long./dev/shm/dovecot",
"tags": [
"lda",
"lmtp"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The directory in which LDA/LMTP will temporarily store incoming message data\nthat is above 128kB in size.
\nMail user variables can be used.
1week",
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "How often Dovecot scans for and deletes stale temporary files. These files\nexist only if Dovecot crashes while saving a message. This is just to make\nsure such temporary files will eventually get deleted to avoid wasting disk\nspace. This scan happens independently for each folder, and it's done at the\ntime the folder is opened.
\nIn order to prevent load spikes, the actual value of the setting is spread\nincreasing it by 0..30%, based on a hash of the username.
\nThe scanning is done only for these mailbox formats:
\ntmp/. The scan is done if tmp/ directory's atime older than this setting..temp.* files having ctime older\nthan 36 hours from dbox-Mails/. The scan is done if the\nlast_temp_file_scan header field in dovecot.index is older than this\nsetting..temp.* files having ctime older than 36 hours\nfrom storage/. The scan is done if storage/ directory's atime is older\nthan this setting.A value of 0 means this scan never occurs.
mail_gid"
],
"values": [
{
"label": "String",
"url": "string"
},
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"default": "vmail",
"text": "This setting indicates the system userid used for accessing mail\nmessages.
\nCan be either a numeric ID or a username.
\nThis can be overridden via the uid userdb field.
no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If Dovecot has been compiled with --enable-experimental-mail-utf8 configure option,\nthis setting can be used to enable the feature. Settings this to yes will\nenable SMTPUTF8 for LMTP and Submission sessions, and UTF8=ACCEPT for IMAP sessions.
unlimited",
"text": "Controls transitioning mail size determination to the background instead of\nsynchronously during the delivery process.
\nAfter this many messages have been opened, the system allows a background\nindexer-worker process to perform quota calculations in the background.
\nThis may happen when mail messages do not have their virtual sizes cached.
\nWhen indexing is occurring in the background, explicit quota size queries\nreturn an internal error and mail deliveries are assumed to succeed.
\nThis setting must not be set to indexer-worker process, or the background\ncalculation isn't finished. The configuration should be like:
\nprotocol !indexer-worker {\n mail_vsize_bg_after_count = 10\n}mail_path"
],
"text": "One of the mailbox formats described at Mailbox Formats.
\nFor an empty value or auto, Dovecot attempts to find the mailboxes\nautomatically.
<specific to mail_driver setting>",
"seealso": [
"Mail User Variables",
"Home Directories for Virtual Users",
"mail_driver"
],
"text": "Path to a directory where the mail is stored. Mail User Variables are commonly used here.
\nUsually the mails should be stored in a sub-directory under the home directory,\nbut not the home directory itself (see\nHome Directories for Virtual Users).
\nThe path must be absolute, not a relative path. Even if relative paths appear\nto work, this usage is deprecated and will likely stop working at some point.
\nMail user variables and ~/ can be used.
mail_home",
"mail_path"
],
"text": "Path to the INBOX mailbox. The path doesn't have to be absolute - it is\nrelative to the mail_path.
WARNING
\nIf your inbox does not reside in some weird location, you should not\nset this setting to any value.
\nSetting it to . or $MAIL_HOME/ will just cause problems.
You almost certainly want to change mail_home or mail_path\nsettings instead.
This is often used with mbox format where INBOX is in /var/mail/ while the\nrest of the folders are under the user's home directory.
This can also be used to specify a different INBOX path with Maildir:
\n mail_driver = maildir\n mail_path = ~/Maildir\n mail_inbox_path = ~/Maildir/.INBOXMail user variables and ~/ can be used.
<same as mail_path setting>",
"seealso": [
"Mail Location: Index Files"
],
"text": "Location of index files.
\nMail user variables and ~/ can be used.
The private index files are used with shared mailboxes to provide private\n(per-user) message flags.
\nMail user variables and ~/ can be used.
<same as mail_index_path setting>",
"text": "Place dovecot.index.cache files to this directory instead of among the\nother index files. This may be used as an optimization to split most index\nfiles to the fastest (smallest) storage while keeping cache files in a slightly\nslower (larger) storage.
Mail user variables and ~/ can be used.
Location for (mailbox-format specific) control files.
\nMail user variables and ~/ can be used.
Specifies the dbox alternate storage path.
\nMail user variables and ~/ can be used.
yes",
"seealso": [
"mail_alt_path"
],
"text": "Whether to perform a sanity check and warn if mail_alt_path changes\nfrom the last access. This can catch accidentally broken configurations before\nusers start reporting missing mails. The downside to this check is some\nadditional disk IO.
fs",
"seealso": [
"dbox",
"Maildir",
"mbox",
"obox plugin"
],
"text": "Directory layout to use.
\n| Value | \nDescription | \n
|---|---|
Maildir++ | \nThe default used by Maildir. | \n
fs | \nThe default used by mbox and dbox. | \n
index | \nThe default used by obox plugin. Uses mailbox GUIDs as the directory names. The mapping between mailbox names and GUIDs exists in dovecot.list.index* files. | \n
INFO
\nThe mail_driver setting provides the default value, that the\nmailbox_list_layout setting can override.
subscriptionsSpecifies the filename used for storing mailbox subscriptions.
\n" }, "mailbox_directory_name": { "tags": [ "mail-location" ], "values": [ { "label": "String", "url": "string" } ], "default": "<specific to mail_driver setting>",
"seealso": [
"mail_driver",
"mailbox_directory_name_legacy"
],
"text": "Specifies the directory name used for mailbox, index, and control directory\npaths. See the individual mailbox format pages for further information. For\nexample dbox-Mails with dbox.
With mbox format this works differently. The user-provided mailbox name is the\ndirectory name, while mailbox_directory_name is the mbox file. For example\nwith mailbox_directory_name=mbox, creating foo/bar mailbox name ends up\ncreating .../foo/bar/mbox file.
The default value changed from yes to no.
This legacy setting is obsolete and destined to be removed. Changing this\nsetting requires migration, see\ndbox: Migrating away from `mailbox_directory_name_legacy`
\n", "version": "Deprecated: 3.2.0" } ], "default": "no",
"seealso": [
"mailbox_directory_name"
],
"text": "If no, mailbox_directory_name applies also to index and control\ndirectories. The only reason to set this to yes is if you already have an\nexisting Dovecot installation with the legacy DIRNAME (rather than\nFULLDIRNAME) parameter and don't want to migrate the data.
specific to the mail_driver setting",
"text": "Specifies directory name under which all mailbox directories are stored. For\nexample mailboxes with dbox.
Specifies the location of volatile files. This includes lock files and\npotentially other files that don't need to exist permanently, so it can point\nto an in-memory filesystem (tmpfs). This is especially useful to avoid\ncreating lock files to NFS or other remote filesystems.
Mail user variables and ~/ can be used.
dovecot.list.index",
"text": "Prefix for the mailbox list index filename. It may also optionally include a\npath (relative to mail_index_path) to place it in a different\ndirectory.
mailbox_list_storage_escape_char"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"default": "The default for imapc storage is ~.",
"text": "Specifies an escape character that is used for broken or otherwise inaccessible\nmailbox names. If mailbox name can't be changed reversibly to UTF-8 and back,\nencode the problematic parts using\n<mailbox_list_visible_escape_char><hex>in the user-visible UTF-8 name. The\nmailbox_list_visible_escape_char itself also has to be encoded the same\nway.
This can be useful with imapc to access mailbox names that aren't\nvalid mUTF-7 charset from remote servers, or if the remote server uses a\ndifferent hierarchy separator and has folder names containing the local\nseparator.
\nINFO
\nIt's possible to use the same character here as for\nmailbox_list_storage_escape_char.
mailbox_list_visible_escape_char"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"default": "The default for imapc storage is %.",
"text": "Specifies an escape character that it used for encoding special characters in\nthe mailbox names in storage. This allows users to use characters in mailboxes\nnames that would otherwise be illegal. For example:
\n. character, since it's used\ninternally as the folder hierarchy separator.~ character at the beginning of the mailbox name is disallowed,\nbecause of the possibility that it gets expanded to user's home directory./ character can't be used on POSIX filesystems, since it's the\ndirectory separator.The characters are escaped to the mailbox name as\n<mailbox_list_storage_escape_char><hex>.
INFO
\nIt's possible to use the same character here as for\nmailbox_list_visible_escape_char.
yes",
"text": "Specifies whether to automatically delete NoSelect mailboxes that have no\nchildren. These mailboxes are sometimes confusing to users. Also if a\nNoSelect mailbox is attempted to be created with CREATE box/, it's\ncreated as selectable mailbox instead.
INFO
\nMaildir layout does not support NoSelect mailboxes, so this\nsetting has no effect with it.
mail_full_filesystem_access"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"default": "yes",
"text": "Specifies whether to disallow mailbox names that might be unsafe to use in\nfilesystems or potentially allow bypassing ACL checks:
\n/ character anywhere in the name (except as a hierarchy separator),\nunless mailbox list isn't on a filesystem (e.g. index, imapc)./ as the first character.~ as the first character (so it's not confused as home directory)./ characters.. or .. names between / characters.mailbox_directory_name between / characters./ characters,mailbox_directory_name is non-empty. This mainly means the\nMaildir new, cur and tmp directories in some configurations.Enabling mail_full_filesystem_access enables also this setting.
no",
"text": "Perform mailbox listing using the mail_index_path directories\ninstead of the mail_path directories. Mainly useful when the index\nfile storage is on a faster storage.
no",
"text": "Store mailbox names on disk using UTF-8 instead of modified UTF-7 (mUTF-7).
\n" }, "mailbox_idle_check_interval": { "default": "30secs",
"tags": [
"imap"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"advanced": true,
"text": "The minimum time between checks for new mail/other changes when a mailbox\nis in the IMAP IDLE state.
\n" }, "mailbox_list_index": { "default": "yes",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Dovecot indexes live at the root of user's mailbox storage, and allows\nquick lookup of mailbox status instead of needing to open all mailbox\nindexes separately.
\nEnabling this optimizes the server reply to IMAP STATUS commands, which are\ncommonly issued by clients. This also needs to be enabled if you wish to\nenable the IMAP NOTIFY extension.
\n" }, "mailbox_list_index_include_inbox": { "default": "no
obox { yes }",
"seealso": [
"mailbox_list_index"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Should INBOX be kept up-to-date in the mailbox list index?
\nDisabled by default as most mailbox accesses will open INBOX anyway.
\n" }, "mailbox_list_index_very_dirty_syncs": { "default": "no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, assume that the mailbox list index is fully updated so that\nstat() will not be run for mailbox files/directories.
\n" }, "maildir_broken_filename_sizes": { "default": "no",
"tags": [
"maildir"
],
"seealso": [
"Maildir"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, do not obtain a mail message's physical size from the\nS=<size> data in the Maildir filename except when recalculating the\nMaildir++ quota.
yes",
"tags": [
"maildir"
],
"seealso": [
"Maildir"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, copying of a message is done with hard links whenever possible.
\nThis makes the performance much better, and it's unlikely to have any side\neffects. The only reason to disable this is if you're using a filesystem\nwhere hard links are slow (e.g. HFS+).
\n" }, "maildir_empty_new": { "default": "no",
"tags": [
"maildir"
],
"seealso": [
"Maildir"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Should mail messages always be moved from the new/ directory to\ncur/, even when the Recent flags aren't being reset?
no",
"tags": [
"maildir"
],
"seealso": [
"Maildir"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, don't include non-directory files in a LIST response that begin\nwith a dot. Thus, if disabled, Dovecot assumes that all the files beginning\nwith a dot in the Maildir are Maildirs.
\nYou shouldn't have any non-directory files beginning with a dot in the\nMaildirs, but if you do you may need to set this to yes, in which case\nDovecot needs to stat() each directory entry, which degrades the\nperformance. Some filesystems (e.g. ext4) provide the\ndirectory/non-directory status for free without having to stat().\nIn those filesystems this setting is ignored.
no",
"tags": [
"maildir"
],
"seealso": [
"Maildir"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled (yes), Dovecot is assumed to be the only MUA that accesses\nMaildir directly, so the cur/ directory is scanned only when its mtime\nchanges unexpectedly or when the mail cannot otherwise be found.
If enabled and another process (or a Dovecot process which doesn't update\nindex files) does changes to cur/ while the mailbox is simultaneously\nbeing modified by Dovecot, Dovecot may not notice those external changes.
It is still safe to deliver new mails to new/ using non-Dovecot\nsoftware (except with mailbox_list_index = yes, changes aren't\nnoticed outside INBOX).
yes",
"seealso": [
"mbox_very_dirty_syncs",
"mbox"
],
"tags": [
"mbox"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Enable optimized mbox syncing?
\nFor larger mbox files, it can take a long time to determine what has\nchanged when the file is altered unexpectedly. Since the change in\nmost cases consists solely of newly appended mail, Dovecot can\noperate more quickly if it starts off by simply reading the new\nmessages, then falls back to reading the entire mbox file if\nsomething elsewhere in it isn't as expected.
\nDovecot assumes that external mbox file changes only mean that new messages\nwere appended to it. Without this setting Dovecot re-reads the whole mbox\nfile whenever it changes. There are various safeguards in place to make this\nsetting safe even when other changes than appends were done to the mbox. The\ndownside to this setting is that external message flag modifications may not\nbe visible immediately.
\nWhen this setting is enabled, Dovecot tries to avoid re-reading the mbox\nevery time something changes. Whenever the mbox changes (i.e. timestamp or\nsize), Dovecot first checks if the mailbox's size changed. If it didn't, it\nmost likely meant that only message flags were changed so it does a full\nmbox read to find it. If the mailbox shrunk, it means that mails were\nexpunged and again Dovecot does a full sync. Usually however the only thing\nbesides Dovecot that modifies the mbox is the LDA which appends new mails\nto the mbox. So if the mbox size was grown, Dovecot first checks if the\nlast known message is still where it was last time. If it is, Dovecot reads\nonly the newly added messages and goes into "dirty mode". As long as\nDovecot is in dirty mode, it can't be certain that mails are where it\nexpects them to be, so whenever accessing some mail, it first verifies that\nit really is the correct mail by finding its X-UID header. If the X-UID\nheader is different, it fallbacks to a full sync to find the mail's correct\nposition. The dirty mode goes away after a full sync. If\nmbox_lazy_writes was enabled and the mail didn't yet\nhave an X-UID header, Dovecot uses the MD5 sum of a couple of headers to\ncompare the mails.
2 mins",
"tags": [
"mbox"
],
"seealso": [
"mbox"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "Override a lockfile after this amount of time if a dot-lock exists but the\nmailbox hasn't been modified in any way.
\n" }, "mbox_lazy_writes": { "default": "yes",
"tags": [
"mbox"
],
"seealso": [
"mbox"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, mbox headers (e.g., metadata updates, such as writing X-UID\nheaders or flag changes) are not written until a full write sync is\nperformed (triggered via IMAP EXPUNGE or CHECK commands and/or when the\nmailbox is closed). mbox rewrites can be costly, so this may avoid a lot of\ndisk writes.
\nEnabling this setting is especially useful with POP3, in which clients\noften delete all mail messages.
\nOne negative consequence of enabling this setting is that the changes\naren't immediately visible to other MUAs.
\nC-Client works the same way. The upside of this is that it reduces writes\nbecause multiple flag updates to same message can be grouped, and sometimes\nthe writes don't have to be done at all if the whole message is expunged.\nThe downside is that other processes don't notice the changes immediately\n(but other Dovecot processes do notice because the changes are in index\nfiles).
\n" }, "mbox_lock_timeout": { "default": "5 mins",
"tags": [
"mbox"
],
"seealso": [
"mbox"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "The maximum time to wait for all locks to be released before aborting.
\n" }, "mbox_md5": { "default": "apop3d",
"tags": [
"mbox"
],
"seealso": [
"pop3_uidl_format",
"mbox"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"values_enum": [
"apop3d",
"all"
],
"advanced": true,
"text": "The mail-header selection algorithm to use for MD5 POP3 UIDLs when the\nsetting pop3_uidl_format = %{md5} is applied.
For mboxes smaller than this size, index files are not written.
\nIf an index file already exists, it gets read but not updated.
\nThe default should not be changed for most installations.
\n" }, "mbox_read_locks": { "default": "fcntl",
"tags": [
"mbox"
],
"seealso": [
"mbox"
],
"values": [
{
"label": "Boolean List",
"url": "Boolean List"
}
],
"values_enum": [
"dotlock",
"dotlock_try",
"fcntl",
"flock",
"lockf"
],
"text": "Specify which locking method(s) to use for locking the mbox files during\nreading.
\nDescriptions of the locking methods can be found at mbox locking.
\n" }, "mbox_very_dirty_syncs": { "default": "no",
"tags": [
"mbox"
],
"seealso": [
"mbox_dirty_syncs",
"mbox"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, Dovecot performs the optimizations from\nmbox_dirty_syncs also for the IMAP SELECT, EXAMINE,\nEXPUNGE, and CHECK commands.
If set, this option overrides mbox_dirty_syncs.
dotlock fcntl",
"tags": [
"mbox"
],
"seealso": [
"mbox"
],
"values": [
{
"label": "Boolean List",
"url": "Boolean List"
}
],
"values_enum": [
"dotlock",
"dotlock_try",
"fcntl",
"flock",
"lockf"
],
"text": "Specify which locking method(s) to use for locking the mbox files during\nwriting.
\nDescriptions of the locking methods can be found at mbox locking.
\n" }, "mdbox_preallocate_space": { "default": "no",
"tags": [
"mdbox"
],
"seealso": [
"mdbox_rotate_size",
"mdbox"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "mdbox only: If enabled, preallocate space for newly created files.
\nIn creation of new mdbox files, their size is immediately\npreallocated as mdbox_rotate_size.
This setting currently works only in Linux with certain filesystems (ext4\nand xfs).
\n" }, "mdbox_rotate_interval": { "default": 0, "tags": [ "mdbox" ], "seealso": [ "mdbox" ], "values": [ { "label": "Size", "url": "size", "default_required": true } ], "text": "mdbox only: The maximum age the dbox file may reach before it's rotated.
\n0 means there is no age-based rotation.
10M",
"tags": [
"mdbox"
],
"seealso": [
"mdbox"
],
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"text": "mdbox only: The maximum size the dbox file may reach before it is rotated.
\n" }, "mmap_disable": { "default": "no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Disable mmap() usage?
\nThis must be set to yes if you store indexes to shared filesystems\n(i.e., if you use NFS or a clustered filesystem).
Creates a new namespace to the list of namespaces. The filter name refers to\nthe namespace_name setting.
Example:
\nnamespace foo {\n [...]\n}Name of the namespace. This is used only in configurations - it's not visible\nto user. The namespace filter refers to this setting.
Refers to an alias namespace's namespace_name.
If multiple namespaces point to the same location, they should be marked as\naliases against one primary namespace. This avoids duplicating work for\nsome commands (listing the same mailbox multiple times).
\nMail user variables can be used.
Note: Alias namespaces often have hidden=yes and list=no so\nthey are not visible unless clients have specifically configured\nthem, and they're typically used when migrating to a different\nnamespace prefix for existing users.
Example:
\nnamespace inbox {\n prefix =\n # ...\n}\nnamespace alias {\n prefix = INBOX/\n alias_for = inbox\n}no",
"tags": [
"namespace"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If yes, namespace is disabled and cannot be accessed by user in any way.
Useful when returned by a userdb lookup to easily configure per-user\nnamespaces.
\n" }, "namespace_hidden": { "default": "no",
"tags": [
"namespace"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If yes, namespace will be hidden from IMAP NAMESPACE (RFC 2342)\ncommand.
no",
"tags": [
"namespace"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If namespace's storage initialization fails, by default the entire session will\nfail to start. If this is set, this namespace will be ignored instead.
\n" }, "namespace_inbox": { "default": "no",
"tags": [
"namespace"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If yes, this namespace will be considered the one holding the INBOX\nfolder.
There can be only one namespace defined like this.
\n" }, "namespace_list": { "default": "yes",
"tags": [
"namespace"
],
"seealso": [
"namespace_hidden"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"yes",
"no",
"children"
],
"text": "Include this namespace in LIST output when listing its parent's folders.
\nOptions:
\n| Value | \nDescription | \n
|---|---|
children | \nNamespace prefix list listed only if it has child mailboxes. | \n
no | \nNamespace and mailboxes not listed unless listing requests explicitly mailboxes under the namespace prefix. | \n
yes | \nNamespace and mailboxes are always listed. | \n
It is still possible to list the namespace's folders by explicitly asking\nfor them. For example, if this setting is no, using LIST "" * with\nnamespace prefix "lazy-expunge/" won't list it, but using LIST "" lazy-expunge/* lists all folders under it.
Sets display order in IMAP NAMESPACE (RFC 2342) command.
\nNamespaces are automatically numbered if this setting does not exist.
\n" }, "namespace_prefix": { "tags": [ "namespace" ], "values": [ { "label": "String", "url": "string" } ], "text": "Specifies prefix for namespace.
\nINFO
\nMust end with namespace_separator.
Mail user variables can be used.
Example:
\nnamespace shared {\n prefix = Shared/\n separator = /\n}"." for Maildir; "/" for other mbox formats",
"tags": [
"namespace"
],
"seealso": [
"Namespaces: Hierarchy Separators"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "Specifies the hierarchy separator for the namespace.
\nThe separator is a single character, which can't then otherwise be used in\nfolder names.
\nThe commonly used separators are . and /, but other separators can\nbe used as well. For example ^ is less likely to be found in normal\nfolder names.
Recommended value is to leave it empty and accept the default value.
\n" }, "namespace_subscriptions": { "default": "yes",
"tags": [
"namespace"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Whether subscriptions are stored in this namespace.
\nThis is usually no for shared namespaces so that the shared folders'\nsubscriptions are stored in the user's primary subscriptions file. If\nno, the subscriptions are stored in the first parent namespace (based\non the prefix) that has this setting enabled.
Example: If this setting is no for a namespace with\nprefix=foo/bar/, Dovecot first sees if there's a prefix=foo/\nnamespace with subscriptions=yes and then a namespace with an empty\nprefix. If neither is found, an error is given.
private",
"tags": [
"namespace"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"private",
"shared",
"public"
],
"text": "The namespace type. One of:
\n| Type | \nDescription | \n
|---|---|
public | \nContains public shared mailboxes. | \n
private | \nTypically contains only user's own private mailboxes. | \n
shared | \nContains other users' user shared mailboxes. | \n
Create a new mailbox to the list of mailboxes. The filter name refers to the\nmailbox_name setting.
The mailbox name can contain ? and * wildcards. Settings are applied\nfor all matching mailbox filters.
TIP
\nIf the mailbox name has spaces, you can put it into quotes:
\nmailbox \"Test Mailbox\" {\n # ...\n}TIP
\nIt's possible to rename the mailbox in userdb. For example:
\nmailbox junk {\n name = Junk\n special_use = \\Junk\n}The userdb can then return mailbox/junk/name=Spam to rename the mailbox\nfor a specific user.
Name of the mailbox being configured. The mailbox filter name\nrefers to this setting.
no",
"tags": [
"mailbox"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"create",
"no",
"subscribe"
],
"text": "Autocreate and/or subscribe to the mailbox?
\n| Value | \nDescription | \n
|---|---|
create | \nAutocreate but don't autosubscribe | \n
no | \nDon't autocreate or autosubscribe | \n
subscribe | \nAutocreate and autosubscribe | \n
Autocreated mailboxes are created lazily to disk only when accessed for\nthe first time. The autosubscribed mailboxes aren't written to\nsubscriptions file, unless SUBSCRIBE command is explicitly used for them.
\n" }, "mailbox_autoexpunge": { "default": 0, "seealso": [ "mailbox_autoexpunge_max_mails"
],
"tags": [
"mailbox"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "Expunge all mails in this mailbox whose saved-timestamp is older than this\nvalue. 0 means autoexpunging is disabled.
For IMAP and POP3 this happens after the client is already disconnected.
\nFor LMTP this happens when the user's mail delivery is finished. Note that\nin case there are multiple recipients, autoexpunging is done only for some\nof the recipients to prevent delays with the mail delivery: The last\nrecipient user is autoexpunged first. Next, the first recipient user is\nautoexpunged (because the first user's mail was kept open in case it could\nbe directly copied to the other users). None of the middle recipient users\nare autoexpunged.
\nmailbox_list_index = yes is highly recommended when\nusing this setting, as it avoids actually opening the mailbox to see if\nanything needs to be expunged.
mail_always_cache_fields = date.save is also\nrecommended when using this setting with sdbox or Maildir,\nas it avoids using stat() to find out the mail's saved-timestamp. With\nmdbox format this isn't necessary, since the saved-timestamp is\nalways available.
Mails are autoexpunged until mail count is at or below this number of messages.
\nOnce this threshold has been reached, mailbox_autoexpunge\nprocessing is done.
Using non-standard special-use flags will result in a warning message at\nstartup.
\n", "version": "Changed: 3.1.0" } ], "values": [ { "label": "Boolean List", "url": "Boolean List" } ], "seealso": [ "Namespaces" ], "text": "List of SPECIAL-USE (RFC 6154) flags to broadcast for the mailbox.
\nThere are no validity checks, so you could specify anything you want here,\nbut it's not a good idea to use other than the standard ones specified in\nthe RFC.
\n" }, "metric": { "tags": [ "metrics" ], "values": [ { "label": "Named List Filter", "url": "Named List Filter" } ], "seealso": [ "metric_name"
],
"text": "Creates a new metric. The filter name refers to the metric_name\nsetting.
Name of the metric. It is visible in statistics outputs. The metric\nfilter name refers to this setting.
All listed fields are exported to OpenMetrics as well.
\n", "version": "Changed: 3.1.0" } ], "tags": [ "metrics" ], "values": [ { "label": "Boolean List", "url": "Boolean List" } ], "text": "A list of fields included in the metric. All events have a default duration\nfield that does not need to be listed explicitly.
Creates a new group_by for dynamically generating\nsub-metrics based on the specified field's values. The filter name refers to\nthe metric_group_by_field.
Generate sub-metrics based on this event field name. The\nmetric_group_by filter name refers to this setting.
Configures metric_group_by_method_method = the aggregation method for\nthe metric_group_by. Only a single method can be specified for\na group_by. The filter name refers to the\nmetric_group_by_method_method.
discrete",
"seealso": [
"Statistics: Group By"
],
"text": "Configures the aggregation method for the\nmetric_group_by. The metric_group_by_method filter name\nrefers to this setting.
Configures a modifier string for values grouped by the\ndiscrete method.\n%variables and their functions can be used:
\n%{value}%{user | domain}user@domain format, this contains the domain\ntext. Otherwise empty.metric_group_by_method_exponential_max_magnitude",
"metric_group_by_method_exponential_base"
],
"text": "Configures the minimum magnitude for values grouped by the\nexponential method.
\n" }, "metric_group_by_method_exponential_max_magnitude": { "tags": [ "metrics" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": 0, "seealso": [ "Statistics: Group By", "metric_group_by_method_exponential_min_magnitude",
"metric_group_by_method_exponential_base"
],
"text": "Configures the maximum magnitude for values grouped by the\nexponential method.
\n" }, "metric_group_by_method_exponential_base": { "tags": [ "metrics" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": "10",
"seealso": [
"Statistics: Group By",
"metric_group_by_method_exponential_min_magnitude",
"metric_group_by_method_exponential_max_magnitude"
],
"text": "Configures the base for values grouped by the\nexponential method. Only 2 and\n10 are supported.
metric_group_by_method_linear_max",
"metric_group_by_method_linear_step"
],
"text": "Configures the minimum for values grouped by the\nlinear method.
\n" }, "metric_group_by_method_linear_max": { "tags": [ "metrics" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": 0, "seealso": [ "Statistics: Group By", "metric_group_by_method_linear_min",
"metric_group_by_method_linear_step"
],
"text": "Configures the maximum for values grouped by the\nlinear method.
\n" }, "metric_group_by_method_linear_step": { "tags": [ "metrics" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": 0, "seealso": [ "Statistics: Group By", "metric_group_by_method_linear_min",
"metric_group_by_method_linear_max"
],
"text": "Configures the step for values grouped by the\nlinear method.
\n" }, "metric_filter": { "tags": [ "metrics" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "Metric Filters" ], "text": "Event filter that matches the events belonging to\nthis metric.
\n" }, "metric_exporter": { "tags": [ "metrics" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "Event Export", "event_exporter_name"
],
"text": "Export events matching the filter with this\nevent exporter. Refers to the\nevent_exporter_name setting. If empty, the events are used only for\nstatistics, and no exporting is done.
name hostname timestamps categories fields",
"text": "Specifies which parts of the event are exported to the serialized event:
\n| Values | \nDescription | \n
|---|---|
name | \nThe name of the event. | \n
hostname | \nThe name of the host generating this event. | \n
timestamps | \nThe event start and end timestamps. | \n
categories | \nA set of categories associated with this event. | \n
fields | \nThe fields associated with this event. The fields that will be exported are defined by the metric_fields setting. | \n
For example:
\nmetric example {\n exporter_include = name hostname timestamps\n}includes just the 3 specified parts, while
\nmetric another_example {\n exporter_include =\n}includes nothing and the exported event will be empty (i.e. {} in JSON).
Human-readable description of the metric. This is included in the HELP text\nsent to OpenMetrics.
\n" }, "oauth2": { "tags": [ "oauth2" ], "values": [ { "label": "Named Filter", "url": "Named Filter", "no_default": true } ], "seealso": [ "OAuth2 Authentication Database" ], "text": "Filter for oauth2 specific settings.
\n", "no_default": true }, "oauth2_token_expire_grace": { "tags": [ "oauth2" ], "values": [ { "label": "Time", "url": "time", "default_required": true } ], "default": "1min",
"text": "Specifies how long after token expiration it is still accepted. It shouldn't be\n0 because clocks aren't exact, and network can add some delays.
\n" }, "oauth2_tokeninfo_url": { "tags": [ "oauth2" ], "values": [ { "label": "String", "url": "string" } ], "text": "URL for verifying token validity. Token is appended to the URL.
\nExample:
\noauth2_tokeninfo_url = http://endpoint/oauth/tokeninfo?access_token=URL for getting more information about token.
\n" }, "oauth2_introspection_mode": { "tags": [ "oauth2" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "oauth2_introspection_url",
"oauth2_tokeninfo_url",
"oauth2_force_introspection"
],
"text": "To enable oauth2 you must choose how to do token introspection.\noauth2_introspection_url is not required if\noauth2_tokeninfo_url already provides all the necessary fields, or\nif you are using local validation.
You can force introspection with oauth2_force_introspection, if you\nneed to it every time.
With local validation, oauth2_tokeninfo_url is also ignored.
| Value | \nDescription | \n
|---|---|
auth | \nGET request with Bearer authentication. | \n
get | \nGET request with token appended to URL. | \n
post | \nPOST request with token=bearer_token as content. | \n
local | \nAttempt to locally validate and decode JWT token. | \n
no",
"text": "Force introspection even if tokeninfo contains wanted fields. Set this to\nyes if you are using oauth2_active_attribute.
dict"
],
"text": "A dictionary for fetching validation keys.
\nExample:
\noauth2_local_validation {\n dict fs {\n fs posix {\n prefix = /tmp/keys/\n }\n }\n}A list of valid scopes.
\n" }, "oauth2_username_attribute": { "tags": [ "oauth2" ], "values": [ { "label": "String", "url": "string" } ], "default": "email",
"text": "Username attribute in response.
\n" }, "oauth2_username_validation_format": { "tags": [ "oauth2" ], "values": [ { "label": "String", "url": "string" } ], "default": "%{user}",
"seealso": [
"oauth2_username_attribute"
],
"text": "Normalization for oauth2 provided username, this setting is normally not\nneeded. You only need this if the username that comes from authentication will\nnot otherwise match with oauth2_username_attribute value.
Attribute name for (optional) checking whether account is disabled.
\n" }, "oauth2_active_value": { "tags": [ "oauth2" ], "values": [ { "label": "String", "url": "string" } ], "text": "Expected value in active_attribute. (empty = require present, but anything\ngoes)
Valid issuer(s) for the token.
\n" }, "oauth2_openid_configuration_url": { "tags": [ "oauth2" ], "values": [ { "label": "String", "url": "string" } ], "text": "URL to RFC 7628 OpenID Provider Configuration Information schema.
\n" }, "oauth2_fields": { "tags": [ "oauth2" ], "values": [ { "label": "String List", "url": "String List" } ], "text": "Key-value fields to include in successful authentication.
\n" }, "oauth2_send_auth_headers": { "tags": [ "oauth2" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"text": "Whether to send special headers about authentication to remote server. If you\nenable this, the following headers will be sent:
\nX-Dovecot-Auth-ProtocolX-Dovecot-Auth-LocalX-Dovecot-Auth-Remoteno",
"seealso": [
"passdb_use_worker"
],
"text": "Use worker process to verify token. This setting only applies to mechanism. If\nyou want to use worker with passdb oauth2, use\npassdb_use_worker instead. Worker processes are mostly useful for\ndistributing local token validation to multiple CPUs.
passdb_driver"
],
"seealso": [
"passdb",
"passdb_name",
"passdb_driver"
],
"text": "Creates a new passdb. The filter name refers to the\npassdb_name setting.
passdb",
"passdb_driver"
],
"text": "Name of the passdb. The passdb filter name refers to this setting.\nIf the passdb_driver setting is empty, the passdb_name is used\nas the driver. This allows doing e.g.:
passdb passwd-file {\n passwd_file_path = /etc/dovecot/passwdpassdb_name",
"passdb",
"Authentication Databases"
],
"text": "The driver used for this password database. If empty, defaults to\npassdb_name.
Passdb fields (and passdb: Extra Fields). The values can contain\n%variables. All %variables used here reflect\nthe state after the current passdb lookup, and can refer to fields returned\nby previous passdb lookups. Depending on the passdb driver, it can also refer\nto variable fields returned by it (e.g. %{ldap:fieldName}).
INFO
\nThe LDAP driver provides additional specific variables,\nsee LDAP authentication for more details.
\nFor example:
\npassdb ldap {\n fields {\n user = %{ldap:userId}\n proxy = yes\n host = %{ldap:proxyHost}\n }\n}yespassdb ldap the default is no.",
"seealso": [
"passdb_fields"
],
"text": "If yes, import all fields returned by the passdb lookup. If no, require\npassdb_fields to explicitly add wanted fields.
CRYPTpassdb_static: PLAIN",
"changed": [
{
"text": "Changed from PLAIN to CRYPT.
The scheme that passwords are in the passdb, unless overridden by the passdb\nentry (typically by prefixing with {SCHEME}).
Skip the passdb if non-empty and the current auth mechanism is not listed here.\nIf the value contains lookup, it matches for non-authenticating passdb\nlookups (e.g. lmtp/doveadm lookups).
Example:
\npassdb passwd-file {\n driver = passwd-file\n mechanisms_filter = PLAIN LOGIN\n # ...\n}Skip the passdb if non-empty and the username doesn't match the filter. This is\nmainly used to assign specific passdbs to specific domains. Space or\ncomma-separated list of username filters that can have * or ?\nwildcards. If any of the filters matches, the filter succeeds. Define negative\nmatches by preceding !. If any of the negative filter matches, the filter\nwon't succeed.
Example:
\n*@example.com *@example2.com !user@example.comany@example.comuser@example2.comuser@example.comnever",
"text": "Configures when passdbs should be skipped:
\n| Value | \nDescription | \n
|---|---|
never | \nNever skip over this passdb. | \n
authenticated | \nSkip if an earlier passdb already authenticated the user successfully. | \n
unauthenticated | \nSkip if user hasn't yet been successfully authenticated by the previous passdbs. | \n
The static password to be used for all users authenticating using this passdb.
\n" }, "passdb_use_worker": { "tags": [ "passdb" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "noIf yes, run the passdb lookup in auth-worker process instead of the main\nauth process. This setting is only used by some of the passdb drivers.
return-ok",
"seealso": [
"passdb: Result Values"
],
"text": "What to do after the passdb authentication succeeded. Possible values and their\nmeaning are described fully at passdb: Result Values.
\nThis is commonly used together with master passdb to specify that even after a\nsuccessful master user authentication, the authentication should continue to\nthe actual non-master passdb to lookup the user.
\n" }, "passdb_result_failure": { "tags": [ "passdb" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "return-ok", "return", "return-fail", "continue", "continue-ok", "continue-fail" ], "default": "continue",
"seealso": [
"passdb: Result Values"
],
"text": "What to do after the passdb authentication failed. Possible values and their\nmeaning are described fully at passdb: Result Values.
\n" }, "passdb_result_internalfail": { "tags": [ "passdb" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "return-ok", "return", "return-fail", "continue", "continue-ok", "continue-fail" ], "default": "continue",
"seealso": [
"passdb: Result Values"
],
"text": "What to do after the passdb authentication failed due to an internal error.\nPossible values and their meaning are described fully at\npassdb: Result Values. If any of the passdbs had an internal failure\nand the final passdb also returns continue the authentication will fail\nwith internal error.
no",
"text": "If yes and the user is found from the denied user database the\nauthentication will fail.
no",
"text": "If yes and the user is found from the Master Users the user\nis allowed to login as other users.
SQL query to lookup the passdb fields (password and other extra fields).
SQL query to update the password. Currently used only by the OTP auth\nmechanism.
100",
"seealso": [
"service_restart_request_count"
],
"text": "Number of requests a auth-worker process handles for passdb pam before it dies.\nThis configures similar behaviour as the\nservice_restart_request_count setting but it limits only the number\nof pam passdb requests, not all requests to be handled by an auth-worker.
no",
"text": "Replace the default Authentication failed reply with PAM's failure.
dovecot",
"text": "The PAM service name to be used with the pam passdb.
\n" }, "passdb_pam_setcred": { "tags": [ "passdb", "passdb-pam" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"text": "Make Dovecot create PAM credentials. The credentials are never deleted, which\nmay cause problems with some PAM plugins.
\n" }, "passdb_pam_session": { "tags": [ "passdb", "passdb-pam" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"text": "Make Dovecot open a PAM session and close it immediately.
\n" }, "passwd_file_path": { "tags": [ "passwd-file" ], "values": [ { "label": "String", "url": "string" } ], "text": "Path to the passwd-file.
\n" }, "pop3_client_workarounds": { "tags": [ "pop3" ], "values": [ { "label": "Boolean List", "url": "Boolean List" } ], "text": "Workarounds for various POP3 client bugs can be enabled here.
\nThe following values are currently supported:
\noe-ns-eohoutlook-no-nuls0x80 character.default",
"tags": [
"pop3"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"default",
"flag",
"expunge"
],
"text": "Action to perform in POP3 when mails are deleted and\npop3_deleted_flag is enabled.
pop3_delete_type"
],
"tags": [
"pop3"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "Change POP3 behavior so a user cannot permanently delete messages via POP3.
\nInstead, the messages are hidden from POP3 sessions by setting an IMAP\nflag, which Dovecot will filter out in future listings.
\nTo enable this behavior, enter the name of the IMAP keyword to use.
\nINFO
\nThis keyword will visible on IMAP clients for the message.
\nExample:
\npop3_deleted_flag = $POP3Deletedno",
"tags": [
"pop3"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Enable support for the POP3 LAST command.
\nWhile this command has been removed from newer POP3 specs, some clients\nstill attempt to use it. Enabling this causes the RSET command to clear all\n\\Seen flags that messages may have.
\n" }, "pop3_fast_size_lookups": { "default": "no",
"tags": [
"pop3"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, use the virtual message size of the message for POP3 replies if\navailable.
\nPOP3 requires message sizes to be listed as if they contain CR+LF\nline breaks; however, many POP3 servers instead return the sizes with\npure line feeds (LFs), for the sake of speed.
\nIf enabled, use the virtual message size if available, before\nfalling back to the incorrect, physical size (used by many POP3\nservers) if judging the correct size would have required opening the\nmessage to determine.
\n" }, "pop3_lock_session": { "default": "no",
"tags": [
"pop3"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, only one POP3 session may exist for any single user.
\n" }, "pop3_logout_format": { "default": "top=%{top_count}/%{top_bytes}, retr=%{retr_count}/%{retr_bytes}, del=%{deleted_count}/%{deleted_bytes}, size=%{message_bytes}",
"tags": [
"pop3"
],
"values": [
{
"label": "String Without Variables",
"url": "String without variables"
}
],
"text": "The string to display to the client on POP3 logout (informational only).
\nVariables available (in addition to Mail user variables):
| Variable Name | \nDescription | \n
|---|---|
%{input} | \nBytes read from the client | \n
%{output} | \nBytes sent to the client | \n
%{top_count} | \nNumber of TOP commands run | \n
%{top_bytes} | \nBytes sent to the client because of TOP commands | \n
%{retr_count} | \nNumber of RETR commands run | \n
%{retr_bytes} | \nBytes sent to the client because of RETR commands | \n
%{deleted_count} | \nNumber of deleted messages | \n
%{deleted_bytes} | \nNumber of bytes in deleted messages | \n
%{message_count} | \nNumber of messages before deletion | \n
%{message_bytes} | \nMailbox size, in bytes, before deletion | \n
%{uidl_change} | \nThe old and the new UIDL hash (which can be useful for identifying unexpected changes in UIDLs) | \n
no",
"tags": [
"pop3"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, do not attempt to mark mail messages as seen or non-recent when\na POP3 session is involved.
\n" }, "pop3_reuse_xuidl": { "default": "no",
"tags": [
"pop3"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, and the mail message has an X-UIDL header, use this as the\nmail's UIDL.
\n" }, "pop3_save_uidl": { "default": "no",
"tags": [
"maildir",
"pop3"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Maildir only: If enabled, allow permanent saving of UIDLs sent to\nPOP3 clients so that changes to pop3_uidl_format don't cause\nfuture changes to the corresponding UIDLs.
allow",
"tags": [
"pop3"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"allow",
"rename"
],
"text": "How to handle any duplicate POP3 UIDLs that may exist.
\nOptions:
\nallowrename%{uid | hex(8)}%{uidvalidity | hex(8)}",
"tags": [
"pop3"
],
"values": [
{
"label": "String Without Variables",
"url": "String without variables"
}
],
"text": "The POP3 unique mail identifier (UIDL) format to use.
\nThe following variables can be used in combination with the\nstandard variable filters (e.g., %{filename | upper} supplies the filename\nin uppercase) and with Global variables:
| Variable Name | \nDescription | \n
|---|---|
%{uidvalidity} | \nMailbox's IMAP UIDVALIDITY value | \n
%{uid} | \nIMAP UID associated with the message | \n
%{md5} | \nMD5 sum of the mailbox headers in hex (mbox only) | \n
%{filename} | \nFilename (Maildir only) | \n
%{guid} | \nDovecot GUID for the message | \n
List of features, optimizations, and workarounds that can be enabled.
\nWorkarounds:
\nno-pipeliningThe remote POP3 host to connect to.
\n" }, "pop3c_master_user": { "tags": [ "pop3c" ], "seealso": [ "pop3c_password",
"pop3c_user"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The master username to authenticate as on the remote POP3 host.
\nTo authenticate as a master user but use a separate login user, the\nfollowing configuration should be employed, where the credentials are\nrepresented by masteruser and masteruser-secret:
\npop3c_user = %{user}\npop3c_master_user = masteruser\npop3c_password = masteruser-secretMail user variables can be used.
pop3c_master_user",
"pop3c_user"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The authentication password for the remote POP3 server.
\nIf using master users, this setting will be the password of the master user.
\n" }, "pop3c_port": { "default": "110",
"tags": [
"pop3c"
],
"values": [
{
"label": "Port Number",
"url": "Port Number",
"default_required": true
}
],
"text": "The port on the remote POP3 host to connect to.
\n" }, "pop3c_quick_received_date": { "default": "no",
"tags": [
"pop3c"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, pop3c doesn't require calling TOP for each message in order to\nget the metadata.
\n" }, "pop3c_rawlog_dir": { "seealso": [ "rawlog" ], "tags": [ "pop3c" ], "values": [ { "label": "String", "url": "string" } ], "text": "Log all POP3 traffic input/output to this directory.
\n" }, "pop3c_ssl": { "default": "no",
"tags": [
"pop3c"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"no",
"pop3s",
"starttls"
],
"text": "Use TLS to connect to the remote POP3 server.
\n| Value | \nDescription | \n
|---|---|
no | \nNo TLS | \n
pop3s | \nExplicitly connect to remote POP3 port using TLS | \n
starttls | \nUse POP3 STARTTLS command to switch to TLS connection | \n
yes",
"tags": [
"pop3c"
],
"seealso": [
"pop3c_ssl"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Verify remote POP3 TLS certificate?
\nVerification may be disabled during testing, but should be enabled during\nproduction use.
\nOnly used if pop3c_ssl is enabled.
%{user}",
"tags": [
"pop3c"
],
"seealso": [
"pop3c_master_user",
"pop3c_password"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The user identity to be used for performing authentication to the source\nPOP3 server.
\nMail user variables can be used.
postmaster@%{user|domain|default(hostname)}",
"tags": [
"lda",
"lmtp"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The From address from which email rejection messages (bounces) are sent.
\nAs used here, %{user | domain} expands to the domain of the local user.\nOther Mail user variables can be used as well.
Filter to specify which events shutdown the process after finishing the\ncurrent connections. This is mainly intended to save memory by preventing\nlong-running imap processes that use a lot of memory (due to libc not freeing\nall of it to the OS). The syntax of the filter is described in\nGlobal Metric Filters.
\nFor example:
\nprocess_shutdown_filter = \"event=mail_user_session_finished AND rss > 20MB\"For imap, pop3 and submission: event=mail_user_session_finished AND rss > 20MB"
},
"protocols": {
"default": "",
"values": [
{
"label": "Boolean List",
"url": "Boolean List"
}
],
"text": "The list of protocols to enable. By default all protocols are disabled.
\nFor example:
\n# Only IMAP protocol enabled:\nprotocols = imap\n\n# Enable also LMTP protocol (on top of IMAP):\nprotocols {\n lmtp = yes\n}no",
"seealso": [
"quota plugin"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, return a temporary failure to the sending server if quota is\nexceeded. This allows the message to potentially be delivered later if the\naccount moves under the quota limit at the time of redelivery.
\nIf disabled, the message is bounced with a permanent error returned to the\nsending server.
\n" }, "rawlog_dir": { "seealso": [ "rawlog" ], "values": [ { "label": "String", "url": "string" } ], "text": "Directory where to create *.in and *.out rawlog files, one per TCP\nconnection. The directory must already exist and be writable by the process.\nNo error is logged if the directory doesn't exist.
Mail user variables can be used.
Example:
\nprotocol imap {\n rawlog_dir = /tmp/rawlog/%{user}\n # if you want to put files into user's homedir, use this, do not use ~\n #rawlog_dir = %{home}/rawlog\n}+",
"tags": [
"sieve"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The separator between the :user and :detail address parts.
\n" }, "rejection_reason": { "default": "Your message to <%{to}> was automatically rejected:%{literal('\\r\\n')}%{reason}",
"tags": [
"lda",
"lmtp"
],
"values": [
{
"label": "String Without Variables",
"url": "String without variables"
}
],
"text": "A human-readable message for the recipients of bounce messages.
\nThe following variables are allowed, including Global variables:
| Variable Name | \nDescription | \n
|---|---|
%{reason} | \nReason for rejection | \n
%{subject} | \nOriginal subject line | \n
%{to} | \nRecipient address | \n
The variable values are obtained from the mail being delivered or the\ndelivery protocol.
\n" }, "rejection_subject": { "default": "Rejected: %{subject}",
"seealso": [
"rejection_reason"
],
"tags": [
"lda",
"lmtp"
],
"values": [
{
"label": "String Without Variables",
"url": "String without variables"
}
],
"text": "The Subject: header to use for bounce messages.
\nSee rejection_reason for the list of variables that can be used.
/usr/sbin/sendmail",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The binary to use for sending email.
\nUsed only if submission_host is not set.
service_name"
],
"text": "Creates a new service to the list of services. The filter name refers to the\nservice_name setting.
service"
],
"text": "Name of the service. The service filter name refers to this\nsetting.
protocols"
],
"text": "If non-empty, this service is enabled only when the protocol name is listed in\nprotocols setting.
service_process_limit"
],
"text": "Type of this service:
\n| Value | \nDescription | \n
|---|---|
<empty> | \nThe default. | \n
login | \nUsed by login services. The login processes have "all processes full" notification fd. It's used by the processes to figure out when no more client connections can be accepted because client and process limits have been reached. The login processes can then kill some of their oldest connections that haven't logged in yet. | \n
worker | \nUsed by various worker services. It's normal for worker processes to fill up to service_process_limit, and there shouldn't be a warning logged about it. | \n
startup | \nCreates one process at startup. | \n
logconfiganvil | \nTreated specially by these specific services. | \n
base_dir"
],
"text": "The binary path to execute and its parameters. If the path doesn't begin with\n/, it's relative to base_dir.
default_login_user",
"default_internal_user"
],
"text": "UNIX user (UID) which runs this process. default_login_user should\nbe used for type=login processes and default_internal_user\nshould be used for other processes that don't require root privileges.
The primary UNIX group (GID) which runs this process.
\n" }, "service_privileged_group": { "tags": [ "service" ], "advanced": true, "values": [ { "label": "String", "url": "string" } ], "seealso": [ "mail_privileged_group"
],
"text": "Secondary UNIX group - which is disabled by default - but can be enabled by the\nprocess. mail_privileged_group setting is a more user friendly way\nto use this setting for mail processes.
mail_access_groups"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "Secondary UNIX groups that this process belongs to.
\nWARNING
\nThis may be dangerous to use for the same reason as\nmail_access_groups.
base_dir"
],
"text": "The processes are chrooted to this directory at startup. Relative to\nbase_dir.
no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Drop all privileges after forking, but before executing the binary. This is\nmainly useful for dumping core files on non-Linux OSes, since the processes are\nno longer in "setuid" mode. This setting can't be used with non-empty chroot.
\n" }, "service_process_min_avail": { "tags": [ "service" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": 0, "seealso": [ "service_client_limit",
"service_restart_request_count"
],
"text": "Minimum number of processes that always should be available to accept more\nclient connections.
\nNote that if service_client_limit = 1, this means there are always\nthat many processes that are not doing anything. When a new process launches,\none of the idling processes will accept the connection and a new idling process\nis launched.
service_restart_request_count = 1 processes this decreases the\nlatency for handling new connections, because there's no need to wait for\nprocesses to fork. This is usually not necessary to to be set. Large\nservice_process_min_avail values might be useful in some special\ncases, like if there are a lot of POP3 users logging in exactly at the same\ntime to check mails.service_restart_request_count to a value !=1 and\nservice_client_limit to a value >1 processes it could be set\nto the number of CPU cores (you can use %{system:cpu_count}) on the\nsystem to balance the load among them. This is commonly used with *-login\nprocesses.service_restart_request_count with a value of !=1 and\nservice_client_limit = 1 processes it is likely not useful to use\nthis, because generally there are already some idling processes waiting to\naccept new connections. However, it's not harmful either, since\nservice_process_min_avail includes the existing idling processes\nwhen counting how many new idling processes are needed.default_process_limit",
"text": "The maximum number of processes that may exist for this service.
\n" }, "service_client_limit": { "tags": [ "service" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": "default_client_limit",
"text": "Maximum number of simultaneous client connections per process. Once this number\nof connections is received, the next incoming connection will prompt Dovecot to\nspawn another process.
\n" }, "service_restart_request_count": { "tags": [ "service" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": "unlimited",
"text": "Number of client connections to handle until the process kills itself. Use\nunlimited to keep the process alive. 1 means only a single connection\nis handled until the process is stopped - this is the most secure choice since\nthere's no way for one connection's state to leak to the next one. For better\nperformance this can be set higher, but ideally not unlimited since more\ncomplex services can have small memory leaks and/or memory fragmentation and\nthe process should get restarted eventually. For example 100 or 1000\ncan be good values.
default_idle_kill_interval",
"text": "Time interval between killing extra idling processes. During the interval the\nmaster process tracks the lowest number of idling processes for the service.\nAfterwards it sends SIGINT notification to that many idling processes. If\nthe processes are still idling when receiving the signal, they shut down\nthemselves.
Using infinite disables the idle-killing.
default_vsz_limit",
"text": "Limit the process's address space (both RLIMIT_DATA and RLIMIT_AS if\navailable). When the space is reached, some memory allocations may start\nfailing with "Out of memory", or the kernel may kill the process with signal 9.\nThis setting is mainly intended to prevent memory leaks from eating up all of\nthe memory, but there can be also legitimate reasons why the process reaches\nthis limit. For example a huge mailbox may not be accessed if this limit is too\nlow. Use unlimited to disable this entirely.
yes",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, all processes are killed when the master process is shutdown.
\nOtherwise, existing processes will continue to run. This may be useful to not\ninterrupt earlier sessions, but may not be desirable if restarting Dovecot\nto apply a security update, for example.
\n" }, "sql_driver": { "values": [ { "label": "String", "url": "string" } ], "text": "SQL driver to use for any SQL database accesses.
\n" }, "ssl": { "default": "yes",
"seealso": [
"SSL configuration",
"inet_listener_ssl"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"yes",
"no",
"required"
],
"text": "The level of SSL support. This setting affects both the implicit SSL ports\nand the STARTTLS commands.
\nOptions:
\nnoyesrequiredauth_allow_cleartext in that even non-cleartext\nauthentication mechanisms aren't allowed without SSL/TLS. See\nsecured connections for details which connections are considered\nsecured.The value of this setting affects the secured state of connections. See\nsecured connections.
Note: Do not confuse this with the inet_listener_ssl setting,\nwhich gets used inside inet_listener { ssl }.
ssl",
"SSL configuration"
],
"values": [
{
"label": "File",
"url": "File"
}
],
"text": "Alternative SSL certificate that will be used if the algorithm differs from\nthe primary certificate.
\nThis is useful when migrating to e.g. an ECDSA certificate.
\nExample:
\nssl_server_alt_cert_file = /path/to/alternative/cert.pemssl",
"ssl_server_alt_cert_file",
"SSL configuration"
],
"values": [
{
"label": "File",
"url": "File"
}
],
"text": "Private key for ssl_server_alt_cert_file.
Example:
\nssl_server_alt_key_file = /path/to/alternative/key.pem\nssl_server_alt_cert_file = /path/to/alternative/cert.pemssl",
"ssl_client_require_valid_cert",
"ssl_server_request_client_cert"
],
"values": [
{
"label": "File",
"url": "File"
}
],
"text": "List of SSL CA certificates that are used to validate whether SSL\ncertificates presented by incoming imap/pop3/etc. client connections are\nvalid.
\nExample:
\nssl_server_ca_file = /etc/dovecot/ca.crt\nssl_server_request_client_cert = yes\nauth_ssl_require_client_cert = yesssl",
"ssl_server_key_file",
"SSL configuration"
],
"values": [
{
"label": "File",
"url": "File"
}
],
"text": "Path to the PEM-encoded X.509 SSL/TLS certificate presented for incoming\nimap/pop3/etc. client connections.
\nThe ssl_server_key_file is also needed for the private certificate.
Example:
\nssl_server_cert_file = /etc/ssl/private/dovecot.crt\nssl_server_key_file = /etc/ssl/private/dovecot.keycommonName",
"seealso": [
"ssl",
"SSL configuration"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "Field name in the SSL client certificate that is used for\nauth_ssl_username_from_cert.
The most common choices are commonName and x500UniqueIdentifier.
Note: auth_ssl_username_from_cert MUST be enabled.
ssl",
"SSL configuration",
"passdb: check_client_fp Extra field"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "An OpenSSL digest algorithm name to use to hash peer certificate names.\nSetting this value is required for ssl_client_cert_fp and ssl_client_cert_pubkey_fp\navailability in login_log_format_elements and also in authentication\nvariables. Weak algorithms are explicitly disallowed, such as MD5.
ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH (for ssl_server, empty for ssl_client)",
"seealso": [
"ssl",
"ssl_cipher_suites",
"ssl_min_protocol",
"SSL configuration"
],
"tags": [
"ssl-ldap",
"sql-mysql"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The list of SSL ciphers to use for TLSv1.2 and below connections, in order\nof preference. Use ssl_cipher_suites for TLSv1.3 connections.
You do not need to edit this setting in order to disable specific SSL\nprotocols; that is best done with ssl_min_protocol instead.
This setting is used for both incoming and outgoing SSL connections.
\n" }, "ssl_cipher_suites": { "default": "<OpenSSL version specific>",
"seealso": [
"ssl",
"ssl_cipher_list",
"SSL configuration"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The list of SSL cipher suites to use for TLSv1.3 connections, in order of\npreference. Use ssl_cipher_list for TLSv1.2 and below connections.
This setting is used for both incoming and outgoing SSL connections.
\nSee: https://wiki.openssl.org/index.php/TLS1.3#Ciphersuites
\n" }, "ssl_client": { "seealso": [ "ssl",
"ssl_server",
"SSL configuration"
],
"values": [
{
"label": "Named Filter",
"url": "Named Filter",
"no_default": true
}
],
"text": "Named filter, which can be used for specifying SSL client settings.
\n", "no_default": true }, "ssl_client_ca_dir": { "seealso": [ "ssl",
"SSL configuration"
],
"tags": [
"ssl-ldap",
"sql-mysql"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The directory where trusted SSL CA certificates can be found. For example\n/etc/ssl/certs. These certificates are used only for outgoing SSL\nconnections (e.g. with the imapc driver).
For extra security you might want to point to a directory containing\ncertificates only for the CAs that are actually needed for the server\noperation instead of all the root CAs.
\n" }, "ssl_client_ca_file": { "tags": [ "ssl-ldap", "ssl-cassandra", "sql-mysql" ], "seealso": [ "ssl",
"SSL configuration"
],
"values": [
{
"label": "File",
"url": "File"
}
],
"text": "File containing the trusted SSL CA certificates. For example\n/etc/ssl/certs/ca-bundle.crt.
These certificates are used only for outgoing SSL connections (e.g. with\nthe imapc driver).
\nNote that this setting isn't recommended to be used with large CA bundles,\nbecause all the certificates are read into memory. This leads to excessive\nmemory usage, because it gets multiplied by the number of imap processes.\nIt's better to either use ssl_client_ca_dir setting or\nuse a CA bundle that only contains the CAs that are actually necessary for\nthe server operation.
ssl",
"ssl_client_key_file",
"SSL configuration"
],
"tags": [
"ssl-ldap",
"ssl-cassandra",
"sql-mysql"
],
"values": [
{
"label": "File",
"url": "File"
}
],
"text": "Public SSL certificate used for outgoing SSL connections. This is generally\nneeded only when the server authenticates the client using the certificate.
\nssl_client_key_file is also needed for the private certificate.
Example:
\nssl_client_cert_file = /etc/dovecot/dovecot-client.crt\nssl_client_key_file = /etc/dovecot/dovecot-client.keyssl",
"ssl_client_cert_file",
"SSL configuration"
],
"tags": [
"ssl-ldap",
"ssl-cassandra",
"sql-mysql"
],
"values": [
{
"label": "File",
"url": "File"
}
],
"text": "Private key for ssl_client_cert_file. If it is password protected,\nset the password with ssl_client_key_password.
Example:
\nssl_client_cert_file = /etc/dovecot/dovecot-client.crt\nssl_client_key_file = /etc/dovecot/dovecot-client.keyssl",
"ssl_client_key_file",
"SSL configuration"
],
"tags": [
"ssl-cassandra"
],
"text": "Password for the ssl_client_key_file.
ssl",
"SSL configuration"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "Available Values: <Obtain by running openssl engine command>
Which SSL crypto device to use.
\n" }, "ssl_curve_list": { "default": "<defaults from the SSL library>",
"seealso": [
"ssl",
"SSL configuration"
],
"tags": [
"ssl-ldap"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "Colon separated list of elliptic curves to use, in order of preference.\nAn empty value uses the defaults from the SSL library.
\nThis setting is used for both incoming and outgoing SSL connections.
\nExample:
\nssl_curve_list = P-521:P-384:P-256ssl",
"SSL configuration"
],
"values": [
{
"label": "File",
"url": "File"
}
],
"text": "Path to the Diffie-Hellman parameters file. This setting isn't needed if using\nonly ECDSA certificates.
\nYou can generate a new parameters file by, for example, running\nopenssl dhparam -out dh.pem 4096 on a machine with sufficient entropy\n(this may take some time).
Example:
\nssl_server_dh_file = /path/to/dh.pemyes",
"seealso": [
"ssl",
"SSL configuration"
],
"tags": [
"ssl-ldap",
"ssl-cassandra",
"sql-mysql"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Require a valid certificate when connecting to external SSL services?
\n" }, "ssl_server_key_file": { "seealso": [ "ssl",
"ssl_server_cert_file",
"ssl_server_key_password",
"SSL configuration"
],
"values": [
{
"label": "File",
"url": "File"
}
],
"text": "Path to the PEM-encoded X.509 SSL/TLS private key for\nssl_server_cert_file.
Example:
\nssl_server_cert_file = /etc/ssl/private/dovecot.crt\nssl_server_key_file = /etc/ssl/private/dovecot.keyssl",
"ssl_server_key_file",
"SSL configuration"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The password to use if ssl_server_key_file is password-protected.
Since this file is often world-readable, you may wish to specify the path\nto a file containing the password, rather than the password itself, by\nusing the format ssl_server_key_password = <path here. The path should\nbe to a root-owned file with mode 0600.
Alternatively, you can supply the password via the -p parameter at startup.
\n" }, "ssl_min_protocol": { "default": "TLSv1.2",
"seealso": [
"ssl",
"ssl_cipher_list",
"SSL configuration"
],
"tags": [
"ssl-ldap"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The minimum SSL protocol version Dovecot accepts. It cannot be empty.
\nThis setting is used for both incoming and outgoing SSL connections.
\nSupported values are:
\nANYWARNING
\nThis value is meant for tests only. It should not be used in any\ndeployment of any value/relevance.
\nTLSv1TLSv1.1TLSv1.2TLSv1.3LATESTssl",
"SSL configuration"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"compression",
"no_ticket"
],
"text": "Additional options for SSL.
\nThis setting is used for both incoming and outgoing SSL connections.
\nCurrently supported options are:
\ncompressionno_ticketclient",
"seealso": [
"ssl",
"SSL configuration"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"client",
"server"
],
"text": "Whether to give preference to the server's cipher list over a client's\nlist.
\n" }, "ssl_server_require_crl": { "default": "yes",
"seealso": [
"ssl",
"ssl_server_ca_file",
"SSL configuration"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, the CRL check must succeed for presented SSL client\ncertificate and any intermediate certificates. The CRL list is generally\nappended to the ssl_server_ca_file file.
Renamed from ssl_verify_client_cert setting.
no",
"seealso": [
"ssl",
"auth_ssl_require_client_cert",
"SSL configuration"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"no",
"yes",
"any-cert"
],
"text": "If enabled, the imap/pop3/etc. client is requested to send an SSL certificate.
\nYou can accept any certificate with 'any-cert' value, but you must configure\nauthentication to check the client certificate with check_client_fp (or\nvariant) extra field. See passdb: check_client_fp Extra field.
\nNote: This setting doesn't yet require the certificate to be valid or\nto even exist. See auth_ssl_require_client_cert.
ssl",
"ssl_client",
"SSL configuration"
],
"values": [
{
"label": "Named Filter",
"url": "Named Filter",
"no_default": true
}
],
"text": "Named filter, which can be used for specifying SSL server settings.
\n", "no_default": true }, "state_dir": { "default": "/var/lib/dovecot",
"values": [
{
"label": "String",
"url": "string"
}
],
"advanced": true,
"text": "The compile-time directory PKG_STATEDIR (typically /var/lib/dovecot)\nis hard-coded as the location of state files. The PKG_STATEDIR value\nis taken as the default state_dir setting but can be overridden - for\ninstance, if you wish to use the same binaries for a system daemon and\na user daemon.
\nThe settings state_dir = /home/foo/dovecot/state and\nbase_dir = /home/foo/dovecot/run give an example of usage.
Filter for stats server specific settings.
\n", "no_default": true }, "stats_writer_socket_path": { "default": "stats-writer",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The path to the stats-writer socket.
\n" }, "submission_add_received_header": { "default": "yes",
"tags": [
"submission"
],
"added": [
{
"version": "Added: 3.0.0"
}
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Controls if "Received:" header should be added to mails by the submission\nbackend.
\n" }, "submission_client_workarounds": { "tags": [ "submission" ], "values": [ { "label": "Boolean List", "url": "Boolean List" } ], "text": "Configures the list of active workarounds for Submission client bugs.
\nSupported workaround identifiers are:
\nimplicit-auth-externalmailbox-for-pathwhitespace-before-pathUse this SMTP submission host to send messages.
\nOverrides sendmail_path value, if set.
in=%{input} out=%{output}",
"tags": [
"submission"
],
"values": [
{
"label": "String Without Variables",
"url": "String without variables"
}
],
"text": "The SMTP Submission logout format string.
\nVariables supported, including Mail user variables:
| Variable Name | \nDescription | \n
|---|---|
%{input} | \nBytes read from client | \n
%{output} | \nBytes sent to client | \n
%{command_count} | \nNumber of commands received from client | \n
%{reply_count} | \nNumber of replies sent to client | \n
%{transaction_id} | \nID of the current transaction, if any | \n
40M",
"tags": [
"submission"
],
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"text": "The maximum message size accepted for relay.
\nThis value is announced in the SMTP SIZE capability.
\nIf empty, this value is either determined from the relay server or left\nunlimited if no limit is known; the relay MTA will reply with error if some\nunknown limit exists there, which will be passed back to the client.
\n" }, "submission_max_recipients": { "tags": [ "submission" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": "unlimited",
"text": "Maximum number of recipients accepted per connection.
\n" }, "submission_relay_command_timeout": { "default": "5mins",
"tags": [
"submission_relay"
],
"values": [
{
"label": "Time (milliseconds)",
"url": "time (milliseconds)",
"default_required": true
}
],
"text": "Timeout for SMTP commands issued to the submission service's relay server.
\nThe timeout is reset every time more data is being sent or received.
\n" }, "submission_relay_connect_timeout": { "default": "30secs",
"tags": [
"submission_relay"
],
"values": [
{
"label": "Time (milliseconds)",
"url": "time (milliseconds)",
"default_required": true
}
],
"text": "Timeout for connecting to and logging into the submission service's relay\nserver.
\n" }, "submission_relay_host": { "tags": [ "submission_relay" ], "values": [ { "label": "String", "url": "string" } ], "text": "Host of the relay server (REQUIRED to provide the submission service).
\n" }, "submission_relay_master_user": { "tags": [ "submission_relay" ], "values": [ { "label": "String", "url": "string" } ], "text": "Master user name for authentication to the relay MTA if authentication is\nrequired.
\n" }, "submission_relay_max_idle_time": { "default": "29mins",
"tags": [
"submission_relay"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "Submission relay max idle time for connection to relay MTA.
\n" }, "submission_relay_password": { "tags": [ "submission_relay" ], "values": [ { "label": "String", "url": "string" } ], "text": "Password for authentication to the relay MTA if authentication is required.
\n" }, "submission_relay_port": { "default": "25",
"tags": [
"submission_relay"
],
"values": [
{
"label": "Port Number",
"url": "Port Number",
"default_required": true
}
],
"text": "Port for the submission relay server.
\n" }, "submission_relay_rawlog_dir": { "tags": [ "submission_relay" ], "seealso": [ "rawlog" ], "values": [ { "label": "String", "url": "string" } ], "text": "Write protocol logs for relay connection to this directory for debugging.
\nMail user variables can be used.
no",
"tags": [
"submission_relay"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"no",
"smtps",
"starttls"
],
"text": "If enabled, SSL/TLS is used for the connection to the relay server.
\nAvailable values:
\nnosmtpsstarttlsyes",
"tags": [
"submission_relay"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, TLS certificate of the relay server must be verified.
\n" }, "submission_relay_trusted": { "default": "no",
"tags": [
"submission_relay"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, the relay server is trusted.
\nDetermines whether we try to send (Postfix-specific) XCLIENT data to the\nrelay server (only if enabled).
\n" }, "submission_relay_user": { "tags": [ "submission_relay" ], "values": [ { "label": "String", "url": "string" } ], "text": "User name for authentication to the relay MTA if authentication is required.
\n" }, "submission_ssl": { "default": "no",
"seealso": [
"submission_host"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"values_enum": [
"no",
"smtps",
"starttls"
],
"text": "If enabled, use SSL/TLS to connect to submission_host.
Available values:
\nnosmtpsstarttls30secs",
"seealso": [
"submission_host"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "Timeout for submitting outgoing messages.
\n" }, "syslog_facility": { "default": "mail",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The syslog facility used if you're logging to syslog.
\n" }, "unix_listener": { "tags": [ "service" ], "values": [ { "label": "Named List Filter", "url": "Named List Filter" } ], "seealso": [ "service",
"unix_listener_path"
],
"text": "Creates a new UNIX listener for a service. The filter name refers\nto the unix_listener_path setting.
base_dir",
"unix_listener"
],
"text": "Path to the UNIX socket file, relative to base_dir setting. The\nunix_listener filter name refers to this setting.
Listener type. This string value has service-specific meaning and is used to\ndistinguish different listener types that one service may employ.
\n" }, "unix_listener_mode": { "tags": [ "service" ], "values": [ { "label": "Octal Unsigned Integer", "url": "octal unsigned integer", "default_required": true } ], "default": "0600",
"text": "Mode of the file. Note that 0600 is an octal value, while 600 is a\ndifferent decimal value. Setting mode to 0 disables the listener.
Owner of the listener file. Empty (default) means UID 0 (root).
\n" }, "unix_listener_group": { "tags": [ "service" ], "values": [ { "label": "String", "url": "string" } ], "text": "Group of the listener file. Empty (default) means GID 0 (root/wheel).
\n" }, "userdb": { "tags": [ "userdb" ], "values": [ { "label": "Named List Filter", "url": "Named List Filter" } ], "dependencies": [ "userdb_driver"
],
"seealso": [
"userdb",
"userdb_name",
"userdb_driver"
],
"text": "Creates a new userdb. The filter name refers to the\nuserdb_name setting.
userdb",
"userdb_driver"
],
"text": "Name of the userdb. The userdb filter name refers to this setting.\nIf the userdb_driver setting is empty, the userdb_name is used\nas the driver. This allows doing e.g.:
userdb passwd-file {\n passwd_file_path = /etc/dovecot/passwduserdb_name",
"userdb",
"Authentication Databases"
],
"text": "The driver used for this user database. If empty, defaults to\nuserdb_name.
Userdb fields (and userdb: Extra Fields). The values can contain\n%variables. All %variables used here reflect\nthe state after the current userdb lookup, and can refer to fields returned\nby previous userdb lookups. Depending on the userdb driver, it can also refer\nto variable fields returned by it (e.g. %{ldap:fieldName}).
INFO
\nThe LDAP driver provides additional specific variables,\nsee LDAP authentication for more details.
\nFor example:
\nuserdb ldap {\n fields {\n user = %{ldap:userId}\n home = /home/%{ldap:mailboxPath}\n uid = vmail\n gid = vmail\n }\n}yesuserdb ldap the default is no.",
"seealso": [
"userdb_fields"
],
"text": "If yes, import all fields returned by the userdb lookup. If no, require\nuserdb_fields to explicitly add wanted fields.
never",
"text": "Configures when userdbs should be skipped:
\n| Value | \nDescription | \n
|---|---|
never | \nNever skip over this userdb. | \n
found | \nSkip if an earlier userdbs already found the user. | \n
notfound | \nSkip if previous userdbs haven't yet found the user. | \n
no",
"text": "Skip user existence verification via passdb lookup.
\n" }, "userdb_use_worker": { "tags": [ "userdb" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "noIf yes, run the userdb lookup in auth-worker process instead of the main\nauth process. This setting is only used by some of the userdb drivers.
return-ok",
"seealso": [
"userdb: Result Values"
],
"text": "What to do if the user was successfully found from the userdb. Possible values\nand their meaning are described fully at userdb: Result Values.
\n" }, "userdb_result_failure": { "tags": [ "userdb" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "return-ok", "return", "return-fail", "continue", "continue-ok", "continue-fail" ], "default": "continue",
"seealso": [
"userdb: Result Values"
],
"text": "What to do if the user was not found from the userdb. Possible values and their\nmeaning are described fully at userdb: Result Values.
\n" }, "userdb_result_internalfail": { "tags": [ "userdb" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "return-ok", "return", "return-fail", "continue", "continue-ok", "continue-fail" ], "default": "continue",
"seealso": [
"userdb: Result Values"
],
"text": "What to do after the userdb failed due to an internal error.\nPossible values and their meaning are described fully at\nuserdb: Result Values. If any of the userdbs had an internal failure\nand the final userdb also returns continue the authentication will fail\nwith internal error.
SQL query to lookup the userdb fields.
\n" }, "userdb_sql_iterate_query": { "tags": [ "userdb" ], "values": [ { "label": "String", "url": "string" } ], "text": "SQL query to list all available usernames.
\n" }, "valid_chroot_dirs": { "values": [ { "label": "Boolean List", "url": "Boolean List" } ], "text": "List of directories under which chrooting is allowed for mail processes.
\nAddresses the risk of root exploits enabled by incorrect use of chrooting.
\nInterpretation is recursive, so including /var/mail allows chrooting\nto subdirectories such as /var/mail/foo/bar.
yes",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, the ps command shows more verbose process details,\nincluding the username and IP address of the connected client.
This aids in seeing who is actually using the server, as well as helps\ndebugging in case there are any problems. See process titles.
\n" }, "verbose_ssl": { "removed": [ { "version": "Removed: 3.1.0" } ], "default": "no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, protocol-level SSL errors are logged. Same as\nlog_debug = category=ssl.
no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, ignore version mismatches between different Dovecot versions.
\n" }, "ldap_auth_dn": { "tags": [ "auth-ldap", "dict-ldap", "sieve-storage-ldap" ], "values": [ { "label": "String", "url": "string" } ], "text": "Specify the Distinguished Name (the username used to login to the LDAP server).
\nLeave it commented out to bind anonymously (useful with passdb_ldap_bind = yes).
Example: ldap_auth_dn = uid=dov-read,dc=example,dc=com,dc=.
Password for LDAP server. Used if ldap_auth_dn is specified.
SASL authorization ID, ie. the ldap_auth_dn_password is for this "master user", but the\nldap_auth_dn is still the logged in user. Normally you want to keep this empty.
List of SASL mechanism names to use.
\n" }, "ldap_auth_sasl_realm": { "tags": [ "auth-ldap", "sieve-storage-ldap" ], "values": [ { "label": "String", "url": "string" } ], "text": "SASL realm to use.
\n" }, "ldap_base": { "tags": [ "auth-ldap", "dict-ldap", "sieve-storage-ldap" ], "values": [ { "label": "String", "url": "string" } ], "text": "LDAP base.
\nSettings variables can be used.
Example: ldap_base = dc=mail, dc=example, dc=org
Only databases with the same connection group share the ldap connections.\nBy default all the databases have the same ""(empty string) default connection group,\nand as such share the connections.
LDAP library debug level as specified by LDAP_DEBUG_* in ldap_log.h.
Value -1 means everything.
You may need to recompile OpenLDAP with debugging enabled to get enough output.
\n" }, "ldap_deref": { "tags": [ "auth-ldap", "sieve-storage-ldap" ], "default": "never",
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"never",
"searching",
"finding",
"always"
],
"text": "Specify dereference which is set as an LDAP option.
\n" }, "dict_map_ldap_filter": { "tags": [ "dict-ldap" ], "values": [ { "label": "String", "url": "string" } ], "text": "The ldap filter to use to find the ldap entry.
\nThis setting is required for ldap dict_map
Disconnect from LDAP server after connection has been idle for this many seconds.
\n" }, "ldap_scope": { "tags": [ "auth-ldap", "dict-ldap", "sieve-storage-ldap" ], "default": "subtree",
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"base",
"onelevel",
"subtree"
],
"text": "This specifies the search scope.
\n" }, "ldap_starttls": { "tags": [ "auth-ldap", "dict-ldap", "sieve-storage-ldap" ], "default": "no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Set to yes to use TLS to connect to the LDAP server.
LDAP URIs to use.
\nConfigure this setting to specify what LDAP\nserver(s) to connect to.
\nThe URIs are in syntax protocol://host:port.
Example: ldap_uris = ldaps://secure.domain.org
3",
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"text": "LDAP protocol version to use. Likely 2 or 3.
no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Set yes to use authentication binding for verifying password's validity.
This works by logging into LDAP server using the username and password given by client.
\nThe passdb_ldap_filter is used to find the DN for the user.\nNote that the passdb_fields are still used, only the password field\nis ignored in it.
Before doing any search, the binding is switched back to the default DN.
\nIf you use this setting, it's a good idea to use a different\nldap_connection_group for userdb. That way one connection is used\nonly for LDAP binds and another connection is used for user lookups.\nOtherwise the binding is changed to the default DN before each user lookup.
If authentication binding is used, you can save one LDAP request per login\nif users' DN can be specified with a common template. The template can use\nthe standard Settings variables.
Note that you can't use any passdb_fields declaration if you use this setting.
Example: passdb_ldap_bind_userdn = cn=%{user},ou=people,o=org
Filter for passdb lookup.
\nVariables that can be used (see Settings variables for full list).
Example:
\npassdb ldap {\n filter = (&(objectClass=posixAccount)(uid=%{user}))\n #...\n}Filter for userdb lookup.
\nVariables that can be used (see Settings variables for full list).
Example:
\nuserdb ldap {\n filter = (&(objectClass=posixAccount)(uid=%{user}))\n #...\n}Attributes to get a list of all users. Currently only the attribute\nuser is supported.
Example:
\nuserdb ldap {\n iterate_filter = (objectClass=smiMessageRecipient)\n iterate_fields {\n user = %{ldap:mailRoutingAddress}\n }\n}Filter to get a list of all users.
\nuserdb ldap {\n iterate_filter = (objectClass=smiMessageRecipient)\n iterate_fields {\n user = %{ldap:mailRoutingAddress}\n }\n}metric"
],
"text": "Group that expands to recommended metric settings in proxies or\nbackends.
Changed default mailbox_auto value for the mailboxes from no\nto subscribe.
mailbox_special_use"
],
"text": "Group that expands to recommended English language mailbox names with\nmailbox_special_use flags added.
Group that expands to various settings that are required for cluster to run\nin a proxy or backend.
\n" }, "cluster_geodb": { "tags": [ "cluster", "cluster-proxy", "cluster-backend" ], "values": [ { "label": "String", "url": "string" } ], "text": "Configuration for the globally shared GeoDB dict. This typically points to\nCassandra.
\nCluster: Applies to both Proxy and Backend.
\n" }, "cluster_local_site": { "tags": [ "cluster", "cluster-proxy", "cluster-backend" ], "values": [ { "label": "String", "url": "string" } ], "text": "Name of the local site. This must be the same name as used by\ndoveadm cluster-site commands.
Cluster: Applies to both Proxy and Backend.
\n" }, "cluster_localdb": { "tags": [ "cluster", "cluster-proxy", "cluster-backend" ], "advanced": true, "values": [ { "label": "String", "url": "string" } ], "text": "Configuration for the backend-specific local database. This is expected to\npoint to metacache-users socket.
Cluster: Applies only to Backend.
\n" }, "cluster_proxy_check_sites": { "default": "yes",
"tags": [
"cluster",
"cluster-proxy"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "If enabled, this proxy runs checks on other sites' load balancers to see whether\nthey are reachable via a simple TCP connection. This only updates statistics to\nallow controller to determine the reachability of other sites' load balancers.\nSee Site reachability checks.
\nCluster: Applies only to Proxy.
\n" }, "cluster_proxy_check_backends": { "default": "yes",
"tags": [
"cluster",
"cluster-proxy"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"seealso": [
"cluster_backend_test_username",
"cluster_backend_test_password"
],
"text": "If enabled, this proxy runs checks on backends that are offline to see whether\nthey have come back online. This only updates statistics to allow controller to\nset the backends online. Backends that are online are not checked, except once\nat startup.
\nCluster: Applies only to Proxy.
\n" }, "cluster_backend_test_username": { "tags": [ "cluster", "cluster-proxy", "cluster-backend" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "cluster_backend_test_password",
"cluster_proxy_check_backends"
],
"text": "This setting is used for two purposes:
\n%{backend_host} variable expands to the hostname of the backend.Cluster: Applies to both Proxy and Backend.
\n" }, "cluster_backend_test_password": { "tags": [ "cluster", "cluster-proxy" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "cluster_backend_test_username",
"cluster_proxy_check_backends"
],
"text": "Password used for logging into backends to see if it's up or down.
\nCluster: Applies only to Proxy.
\n" }, "cluster_director_transition_config": { "tags": [ "cluster", "cluster-proxy" ], "values": [ { "label": "File", "url": "File" } ], "text": "Path to configuration file for director to cluster transition.
\nThe configuration file has to be created by the migrate_start.py script, which\nis to be used as described in Transition from OX Dovecot Pro 2.3.x Architecture.
If this file is set, the cluster will perform an additional lookup for the\nuser's backend in the current site, using information from the transition\nconfiguration.\nThis lookup is only performed if the user does not already have a backend\nassigned.
\nThis way, users are assigned the same backend at login as they had in the\ndirector setup they are being transitioned from.\nFor more information please refer to Transition from OX Dovecot Pro 2.3.x Architecture.
\n" }, "cluster_user_move_timeout": { "tags": [ "cluster", "cluster-proxy" ], "values": [ { "label": "Time", "url": "time", "default_required": true } ], "default": "31secs",
"text": "If user moving hasn't finished by this timeout, just assume it finished and\ncontinue to the next user.
\nCluster: Applies only to Proxy.
\n" }, "cluster_backend_name": { "tags": [ "cluster", "cluster-backend" ], "values": [ { "label": "String", "url": "string" } ], "text": "Host name of the backend. This must be the same name as used by\ndoveadm cluster-backend commands.
Cluster: Applies only to Backend.
\n" }, "CLUSTER_SITE": { "tags": [ "controller" ], "values": [ { "label": "Python String", "url": "Python String" } ], "default": ""dc1a"",
"text": "Palomar site this controller is responsible for. Must be the same\nsite name configured in dovecot proxies with cluster_local_site.
"http://localhost:8000"",
"text": "URL controller API runs on. The server will bind to this address and the admin\nUI uses this address to send the HTTP requests.
\n" }, "CELERY_RESULT_EXPIRES_SECS": { "tags": [ "controller" ], "values": [ { "label": "Python Integer", "url": "Python Integer" } ], "default": "60",
"text": "Time to live of task results in Redis (in seconds).
\n" }, "CASSANDRA_SERVERS": { "tags": [ "controller" ], "values": [ { "label": "Python String", "url": "Python String" } ], "default": ""localhost"",
"text": "Comma separated list of Cassandra server endpoints.
\n" }, "CASSANDRA_PORT": { "tags": [ "controller" ], "values": [ { "label": "Python Integer", "url": "Python Integer" } ], "default": "9042",
"text": "The port Cassandra servers listen on.
\n" }, "CASSANDRA_TLS_ENABLED": { "tags": [ "controller" ], "values": [ { "label": "Python Boolean", "url": "Python Boolean" } ], "default": "False",
"text": "Whether to use TLS in Cassandra connections.
\n" }, "CASSANDRA_KEYSPACE": { "tags": [ "controller" ], "values": [ { "label": "Python String", "url": "Python String" } ], "default": ""d8s_cluster"",
"deprecated": [
{
"text": "Use CASSANDRA_GEODB_KEYSPACE instead.
Cassandra keyspace to use.
\n" }, "CASSANDRA_GEODB_KEYSPACE": { "tags": [ "controller" ], "values": [ { "label": "Python String", "url": "Python String" } ], "default": ""d8s_cluster"",
"added": [
{
"version": "Added: 3.0.1"
}
],
"text": "Cassandra keyspace used for dovecot cluster.
\n" }, "CASSANDRA_PROTOCOL_VERSION": { "tags": [ "controller" ], "values": [ { "label": "Python Integer", "url": "Python Integer" } ], "default": "4",
"text": "Version of the cassandra protocol to be used.
\n" }, "CASSANDRA_LOAD_BALANCING_POLICY": { "tags": [ "controller" ], "values": [ { "label": "Python String", "url": "Python String" } ], "values_enum": [ "\"RoundRobin\"", "\"DCAwareRoundRobin\"" ], "default": ""DCAwareRoundRobin"",
"added": [
{
"version": "Added: 3.0.1"
}
],
"text": "Policy to use for cassandra load balancing. Determines how requests are\ndistributed among nodes in the cluster.
\nCASSANDRA_USED_HOSTS_PER_REMOTE_DC.0",
"added": [
{
"version": "Added: 3.0.1"
}
],
"text": "If CASSANDRA_LOAD_BALANCING_POLICY is set to "DCAwareRoundRobin",\ncontrols how many nodes in each remote datacenter will have connections opened\nagainst them.
"d8s_cluster"",
"deprecated": [
{
"text": "Use CASSANDRA_LOCAL_DC instead.
Name of the local datacenter in Cassandra cluster.
\n" }, "CASSANDRA_LOCAL_DC": { "tags": [ "controller" ], "values": [ { "label": "Python String", "url": "Python String" } ], "default": ""d8s_cluster"",
"added": [
{
"version": "Added: 3.0.1"
}
],
"text": "Name of the local datacenter in Cassandra cluster.
\n" }, "HOST_LOAD_BALANCE_MIN_COOL_TIME_SECS": { "tags": [ "controller" ], "values": [ { "label": "Python Integer", "url": "Python Integer" } ], "default": "3600",
"text": "Used to determine if a user or a backend has been subject to user moves\nrecently and should be skipped for load balancing.
\nFor users, it determines the minimum time in seconds a user will not be\nmoved to a new backend because of load balancing decisions. The users' move\ntimestamps are tracked by backends, so users that have been moved for any\nreason by either Controller or doveadm commands will not be moved again until\nthis many seconds have passed.
\nFor backends, it determines the minimum time in seconds no move will be\ndone from or to the backend. The timestamp of last user move from or to\nthe backend is tracked by Controller and at each load balancing iteration,\nbackends that have had a user move within this period will be skipped.
\n" }, "HOST_LOAD_BALANCE_GROUP_MIN_COOL_TIME_SECS": { "tags": [ "controller" ], "values": [ { "label": "Python Integer", "url": "Python Integer" } ], "default": "3600",
"added": [
{
"version": "Added: 3.0.1"
}
],
"deprecated": [
{
"text": "Use HOST_LOAD_BALANCE_MIN_COOL_TIME_SECS instead.
Minimum time in seconds a group will not be moved to a new backend. If a\ngroup needs to be moved for load balancing, this period is honored and\ngroups that have been moved recently will not be moved again.\nMust be larger than 0.
\n" }, "HOST_LOAD_BALANCE_SCORE_DELTA_THRESHOLD_RATIO": { "tags": [ "controller" ], "values": [ { "label": "Python Float", "url": "Python Float" } ], "default": "0.5",
"text": "Minimum load score difference between backends to initiate user move. See Cluster Controller Load Balancing.
\n" }, "HOST_LOAD_BALANCE_MIN_SAMPLES": { "tags": [ "controller" ], "values": [ { "label": "Python Integer", "url": "Python Integer" } ], "default": "3000",
"text": "Number of samples over the last 24 hours needed for all the Z-scores for a host to do load balancing.
\n" }, "HOST_FAILURE_BACKEND_NUM_THRESHOLD": { "tags": [ "controller" ], "values": [ { "label": "Python Float", "url": "Python Float" } ], "default": "0.3",
"text": "Percentage of backends in a site that are allowed to become offline before stopping backend evacuations within the site.
\n" }, "HOST_FAILURE_RATIO": { "tags": [ "controller" ], "values": [ { "label": "Python Float", "url": "Python Float" } ], "default": "0.1",
"text": "Ratio of failed logins or mail deliveries to trigger user moves. Must be in (0, 1) range exclusive.
\n" }, "HOST_FAILURE_COOL_TIME_SECS": { "tags": [ "controller" ], "values": [ { "label": "Python Integer", "url": "Python Integer" } ], "default": "3600",
"text": "Minimum time in seconds a user will not be moved to a new backend because\nof backend health decisions. The users' move timestamps are tracked by\nbackends, so users that have been moved for any reason by either\nController or doveadm commands will not be moved again until this many\nseconds have passed.
\n" }, "HOST_FAILURE_MIN_LOGINS": { "tags": [ "controller" ], "values": [ { "label": "Python Integer", "url": "Python Integer" } ], "default": "10",
"text": "Minimum number of logins needed in past 5 minutes to start processing\nhost's health (i.e. change backend status if necessary or move users from it\nif there is high failure rate).
\n" }, "HOST_FAILURE_FORCE_MOVE_PERCENTAGE_INCREASE_INTERVAL_SECONDS": { "tags": [ "controller" ], "values": [ { "label": "Python Integer", "url": "Python Integer" } ], "default": "60",
"added": [
{
"version": "Added: 3.1.0"
}
],
"text": "Time interval between increases in percentage of users when backend is being\nevacuated in a force-move operation. If a backend is slow in moving users\nto another backend (due to admin's decision to set load factor to 0 or for\nhealth handling by controller) a force-move is started in which proxies are\ninstructed to move a portion of users away to other healthy backends. The\namount of users being moved to other backends starts at 10% then after\na duration of time, configurable by this setting, it is increased to\n40% then 70% and finally 100%. In all these percentage increases the time\ninterval applies as well.
\n" }, "DRY_RUN": { "tags": [ "controller" ], "values": [ { "label": "Python Integer", "url": "Python Integer" } ], "default": "200",
"deprecated": [
{
"text": "Use feature state 'dryrun'.
\n", "version": "Deprecated: 3.0.2" } ], "text": "Whether to enable DRY_RUN mode to log but not perform controller worker actions, such as: set_host_offline, set_host_online and move users.
\n" }, "GROUP_MOVE_START_TIMEOUT_SECS": { "tags": [ "controller" ], "values": [ { "label": "Python Integer", "url": "Python Integer" } ], "default": "180",
"added": [
{
"version": "Added: 3.0.1"
}
],
"deprecated": [
{
"version": "Deprecated: 3.1.0"
}
],
"text": "Maximum allowed time of a group move to start in seconds. If backends don't\nstart moving group after this time, a force move will be done. A forced move\nis done by directly setting group's backend ID in GeoDB.
\n" }, "USER_MOVE_START_TIMEOUT_SECS": { "tags": [ "controller" ], "values": [ { "label": "Python Integer", "url": "Python Integer" } ], "default": "180",
"added": [
{
"version": "Added: 3.1.0"
}
],
"seealso": [
"USER_MOVE_FINISH_TIMEOUT_SECS"
],
"text": "Maximum allowed time of a non load-balancing user move operation to start in\nseconds. If backends don't start moving user after this time, the operation\nwill be retried once. If the move is still not successful on the second try,\na force move will be triggered. A forced move is done by populating\nforce_move_percentage on backend's table in GeoDB.
600",
"added": [
{
"version": "Added: 3.0.1"
}
],
"deprecated": [
{
"version": "Deprecated: 3.1.0"
}
],
"text": "Maximum time for a group move to finish in seconds. Controller tries to\ncalculate the finish time based on the trend of moved users so far. If it\nseems that backends won't be able to finish the move in time, it will be\nforced. A forced move is done by directly setting group's backend ID in GeoDB.
\n" }, "USER_MOVE_FINISH_TIMEOUT_SECS": { "tags": [ "controller" ], "values": [ { "label": "Python Integer", "url": "Python Integer" } ], "default": "600",
"added": [
{
"version": "Added: 3.1.0"
}
],
"seealso": [
"USER_MOVE_START_TIMEOUT_SECS"
],
"text": "Maximum time for non load-balancing user move operations to finish in seconds.\nController tries to calculate the finish time based on the trend of moved\nusers so far. If it seems that backends won't be able to finish the move in\ntime, the operation will be retried once and if still not successful,\nit will be forced. A forced move is done by writing to\nforce_move_percentage column in backends table.
info",
"added": [
{
"version": "Added: 3.2.0"
}
],
"values_enum": [
"critical",
"error",
"warning",
"info",
"debug"
],
"text": "Log level for controller.
\n" }, "LOG_STRUCTURED": { "tags": [ "controller" ], "values": [ { "label": "Python Boolean", "url": "Python Boolean" } ], "default": "False",
"added": [
{
"version": "Added: 3.2.0"
}
],
"text": "Whether structured logging is enabled for controller. If set to True,\nlogs are emitted as a json payload.
\n" }, "LOG_COLOR_ENABLED": { "tags": [ "controller" ], "values": [ { "label": "Python Boolean", "url": "Python Boolean" } ], "default": "False",
"added": [
{
"version": "Added: 3.2.0"
}
],
"text": "Whether coloured logging is enabled for controller when non-structured logging is selected\n(coloured logging is always disabled for structured logging).
\n" }, "@fts_fs_defaults": { "plugin": [ "fts-dovecot" ], "values": [ { "label": "Settings Group", "url": "Groups Includes" } ], "values_enum": [ "aws-s3", "s3", "azure", "sproxyd", "nfs" ], "seealso": [ "Dovecot Filesystems", "fs",
"@fs_defaults"
],
"text": "Group that expands to recommended fts-dovecot plugin fs\nsettings, compression and\nencryption. Note that they use\n/var/cache/fts directory, which must be created and be writable to the\nmail_uid = vmail user. Also note that you must configure the\nencryption keys. See below for what the groups\nexpand to.
INFO
\n fts dovecot {\n fs fts-cache {\n }\n fs fscache {\n path = /var/cache/fts/%{user | sha1 % 4}\n log_path = /var/cache/fts-%{user | sha1 % 4}.log\n size = 512 M\n }\n fs compress {\n }\n fs crypt {\n }\n fs dictmap {\n storage_passthrough_paths = full\n dict proxy {\n name = mails\n socket_path = dict-async\n }\n }\n fs aws-s3 {\n }\n } fts dovecot {\n fs fts-cache {\n }\n fs fscache {\n path = /var/cache/fts/%{user | sha1 % 4}\n log_path = /var/cache/fts-%{user | sha1 % 4}.log\n size = 512 M\n }\n fs compress {\n }\n fs crypt {\n }\n fs dictmap {\n storage_passthrough_paths = full\n dict proxy {\n name = mails\n socket_path = dict-async\n }\n }\n fs s3 {\n }\n } fts dovecot {\n fs fts-cache {\n }\n fs fscache {\n path = /var/cache/fts/%{user | sha1 % 4}\n log_path = /var/cache/fts-%{user | sha1 % 4}.log\n size = 512 M\n }\n fs compress {\n }\n fs crypt {\n }\n fs dictmap {\n storage_passthrough_paths = full\n dict proxy {\n name = mails\n socket_path = dict-async\n }\n }\n fs azure {\n }\n } fts dovecot {\n fs fts-cache {\n }\n fs fscache {\n path = /var/cache/fts/%{user | sha1 % 4}\n log_path = /var/cache/fts-%{user | sha1 % 4}.log\n size = 512 M\n }\n fs compress {\n }\n fs crypt {\n }\n fs dictmap {\n dict proxy {\n name = mails\n socket_path = dict-async\n }\n }\n fs sproxyd {\n }\n } fts dovecot {\n fs fts-cache {\n }\n fs fscache {\n path = /var/cache/fts/%{user | sha1 % 4}\n log_path = /var/cache/fts-%{user | sha1 % 4}.log\n size = 512 M\n }\n fs compress {\n }\n fs crypt {\n }\n fs metawrap { # v3.1.2+\n }\n fs posix {\n }\n }Default changed from 0 to 10
10",
"plugin": [
"fts-dovecot"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"advanced": true,
"text": "Upload locally cached FTS indexes to object storage every N new emails.\nThis reduces the number of emails that have to be read after backend\nfailure to update the FTS indexes, but at the cost of doing more writes to\nobject storage.
\n", "plugin_link": "fts-dovecot plugin" }, "fts_dovecot_max_triplets": { "changed": [ { "text": "Default changed from 0 to 200
200",
"plugin": [
"fts-dovecot"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"advanced": true,
"text": "FTS lookups will fail and error message will be logged, when the number of\ntriplets exceeds the threshold specified in the setting. 0 means there\nis no maximum number of triplets to be exceeded.
128 kB",
"plugin": [
"fts-dovecot"
],
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"advanced": true,
"text": "The smallest FTS triplet is getting recreated whenever indexing new mails\nuntil it reaches this size. Then the triplet becomes merged with the next\nlargest triplet.
\nWhen fts-cache is used, this effectively controls how large the fts.L file\ncan become in metacache until the FTS triplet is uploaded to object\nstorage.
\n", "plugin_link": "fts-dovecot plugin" }, "fts_dovecot": { "advanced": true, "plugin": [ "fts-dovecot" ], "values": [ { "label": "Named Filter", "url": "Named Filter", "no_default": true } ], "seealso": [ "fs",
"obox",
"Mail Location Setting"
],
"text": "Named filter for initializing FS Driver for FTS indexes. It must be\nsomewhat synchronized with obox and Mail Location Setting.
This setting isn't actually necessary to use. It's simpler to add the settings\ninside fts dovecot filter (see: fts), which is used to enable\nDovecot Pro FTS driver.
3-",
"changed": [
{
"text": "Changed default from no to 3-
Specifies how prefix search should be invoked. May not work with some\nfilters.
\nIf snowball filter is active, an existing system will require all existing\nuser FTS data to be re-indexed (see doveadm fts rescan and\ndoveadm index).
Options:
\n| Value | \nDescription | \n
|---|---|
yes | \nEquivalent to 0-255 | \n
<num>-[<num>] | \nSearch strings with that length will be treated as prefixes (e.g. 4-, 3-10) | \n
no | \nNo prefix searching is performed | \n
A template of the UIDL format to use when migrating messages.
\nThe template supports variable substitution of the form %{variable_name}.
Variable substitutions available:
\n| Field | \nValue | \n
|---|---|
owm | \nOpenWave: If Message-ID header is valid POP3 UIDL, use it. Otherwise, use MD5 of the Message-ID header. | \n
uid | \nIMAP message UID | \n
uidvalidity | \nCurrent UID validity | \n
This setting enables the vault plugin and identifies where to store a copy\nof the message.
\n", "plugin_link": "vault plugin" }, "nfs_hostchange_migration": { "default": "no",
"plugin": [
"nfs-hostchange"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "When enabled, assume user is being migrated.
\n", "plugin_link": "nfs-hostchange plugin" }, "@fs_dictmap_defaults": { "plugin": [ "obox" ], "tags": [ "fs-dictmap" ], "values": [ { "label": "Settings Group", "url": "Groups Includes" } ], "values_enum": [ "cassandra" ], "seealso": [ "dict_map"
],
"text": "Group that expands to required dict_map settings for use with\nDictmap.
fs",
"@fts_fs_defaults"
],
"text": "Group that expands to recommended obox plugin fs settings,\nincluding compression and\nencryption. Note that they use\n/var/cache/mails directory, which must be created and be writable to the\nmail_uid = vmail user. Also note that you must configure the\nencryption keys. See below for what the groups\nexpand to.
INFO
\n fs_compress_write_method = zstd\n obox {\n fs fscache {\n path = /var/cache/mails/%{user | sha1 % 4}\n log_path = /var/cache/mails-%{user | sha1 % 4}.log\n size = 512 M\n }\n fs compress {\n }\n fs crypt {\n }\n fs dictmap {\n storage_objectid_prefix = %{user}/mails/\n }\n fs aws-s3 {\n }\n }\n metacache {\n fs compress {\n }\n fs crypt {\n }\n fs dictmap {\n storage_passthrough_paths = full\n }\n fs aws-s3 {\n }\n } fs_compress_write_method = zstd\n obox {\n fs fscache {\n path = /var/cache/mails/%{user | sha1 % 4}\n log_path = /var/cache/mails-%{user | sha1 % 4}.log\n size = 512 M\n }\n fs compress {\n }\n fs crypt {\n }\n fs dictmap {\n storage_objectid_prefix = %{user}/mails/\n }\n fs s3 {\n }\n }\n metacache {\n fs compress {\n }\n fs crypt {\n }\n fs dictmap {\n storage_passthrough_paths = full\n }\n fs s3 {\n }\n } fs_compress_write_method = zstd\n obox {\n fs fscache {\n path = /var/cache/mails/%{user | sha1 % 4}\n log_path = /var/cache/mails-%{user | sha1 % 4}.log\n size = 512 M\n }\n fs compress {\n }\n fs crypt {\n }\n fs dictmap {\n storage_objectid_prefix = %{user}/mails/\n }\n fs azure {\n }\n }\n metacache {\n fs compress {\n }\n fs crypt {\n }\n fs dictmap {\n storage_passthrough_paths = full\n }\n fs azure {\n }\n } fs_compress_write_method = zstd\n obox {\n fs fscache {\n path = /var/cache/mails/%{user | sha1 % 4}\n log_path = /var/cache/mails-%{user | sha1 % 4}.log\n size = 512 M\n }\n fs compress {\n }\n fs crypt {\n }\n fs dictmap {\n }\n fs sproxyd {\n }\n }\n metacache {\n fs compress {\n }\n fs crypt {\n }\n fs dictmap {\n }\n fs sproxyd {\n }\n } fs_compress_write_method = zstd\n obox {\n fs fscache {\n path = /var/cache/mails/%{user | sha1 % 4}\n log_path = /var/cache/mails-%{user | sha1 % 4}.log\n size = 512 M\n }\n fs compress {\n }\n fs crypt {\n }\n fs metawrap { # v3.1.2+\n }\n fs posix {\n }\n }\n metacache {\n fs compress {\n }\n fs crypt {\n }\n fs metawrap { # v3.1.2+\n }\n fs posix {\n }\n }Named filter for fs-auth service. Used for configuring dictionary for\nauthentication cache. This allows sharing the cache between multiple servers.
\n", "plugin_link": "obox plugin", "no_default": true }, "fs_auth_request_max_retries": { "default": "1",
"plugin": [
"obox"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"text": "If fs-auth fails to perform authentication lookup, retry the HTTP request\nthis many times.
\n", "plugin_link": "obox plugin" }, "fs_auth_request_timeout": { "default": "10s",
"plugin": [
"obox"
],
"values": [
{
"label": "Time (milliseconds)",
"url": "time (milliseconds)",
"default_required": true
}
],
"text": "Absolute HTTP request timeout for authentication lookups.
\n", "plugin_link": "obox plugin" }, "fs_aws_s3": { "plugin": [ "obox" ], "tags": [ "fs-aws" ], "values": [ { "label": "Named Filter", "url": "Named Filter", "no_default": true } ], "seealso": [ "fs_s3"
],
"text": "Filter for AWS S3-specific settings. fs_s3 filter is also used.
Filter for Azure-specific settings.
\n", "plugin_link": "obox plugin", "no_default": true }, "fs_azure_account_name": { "plugin": [ "obox" ], "tags": [ "fs-azure" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "fs_azure_auth_type"
],
"text": "Azure account name for all authentication types.
\n", "plugin_link": "obox plugin" }, "fs_azure_auth_type": { "plugin": [ "obox" ], "tags": [ "fs-azure" ], "values": [ { "label": "String", "url": "string", "enum_required": true } ], "values_enum": [ "user-sas", "service-sas" ], "default": "user-sas",
"text": "Azure authentication type to use.
\nOptions:
\n| Value | \nDescription | \n
|---|---|
user-sas | \nSee Azure User SAS | \n
service-sas | \nSee Azure Service SAS | \n
256",
"text": "Number of deletes supported within the same bulk delete request. 0 disables\nbulk deletes.
Azure container name.
\n", "plugin_link": "obox plugin" }, "fs_azure_url": { "plugin": [ "obox" ], "tags": [ "fs-azure" ], "values": [ { "label": "String", "url": "string" } ], "default": "https://blob.core.windows.net",
"advanced": true,
"text": "URL for accessing the Azure storage. It is not intended to be changed, unless\ntesting some other Azure-compatible storage.
\n", "plugin_link": "obox plugin" }, "fs_azure_user_sas_client_id": { "plugin": [ "obox" ], "tags": [ "fs-azure" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "fs_azure_auth_type",
"Azure User SAS"
],
"text": "ClientId to be used for authentication against Entra IDM. This is needed only\nwith fs_azure_auth_type = user-sas.
fs_azure_auth_type",
"Azure Service SAS"
],
"text": "Base64-encoded authentication shared key secret when using\nfs_azure_auth_type = service-sas.
fs_azure_auth_type",
"Azure User SAS"
],
"text": "Client secret to be used for authentication against Entra IDM (base64 encoded).\nThis is needed only with fs_azure_auth_type = user-sas.
fs_azure_auth_type",
"Azure User SAS"
],
"text": "TenantId to be used for authentication against Entra IDM. This is needed only\nwith fs_azure_auth_type = user-sas.
no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"seealso": [
"fs_azure_auth_type",
"Azure User SAS"
],
"added": [
{
"version": "Added: 3.1.2"
}
],
"text": "If enabled this emulates the unwanted behaviour of previous releases where all objects\nare stored with a '/' appended to the path.
\n", "plugin_link": "obox plugin" }, "fs_fscache_size": { "plugin": [ "obox" ], "tags": [ "fs-fscache" ], "values": [ { "label": "Size", "url": "size", "default_required": true } ], "default": 0, "text": "Size of the fscache.
\n", "plugin_link": "obox plugin" }, "fs_fscache_log_path": { "plugin": [ "obox" ], "added": [ { "version": "Added: 3.2.0" } ], "default": "fs_fscache_path/fscache.log",
"tags": [
"fs-fscache"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "Path to the fscache log file. It is recommended to place this file outside\nof fs_fscache_path so that if the filesystem partition used by\nfscache becomes full, the log file can still be written. Otherwise, this\ncould lead to fscache file leaks.
Note that when this setting is used, doveadm fscache rescan must use the\n--log-path parameter pointing to the correct log path.
Path to fscache root directory, which contains the cached files inside\nsubdirectories.
\n", "plugin_link": "obox plugin" }, "fs_dictmap_bucket_cache_path": { "plugin": [ "obox" ], "tags": [ "fs-dictmap" ], "values": [ { "label": "String", "url": "string" } ], "default": "[None]obox { "%{home}/buckets.cache" }",
"seealso": [
"fs_dictmap_bucket_size"
],
"text": "Required when fs_dictmap_bucket_size is set. Bucket counters are\ncached in this file. This path should be located under the obox indexes\ndirectory (on the SSD backed cache mount point; e.g.\n%{home}/buckets.cache).
obox { 11 }",
"seealso": [
"fs_dictmap_bucket_size"
],
"text": "Track Cassandra's tombstones in buckets.cache file to avoid creating\nexcessively large buckets when a lot of mails are saved and deleted in a\nfolder. The value should be one day longer than gc_grace_seconds for the\nuser_mailbox_objects table. By default this is 10 days, so in that case\nfs_dictmap_bucket_deleted_days = 11 should be used. When determining\nwhether fs_dictmap_bucket_size is reached and a new one needs to be\ncreated, with this setting the tombstones are also taken into account. This\ntracking is preserved only as long as the buckets.cache exists.
obox { 10000 }",
"seealso": [
"fs_dictmap_bucket_cache_path"
],
"dependencies": [
"fs_dictmap_bucket_cache_path"
],
"text": "Separate email objects into buckets, where each bucket can have a maximum of\nthis many emails. This should be set to 10000 with Cassandra to avoid\npartitions becoming too large when there are a lot of emails.
yes",
"seealso": [
"Uncertain Writes"
],
"text": "If a write to Cassandra fails with uncertainty and this setting is enabled\nDovecot attempts to clean it up.
\n", "plugin_link": "obox plugin" }, "fs_dictmap_delete_dangling_links": { "plugin": [ "obox" ], "tags": [ "fs-dictmap" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"seealso": [
"Obox Troubleshooting: Object exists in dict, but not in storage"
],
"text": "If an object exists in dict, but not in storage, delete it automatically from\ndict when it's noticed.
\nWARNING
\nThis setting isn't safe to use by default, because storage may return "object\ndoesn't exist" errors only temporarily during split brain.
\n10s",
"text": "Increase Cassandra's DELETE timestamp by this value. This is useful to make\nsure the DELETE isn't ignored because Dovecot backends' times are slightly\ndifferent.
WARNING
\nIf the same key is intentionally attempted to be written again soon afterwards,\nthe write becomes ignored. Dovecot doesn't normally do this, but this can\nhappen if the user is deleted with doveadm obox user delete and the same\nuser is recreated. This can also happen with doveadm backup that reverts\nchanges by deleting a mailbox; running the doveadm backup again will\nrecreate the mailbox with the same GUID.
Prefix that is added to all dict keys.
\nFor example fts-dovecot plugin writes everything to root. This setting is\nused in the defaults to make it write to the expected dict path prefix\n(%{user}/fts/), which is expected by the default dict maps.
nometacache { yes }",
"seealso": [
"Optimize Index Diff & Self-bundle Updates",
"metacache"
],
"text": "Store diff and self index bundle objects to a separate table. This is a\nCassandra-backend optimization.
\n", "plugin_link": "obox plugin" }, "fs_dictmap_lock_path": { "plugin": [ "obox" ], "tags": [ "fs-dictmap" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "fs_dictmap_refcounting_table",
"lazy-expunge plugin"
],
"text": "If fs_dictmap_refcounting_table is enabled, use this dictionary for\ncreating lock files to objects while they're being copied or deleted. This\nattempts to prevent race conditions where an object copy and delete runs\nsimultaneously and both succeed, but the copied object no longer exists. This\ncan't be fully prevented if different servers do this concurrently. If\nlazy-expunge plugin is used this setting isn't really needed, because such\nrace conditions are practically nonexistent. Not using the setting will\nimprove performance by avoiding a Cassandra SELECT when copying mails.
obox { 3 }",
"text": "Defines the maximum number of results returned from a dictionary iteration\nlookup (i.e. Cassandra CQL query) when checking the number of links to an\nobject. Limiting this may improve performance. Currently Dovecot only cares\nwhether the link count is 0, 1 or "more than 1" so for a bit of\nextra safety we recommend setting it to 3.
Increased default from 1 to 10
10",
"text": "Describes how many parallel dict iterations can be created internally. The\ndefault value is 10. Parallel iterations can especially help speed up\nreading huge folders.
no",
"seealso": [
"fs_dictmap_refcounting_table"
],
"text": "Similar to the fs_dictmap_refcounting_table setting, but instead of\nusing a reverse table to track the references, assume that the database has a\nreverse index set up.
noobox { yes }",
"seealso": [
"Reference Counting table"
],
"text": "Enable reference counted objects. Reference counting allows a single mail\nobject to be stored in multiple mailboxes, without the need to create a new\ncopy of the message data in object storage.
\n", "plugin_link": "obox plugin" }, "fs_dictmap_storage_objectid_migrate": { "plugin": [ "obox" ], "tags": [ "fs-dictmap" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"text": "This is expected to be used with fs_dictmap_storage_objectid_prefix\nwhen adding fs-dictmap for an existing installation. The newly created object\nIDs have <storage-objectid-prefix>/<object-id> path while the migrated\nobject IDs have <user>/mailboxes/<mailbox-guid>/<oid> path. The newly\ncreated object IDs can be detected from the 0x80 bit in the object ID's\nextra-data. Migrated object IDs can't be copied directly within dict -\nthey'll be first copied to a new object ID using the parent fs.
fs_dictmap_storage_passthrough_paths",
"obox plugin"
],
"text": "Use fake object IDs with object storage that internally uses paths. This makes\ntheir performance much better, since it allows caching object IDs in Dovecot\nindex files and copying them via dict. This works by storing object in\n<prefix>/<objectid>. This setting should be used inside obox plugin\nnamed filter for storing mails under <prefix> (but not for\nmetacache or fts).
For example:
\nfs_dictmap_storage_objectid_prefix = %{user}/mails/none",
"seealso": [
"fs_dictmap_storage_objectid_prefix"
],
"text": "Use fake object IDs with object storage that internally uses path. Assume that\nobject ID is the same as the path. Objects can't be copied within the dict.\nThis setting should be used inside metacache and\nfts_dovecot named filters, because they don't need to support\ncopying objects. For mails, use fs_dictmap_storage_objectid_prefix\ninstead.
| Value | \nDescription | \n
|---|---|
none | \nDon't use fake object IDs. | \n
full | \nThe object ID is written to dict as an empty value, because it's not used. | \n
read-only | \nUseful for backwards compatibility. The path is written to the dict as the object ID even though it is not used (except potentially by an older Dovecot version). | \n
Headers to add to HTTP requests.
\n", "plugin_link": "obox plugin" }, "fs_http_log_headers": { "plugin": [ "obox" ], "tags": [ "fs-http" ], "values": [ { "label": "Boolean List", "url": "Boolean List" } ], "text": "Headers with the given name in HTTP responses are logged as part of any error,\ndebug or warning messages related to the HTTP request. These headers are also\nincluded in the http_request_finished event as fields prefixed with\nhttp_hdr_.
If non-zero add X-Dovecot-Reason: header to the HTTP request. The value\ncontains a human-readable string why the request is being sent.
5s",
"text": "Log a warning about any HTTP request that takes longer than this time.
\n", "plugin_link": "obox plugin" }, "fs_http_log_trace_headers": { "plugin": [ "obox" ], "tags": [ "fs-http" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "yes",
"text": "If yes add X-Dovecot-User: and X-Dovecot-Session: headers to HTTP\nrequest. The session header is useful to correlate object storage requests to\nAppSuite/Dovecot sessions.
fs_s3_url",
"fs_azure_url"
],
"text": "Setting to append a suffix to fs-http based fs drivers url.
\nFor example fts-dovecot plugin writes everything to root. This setting is\nused in the defaults to make it write to the expected path suffix in storage\n(%{user}/fts/).
Filter for S3-specific settings.
\n", "plugin_link": "obox plugin", "no_default": true }, "fs_s3_access_key": { "plugin": [ "obox" ], "tags": [ "fs-s3" ], "values": [ { "label": "String", "url": "string" } ], "text": "S3 access key. Not needed when AWS IAM is used.
\n", "plugin_link": "obox plugin" }, "fs_s3_secret": { "plugin": [ "obox" ], "tags": [ "fs-s3" ], "values": [ { "label": "String", "url": "string" } ], "text": "S3 secret. Not needed when AWS IAM is used.
\n", "plugin_link": "obox plugin" }, "fs_s3_signing": { "plugin": [ "obox" ], "default": "v4",
"tags": [
"fs-s3"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"v4",
"v2"
],
"seealso": [
"fs_s3_region"
],
"text": "AWS s3 signing version to use. It is recommended to keep the default\nv4 signing which also requires\nfs_s3_region to be set. The AWS v2 signing\nis deprecated.
169.254.169.254",
"text": "AWS IAM hostname. Normally there is no reason to change this. This is mainly\nintended for testing.
\n", "plugin_link": "obox plugin" }, "fs_s3_auth_port": { "plugin": [ "obox" ], "advanced": true, "tags": [ "fs-s3" ], "values": [ { "label": "Port Number", "url": "Port Number", "default_required": true } ], "default": "80",
"text": "AWS IAM port. Normally there is no reason to change this. This is mainly\nintended for testing.
\n", "plugin_link": "obox plugin" }, "fs_s3_auth_role": { "plugin": [ "obox" ], "tags": [ "fs-s3" ], "values": [ { "label": "String", "url": "string" } ], "seealso": [ "IAM Authentication" ], "text": "If not empty, perform AWS IAM lookup using this role.
\n", "plugin_link": "obox plugin" }, "fs_s3_bucket": { "plugin": [ "obox" ], "tags": [ "fs-s3" ], "values": [ { "label": "String", "url": "string" } ], "text": "S3 bucket name added to the request path.
\n", "plugin_link": "obox plugin" }, "fs_s3_bulk_delete_limit": { "plugin": [ "obox" ], "tags": [ "fs-s3" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": "1000",
"text": "Number of deletes supported within the same bulk delete request. 0 disables\nbulk deletes.
fs_s3_signing"
],
"text": "Specify region name for AWS S3 bucket. Only needed when using v4 signing.
\n", "plugin_link": "obox plugin" }, "fs_s3_url": { "plugin": [ "obox" ], "tags": [ "fs-s3" ], "values": [ { "label": "String", "url": "string" } ], "text": "URL for accessing the S3 storage. For example:\nhttps://BUCKETNAME.s3.example.com
Filter for sproxyd-specific settings.
\n", "plugin_link": "obox plugin", "no_default": true }, "fs_sproxyd_access_by_path": { "plugin": [ "obox" ], "advanced": true, "tags": [ "fs-sproxyd" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"text": "Objects are accessed by the path instead of by the object ID. Scality sproxyd\ninternally converts the paths into object IDs.
\n", "plugin_link": "obox plugin" }, "fs_sproxyd_avoid_423_timeout": { "plugin": [ "obox" ], "advanced": true, "tags": [ "fs-sproxyd" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "default": 0, "text": "Delay DELETE requests if the same object ID has been\nGET/HEAD/PUT by the same process within\nMillisecond Time. This is intended to reduce\n423 Locked sent by Scality.
When 0, no delay is added. Only use this setting, if it can be seen to\nbring a benefit. Careful investigation of current error-rates and consideration\nof the overall throughput of the platform are recommended before using it.
2",
"text": "Scality Class of Service. 2 means that the objects are written to the\nScality RING 3 times in total. This is generally the minimum allowable\nredundancy for mail and index objects.
FTS data is more easily reproducible, so losing those indexes is not as\ncritical; Class of Service 1 may be appropriate based on customer\nrequirements.
URL for accessing the sproxyd storage.
\n", "plugin_link": "obox plugin" }, "metacache": { "plugin": [ "obox" ], "values": [ { "label": "Named Filter", "url": "Named Filter", "no_default": true } ], "seealso": [ "fs",
"obox plugin"
],
"text": "Named filter for initializing FS Driver for obox index bundles.
\n", "plugin_link": "obox plugin", "no_default": true }, "metacache_close_delay": { "default": "2secs",
"plugin": [
"obox"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "If user was accessed this recently, assume the user's indexes are\nup-to-date. If not, list index bundles in object storage (or Cassandra) to\nsee if they have changed. This typically matters only when user is being\nmoved to another backend and soon back again, or if the user is\nsimultaneously being accessed by multiple backends.
\n", "plugin_link": "obox plugin" }, "metacache_forced_refresh_interval": { "default": "8 hours",
"plugin": [
"obox"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"added": [
{
"version": "Added: 3.0.0"
}
],
"text": "If the user indexes haven't been refreshed for this long time, force the\nrefresh. This is done by ignoring the\nmetacache_close_delay setting (i.e. same as if it is 0).
This setting allows highly active users' indexes still to be refreshed once\nin a while. (Although if the user has an active session 100% of the time,\nthe refresh cannot be done.)
\n", "plugin_link": "obox plugin" }, "metacache_max_grace": { "default": "1G",
"plugin": [
"obox"
],
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"text": "How much disk space on top of metacache_max_space can be used\nbefore Dovecot stops allowing more users to login.
unlimited",
"plugin": [
"obox"
],
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"text": "How much disk space metacache can use before old data is cleaned up.
\nGenerally, this should be set at ~90% of the available disk space.
\n", "plugin_link": "obox plugin" }, "metacache_rescan_interval": { "default": "1 day",
"plugin": [
"obox"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"seealso": [
"metacache_roots"
],
"advanced": true,
"text": "How often to run a background metacache rescan, which makes sure that the\ndisk space usage tracked by metacache process matches what really exists on\nfilesystem.
\nThe desync may happen, for example, because the metacache process (or the\nwhole backend) crashes.
\nThe rescanning helps with two issues:
\nSetting this to 0 disables the rescan.
It's also possible to do this manually by running the\ndoveadm metacache rescan command.
mail_home and mail_chroot",
"plugin": [
"obox"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"seealso": [
"metacache_rescan_interval"
],
"advanced": true,
"text": "List of metacache root directories, separated with :.
Usually this is automatically parsed directly from mail_home and\nmail_chroot settings.
Accessing a metacache directory outside these roots will result in a\nwarning: "Index directory is outside metacache_roots".
\nIt's possible to disable this check entirely by setting the value to :.
TIP
\nThis setting is required for metacache_rescan_interval.
3 days",
"plugin": [
"obox"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"advanced": true,
"text": "Specifies the duration of inactivity after which a user is considered inactive.
\nIf a user has not been accessed within the specified time period,\nthey are marked as inactive. Any inactive users whose metacache is in a different\nbackend are periodically cleaned up.
\n", "plugin_link": "obox plugin" }, "metacache_upload_interval": { "default": "5min",
"plugin": [
"obox"
],
"values": [
{
"label": "Time",
"url": "time",
"default_required": true
}
],
"text": "How often to upload important index changes to object storage?
\nThis mainly means that if a backend crashes during this time, message flag\nchanges within this time may be lost. A longer time can however reduce the\nnumber of index bundle uploads.
\n", "plugin_link": "obox plugin" }, "metacache_pull": { "plugin": [ "obox" ], "values": [ { "label": "Named Filter", "url": "Named Filter", "no_default": true } ], "seealso": [ "metacache_pull_enabled"
],
"text": "Named filter for configuring dictionary to update metacache_last_host\nfield in cluster_geodb.
metacache_pull"
],
"default": "yes",
"text": "By default metacache pulling is enabled.
\nThe Palomar Proxy's cluster process looks up the metacache_last_host\nautomatically from cluster_geodb and forwards it to the backend.\nIf the looked up host differs from the current host\n(cluster_backend_name), metacache is pulled from the\nmetacache_last_host backend.
fs",
"metacache"
],
"text": "Named filter for initializing FS Driver for obox mails.
\nINFO
\nSee the storage provider pages for specific parameters that can be used.
\nmail_prefetch_count",
"plugin": [
"obox"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"text": "Maximum number of email HTTP copy/link operations to do in parallel.
\nIf the storage driver supports bulk-copy/link operation, this controls how\nmany individual copy operations can be packed into a single bulk-copy/link\nHTTP request.
\n", "plugin_link": "obox plugin" }, "obox_max_parallel_deletes": { "default": "mail_prefetch_count",
"plugin": [
"obox"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"text": "Maximum number of email HTTP delete operations to do in parallel.
\nIf the storage driver supports bulk-delete operation, this controls how\nmany individual delete operations can be packed into a single bulk-delete\nHTTP request.
\n", "plugin_link": "obox plugin" }, "obox_max_parallel_writes": { "default": "mail_prefetch_count",
"plugin": [
"obox"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"text": "Maximum number of email write HTTP operations to do in parallel.
\n", "plugin_link": "obox plugin" }, "metacache_refresh_index_once_after": { "default": 0, "plugin": [ "obox" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "text": "This forces the next mailbox open after the specified UNIX timestamp to\nrefresh locally cached indexes to see if other backends have modified the\nuser's indexes simultaneously.
\n", "plugin_link": "obox plugin" }, "metacache_rescan_mails_once_after": { "default": 0, "plugin": [ "obox" ], "values": [ { "label": "Unsigned Integer", "url": "unsigned integer", "default_required": true } ], "text": "This forces the next mailbox open after the specified UNIX timestamp to\nrescan the mails to make sure there aren't any unindexed mails.
\n", "plugin_link": "obox plugin" }, "obox_track_copy_flags": { "default": "no",
"plugin": [
"obox"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "This is an optimization for Dictmap/Cassandra and\nlazy-expunge plugin with lazy_expunge_only_last_instance = yes,\nwhich attempts to avoid Cassandra SELECTs when expunging mails.
Changed: 3.2.0 This is\nenabled by using @fs_dictmap_defaults = cassandra
It works by adding an internal invisible "copied" flag for mails when they\nare copied. If a copied-flag is not found for "trusted UID range", the\nmail's reference count is returned as 1 for the lazy_expunge lookup.\nOtherwise the reference count lookup is done from Cassandra. The "trusted\nUID range" is only the messages that are saved since the metacache was last\ndownloaded, i.e. the optimization only works for new mails. If it was done\nalso for old mails, the result could be wrong after a backend crashes,\nsince it could lose some of the copied-flags. This optimizes only the\nlazy_expunge plugin's reference count lookup, not the final expunges in the\nlazy_expunge folder, so even if something goes wrong and refcount=1 is wrongly\nreturned, the worst that can happen is that a mail is moved to lazy_expunge\nfolder too early.
\n", "plugin_link": "obox plugin" }, "metacache_bg_root_uploads": { "default": "no",
"plugin": [
"obox"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"advanced": true,
"text": "By default, doing changes to folders (e.g. creating or renaming) uploads\nchanges immediately to object storage. If this setting is enabled, the\nupload happens sometimes later (within metacache_upload_interval).
yes",
"plugin": [
"obox"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"advanced": true,
"text": "Enable caching bundle list.
\n", "plugin_link": "obox plugin" }, "metacache_secondary_indexes": { "default": "yes",
"plugin": [
"obox"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"advanced": true,
"text": "Enable including secondary indexes into the user root bundle when using\nthe virtual or virtual-attachments plugin.
\nThis setting can be used to exclude the virtual and virtual-attachments\nfolders from the user root bundle in case any problems are encountered.
\n", "plugin_link": "obox plugin" }, "metacache_index_merging": { "default": "v2",
"plugin": [
"obox"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"advanced": true,
"text": "Specifies the algorithm to use when merging folder indexes.
\n| Algorithm | \nDescription | \n
|---|---|
none | \nDisable the merging algorithm | \n
v2 | \nThe new algorithm designed specifically for this purpose of merging two indexes. This is the recommended setting. | \n
10",
"plugin": [
"obox"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"advanced": true,
"text": "Maximum number of metacache read/write operations to do in parallel.
\n", "plugin_link": "obox plugin" }, "metacache_merge_max_uid_renumbers": { "default": "100",
"plugin": [
"obox"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"advanced": true,
"text": "This is used only with metacache_index_merging = v2.
If the merging detects that there are more than this many UIDs that are\nconflicting and would have to be renumbered, don't renumber any of them.\nThis situation isn't expected to happen normally, and renumbering too many\nUIDs can cause unnecessary extra disk I/O.
\nThe downside is that a caching IMAP client might become confused if it had\npreviously seen different UIDs.
\n", "plugin_link": "obox plugin" }, "metacache_priority_weights": { "plugin": [ "obox" ], "values": [ { "label": "String", "url": "string" } ], "advanced": true, "text": "\n", "plugin_link": "obox plugin" }, "metacache_size_weights": { "plugin": [ "obox" ], "values": [ { "label": "String", "url": "string" } ], "advanced": true, "text": "Whenever metacache notices that metacache_max_space has been\nreached, it needs to delete some older index files to make space for new ones.\nThis is done by calculating cleanup weights.
The simplest cleanup weight is to just use the user's last access UNIX\ntimestamp as the weight. The lowest weight gets deleted first.
\nIt's possible to enable using only simple weights by explicitly setting\nmetacache_priority_weights and this setting\nto empty values. However, by default priorities are taken into account when\ncalculating the weight.
The metacache_priority_weights setting can be used to fine tune how\nmetacache adjusts the cleanup weights for different index priorities. There\nare 4 major priorities (these are also visible in e.g.\ndoveadm metacache list output):
| Priority | \nDescription | \n
|---|---|
0 | \nUser root indexes (highest priority) | \n
1 | \nFTS indexes | \n
2 | \nINBOX and Junk folder indexes ("special" folders) | \n
3 | \nNon-special folder indexes (lowest priority) | \n
The metacache_priority_weights contains <percentage> <weight adjustment> pairs for each of these priorities. So, for example, the\nfirst 10% +1d applies to the user root priority and the last 100% 0\napplies to other folders' priority.
The weight calculation is then done by:
\nmetacache_priority_weights is next looked up for the given\npriority indexes<percentage>, add <weight adjustment> to weight. So, for\nexample, with 10% +1d if the disk space used by index files of this\npriority type take <= 10% of metacache_max_space, increase the\nweight by 1d = 60*60*24 = 86400.+1d typically gives 1 extra day for the index files to exist\ncompared to index files that don't have the weight boost.<percentage> exists so that the weight boost doesn't cause some\nindex files to dominate too much. For example, if root indexes' weights\nweren't limited, it could be possible that the system would be full of\nonly root indexes and active users' other indexes would be cleaned\nalmost immediately.This setting is used to do final adjustments\ndepending on the disk space used by this user's indexes of the specific\npriority. The setting is in format\n<low size> <low weight adjustment> <max size> <high weight adjustment>.
The weight adjustment calculation is:
\n<low size>, increase weight by\n(<low size> - <disk space>) * <low weight adjustment> / <low size><disk space> to <max size> and increase\nweight by (<disk space> - <low size>) * <high weight adjustment> / (<max size> - <low size>)2M +30 1G +120 value the priority adjustments will\nlook like:\n+30+23+15+80+1+6+12+30+60+120Example:
\nmetacache_priority_weights = 10% +1d 10% +1d 50% +1h 100% 0\nmetacache_size_weights = 2M +30 1G +120metacache/metacache-users.db",
"plugin": [
"obox"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"advanced": true,
"text": "Path to a database which metacache process periodically writes to.
\nThis database is read by metacache at startup to get the latest state.
\nThe path is relative to state_dir.
no",
"plugin": [
"obox"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"advanced": true,
"text": "Normally Dovecot attempts to make sure that IMAP UIDs aren't lost even if\na backend crashes (or if user is moved to another backend without indexes\nfirst being uploaded). This requires uploading index bundles whenever\nexpunging recently saved mails. Setting this to "yes" avoids this extra\nindex bundle upload at the cost of potentially changing IMAP UIDs. This\ncould cause caching IMAP clients to become confused, possibly even causing\nit to delete wrong mails. Also FTS indexes may become inconsistent since\nthey also rely on UIDs.
\n", "plugin_link": "obox plugin" }, "obox_autofix_storage": { "default": "no",
"plugin": [
"obox"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"advanced": true,
"text": "If activated, when an unexpected 404 is found when retrieving a message\nfrom object storage, Dovecot will rescan the mailbox by listing its\nobjects. If the 404-object is still listed in this query, Dovecot issues a\nHEAD to determine if the message actually exists. If this HEAD request\nreturns a 404, the message is dropped from the index. The message object is\nnot removed from the object storage.
\n", "plugin_link": "obox plugin" }, "obox_avoid_cached_vsize": { "default": "no",
"plugin": [
"obox"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"advanced": true,
"text": "Avoid getting the email's size from the cache whenever the email body is\nopened anyway. This avoid unnecessary errors if a lot of the vsizes are\nwrong. The vsize in dovecot.index is also automatically updated to the\nfixed value with or without this setting.
\nThis setting was mainly useful due to earlier bugs that caused the vsize to\nbe wrong in many cases.
\n", "plugin_link": "obox plugin" }, "obox_disable_fast_copy": { "default": "no",
"plugin": [
"obox"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"advanced": true,
"text": "Workaround for object storages with a broken copy operation. Instead\nperform copying by reading and writing the full object.
\n", "plugin_link": "obox plugin" }, "obox_use_object_ids": { "default": "yes",
"plugin": [
"obox"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"advanced": true,
"text": "If enabled, access objects directly via their IDs instead of by path, if\npossible.
\n", "plugin_link": "obox plugin" }, "obox_fetch_lost_mails_as_empty": { "default": "no",
"plugin": [
"obox"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"advanced": true,
"seealso": [
"storage workarounds"
],
"text": "Cassandra: "Object exists in dict, but not in storage" errors will be\nhandled by returning empty emails to the IMAP client. The tagged FETCH\nresponse will be OK instead of NO.
recovered-lost-folder-",
"plugin": [
"obox"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"advanced": true,
"text": "If folder name is lost entirely due to lost index files, generate a name\nfor the folder using this prefix.
\n", "plugin_link": "obox plugin" }, "obox_max_rescan_mail_count": { "default": "10",
"plugin": [
"obox"
],
"values": [
{
"label": "Unsigned Integer",
"url": "unsigned integer",
"default_required": true
}
],
"advanced": true,
"text": "Keep a maximum of this many newly saved mails in local metacache indexes\nbefore metacache is flushed to object storage. For example with a value of\n10, every 11th mail triggers a metacache flush. Note that the flush isn't\nimmediate - it will happen in the background some time within the next\nmetacache_upload_interval.
A higher value reduces the number of index bundle uploads, but increases the\nnumber of mail downloads to fill the caches after a backend crash.
\n", "plugin_link": "obox plugin" }, "obox_pop3_backend_uidls": { "default": "yes",
"plugin": [
"obox"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"advanced": true,
"text": "If set to no, don't try to lookup migrated POP3 UIDLs from email metadata\nin any situation. This used to bring performance improvements, but now the\nexistence of migrated UIDLs is tracked more efficiently and there should be no\nneed to change this setting.
warn-read",
"plugin": [
"obox"
],
"values": [
{
"label": "String",
"url": "string",
"enum_required": true
}
],
"values_enum": [
"warn-read",
"read",
"stat"
],
"advanced": true,
"text": "This setting controls what should be done when the mail object is missing\nthe size metadata.
\nOptions:
\n| Value | \nDescription | \n
|---|---|
read | \nSame as warn-read, but doesn't log a warning. | \n
stat | \nUse fs_stat() to get the size, which is the fastest but doesn't work if mails are compressed or encrypted. | \n
warn-read | \nLog a warning and fallback to reading the email to calculate its size. | \n
Product name for unified quota.
\n", "plugin_link": "unified-quota plugin" }, "quota_unified_dict_unset": { "plugin": [ "unified-quota" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"text": "When updating the unified quota dictionary, specifies whether the dict record\nis first "unset" before setting it again.
\n", "plugin_link": "unified-quota plugin" }, "sieve_zimbra_addressbook_dict": { "plugin": [ "sieve-zimbra-compat" ], "values": [ { "label": "String", "url": "string" } ], "text": "Configuration for the dict lookup. This should normally point to the dict proxy,\nso that asynchronous batch lookups are possible.
\n", "plugin_link": "sieve-zimbra-compat plugin" }, "sieve_zimbra_bare_extensions": { "plugin": [ "sieve-zimbra-compat" ], "values": [ { "label": "String", "url": "string" } ], "text": "A space-separated list of all the Zimbra extensions that are made available\nwithout the prefix.
\nNote that this hides any standard extension with the same name as one of\nZimbra extensions; e.g., the "date" extension will become the Zimbra version\nonce the "date" extension is listed in this setting.
\n", "plugin_link": "sieve-zimbra-compat plugin" }, "sieve_zimbra_notify_as_redirect": { "default": "no",
"plugin": [
"sieve-zimbra-compat"
],
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "If enabled, executes the "vnd.zimbra.notify" action as a "redirect" action.
\n", "plugin_link": "sieve-zimbra-compat plugin" }, "sieve_zimbra_notify_envelope_from": { "default": "sieve_notify_mailto_envelope_from or postmaster",
"plugin": [
"sieve-zimbra-compat"
],
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "Specifies what envelope sender address is used for notification emails.\nThe following values are supported for this setting:
\n| Value | \nDescription | \n
|---|---|
sender | \nThe sender address is used. | \n
recipient | \nThe final recipient address is used. | \n
orig_recipient | \nThe original recipient is used. | \n
user_email | \nThe user's primary address is used. This is configured with sieve_user_email. If that setting is not configured, user_mail is equal to recipient. | \n
postmaster | \nThe postmaster_address configured for the LDA. | \n
<user@domain> | \nNotifications are always sent from user@domain. The angle brackets are mandatory. The null ("<>") address is also supported. | \n
The "From" header is based on this setting as well. When the envelope sender\nof the processed message is the null address "<>", the envelope sender of the\nnotification is also always "<>", irrespective of what is configured for\nthis setting.
\n", "plugin_link": "sieve-zimbra-compat plugin" }, "message_hashing_hash_method": { "plugin": [ "message-hashing" ], "default": "md5",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The hashing method to use. Must be a recognized Dovecot hashing method\n(see auth_policy_hash_mech for list of supported methods).
1 B",
"values": [
{
"label": "Size",
"url": "size",
"default_required": true
}
],
"text": "The minimum size of an attachment to be processed; attachments smaller than\nthis will be skipped.
\n", "plugin_link": "message-hashing plugin" }, "fs_server": { "default": "", "plugin": [ "obox" ], "values": [ { "label": "Named Filter", "url": "Named Filter", "no_default": true } ], "text": "Specifies how to store files with fs-server.
\n", "seealso": [ "Object storage server emulator" ], "plugin_link": "obox plugin", "no_default": true }, "intercept": { "tags": [ "intercept-common" ], "values": [ { "label": "Named List Filter", "url": "Named List Filter" } ], "seealso": [ "intercept_driver"
],
"text": "Enables the intercept driver. Only one intercept driver can be enabled. The\nfilter name refers to the intercept_driver setting.
Example:
\nintercept utimaco {\n # ...\n}Since an empty dict_driver defaults to dict_name, there\nis no need to specify the dict_driver setting explicitly.
The intercept driver to use. Configure this via\nthe intercept_driver setting instead.
<system time zone>",
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "Allows choosing a time zone for the proxy that is different than the default\nsystem time zone. This is useful for some backends (Utimaco) that use\ntimestamps without time zone field and expect a specific time zone.
\nThe syntax is identical to the TZ environment variable.
\n" }, "intercept_fs": { "tags": [ "intercept-fs" ], "values": [ { "label": "Named Filter", "url": "Named Filter", "no_default": true } ], "text": "Named filter for intercept FS driver settings.
\n", "no_default": true }, "intercept_fs_header_line": { "tags": [ "intercept-fs" ], "values": [ { "label": "String", "url": "string" } ], "text": "Add a header to the log.
\nSee variables for supported variable substitutions.
\n" }, "intercept_fs_rotate_interval": { "tags": [ "intercept-fs" ], "values": [ { "label": "Time", "url": "time", "default_required": true } ], "default": "5min",
"text": "Flush log and create a new one this often.
\n" }, "intercept_fs_rotate_at_midnight": { "tags": [ "intercept-fs" ], "default": "no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Rotate the log at midnight (server's local timezone).
\n" }, "intercept_fs_rotate_size": { "tags": [ "intercept-fs" ], "values": [ { "label": "Size", "url": "size", "default_required": true } ], "default": 0, "text": "Rotate the log when it reaches this size.
\nIf 0, never rotate.
Path to temporary files creating intercepted data.
\nNeeded only when intercept_buffer_max_size > 0.
0",
"text": "Write intercept buffers larger than this into temporary files in\nintercept_buffer_dir.
If 0, buffers are always kept in memory.
Named filter for intercept Pine driver settings.
\n", "no_default": true }, "intercept_pine_host": { "tags": [ "intercept-pine" ], "values": [ { "label": "String", "url": "string" } ], "text": "PineApp server's hostname.
\n" }, "intercept_pine_port": { "tags": [ "intercept-pine" ], "values": [ { "label": "Port Number", "url": "Port Number", "default_required": true } ], "default": "", "text": "PineApp server's port.
\nWARNING
\nThis value must be set if using PineApp, or else Dovecot will not start.
\nValue for the %{crypted_user} variable. The most secure way to generate\nthis is to generate a unique identifier for each intercept request's\nintercept_id and use that as the salt:
intercept_crypted_user = %{user | encrypt(key='secret',salt=userdb:intercept_id,raw=1)}For backwards compatibility with old intercept_crypt_* settings, use:
intercept_crypted_user = %{user | encrypt(hash='sha1',rounds=16,key='intercept_crypt_key',salt='intercept_crypt_key',algorithm='intercept_crypt_cipher',raw=1)}If set, intercept is activated for this user.
\nAdditionally, this value is passed to the intercept-proxy as an intercept-ID\nin the interception session.
\nNote
\nThis is intended to be set in a user's session by userdb lookup.
\nIt is documented here for completion's sake.
\nNote
\nThe login-intercept plugin uses passdb: Extra Fields instead of\nthis value.
\nNamed filter for intercept Utimaco driver settings.
\n", "no_default": true }, "intercept_api_utimaco_sql_query_surveillance": { "tags": [ "intercept-api", "intercept-utimaco" ], "values": [ { "label": "String", "url": "string" } ], "default": "\nSELECT uuid, UNIX_TIMESTAMP(created) AS created FROM targets WHERE userid_hash = '%{user | md5 | hexlify}'",
"advanced": true,
"text": "The SQL query used to obtain surveillance information (from the Utimaco X1\nservice) about a particular e-mail address.
\nSee intercept_utimaco_x1_sql_query_check_surveillance for variable\nsubstitution information.
\nSELECT uuid FROM targets WHERE userid_hash = '%{userid | md5 | hexlify}",
"advanced": true,
"text": "The SQL query used to check (from Utimaco X1 service) whether an e-mail\naddress is already surveilled.
\nVariable substitutions supported:
\n| Variable | \nDescription | \n
|---|---|
%{userid} | \nUser ID | \n
%{uuid} | \nUUID | \n
%{address} | \nAddress | \n
\nINSERT INTO targets (userid_hash, uuid, address) VALUES ('%{userid | md5 | hexlify}', '%{uuid}', '%{address}')",
"advanced": true,
"text": "The SQL query used to add a new target to the Utimaco X1 surveillance database.
\nSee intercept_utimaco_x1_sql_query_check_surveillance for variable\nsubstitution information.
DELETE FROM targets WHERE uuid = '%{uuid}'",
"advanced": true,
"text": "The SQL query used to remove a target from the Utimaco X1 surveillance\ndatabase.
\nSee intercept_utimaco_x1_sql_query_check_surveillance for variable\nsubstitution information.
SELECT userid_hash, address FROM targets WHERE uuid = '%{uuid}'",
"advanced": true,
"text": "The SQL query used to get information (from the Utimaco X1 surveillance\ndatabase) about a surveilled user.
\nSee intercept_utimaco_x1_sql_query_check_surveillance for variable\nsubstitution information.
SELECT uuid FROM targets WHERE uuid = '%{uuid}'",
"advanced": true,
"text": "The SQL query used to check (from the Utimaco X1 surveillance database)\nwhether an UUID is currently surveilled.
\nSee intercept_utimaco_x1_sql_query_check_surveillance for variable\nsubstitution information.
SELECT uuid FROM targets",
"advanced": true,
"text": "The SQL query used to list all items from the Utimaco X1 surveillance database.
\nSee intercept_utimaco_x1_sql_query_check_surveillance for variable\nsubstitution information.
no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Enable the Utimaco testing mode for the utimaco-x1 service, in which the use\nof TLS is not required.
\n" }, "intercept_utimaco_x3_url": { "tags": [ "intercept-utimaco" ], "values": [ { "label": "URL", "url": "URL" } ], "text": "The HTTP URL of the Utimaco X3 receiver.
\n" }, "intercept_utimaco_x3_rawlog_dir": { "tags": [ "intercept-utimaco" ], "advanced": true, "values": [ { "label": "String", "url": "string" } ], "text": "If this directory exists, and it is writable by the utimaco-x3 service,\nthe messages exchanged between client and server are logged here. This is\nuseful for debugging.
\n" }, "intercept_utimaco_x3_debug": { "tags": [ "intercept-utimaco" ], "advanced": true, "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"text": "Enable debug logging for utimaco-x3 service.
\n" }, "intercept_utimaco_x3_kafka_brokers": { "tags": [ "intercept-utimaco" ], "values": [ { "label": "String", "url": "string" } ], "text": "A list of brokers that are used to establish an initial connection to the\nKafka cluster. At least one is required when Kafka is used. It is not required\nto list all brokers in the cluster; the full list is established during\nprotocol initialization.
\nSeparate brokers with spaces, , or ; in the setting.
The name of the Kafka topic the event messages are submitted to. This setting\ndetermines whether kafka is used; if this is not configured, the system will\nattempt direct submission to the X3 endpoint through HTTP.
\n" }, "intercept_utimaco_x3_kafka_consumer_group": { "tags": [ "intercept-utimaco" ], "default": "utimaco-x3-consumers",
"advanced": true,
"values": [
{
"label": "String",
"url": "string"
}
],
"text": "The name of the Kafka consumer group used by the utimaco-x3-kafka consumer\nservice. This is currently only used to record the current consumption offset\non the Kafka cluster; it is currently not possible to have more than a single\nconsumer!
\n" }, "intercept_utimaco_x3_kafka_consume_interval": { "tags": [ "intercept-utimaco" ], "values": [ { "label": "Time", "url": "time", "default_required": true } ], "default": 0, "text": "The maximum time a broker is requested to wait before responding to a\nconsumer. If there are no messages queued, the broker will respond with an\nempty list of messages. Use this to keep the connection with the broker\nactive.
\n" }, "intercept_utimaco_x3_kafka_consume_max_size": { "tags": [ "intercept-utimaco" ], "values": [ { "label": "Size", "url": "size", "default_required": true } ], "advanced": true, "default": "10M",
"text": "Limit a batch of consumed messages to approximately this size.
\n" }, "intercept_utimaco_x3_kafka_consume_min_size": { "tags": [ "intercept-utimaco" ], "values": [ { "label": "Size", "url": "size", "default_required": true } ], "default": 0, "advanced": true, "text": "The broker will respond to a consumer when a batch of messages with this\ncumulative size is available.
\n" }, "intercept_utimaco_x3_testing": { "tags": [ "intercept-utimaco" ], "advanced": true, "default": "no",
"values": [
{
"label": "Boolean",
"url": "boolean",
"default_required": true
}
],
"text": "Enable the Utimaco testing mode for the utimaco-x3 service, in which the use\nof TLS is not required.
\n" }, "intercept_box_path": { "plugin": [ "intercept-box" ], "values": [ { "label": "String", "url": "string" } ], "text": "Path to save the mail intercepted via the intercept-box plugin.
\nFor example:
\nintercept_box_path = %{crypted_user}/%{timestamp}.%{generate:guid128}.SMTP.%{type}.emlVariable substitutions supported:
\n| Variable | \nDescription | \n
|---|---|
user | \nuser@domain (based on the folder name) | \n
crypted_user | \nuser@domain encrypted via intercept_crypted_user | \n
timestamp | \ntimestamp (based on the folder name) | \n
type | \ntype (based on the folder name) | \n
Mail User Variables can also be used.
\n", "plugin_link": "intercept-box plugin" }, "intercept_box_add_headers": { "plugin": [ "intercept-box" ], "values": [ { "label": "String List", "url": "String List" } ], "seealso": [ "intercept_box_path"
],
"text": "Headers to add to HTTP requests, when intercept_box is configured\nwith HTTP-based fs storage.
See intercept_box_path for supported variable substitutions.
Named filter for intercept-box settings.
\n", "plugin_link": "intercept-box plugin", "no_default": true }, "imap_intercept_disconnect_after": { "plugin": [ "imap-intercept" ], "values": [ { "label": "Time", "url": "time", "default_required": true } ], "default": "infinite",
"text": "The IMAP client is disconnected after this amount of time, and interception\nis discontinued.
\nThis timeout prevents repeated interception of a very long session\n(disconnection is performed for all users, so that interception-specific\nbehavior isn't obvious to the user).
\n", "plugin_link": "imap-intercept plugin" }, "intercept_debug": { "tags": [ "intercept-common" ], "values": [ { "label": "Boolean", "url": "boolean", "default_required": true } ], "default": "no",
"text": "Normally, the intercept plugins don't log much of anything, even in error\nsituations, because we want to avoid making visible which users are being\nintercepted.
\nSet this value to true to output additional debugging information.
\n" } }