Dovecot Pro 3.1.0

Upgrading Information:

Upgrading from OX Dovecot Pro 3.0.x to Dovecot Pro 3.1.x

Status

First Customer Shipment	2025-XX-XX
Support End	TBD
Current Support Status

Release Notes

Previous Version

Dovecot Pro v3.0.1

This is the first major release of Dovecot Pro v3.1.

In addition to bug fixes and optimizations, this release contains new features, as well as removals of existing features.

Known Issues

Deploying Dovecot Pro Palomar Controller with docker-compose is experimental.

Dovecot

New Features

DOV-6263: Support inline ACLs in config file, see acl plugin for more information.
DOV-6325: Added %{system:cpu_count} variable.
DOV-6383: Dovecot now supports alpn.
DOV-7328: Add support for peer certificate fingerprinting. This can be used to log or validate client certificates during login process.
- NEW SETTING: ssl_peer_certificate_fingerprint_hash
DOV-7330: Support PLUS variants of SCRAM-SHA-1 and SCRAM-SHA-256 mechanisms.
DOV-7336: Add simple i;unicode-casemap comparator. It cannot do character decomposition.

Changes

DOV-6003: metric { filter } ignored events without an explicit event name. Unnamed leaf events are still not sent to stats, but unnamed parent events are, and they can now match the filter. This can cause unexpected changes in metrics output. Be sure to include an explicit "event=name" in all filters to avoid problems.
DOV-6004: All settings now support %{variables}, except for log_timestamp, listen and inet_listener { address }.
DOV-6004: Unset service { ... } settings now default to the global service_* settings. The 0 values no longer mean "default" values - instead they're treated as invalid values. The default_process_limit, default_client_limit, default_idle_kill and default_vsz_limit settings were removed. Use the global service_process_limit, service_client_limit, service_idle_kill and service_vsz_limit instead.
DOV-6004: postmaster_address setting that is explicitly set to empty no longer generates an address. Keep the setting as default (unset) instead to preserve the old behavior.
DOV-6004: submission_backend_capabilities setting that is explicitly set to empty means now to propagate the connected backend's capabilities. Use "none" to preserve the old behavior of "no capabilities".
DOV-6004: namespace { alias_for } now points to the namespace section name, not the namespace prefix.
DOV-6019: namespace { alias_for } now points to the namespace name, not the prefix.
DOV-6019: Empty submission_backend_capabilities value now means to propagate backend's capabilities. To disable all capabilities, use "-".
DOV-6027: Added "list of booleans" setting type. Settings that use it are: protocols, mail_plugins, auth_mechanisms, passdb_mechanisms
DOV-6095: Enable SNI for SMTP and LMTP. Reload local_name config sections for the specified server name.
DOV-6112: notify status: Change notify_status_dict into a filter-name. notify_mailbox_status is now called mailbox_notify_status and is disabled by default, it can be enabled per mailbox or using a mailbox filter name wildcard.
DOV-6114: Replace mail_attachment_fs with mail_attachment { ... } named filter.
DOV-6114: doveadm fs: Change fs-driver & fs-args parameters to filter-name.
DOV-6114: doveadm dict: Change dict-uri parameter to filter-name.
DOV-6114: Replace obox_fs with obox { ... } named filter. Replace obox_index_fs with metacache { ... } named filter.
DOV-6114: Replace fs_server_backend with fs_server { ... } named filter.
DOV-6114: obox fs-drivers' settings are now individual normal fs_* settings, not encoded in the URLs or elsewhere. Some of the fs-drivers' default settings have also been changed.
DOV-6114: obox fs-drivers' HTTP User-Agent header no longer contains obox/version.
DOV-6114: Replace fts_dovecot_fs with fts_dovecot { ... } named filter.
DOV-6114: Replace intercept_fs with intercept { ... } named filter.
DOV-6118: push-notification: Change push_notification into a filter-name. Push notification settings now require a push_notification_driver key that identifies the appropriate driver, as well as specifically named options per driver.
DOV-6120: mail_compress_save plugin setting is replaced by mail_compress_write_method. mail_compress_save_level plugin setting is replaced by compression method specific settings: compress_gz_level, compress_deflate_level, compress_bz2_block_size_100k, compress_zstd_level.
DOV-6120: fs-compress: The compression method parameter is replaced by fs_compress_write_method setting. An empty setting means writing with plaintext. The old "maybe-" prefix is replaced by fs_compress_read_plain_fallback setting.
DOV-6263: ACL settings have changed. See acl plugin for more information.
- REMOVAL: Global ACL directory support has been fully removed.
DOV-6278: Split mail_location setting into separate settings:
- CHANGED: mailbox { driver } setting replaced by mailbox { mail_driver }
DOV-6291: Removed namespace { location } setting. Use namespace { mail_location } instead.
DOV-6295: Removed the example configuration and replaced it with an automatically installed minimum configuration.
DOV-6304: fts settings have changed. See fts plugin for more information.
DOV-6304: fts-solr settings have changed. See fts-solr plugin for more information.
DOV-6304: fts-flatcurve settings have changed. See fts-flatcurve plugin for more information.
DOV-6304: fts-dovecot settings have changed. See fts-dovecot plugin for more information.
DOV-6305: import_environment setting is now a string list. The values are expanded from the calling environment on Dovecot startup.
DOV-6305: imap_id_send setting is now a string list. New distribution attributes are available in the configuration via the {}%{dovecot:<key>{}} syntax.
DOV-6307: quota_clone plugin settings converted to normal quota_clone* settings
DOV-6314: Rename lib-fts to lib-language
DOV-6325: %{pid}, %{uid} and %{gid} variables are now prefixed with process:, e.g. %{process:pid}. %{hostname} is now prefixed with system:, i.e. %{system:hostname}.
DOV-6325: Renamed %{pid} to %{client_pid} in auth variables.
DOV-6326: Replace inet_listener { address } with inet_listener { listen }
DOV-6365: Moved Pigeonhole plugin settings to global settings. FIXME: more?
DOV-6379: service { service_count } renamed to service_restart_request_count
DOV-6383: Pre-login settings are applied based on SNI.
DOV-6391: fts_languages setting has been converted into language xx { ... } blocks. See All Dovecot Settings for more information.
DOV-6391: fts_filters setting has been changed and split into converted into language_filters, language_filter_normalizer_icu_id and language_filter_stopwords_dir. See All Dovecot Settings for more information.
DOV-6391: fts_tokenizers setting has been changed and split into language_tokenizers, language_tokenizer_address_token_maxlen, language_tokenizer_generic_algorithm, language_tokenizer_generic_token_maxlen, language_tokenizer_generic_wb5a, language_tokenizer_kuromoji_icu_id, language_tokenizer_kuromoji_split_compounds and language_tokenizer_kuromoji_token_maxlen. See All Dovecot Settings for more information.
DOV-6421: dict { .. } string list was converted to dict_server { dict { .. } ... } filter settings. See Dictionary Proxy Process.
DOV-6424: passdb/userdb passwd-file args parameter converted to separate settings: scheme -> passdb_default_password_scheme, username_format -> auth_username_format, path -> passwd_file_path.
DOV-6446: oauth2 settings are now inlined, see OAuth2 Authentication Database for more details.
DOV-6447: OAuth2 mechanism no longer use passdb to validate tokens, instead a new setting auth_oauth2_config_file is used.
DOV-6453: [user|pass]db static args parameter converted to separate settings: password -> passdb_static_password, allow_all_users -> userdb_static_allow_all_users
DOV-6454: passdb/userdb passwd args parameter converted to separate settings:
- blocking -> passdb/userdb_use_worker
DOV-6455: lib-lua: Add lua_file and lua_settings global settings. These settings are now used by passdb-lua, userdb-lua, push-notification-lua and mail-lua.
DOV-6455: Introduce mail_lua setting filter.
DOV-6455: Remove push_notification_lua_path, it can now be configured using the lua_file setting.
DOV-6455: [user|pass]db lua args parameter converted to separate settings: scheme -> passdb_default_password_scheme, file -> lua_file, generic args -> lua_settings, blocking -> [user|pass]db_use_worker, cache_key -> the setting is removed, it can now be set from the auth lua script itself implementing auth_[user|passdb]_get_cache_key()
DOV-6456: passdb imap - Replace args-based settings with generic imapc_* settings.
DOV-6456: Change default value of imapc_max_line_length to unlimited. Make 0 an explicit configuration error.
DOV-6457: LDAP external config file has been converted into ldap_*, passdb_ldap_* and userdb_ldap_* settings.
DOV-6458: passdb/userdb pam args parameter converted to separate settings:
- blocking -> passdb/userdb_use_worker, session -> passdb_pam_session, setcred -> passdb_pam_setcred, failure_show_msg -> passdb_pam_failure_show_msg, max_requests -> passdb_pam_max_requests, service name parameter -> passdb_pam_service_name and cache_key parameter was removed.
DOV-6459: passdb bsdauth - replace "blocking" argument with global "use_worker" setting
DOV-6459: passdb bsdauth lookups are cached by default now, previously this needed a specific passdb argument
DOV-6471: Converted ssl settings to file type:
- ssl_cert -> ssl_cert_file
- ssl_alt_cert
- ssl_alt_cert_file
- ssl_key -> ssl_key_file
- ssl_alt_key -> ssl_alt_key_file
- ssl_client_cert -> ssl_client_cert_file
- ssl_client_key -> ssl_client_key_file
- ssl_dh -> ssl_dh_file
- ssl_ca -> ssl_ca_file
- ssl_client_ca and ssl_client_ca_file -> merged into the same ssl_client_ca_file
DOV-6471: Converted mail-crypt settings to file type: crypt_private_key -> crypt_private_key_file and crypt_global_public_key -> crypt_global_public_key_file
DOV-6483: sql connect string was split into individual mysql_*, pgsql_*, sqlite_* and cassandra_* settings. See the SQL driver settings in MySQL Configuration, PostgreSQL Configuration, SQLite Configuration, and Cassandra configuration respectively.
DOV-6542: passdb/userdb sql - external config file was moved to regular settings: connect -> individual sql-driver specific settings, password_query -> passdb_sql_query, user_query -> userdb_sql_query, update_query -> passdb_sql_update_query, iterate_query -> userdb_sql_iterate_query, default_pass_scheme -> passdb_default_password_scheme. userdb_warning_disable setting was removed.
DOV-6551: Referring to a $setting in config file must now be prefixed with $SET:, i.e. $SET:setting
DOV-6552: External dict-sql configuration file was converted to regular settings. See dictionary
DOV-6556: dict { .. } is renamed to dict_legacy { .. } for now - this will be removed later entirely.
DOV-6556: dict_driver=<value> setting is replaced by dict <value> { }
DOV-6559: Split fts_enforced setting:
- fts_enforced=no (default) -> fts_search_add_missing=body-search-only, fts_search_read_fallback=yes
- fts_enforced=yes -> fts_search_add_missing=yes, fts_search_read_fallback=no
- fts_enforced=body -> fts_search_add_missing=body-search-only, fts_search_read_fallback=no
DOV-6693: The "driver" field in dict events was renamed to "dict_driver".
DOV-6901: Renamed ":protected" passdb/userdb field suffix to ":default".
DOV-6909: welcome plugin now uses global settings and execute { .. } settings.
DOV-6912: Setting names for Dovecot's Lua HTTP client have changed.
DOV-6924: Variable syntax has been changed. See Settings Variables for more information on the change.
- REMOVE: Old variable aliases have been removed
- REMOVE: Old one letter variables are no longer supported.
DOV-6984: Converted last_login, mail_log, virtual, apparmor, charset_alias, pop3_migration and trash plugin settings to global settings.
DOV-6999: Various changes to metric and event exporter settings.
DOV-7069: Renamed service_idle_kill setting to service_idle_kill_interval.
DOV-7070: Shared namespace prefix %%variables were changed to $variables.
DOV-7071: Renamed passdb_mechanisms to passdb_mechanisms_filter. Rename "none" value to "lookup".
DOV-7187: Converted metacache and obox plugin settings to global settings. Added metacache_pull setting. Renamed settings:
- CHANGED: mail_prefetch_count defaults to 10 now for obox format.
DOV-7197: Intercept plugin settings and environment variables are now global settings.
DOV-7199: encrypt and decrypt filters are now always available for %variables.
DOV-7203: Convert pop3-uidl-migrate, vault and nfs-hostchange plugin settings to globals.
DOV-7240: doveadm and dovecot-lda no longer log an error if they can't connect to stats-writer socket due to permission errors.
DOV-7242: Renamed fts_index_timeout to fts_search_timeout
DOV-7251: Dovecot no longer enables any (imap, pop3 or lmtp) protocols by default. You need to enable the ones you want explicitly with the protocols setting.
DOV-7255: Replace in-URL authentication configuration for azure and s3 storage's.
- Adds fs_s3_access_key and fs_s3_secret
- Adds fs_azure_account_name, fs_azure_container_name, fs_azure_legacy_auth_secret and fs_azure_service_sas_secret
- Remove the no_sas_auth URL Parameter, it is replaced by fs_azure_auth_type which defaults to user-sas
- To configure User SAS the URL Parameter based configuration is replaced by the following settings: auth_tenant_id -> fs_azure_auth_user_sas_tenant_id, auth_client_id -> fs_azure_auth_user_sas_client_id,
- client_secret -> fs_azure_user_sas_client_secret please see Azure Storage Provider as well.
DOV-7302: ssl_cipher_list for outgoing SSL client connections is now empty (OpenSSL default).
DOV-7305: Added ssl_server_ prefix to SSL server settings: ssl_server_ca_file, ssl_server_cert_file, ssl_server_alt_cert_file, ssl_server_key_file, ssl_server_alt_key_file, ssl_server_key_password, ssl_server_dh_file, ssl_server_cert_username_field, ssl_server_require_crl, ssl_server_request_client_cert, ssl_server_prefer_ciphers

Removed Items

DOV-6114: obox-fs.sh script. "doveadm mail fs" commands replace this.
DOV-6278: passwd-file - Remove support for "old" format which used mail_location in the "shell" field.
DOV-6278: doveadm sync/backup: Removed -d (default-destination) and -E (legacy-dsync) parameters
- CHANGED: doveadm sync/backup: The destination parameter is now in a simple mail_driver:mail_path format. For additional options use -p parameter to specify any destination-specific storage options (similarly to how -o parameter would be used for source-specific storage options).
- CHANGED: doveadm import: The source location parameter is now in a simple mail_driver:mail_path format. For additional options use -p parameter to specify any source-specific storage options (similarly to how -o parameter would be used for destination-specific storage options).
- CHANGED: Rename mail_attachment* settings related to external attachment files to mail_ext_attachment*. Also rename mail_attachment_dir to mail_ext_attachment_path.
DOV-6456: Remove imapc_ssl_veryify setting. Use ssl_client_require_valid_cert instead.
DOV-6901: passdb/userdb default_fields { .. } and override_fields { .. } These are replaced by the more generic fields { .. }. Default fields can be set by adding ":default" to the field name.
DOV-7187: Removed unnecessary settings: metacache_socket_path, obox_username

Improvements

DOV-6004: Added "unlimited" value for number, size, and time interval setting types. Some of the service { idle_kill } defaults now shows up as "unlimited".
DOV-6110: Added global http_client_* settings.
- CHANGED: auth_policy_server_timeout_msecs setting replaced by auth_policy { http_client_request_absolute_timeout }
- CHANGED: fs-auth -R parameter replaced by fs_auth { http_client_rawlog_dir }
- CHANGED: fs_auth_request_timeout setting replaced by fs_auth { http_client_request_timeout }
- CHANGED: fs_auth_request_max_retries setting replaced by fs_auth { http_client_max_attempts }
- CHANGED: oauth2 uses now the global http_client_* and ssl_* settings. The old settings were removed from the .conf.ext file.
DOV-6114: Add "doveadm mail fs" commands. These are similar to "doveadm fs" commands, but they're run in the mail user context. This way all user-specific settings are applied and process uid/gid is also set properly.
DOV-6114: Add "doveadm mail dict" commands. These are similar to "doveadm dict" commands, but they're run in the mail user context. This way all user-specific settings are applied and process uid/gid is also set properly.
DOV-6313: Added global http_server_* settings.
- CHANGED: stats_http_rawlog_dir replaced by stats_server { http_server_rawlog_dir }
DOV-6485: Added passdb_fields { .. } and userdb_fields { .. } that can be used to specify passdb/userdb extra fields. These can refer to the passdb/userdb lookup's results using %variables. These make the old default_fields and override_fields settings unnecessary.
DOV-6529: Empty passdb/userdb_driver settings default to passdb/userdb_name setting. This allows using e.g. passdb passwd-file { .. } without specifying the driver setting again.
DOV-6693: Added "sql_driver" field to sql events.
DOV-6710: Added support for groups includes in configuration file. See Groups Includes.
DOV-7076: Added built-in @fs_dictmap_defaults, @cluster_defaults and @metric_defaults groups, which can be included in configuration files to pull required/recommended default settings.
DOV-7174: You can now iterate users from variable passwd-file paths if enough variables are provided.
DOV-7197: Added %{generate:guid}, %{generate:guid128} and %{generate:uuid} variables.
DOV-7199: %variable encryption supports hashed key material generation with salt.
DOV-7302: Added ssl_client and ssl_server named filters for giving client/server-specific SSL settings.

Fixed Issues

DOV-5767: REMOVAL: config_cache_size setting, which is now unnecessary.
- IMPROVEMENT:
DOV-5767: Added "local_name" field to pre-login client event.
- BUG:
DOV-5892: Login processes ignored protocol-specific settings (e.g. imap_capability) specified inside local_name sections.
DOV-5893: local_name { ... } config filter couldn't be used for any post-login settings.
DOV-6040: REMOVAL: verbose_ssl setting. Replaced by log_debug = category=ssl
- CHANGED: Renamed ssl_verify_client_cert setting to ssl_request_client_cert.
- CHANGED: Split ssl_client_ca out of ssl_ca. ssl_ca is now used only for verifying client certificates, while ssl_client_ca is used in addition to ssl_client_ca_file/dir.
- CHANGED: passdb imap no longer has ssl_ca_dir, ssl_ca_file or allow_invalid_cert args. Instead, the global ssl_client_ca_file/dir and ssl_client_require_valid_cert settings can be used.
DOV-6073: CHANGED: auth client, auth server, login: Renamed "service" event field to "protocol", which more correctly describes the value. Note that storage events still have a "service".
- CHANGED: auth, login: Renamed %s and %{service} variables to %{protocol}, which more correctly describes the value. Note that storage variables still have %{service}.
DOV-6119: REMOVAL: lazy_expunge no longer supports namespaces as destination.
- CHANGE:
DOV-6169: REMOVAL: fs-mail-crypt plugin. The fs-crypt plugin works for the same purposes now.
- mail_crypt plugin no longer supports writing version 1 files.
DOV-6306: REMOVAL: passdb { pass } setting. Use result_success=continue instead.
- CHANGED: passdb { default_fields & override_fields } are now string lists.
DOV-6405: Nested filters (e.g. local, remote, local_name, protocol { .. }) weren't handled correctly. Regression in v2023.10.
DOV-6917: REMOVAL: Maildir++ quota: Remove support for reading quota limits from an existing maildirsize file. Quota limits must be explicitly configured in Dovecot.
- CHANGED: Default quota grace changed from 10% to 10 MB
DOV-7173: REMOVAL: doveconf -m, -p and -S parameters

Lua Support

These versions of Lua are supported:

Obox Testing

AWS S3

Testing Date	2025-XX
Testing Region(s)	eu-central-1
API Version(s) Tested	2006-03-01
API Documentation (at time of testing)	https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html

Azure Blob

Testing Date	2025-XX
Testing Region(s)	northeurope
API Version(s) Tested	2023-08-03
API Documentation (at time of testing)	https://learn.microsoft.com/en-us/rest/api/storageservices/version-2023-08-03

Scality sproxyd

Testing Date	2025-XX
API Version(s) Tested	8.5.8.6
API Documentation (at time of testing)	https://documentation.scality.com/RING/8.5.8/reference/connectors/sproxyd/index.html

Kubernetes Components

Kubernetes Support

Supported Kubernetes versions: 1.31, 1.30