Install Dovecot for IMAP | LightServe Docs

Postfix delivers mail to your server, but people read it with an IMAP client. Dovecot is the IMAP server that makes that possible. This article installs Dovecot, points it at the Maildir folders Postfix writes to, and turns on encrypted connections only.

Before you begin

Postfix installed and working on a server named mail.example.com (see the Postfix main.cf article).
A TLS certificate for mail.example.com. Dovecot will refuse to start its encrypted listener without one. The Secure Postfix with TLS article shows how to get one with certbot.
A local test user with a password. This guide uses alex, created with sudo adduser alex.
A sudo user, and the firewall tool ufw available (it ships with Ubuntu).

Step 1: Install Dovecot

Install the core server and the IMAP protocol module. Ubuntu keeps these as separate packages, so you install both.

sudo apt update
sudo apt install -y dovecot-core dovecot-imapd

The install starts Dovecot automatically. It is not configured for your domain yet, so the next steps fix that before any client connects.

Step 2: Store mail in Maildir folders

Postfix writes each message as a separate file in a Maildir folder inside the user's home directory. Dovecot must read from the same place. Ubuntu's default layout is different, so you set a small override file. Ubuntu reads every .conf file in conf.d in alphabetical order, so a file named 99-local.conf wins over the defaults.

sudo nano /etc/dovecot/conf.d/99-local.conf

Paste the following into the file, then save with Ctrl+O and exit with Ctrl+X.

# Local settings for mail.example.com
mail_location = maildir:~/Maildir
disable_plaintext_auth = yes
auth_mechanisms = plain login
ssl = required
ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.example.com/privkey.pem

Here is what each line does. mail_location points at the Maildir folder. disable_plaintext_auth refuses passwords sent without encryption. ssl = required makes encryption mandatory. The two ssl_ lines tell Dovecot where the certificate and its private key live. The < character tells Dovecot to read the file's contents.

Step 3: Open the IMAP port

IMAP over encryption uses port 993. Open it in the firewall, and make sure SSH stays allowed first so you do not lock yourself out.

sudo ufw allow OpenSSH
sudo ufw allow 993/tcp
sudo ufw status

If ufw is not active yet, run sudo ufw --force enable after the rules are in place. The status command lists the open ports. Expected output includes:

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere
993/tcp                    ALLOW       Anywhere

Step 4: Check the configuration and restart

doveconf -n prints the effective configuration, which is the quickest way to catch mistakes. Then restart Dovecot and confirm it is running.

sudo doveconf -n mail_location
sudo systemctl restart dovecot
sudo systemctl status dovecot --no-pager

Expected output from the first command: mail_location = maildir:~/Maildir. The status command should show Active: active (running) in green.

Step 5: Test an encrypted IMAP login

Connect to the server with openssl, which is installed on Ubuntu. This acts like a bare-bones mail client so you can see the server's responses.

openssl s_client -connect mail.example.com:993 -quiet

The server greets you with a line like this one, which confirms the TLS connection works:

* OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready.

Type a1 LOGIN alex your-password and press Enter to test a login, then a2 LOGOUT to disconnect. A successful login prints a1 OK. Replace the password with the real one, and do not save the session output anywhere public.

Tip: Your mail app needs three settings: server mail.example.com, port 993 with SSL/TLS, and your username and password. For a system user like alex, the username is just alex.

Troubleshooting

Dovecot fails to start: run sudo doveconf -n. It prints the file and line number of the error. A missing certificate file is the most common cause, so check sudo ls -l /etc/letsencrypt/live/mail.example.com/.
Connection refused on port 993: confirm Dovecot is running with sudo ss -tlnp | grep 993, and that the ufw rule exists.
Login fails with a correct password: the Linux user may have no password yet. Set one with sudo passwd alex, then try again.
Inbox looks empty after a test message: Maildir folders are created on the first delivery. Send a message to alex locally, then check ls ~alex/Maildir/new.

Next steps

Dovecot now serves mail over encrypted IMAP. Next, the Secure Postfix with TLS article gives Postfix the same certificate, turns on encrypted sending, and lets your mail app send through the server with a login. If you plan to host several addresses without Linux accounts for each one, the virtual mailboxes article shows how to do that.