Dovecot

Dovecot is a mail delivery agent (MDA). It is capable of delivering email messages directly into user's inbox on their home directory.

Configuration

cPanel configures Dovecot with the following configuration file.

protocols = lmtp imap pop3
ssl_cert = </etc/dovecot/ssl/dovecot.crt
ssl_key = </etc/dovecot/ssl/dovecot.key
ssl_min_protocol = TLSv1.2
ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256

!include_try /etc/dovecot/sni.conf

namespace inbox {
   type = private
   separator = .
   prefix = INBOX.
   inbox = yes
  mailbox Drafts {
    special_use = \Drafts
    auto = subscribe
  }
  mailbox spam {
    special_use = \Junk
    auto = subscribe
  }
  mailbox Trash {
    special_use = \Trash
    auto = subscribe
  }
  mailbox Sent {
    special_use = \Sent
    auto = subscribe
  }
  mailbox "Sent Messages" {
    special_use = \Sent
    auto = no
  }
  mailbox Archive {
    special_use = \Archive
    auto = create
  }
  mailbox "Archives" {
    special_use = \Archive
    auto = no
  }
}

first_valid_uid = 201
mail_plugins = quota quota_clone zlib
mailbox_list_index = yes
mailbox_idle_check_interval = 30 secs
mail_prefetch_count = 20

protocol !indexer-worker {
}

maildir_copy_with_hardlinks = yes
maildir_very_dirty_syncs = yes
maildir_broken_filename_sizes = yes
mdbox_rotate_size = 10M

protocol imap {
  mail_max_userip_connections = 20
  mail_plugins = acl quota imap_quota
  mail_plugins = $mail_plugins zlib imap_zlib quota_clone virtual
  imap_logout_format = in=%i, out=%o, bytes=%i/%o
  imap_capability = +NAMESPACE
  imap_idle_notify_interval = 24 min
  namespace spam {
      prefix = spam
     separator = .
    location = virtual:/usr/local/cpanel/etc/dovecot/virtual/spam:INDEX=~/mail/virtual/%u/spam
    list = no
    hidden = yes
  }
  namespace sent {
      prefix = sent
     separator = .
    location = virtual:/usr/local/cpanel/etc/dovecot/virtual/sent:INDEX=~/mail/virtual/%u/sent
    list = no
    hidden = yes
  }
}

protocol pop3 {
  pop3_uidl_format = UID%u-%v
  pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s, bytes=%i/%o
  mail_max_userip_connections = 3
  mail_plugins = quota
  mail_plugins = $mail_plugins quota quota_clone virtual zlib
  namespace spam {
      prefix = spam
     separator = .
    location = virtual:/usr/local/cpanel/etc/dovecot/virtual/spam:INDEX=~/mail/virtual/%u/spam
    list = no
    hidden = yes
  }
  namespace sent {
      prefix = sent
     separator = .
    location = virtual:/usr/local/cpanel/etc/dovecot/virtual/sent:INDEX=~/mail/virtual/%u/sent
    list = no
    hidden = yes
  }
}

protocol lmtp {
    quota_full_tempfail = no
    postmaster_address = root
    mail_plugins = quota quota_clone zlib
}

lmtp_save_to_detail_mailbox = yes
lmtp_user_concurrency_limit = 4
recipient_delimiter = +
lmtp_rcpt_check_quota = yes

protocol lda {
  quota_full_tempfail = no
  postmaster_address = root
  mail_plugins = quota quota_clone zlib
}

lda_mailbox_autocreate = yes
disable_plaintext_auth = no
auth_cache_size = 1M
auth_cache_ttl = 3600 sec
auth_cache_negative_ttl = 3600 sec
auth_username_chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!#$-=?^_{}~./@+%"
auth_mechanisms = plain login
auth_policy_server_url = http://127.0.0.1:579/dovecot-auth-policy
auth_policy_server_timeout_msecs = 3000
auth_policy_hash_mech = sha512
auth_policy_request_attributes = auth_database=mail database=mail service=dovecot username=%{orig_user} authtoken_hash=$0$0$%{hashed_password} local_host=%{real_lip} local_port=%{real_lport} remote_host=%{real_rip} remote_port=%{real_rport}
auth_policy_reject_on_fail = no
auth_policy_hash_truncate = 64
auth_policy_hash_nonce = "dummmy"
!include_try /etc/dovecot/auth_policy.conf

passdb {
  driver = dict
  args = /usr/local/cpanel/etc/dovecot/cpauthd-dict.conf
  result_internalfail = continue
  result_failure = return-fail
}

userdb {
   driver = prefetch
}
userdb {
  driver = dict
  args = /usr/local/cpanel/etc/dovecot/cpauthd-dict.conf
}

plugin {
}

service config {
    vsz_limit = 2048 M
}

service quota-status {
  executable = quota-status -p postfix
  unix_listener {
    path = quota-status
    mode = 0666
  }
}

service auth {
  unix_listener auth-client {
    path = auth-client
    mode = 0666
  }
}

service stats {
  client_limit = 2000
  unix_listener stats-writer {
    mode = 0666
  }
}

plugin {
}

mail_access_groups = dovecot

service dict {
  unix_listener dict {
    mode = 0660
      group = dovecot
  }
}

service lmtp {
    vsz_limit = 512 M
    client_limit = 1
    process_limit = 500
    unix_listener lmtp {
       user = mailnull
       group = mail
       mode = 0660
    }
}

service imap-login {
  client_limit = 500
    process_limit = 50
    process_min_avail = 2
    service_count = 0
    vsz_limit = 128 M
    inet_listener imap {
      address = *,::
    }
    inet_listener imaps {
      address = *,::
    }
}

service imap {
    process_limit = 512
    vsz_limit = 512 M
}

service managesieve-login {
  client_limit = 500
    process_limit = 50
    process_min_avail = 2
    service_count = 0
    vsz_limit = 128 M
}

service managesieve {
    process_limit = 512
    vsz_limit = 512 M
}

service pop3-login {
  client_limit = 500
    process_limit = 50
    process_min_avail = 2
    service_count = 0
    vsz_limit = 128 M
    inet_listener pop3 {
      address = *,::
    }
    inet_listener pop3s {
      address = *,::
    }
}

service pop3 {
    process_limit = 512
    vsz_limit = 512 M
}

dict {
}

plugin {
  quota_exceeded_message = "Mailbox is full / Blocks limit exceeded / Inode limit exceeded"
  acl = vfile:cache_secs=86400
}

cPanel also handles the Dovecot authentication by providing a socket at /usr/local/cpanel/var/cpdoveauthd.sock.