Dovecot

Search Marketplace for Dovecot, select the SecureAnyCloud publisher, and click Create.

Configure the NSG to allow TCP 22 for administration and TCP 993 and TCP 995 for secure IMAP and POP3 access. Assign a public IP so remote mail clients can connect.

RG="mail-prod"; LOCATION="eastus"; VM_NAME="dovecot1" IMAGE_URN="sac1647283583153:dovecot-ubuntu-24-04:default:latest" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:dovecot-ubuntu-24-04:default:latest
az vm create --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" --size Standard_B2s \
  --admin-username azureuser --generate-ssh-keys --public-ip-sku Standard
# secure IMAP (993), secure POP3 (995), and the STARTTLS ports (143, 110)
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 993 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 995 --priority 1002
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 143 --priority 1003
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 110 --priority 1004

On the first boot of every VM, dovecot-firstboot.service runs once. It generates the per-instance mailbox password, hashes it into the Dovecot password database and regenerates the TLS private key and certificate. It then writes the plaintext login to /root/dovecot-credentials.txt and starts Dovecot.

Allow about 20 seconds after the VM first becomes reachable.

SSH in, confirm that Dovecot is active and inspect its effective configuration.

sudo systemctl is-active dovecot
sudo doveconf -n | head -30

The mailbox password is unique to this VM. First boot writes it to a root-only file, so read it with elevated privileges:

sudo cat /root/dovecot-credentials.txt

The file contains the mailbox username (mailbox@localhost), the per-instance password, and the IMAP host and ports. Store it somewhere safe.

Dovecot serves IMAP on 143 (STARTTLS) and 993 (implicit TLS). It serves POP3 on 110 (STARTTLS) and 995 (implicit TLS). Check the listeners and the TLS settings:

sudo ss -tlnp | grep -E ':(143|993|110|995|24) ' | sort
sudo doveconf disable_plaintext_auth ssl

With disable_plaintext_auth = yes and ssl = required, a remote client's plaintext authentication on 143 or 110 is refused until the connection is upgraded with STARTTLS.

The image ships a self-contained round-trip check. It connects over implicit TLS on 993 and confirms that a wrong password is rejected and the per-instance password is accepted. It then selects the INBOX, delivers a message over LMTP and reads it back over IMAP.

echo | sudo openssl s_client -connect 127.0.0.1:993 -brief 2>&1 | grep -Ei 'protocol|cipher|verify|subject'
sudo python3 /usr/local/sbin/sac-dovecot-roundtrip.py

The final OK full: line confirms the whole path works: implicit TLS on 993, a wrong password rejected, the per-instance password accepted, the INBOX selectable, and an LMTP-delivered message read back over IMAP.

The hardened configuration at a glance:

• The password database is a root-readable Dovecot password file with a SHA512-hashed per-instance password.
• The TLS certificate and key are unique to this VM and owned by root.
• The system PAM login path is disabled, so only the virtual mailbox can authenticate.
• Plaintext authentication is refused on non-TLS connections.

Point any standards-compliant IMAP or POP3 client at the VM public IP. Use the mailbox username and the per-instance password from the credentials file.

• IMAP over TLS: host <vm-ip>, port 993, SSL/TLS, username mailbox@localhost, password from the file
• POP3 over TLS: host <vm-ip>, port 995, SSL/TLS, same username and password
• IMAP or POP3 with STARTTLS: ports 143 or 110, connection security STARTTLS

The TLS certificate is self-signed and unique to this VM, so your client will prompt you to trust it. Step 10 shows how to replace it with a certificate for your own domain.

Generate a hashed password with doveadm pw, append a line to the password file, and reload Dovecot. Each line has the format user:hash:uid:gid::home::, with the vmail uid and gid (5000).

# generate a hash for a new mailbox (you will be prompted for the password)
HASH=$(doveadm pw -s SHA512-CRYPT -p '<new-password>')
echo "alice@<your-domain>:${HASH}:5000:5000::/var/vmail/alice@<your-domain>::" \
  | sudo tee -a /etc/dovecot/sac-users
sudo systemctl reload dovecot

For production, replace the self-signed per-instance certificate with a certificate for your own domain, for example one from Let's Encrypt. Then point Dovecot at it.

sudo certbot certonly --standalone -d mail.<your-domain>
sudo sed -i 's#^ssl_cert = .*#ssl_cert = </etc/letsencrypt/live/mail.<your-domain>/fullchain.pem#' /etc/dovecot/conf.d/99-sac.conf
sudo sed -i 's#^ssl_key = .*#ssl_key = </etc/letsencrypt/live/mail.<your-domain>/privkey.pem#' /etc/dovecot/conf.d/99-sac.conf
sudo systemctl restart dovecot

Dovecot is the mailbox store (IMAP and POP3) and the local delivery agent (LMTP). To exchange mail with the outside world, put a mail transfer agent such as Postfix in front of it. Postfix delivers inbound mail to Dovecot over LMTP.

Configure Postfix for your own domain and DNS (MX, SPF, DKIM and DMARC records). Keep outbound relay restricted to authenticated submission.

# example only — install and configure Postfix for your own domain
sudo apt-get install -y postfix
sudo postconf -e "mailbox_transport = lmtp:inet:127.0.0.1:24"
sudo postconf -e "myhostname = mail.<your-domain>"
sudo systemctl restart postfix

Note that Azure blocks outbound SMTP on port 25 by default for most subscriptions. To send mail directly, request an outbound port 25 exception from Azure, or relay outbound mail through a smart host on port 587. Inbound mail and IMAP or POP3 access are unaffected.

Dovecot Community Edition is dual licensed under the MIT and LGPL 2.1 licenses, both permissive and redistributable. SecureAnyCloud provides the packaging, hardening and Azure integration, with 24/7 support and a guaranteed 24 hour response SLA.

Trademark notice. SecureAnyCloud is not affiliated with or endorsed by the Dovecot project or Open-Xchange. This image packages the open source Dovecot software for convenient deployment on Azure.

Deploy on Azure

Find Dovecot on Ubuntu 24.04 LTS by SecureAnyCloud on the Azure Marketplace and click Create, or deploy from the Azure CLI as shown above.

Need Help?

Contact SecureAnyCloud support at sales@secureanycloud.com for deployment assistance, configuration guidance, or licensing questions.

Deploy on Azure

Launch Dovecot on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Subscribe to the Dovecot listing, choose Launch through EC2, and pick your instance type, key pair, subnet and Security Group. Allow TCP 22 for administration and TCP 993 and TCP 995 for secure IMAP and POP3 access.

Assign a public IP (or Elastic IP) so remote mail clients can connect.

You can also launch from the AWS CLI. Replace the AMI ID with the one shown on your subscription's launch page, and replace the other IDs with your own:

aws ec2 run-instances \
  --image-id ami-xxxxxxxxxxxxxxxxx \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids sg-xxxxxxxx \
  --subnet-id subnet-xxxxxxxx \
  --associate-public-ip-address

On the first boot of every instance, dovecot-firstboot.service runs once. It generates the per-instance mailbox password, hashes it into the Dovecot password database and regenerates the TLS private key and certificate. It then writes the plaintext login to /root/dovecot-credentials.txt and starts Dovecot.

Allow about 20 seconds after the instance first becomes reachable.

SSH in, confirm that Dovecot is active and check its version.

sudo systemctl is-active dovecot
sudo dovecot --version

The mailbox password is unique to this instance. First boot writes it to a root-only file, so read it with elevated privileges:

sudo cat /root/dovecot-credentials.txt

The file contains the mailbox username (mailbox@localhost), the per-instance password, and the IMAP host and ports. Store it somewhere safe.

Dovecot serves IMAP on 143 (STARTTLS) and 993 (implicit TLS). It serves POP3 on 110 (STARTTLS) and 995 (implicit TLS). An LMTP loopback listener on 127.0.0.1:24 handles local delivery.

sudo ss -tlnp | grep -E ':(143|993|110|995|24) ' | sort
sudo doveconf disable_plaintext_auth ssl ssl_min_protocol

With disable_plaintext_auth = yes and ssl = required, a remote client's plaintext authentication on 143 or 110 is refused until the connection is upgraded with STARTTLS.

The image ships a self-contained round-trip check. It connects over implicit TLS on 993 and confirms that a wrong password is rejected and the per-instance password is accepted. It then selects the INBOX, delivers a message over LMTP and reads it back over IMAP. The check never prints your password.

sudo python3 /usr/local/sbin/sac-dovecot-roundtrip.py

The final OK full: line confirms the whole path works: implicit TLS on 993, a wrong password rejected, the per-instance password accepted, the INBOX selectable, and an LMTP-delivered message read back over IMAP.

The hardened configuration has four parts:

• The password database is a root-readable Dovecot password file with a SHA512-hashed per-instance password.
• The TLS certificate and key are unique to this instance and owned by root.
• The system PAM login path is disabled, so only the virtual mailbox can authenticate.
• Plaintext authentication is refused on non-TLS connections.

Check the file modes and the authentication include:

sudo stat -c '%n %a %U:%G' /etc/dovecot/sac-users /etc/dovecot/private/dovecot-sac.pem /etc/dovecot/private/dovecot-sac.key
sudo grep -n 'auth-system.conf.ext' /etc/dovecot/conf.d/10-auth.conf

Point any standards-compliant IMAP or POP3 client at the instance public IP. Use the mailbox username and the per-instance password from the credentials file.

• IMAP over TLS: host <instance-ip>, port 993, SSL/TLS, username mailbox@localhost, password from the file
• POP3 over TLS: host <instance-ip>, port 995, SSL/TLS, same username and password
• IMAP or POP3 with STARTTLS: ports 143 or 110, connection security STARTTLS

The TLS certificate is self-signed and unique to this instance, so your client will prompt you to trust it. Step 11 shows how to replace it with a certificate for your own domain.

Dovecot is the mailbox store (IMAP and POP3) and the local delivery agent (LMTP). To exchange mail with the outside world, put a mail transfer agent such as Postfix in front of it. Postfix delivers inbound mail to Dovecot over LMTP.

Configure Postfix for your own domain and DNS (MX, SPF, DKIM and DMARC records). Keep outbound relay restricted to authenticated submission.

# example only — install and configure Postfix for your own domain
sudo apt-get install -y postfix
sudo postconf -e "mailbox_transport = lmtp:inet:127.0.0.1:24"
sudo postconf -e "myhostname = mail.<your-domain>"
sudo systemctl restart postfix

Note that AWS blocks outbound SMTP on port 25 by default for new accounts. To send mail directly, request removal of the port 25 restriction from AWS, or relay outbound mail through a smart host on port 587. Inbound mail and IMAP or POP3 access are unaffected.

Generate a hashed password with doveadm pw, append a line to the password file, and reload Dovecot. Each line has the format user:hash:uid:gid::home::, with the vmail uid and gid (5000).

# generate a hash for a new mailbox (you will be prompted for the password)
HASH=$(doveadm pw -s SHA512-CRYPT -p '<new-password>')
echo "alice@<your-domain>:${HASH}:5000:5000::/var/vmail/alice@<your-domain>::" \
  | sudo tee -a /etc/dovecot/sac-users
sudo systemctl reload dovecot

For production, replace the self-signed per-instance certificate with a certificate for your own domain, for example one from Let's Encrypt. Then point Dovecot at it.

sudo certbot certonly --standalone -d mail.<your-domain>
sudo sed -i 's#^ssl_cert = .*#ssl_cert = </etc/letsencrypt/live/mail.<your-domain>/fullchain.pem#' /etc/dovecot/conf.d/99-sac.conf
sudo sed -i 's#^ssl_key = .*#ssl_key = </etc/letsencrypt/live/mail.<your-domain>/privkey.pem#' /etc/dovecot/conf.d/99-sac.conf
sudo systemctl restart dovecot

Dovecot Community Edition is dual licensed under the MIT and LGPL 2.1 licenses, both permissive and redistributable. SecureAnyCloud provides the packaging, hardening and AWS integration, with 24/7 support.

Trademark notice. SecureAnyCloud is not affiliated with or endorsed by the Dovecot project or Open-Xchange. This image packages the open source Dovecot software for convenient deployment on AWS.

Need Help?

Contact SecureAnyCloud support at sales@secureanycloud.com for deployment assistance, configuration guidance, or licensing questions.

Deploy on AWS

Launch Dovecot IMAP and POP3 Mail Server with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com