Dict Proxy Process

Dict can be used by:

Quota
Shared mailbox list
Expire plugin

When using these, the mail processes need to have access the dict socket. By default only "dovecot" user has access to dict socket, which doesn't typically work in any installations. However, giving too wide permissions by default might allow untrusted users to access the dict and cause problems.

If all users share a single UNIX UID (e.g. "vmail"), you could make the dict socket accessible only to it:

service dict {
  unix_listener dict {
    mode = 0600
    user = vmail
  }
}

If you use multiple UNIX UIDs, you can add an extra group for all Dovecot mail processes. This works even if you have untrusted system users who have shell access to the server:

mail_access_groups = dovecot

service dict {
  unix_listener dict {
    mode = 0660
    group = dovecot
  }
}

However, it works with LDA only if it's started as root. If this isn't possible, look into using LMTP instead.