This documentation is for Dovecot v2.x, see wiki1 for v1.x documentation.

Dovecot LDA with Postfix

This page contains only information specific to using LDA with Postfix, see LDA for more information about using the LDA itself.

System users

If you wish you use dovecot-lda for all system users on a single domain mail host you can do it by editing mailbox_command parameter in

/etc/postfix/main.cf (postconf(5)):

mailbox_command = /usr/local/libexec/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT"
#  or
mailbox_command = /usr/libexec/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT"
#  or
mailbox_command = /usr/lib/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT"
#  or wherever it was installed in your system.

Then run postfix reload.

Virtual users

Dovecot LDA is very easy to use on large scale installations with Postfix virtual domains support, just add a dovecot service in /etc/postfix/master.cf (master(5)):

dovecot   unix  -       n       n       -       -       pipe
  flags=DRhu user=vmail:vmail argv=/usr/local/libexec/dovecot/dovecot-lda -f ${sender} -d ${recipient}

An example using address extensions (ie user+extension@domain.com (don't forget to define the proper recipient_delimiter in Postfix's main.cf)) to deliver to the folder 'extension' in your maildir (If you wish to preserve the case of ${extension}, remove the 'hu' flags, and be sure to utilize Modifiers in your dovecot.conf for mail locations and other configuration parameters that are expecting lower case):

dovecot unix    -       n       n       -       -      pipe
  flags=DRhu user=vmail:vmail argv=/usr/local/libexec/dovecot/dovecot-lda -f ${sender} -d ${user}@${nexthop} -m ${extension}

# or if you have a INBOX/ namespace prefix:
dovecot unix    -       n       n       -       -      pipe
  flags=DRhu user=vmail:vmail argv=/usr/local/libexec/dovecot/dovecot-lda -f ${sender} -d ${user}@${nexthop} -m INBOX/${extension}

This example ignores address extensions (ie user+extension@domain.com delivers just like user@domain.com ), but still shows the original address for Sieve:

dovecot   unix  -       n       n       -       -       pipe
  flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/dovecot-lda -f ${sender} -a ${recipient} -d ${user}@${nexthop}

Replace vmail above with your virtual mail user account.

Then set virtual_transport to dovecot in /etc/postfix/main.cf:

dovecot_destination_recipient_limit = 1
virtual_mailbox_domains = your.domain.here
virtual_transport = dovecot

And remember to run

postfix reload

Virtual users with multiple uids/gids

If you need multiple uids/gids you'll need to set dovecot-lda setuid root or invoke it through sudo. See LDA#multipleuids for how to do this securely.

Postfix with a NFS mail store

If you are experiencing problems with dovecot-lda processes hanging when delivering to an NFS mail store, it's likely that the dovecot-lda process is hanging while waiting for free locks. The occurrence of this can be greatly reduced, if not eradicated, by forcing Postfix to only deliver to the same recipient one at a time.

dovecot_destination_concurrency_limit = 1

Prevent backscatter

To prevent backscatter you should configure Postfix to reject mail for non existent recipients.

This is the default behaviour (smtpd_reject_unlisted_recipient = yes) so there's no need to set "reject_unlisted_recipient" in any of your restriction. But: Postfix must know if a recipient exists. Depending on how you've configured Dovecot and Postfix this can be done several ways.

System users

If you only use local system users this is no problem - all valid recipients can be found in the local password or alias database.

Virtual users (static)

When you use virtual users and domains you should maintain a list of valid recipients. The relevant settings settings are:

virtual_alias_maps, virtual_mailbox_maps

For static verification you can maintain the content of the files yourself. For every recipient or alias you need one entry. Example:

virtual_alias_maps

name_recipient@example.com  external@example.net

virtual_mailbox_maps

name@example.com  OK
recipient@example.com  available

Don't forget to run "postmap" afterwards.

Info: if you use the Dovecot LDA or LMTP it doesn't matter what you use behind the recipient address. Use "OK", the full name of the user or else.

Virtual users (dynamic)

Do you already use a database (MySQL, PostgreSQL) for Dovecot? Use the same source for Postfix. You only have to to define a valid sql query for Postfix. Example:

virtual_mailbox_maps = proxy:mysql:/etc/postfix/virtual_mailbox_maps.cf

virtual_mailbox_maps.cf

user = mysql-user
password = mysql-password
hosts = unix:/var/run/mysql/mysqld.sock
dbname = mailserver
query = SELECT name FROM mailbox WHERE email='%s'

This query will return the value of the filed "name" from table "mailbox" if the email address of the recipient matches the email from the field "email". This is enough for Postfix because Postfix must only know if the recipient exists. The value doesn't matter. When you use a database (or LDAP) there's no need to manually maintain a file with valid recipients.

Info: If you use "relay_domains" instead of "virtual_mailbox_domains" you have to use "relay_recipient_maps" instead of "virtual_mailbox_maps".

Dynamic address verification with LMTP

With Dovecot 2.0 you can also use LMTP and the Postfix setting "reject_unverified_recipient" for dynamic address verification. It's really nice because Postfix doesn't need to query an external datasource (MySQL, LDAP...). Postfix maintain a local database with existing/non existing addresses (you can configure how long positive/negative results should be cached).

To use LMTP and dynamic address verification you must first get Dovecot working. Then you can configure Postfix to use LMTP and set "reject_unverified_recipient" in the smtpd_recipient_restrictions.

On every incoming email Postfix will probe if the recipient address exists. You will see similar entries in your logfile:

Recipient address rejected: undeliverable address: host tux.example.com[private/dovecot-lmtp] said: 550 5.1.1 < tzknvtr@example.com > User doesn't exist: tzknvtr@example.com (in reply to RCPT TO command); from=< cnrilrgfclra@spammer.org > to=< tzknvtr@example.com >

If the recipient address exists (status=deliverable) Postfix accepts the mail.

Info: you can not use "reject_unverified_recipient" with "pipe" so this doesn't work with the Dovecot LDA "deliver".

LDA/Postfix (last edited 2012-09-27 19:58:08 by 212)