Choosing Virtual Mailboxes Over System Mailboxes in Dovecot: A Decision Guide

Problem Statement

When building a multi‑tenant mail service with Dovecot, you must decide whether to store user mail in system mailboxes (linked to OS accounts) or in virtual mailboxes (managed purely by Dovecot). The decision impacts scalability, security, and operational complexity.

Decision & Constraints

Decision: Use virtual mailboxes backed by an SQL database.

Constraints:

• All tenants share the same host; no dedicated OS accounts per user.
• Centralized authentication is required (e.g., LDAP or SQL).
• Mail directory must be accessible only to the mail daemon.
• Administrative overhead must stay low for dynamic user provisioning.

Supported Options

Feature	System Mailboxes	Virtual Mailboxes (SQL)
OS Integration	Requires a local user account per mailbox	No OS account needed; Dovecot manages ownership via virtual_uid_maps
Scalability	Limited by the number of system users and disk quota management	Scales to thousands of users; new users are added via database insert
Security Isolation	Dependent on OS user isolation; risk of privilege escalation if mis‑configured	Isolated by file permissions and Dovecot’s mail_privileged_group
Dynamic Provisioning	Requires OS user creation scripts	Simple SQL INSERT; can be automated via API
Backup Complexity	Standard file system snapshots of /var/mail	Requires both DB backup and maildir backup; easier to restore a single user
Latency	Direct file access; minimal lookup time	SQL lookup adds a few milliseconds; acceptable for most workloads
Audit & Logging	OS logs (e.g., utmp) track logins	Dovecot logs authentication; database audit logs can be enabled

Trade‑Offs

• Performance vs Flexibility – System mailboxes are slightly faster but lack the flexibility of database‑driven user management.
• Security vs Convenience – Virtual mailboxes reduce the attack surface by eliminating unnecessary OS accounts, but require careful permission configuration on the mail directory.
• Operational Overhead – Centralized SQL provisioning simplifies onboarding but introduces a database dependency.

Concrete Implementation: SQL‑Backed Virtual Mailbox

Prerequisites

• Dovecot 2.4+ installed.
• MySQL or PostgreSQL database with a virtual_users table.
• Database user with SELECT, INSERT, UPDATE on virtual_users only.

Database Schema (MySQL example)

CREATE TABLE virtual_users (
  id INT AUTO_INCREMENT PRIMARY KEY,
  email VARCHAR(255) NOT NULL UNIQUE,
  password VARCHAR(255) NOT NULL,
  uid INT NOT NULL,
  gid INT NOT NULL,
  home VARCHAR(255) NOT NULL
);

Dovecot Configuration

Place the following snippets in /etc/dovecot/dovecot.conf and /etc/dovecot/conf.d/10-mail.conf respectively.

# /etc/dovecot/dovecot.conf
# Enable virtual mailbox support
mail_location = maildir:/var/mail/vmail/%d/%n
# Map virtual users to database
virtual_mailbox_domains = *
virtual_mailbox_maps = sql:/etc/dovecot/dovecot-sql.conf.ext

# Set a static UID/GID for all virtual mailboxes (e.g., 5000)
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000

# Ensure only the mail daemon can read/write maildirs
mail_privileged_group = vmail

# /etc/dovecot/conf.d/10-mail.conf
# Use the same mail_location as above
mail_location = maildir:/var/mail/vmail/%d/%n

SQL Connection File

# /etc/dovecot/dovecot-sql.conf.ext
driver = mysql
connect = host=localhost dbname=dovecot user=dovecot_passwd password=secret
default_pass_scheme = SHA512-CRYPT
hosts = localhost

# Query to retrieve user details
query = SELECT email as user, password, uid, gid, home FROM virtual_users WHERE email='%u'

Directory Permissions

After creating the mail directory structure, run:

# mkdir -p /var/mail/vmail/example.com/john
# chown -R 5000:5000 /var/mail/vmail
# chmod -R 0700 /var/mail/vmail

Replace 5000 with the UID/GID configured in virtual_uid_maps and virtual_gid_maps.

Verification Steps

1. Log in with an IMAP client using a test virtual user (e.g., [contact removed]) and confirm the mailbox appears.

2. Check the file system: ls -l /var/mail/vmail/example.com/john should show 0700 permissions and owner 5000:5000.

3. Run a SQL query: SELECT * FROM virtual_users WHERE email='[contact removed]'; to verify the record exists and UID/GID match the configuration.

Risk Mitigation

• Grant the database user only SELECT/INSERT/UPDATE on virtual_users to prevent privilege escalation.
• Verify that maildir directories are owned by the mail daemon and have 0700 permissions.
• When switching to LDAP, double‑check the search filter maps correctly to the mailbox path to avoid orphaned maildirs.

Conclusion

For a multi‑tenant mail service, virtual mailboxes backed by an SQL database provide the necessary flexibility, isolation, and scalability. While they introduce a small lookup latency, the operational benefits outweigh the performance cost in most scenarios.