Dovecot Namespaces: Prefix, Separator, and Mailbox Visibility

When shared mailboxes vanish into thin air

\n

You’ve just added a shared namespace to your Dovecot setup, but some users say their folders disappeared. Others can’t see the project mailbox you meant to share. The culprit is often hiding in plain sight: the namespace prefix, separator, and inbox settings.

\n

Dovecot’s namespace block determines exactly what each user’s mail client shows. Get the three core options right—prefix, separator, and inbox—and you control visibility, isolation, and ACL scope. Get them wrong, and you get hidden folders, name collisions, or silent access failures.

\n

Namespace anatomy: prefix, separator, inbox

\n

Every Dovecot namespace is defined by three configuration keys inside a namespace { } block:

\n

\n
• prefix – a string prepended to every mailbox name visible to this namespace. If set to shared/, all mailboxes in this namespace appear under that prefix.
\n
• separator – the character used to separate hierarchy levels in mailbox names, typically /.
\n
• inbox – a boolean that controls whether the special INBOX folder is exposed through this namespace. Setting it to no removes the default INBOX from this namespace’s view.
\n

\n

These three options together decide what a user sees when they run LIST or LSUB. Change one, and the entire visible tree can shift.

\n

Configuring a shared namespace in practice

\n

The following dovecot.conf snippet creates a global shared namespace visible to all users, with a clear prefix and the default separator: namespace { type = shared separator = / prefix = shared/ # inbox = no list = children }

\n

Verifying the namespace with doveadm

\n

The fastest way to see what Dovecot actually serves is: doveadm namespace list -u username

\n

Typical output lists each configured namespace with its prefix, separator, and inbox setting. If the shared namespace doesn’t appear, double‑check that the user has read ACL permission on the root of the shared mailbox tree.

\n

To test across all users, run the command without the -u flag (requires root or doveadm admin privileges). Compare the output for a user who should see the shared namespace versus one who shouldn’t.

\n

Trade‑offs and limitations

\n

Changing a namespace prefix after mailboxes already exist often requires a mailbox rebuild or re‑indexing, otherwise messages may appear in lost folders. Dovecot does not automatically rewrite existing mailbox names when the prefix changes.

\n

Nested namespace hierarchies can also interfere with quota reporting and the default INBOX handling. If you have multiple levels of shared namespaces, verify that quota roots are explicitly set, or quota calculations may double‑count or miss mailboxes entirely.

\n

\n
1. Run doveadm namespace list -u testuser and confirm the prefix, separator, and inbox values match your intent.
\n
2. If you need to adjust the prefix, plan a maintenance window and re‑index affected mailboxes with doveadm reindex -u username.
\n
3. Create a test user, add a couple of mailboxes under the expected prefix, and verify that LIST returns only the names you configured.
\n

\n

Getting namespace configuration right is a matter of a few well‑chosen lines in dovecot.conf, but those few lines dictate what your users can see, share, and protect. Check the output, adjust if needed, and you’ll avoid the silent‑disappearance trap.