Using Dovecot's Maildir++ for Secure and Performant Mail Delivery

Problem and Takeaway

When delivering mail securely and efficiently, many administrators wonder whether Dovecot’s native Maildir++ format meets both security and performance goals. The key takeaway: using Maildir++ with proper permissions and inotify monitoring provides atomic writes, fast index updates, and minimal exposure, making it a suitable default for most Linux‑based mail servers.

Requirements

• Linux filesystem that supports inotify (or FSEvents on macOS) for real‑time change detection.
• Dovecot version ≥ 2.3, which introduced full Maildir++ support.
• Mailbox directory owned by the Dovecot user (often dovecot) with mode 0600 to prevent other users from reading.
• External authentication (PAM, SASL) – Dovecot trusts only the local filesystem and its own process.
• Sufficient disk space and quota monitoring to avoid delivery failures.

Smallest Suitable Design

The minimal design consists of a single Maildir++ tree per user, mounted on a local disk, with Dovecot running as a non‑privileged user. The directory layout is:

~/Maildir/
    cur/      # current message files
    tmp/      # temporary files for atomic writes
    new/      # newly arrived messages

Dovecot’s configuration only needs to point mail_location to this path.

Trust and Data Boundaries

• Trust model: Dovecot assumes the underlying filesystem is reliable and that only the Dovecot process can modify files inside a user’s Maildir.
• Authentication is delegated to PAM or SASL; Dovecot does not handle password verification.
• Backup safety: because each message is a separate file, incremental backups of the Maildir directory are straightforward.

Operational Checks

1. Verify Dovecot version: dovecot --version → must show ≥ 2.3.
2. Confirm mail location: grep mail_location /etc/dovecot/dovecot.conf → should contain maildir:~/Maildir (replace ~/Maildir with actual path).
3. Check file permissions: ls -l /var/mail/user/Maildir → owner dovecot, mode 0600.
4. Run integrity check: doveadm check → output should indicate “no errors”.
5. Monitor disk usage: df -h /var/mail and Dovecot quota commands.

Failure Modes

• Inotify failure (e.g., on non‑Linux kernels) → Dovecot falls back to periodic scans, causing temporary index staleness. Verify by disabling inotify or running on a container without it.
• Permission misconfiguration → other users can read or modify mailbox files, violating confidentiality.
• Elevated privileges → a vulnerability in Dovecot could allow arbitrary file access; always run with the least‑privilege user.
• Quota exhaustion → delivery stops and temporary failures occur; set up alerts on doveadm quota output.

Conditions That Would Change the Design

• Switching to mbox or a remote database requires redesign of atomic write handling and index synchronization.
• Deploying on a high‑load server where inotify misses rapid file changes; consider increasing scan interval or using a different notification mechanism.
• Need for per‑user encryption at rest → Maildir++ alone is insufficient; additional filesystem‑level encryption (e.g., LUKS) would be required.

Concrete Example and Configuration

Assume a user alice with home directory /home/alice. The following snippet shows a minimal dovecot.conf entry:

mail_location = maildir:/home/alice/Maildir

Place the Maildir directory under /home/alice and ensure its ownership:

chown -R dovecot:dovecot /home/alice/Maildir
chmod -R 0600 /home/alice/Maildir

After restarting Dovecot (systemctl restart dovecot), run doveadm reload to apply changes.

Diagnostic Commands and Expected Checks

1. doveadm dump – displays the current index; compare before and after creating a new message in tmp/ to see immediate appearance in cur/.
2. inotifywait -m /home/alice/Maildir – should log events like CREATE tmp/message123 when a new message is delivered.
3. doveadm check – after simulated mail updates, confirm “no errors” and that the index files are consistent.

Practical Verification of Result

To confirm that the index is up‑to‑date, run doveadm search -u alice and verify that the newly added message appears instantly. If the search returns the message, the inotify path is working; otherwise, inspect doveadm log for messages about “fallback to scan” which indicates inotify is not active.

Limitations and Mitigations

• Inotify may miss very rapid bursts of writes on heavily loaded systems; mitigate by increasing the scan interval via mail_check_interval or by using doveadm reload after bulk operations.
• Misconfigured permissions are a common source of exposure; enforce a baseline with a filesystem ACL or a wrapper script that sets correct ownership and mode on directory creation.
• Running Dovecot as root is strongly discouraged; use a dedicated system user with no login capability.

Summary

Maildir++ gives Dovecot atomic writes, fast index updates via inotify, and simple backup semantics. By limiting trust to the local filesystem, using strict file permissions, and regularly verifying integrity with doveadm check, administrators can achieve secure, performant mail delivery. The design is robust unless the environment changes the storage backend or disables real‑time notification, in which case a redesign of index handling becomes necessary.