Dovecot LMTP and Postfix MTA: Which Side Owns Quota Rejection and Subaddress Detail?

Question

Postfix hands local mail to Dovecot through mailbox_transport=lmtp:unix:private/dovecot-lmtp, where Dovecot listens on that socket. The contract is LMTP over a socket, with no shared library or database between components. At this boundary, an unresolved decision remains: should quota rejection and subaddressing be owned by Postfix policy delegation to Dovecot's quota-status service at SMTP time, or by Dovecot's LMTP-time quota and Sieve checks?

Enforcing quota at LMTP rejects the per-recipient RCPT with an SMTP-class reply, and quota_full_tempfail determines whether Postfix bounces or defers; quota-status answers earlier, at SMTP policy time. Subaddressing crosses the same line: Postfix's recipient_delimiter must agree with Dovecot's LMTP handling, or the detail part is stripped before Sieve can use the subaddress and envelope-detail extensions.

Exact defaults for quota_full_tempfail and reply strings vary across Dovecot releases, so remembered values should be treated as unverified. LMTP over TCP needs its own TLS and auth settings separate from imap. Socket path and permissions inside Postfix's chroot affect deferrals rather than rejections.

Which component should own quota rejection, and what criteria decide between SMTP-time policy and LMTP-time enforcement? How can a configuration guarantee that user+tag detail survives the LMTP boundary into Sieve without relying on unverified defaults? What checks confirm that socket reachability, plugin loading under protocol lmtp, and delimiter alignment are correct before attributing failures to the other component?

Tasadduq Burney · Answer

Answer
Dovecot owns the final quota rejection at the LMTP boundary. Postfix quota-status can refuse mail earlier at SMTP time, but it is only a policy hint; Dovecot still makes the authoritative delivery decision when it accepts the message over LMTP. Postfix also owns whether user+tag detail reaches Dovecot, because recipient_delimiter and address rewriting happen before LMTP. If Postfix strips the detail, Dovecot Sieve cannot recover it.
Criteria for SMTP-time versus LMTP-time enforcement

Use quota-status at SMTP time when you want to refuse over-quota recipients before DATA to save bandwidth.
Use LMTP-time enforcement when you want one authoritative quota and Sieve enforcement point, or when quota data lives only in Dovecot's backend.
Do not run both layers with inconsistent policies. quota-status may accept mail that LMTP later defers, or reject mail that LMTP would accept, producing nondeterministic SMTP outcomes.

Set quota_full_tempfail explicitly in Dovecot to choose temporary deferral (4xx) or permanent rejection (5xx). The exact default and reply text vary by Dovecot release, so verify with dovecot -n instead of assuming a value.
Preserving user+tag into Sieve

Set Postfix recipient_delimiter to the same character Dovecot expects, typically +.
Confirm Postfix delivers the full address, including detail, to the LMTP socket. Do not rewrite user+tag to user before mailbox_transport.
Enable quota and sieve under protocol lmtp in Dovecot, not only under imap or local delivery.
Enable Sieve envelope and subaddress tests explicitly; detail survival depends on Dovecot/Pigeonhole version and plugin configuration.

Pre-flight checks before blaming the other component

Run postconf -n mailbox_transport recipient_delimiter and dovecot -n. Confirm the LMTP socket path in Postfix matches service lmtp unix_listener in Dovecot, including owner and mode inside Postfix's chroot.
Test socket reachability. A missing socket or permission denied is a Postfix/Dovecot boundary fault that causes deferral, not a quota rejection.
Send test messages to user and user+tag. Inspect the mail log for Dovecot LMTP and Sieve lines. If the tag disappears, Postfix stripped it before LMTP.
Check quota with doveadm quota get user, then deliver an over-quota test message. Confirm whether Dovecot returns 4xx defer or 5xx reject according to quota_full_tempfail.
If using quota-status, temporarily stop it or point Postfix to a non-listening policy port to confirm failure-open versus failure-closed behavior before depending on SMTP-time rejection.

Missing diagnostic detail: tell me whether over-quota mail should defer temporarily or reject permanently. That choice determines quota_full_tempfail and whether Postfix queues or bounces the message.

Dovecot LMTP and Postfix MTA: Which Side Owns Quota Rejection and Subaddress Detail?

1 answer

Answer

Criteria for SMTP-time versus LMTP-time enforcement

Preserving `user+tag` into Sieve

Pre-flight checks before blaming the other component

Your perspective belongs here.

0 question comments