Dovecot on CentOS: A Legacy IMAP/POP3 Guide with 2026 Security Notes

Publication date: January 4, 2021

Updated: July 29, 2026

Overview

This is the initial configuration procedure required to install and start Dovecot on CentOS. This description assumes CentOS7. The incoming protocols are configured as imaps (IMAP over SSL) and pop3s (POP3 over SSL).

Configure and secure Postfix before enabling the Dovecot integration.

Tested versions:

1. install

This section describes the setup of Dovecot from installation to startup.

1-1. Installing Dovecot

The historical CentOS procedure installed Dovecot with yum from an administrative shell.

[username@hostname ~]$ su -

[root@hostname ~]# yum -y install dovecot

1-2. Startup Confirmation

To confirm that the installation was successful, check the startup. Note that Dovecot does not require start as an argument when starting.

[root@hostname ~]# /usr/sbin/dovecot

[root@hostname ~]# ps aux | grep dovecot

root      1470  0.0  0.1  16092  1156 ?        Ss   18:38   0:00 /usr/sbin/dovecot

dovecot   1471  0.0  0.1   9752  1120 ?        S    18:38   0:00 dovecot/anvil

root      1472  0.0  0.1   9884  1320 ?        S    18:38   0:00 dovecot/log

root      1474  0.0  0.2  12916  2384 ?        S    18:38   0:00 dovecot/config

root      1476  0.0  0.0 112824   968 pts/0    R+   18:38   0:00 grep --color=auto dovecot

If the output shows a process running as the dovecot user, the initial startup succeeded. Stop the service before continuing with the configuration.

[root@hostname ~]# /usr/sbin/dovecot stop

2. Legacy Dovecot configuration walkthrough

2-1. initialization

The following sections record the original Dovecot configuration. Compare every directive with the documentation for the installed supported version.

[root@hostname ~]# vi /etc/dovecot/dovecot.conf

Apply the following change:

#protocols = imap pop3 lmtp

～omission～

#listen =  *, ::

～omission～

#login_greeting = Dovecot ready.

protocols = imap pop3

～omission～

listen = *

～omission～

login_greeting = pop3 and imap ready.

protocols" specifies the protocols to connect to Dovecot.

listen = * binds to all available addresses; it does not authorize a client by itself, but it increases network exposure. Bind only required interfaces and combine the setting with a host firewall, encrypted protocols, and explicit authentication controls. The "::" is a setting for IPv6, but since IPv6 will not be used this time, delete it. By deleting it, only IPv4 will be accepted.

login_greeting" is the message when connecting. It is not necessary to change it, but for security purposes, change the message so that no one will know it is dovecot when they connect.

2-2. POP3 and IMAP Settings

The configuration covers the standard POP3 port 110 and IMAP port 143, with authentication integrated with Postfix.

[root@hostname ~]# vi /etc/dovecot/conf.d/10-master.conf

Apply the following change:

service imap-login {

  inet_listener imap {

    #port = 143

  }

～omission～

service pop3-login {

  inet_listener pop3 {

    #port = 110

  }

service imap-login {

  inet_listener imap {

    port = 143

  }

～omission～

service pop3-login {

  inet_listener pop3 {

    port = 110

  }

2-3. Dovecot Authentication Method Settings

Add login to the Dovecot authentication method.

[root@hostname ~]# vi /etc/dovecot/conf.d/10-auth.conf

Apply the following change:

#disable_plaintext_auth = yes

～omission～

auth_mechanisms = plain

disable_plaintext_auth = no

～omission～

auth_mechanisms = login plain

2-4. Changed mail storage method to "Maildir" format

Set the mail storage location to each user's home directory (under "/home/xxx/").

[root@hostname ~]# vi /etc/dovecot/conf.d/10-mail.conf

Apply the following change:

#mail_location =

～omission～

namespace inbox {

  # Namespace type: private, shared or public

  #type = private

  # Hierarchy separator to use. You should use the same separator for all

  # namespaces or some clients get confused. '/' is usually a good one.

  # The default however depends on the underlying mail storage format.

  #separator =

  # Prefix required to access this namespace. This needs to be different for

  # all namespaces. For example "Public/".

  #prefix =

  # Physical location of the mailbox. This is in same format as

  # mail_location, which is also the default for it.

  #location =

mail_location = maildir:~/Maildir

～omission～

namespace inbox {

  # Namespace type: private, shared or public

  #type = private

  # Hierarchy separator to use. You should use the same separator for all

  # namespaces or some clients get confused. '/' is usually a good one.

  # The default however depends on the underlying mail storage format.

  #separator =

  # Prefix required to access this namespace. This needs to be different for

  # all namespaces. For example "Public/".

  #prefix =

  # Physical location of the mailbox. This is in same format as

  # mail_location, which is also the default for it.

  location = maildir:~/Maildir

2-5. Authentication Settings

Enable ssl settings.

[root@hostname ~]# vi /etc/dovecot/conf.d/10-ssl.conf

Apply the following change:

ssl = required

～omission～

ssl_cert = </etc/pki/dovecot/certs/dovecot.pem

ssl_key = </etc/pki/dovecot/private/dovecot.pem

ssl = required

～omission～

ssl_cert = </etc/pki/tls/certs/localhost.crt

ssl_key = </etc/pki/tls/private/localhost.key

Set ssl_cert and ssl_key to a valid certificate chain and protected private key. Plan renewal and verify that Dovecot reloads renewed material.

The related Apache article contains a historical certificate example, not a current mail-certificate recipe. Follow the certificate authority and Dovecot documentation for the deployment.

Initial configuration required from installation of Apache on CentOS to startup

Next, configure settings related to passwords. Use "auth-system.conf.ext".

[root@hostname ~]# vi /etc/dovecot/conf.d/auth-system.conf.ext

Apply the following change:

passdb {

  driver = pam

  # [session=yes] [setcred=yes] [failure_show_msg=yes] [max_requests=<n>]

  # [cache_key=<key>] [<service name>]

  #args = dovecot

}

～omission～

#passdb {

  #driver = shadow

  # [blocking=no]

  #args =

#}

#passdb {

#driver = pam

  # [session=yes] [setcred=yes] [failure_show_msg=yes] [max_requests=<n>]

  # [cache_key=<key>] [<service name>]

  #args = dovecot

#}

～omission～

passdb {

  driver = shadow

  # [blocking=no]

  #args =

}

2-6. Startup Confirmation

The configuration is now complete, so check to see if Dovecot starts with the configuration completed. Note that "start" is not required as an argument.

[root@hostname ~]# /usr/sbin/dovecot

[root@hostname ~]# ps aux | grep dovecot

root      1716  0.0  0.1  16092  1184 ?        Ss   22:09   0:00 /usr/sbin/dovecot

dovecot   1717  0.0  0.1   9752  1120 ?        S    22:09   0:00 dovecot/anvil

root      1718  0.0  0.1   9884  1312 ?        S    22:09   0:00 dovecot/log

root      1720  0.5  0.2  12916  2396 ?        S    22:09   0:00 dovecot/config

root      1722  0.0  0.0 112824   972 pts/0    S+   22:09   0:00 grep --color=auto dovecot

If a process runs as the dovecot user, the service started. That does not verify authentication, TLS, mailbox permissions, protocol exposure, or Postfix integration; inspect logs and run controlled client tests.

[root@hostname ~]# /usr/sbin/dovecot stop

2-7. Automatic startup setting

Enable Dovecot with the service unit supplied by the operating-system package. Unit names and commands differ by distribution; do not create a second competing unit.

Check if "/usr/lib/systemd/system/dovecot.service" exists. If not, create "dovecot.service" as follows Execute as root user.

[root@hostname ~]# touch /etc/systemd/system/dovecot.service

[root@hostname ~]# vi /etc/systemd/system/dovecot.service

Use the following settings:

[Unit]

#Description.

Description=Dovecot

#Control before and after execution

#Before=xxx.service

After = network.target

[Service]

#User and group designation

User=root

Group=root

#Once activated, set the status to Activated.

Type=oneshot

RemainAfterExit=yes

#Start, stop, reload

ExecStart=/usr/sbin/dovecot

ExecStop=/usr/sbin/dovecot stop

ExecReload=/usr/sbin/dovecot reload

[Install]

#runlevel3 equivalent setting

WantedBy=multi-user.target

Next, register and enable the service with systemctl.

[root@hostname ~]# systemctl enable dovecot

[root@hostname ~]# systemctl is-enabled dovecot

enabled

[root@hostname ~]# systemctl list-unit-files --type=service | grep dovecot

dovecot.service                                enabled

[root@hostname ~]# systemctl daemon-reload

3. Conclusion

The historical walkthrough covers package installation, listeners, authentication, mailbox access, TLS, Postfix integration, service startup, and firewall access. A current deployment requires supported packages, encrypted authentication, least-privilege mail storage, certificate renewal, log monitoring, and controlled client testing.

Official references

• Red Hat Postfix and Dovecot deployment guide
• Dovecot TLS configuration
• Dovecot authentication schemes