mailcow.email Paid content

Dovecot is the IMAP and POP3 server in a mail stack: it stores users' mail in mailboxes and serves that mail to mail clients, and it usually also handles local delivery (via LMTP), authentication lookups, and server-side filtering (Sieve). It does not move mail between servers — that is the MTA's job, typically Postfix. In a dockerized suite like mailcow, Dovecot runs as its own container next to Postfix, SOGo, and Rspamd, which is why it appears in both feature discussions and troubleshooting threads.

The split of duties: MTA vs. IMAP/POP3 server

A mail server is not one program but a chain of specialized components. The two you will see most often are Postfix and Dovecot, and confusing their roles is the most common source of misunderstanding.

The short version: Postfix decides where mail goes; Dovecot decides what a mailbox is and who may read it. When you send a message, Postfix receives it over SMTP, then hands it to Dovecot over LMTP for final delivery into the recipient's mailbox. When you open your mail app, the app talks to Dovecot over IMAP or POP3 — Postfix is not involved at that point.

What Dovecot actually does in practice

Mailbox access: IMAP and POP3

IMAP is the protocol most clients use. It keeps mail on the server and synchronizes state — folders, read/unread flags, deletions — across every device you connect. POP3 is the older alternative: it typically downloads messages to one device and can remove them from the server. If you have ever set up a phone and a laptop and expected both to show the same inbox, that is IMAP doing the work.

Local delivery: LMTP

LMTP (Local Mail Transfer Protocol) is how the MTA hands a message to Dovecot for storage. It looks like SMTP but is designed for final delivery to a mailbox rather than relaying onward. This is the handoff point where a message stops being "in transit" and becomes "in a mailbox."

Authentication

Dovecot can verify credentials against a backend — a database, LDAP, or a passwd-style file — and tell the client whether the login is valid. In a suite like mailcow, this is also how account data is shared with the rest of the stack, so a single account works for both sending and reading mail.

Sieve filtering

Sieve is a mail filtering language. Rules such as "file messages from this sender into that folder" or "reject mail matching this pattern" are evaluated by Dovecot at delivery time, before the message lands in the inbox. This is server-side filtering, so it applies no matter which client you use.

Quotas

Dovecot tracks and enforces per-mailbox storage limits. When a mailbox is full, delivery can be rejected or deferred, which is one reason quota settings show up in delivery-failure investigations.

How Dovecot fits into a dockerized suite like mailcow

mailcow packages the whole stack as containers, and Dovecot is one of them rather than something you install and configure by hand. The mailcow project describes itself as "the mailserver suite with the 'moo'" and lists Dovecot alongside Postfix, SOGo, Rspamd, and others as core components. In that arrangement:

• Postfix handles SMTP in and out.
• Dovecot handles mailbox storage, IMAP/POP3 access, LMTP delivery, authentication, and Sieve.
• SOGo provides the webmail and groupware front end that talks to Dovecot on the user's behalf.
• Rspamd filters spam and can influence what reaches delivery.

Because each piece is a separate container, an update to one component ships independently — mailcow's release notes routinely bump individual components (for example, a 2026 update that raised Redis, SOGo, and ClamAV versions, and another that fixed a CVE in Unbound and bumped Nginx). Dovecot's own version moves on its own schedule within that model, which is worth knowing when you read a changelog and wonder why Dovecot is not mentioned in a given release.

Why Dovecot shows up in troubleshooting

Most Dovecot-related problems fall into a few recognizable categories:

• Authentication failures. The client cannot log in even though the password is correct. Causes range from a backend lookup problem to a mismatch between the username format the client sends and what the auth backend expects.
• Mailbox permission problems. Mail is delivered but cannot be read, or delivery fails outright, because the process serving the mailbox does not have the right ownership or access to the mail directory.
• TLS certificate issues. Clients refuse to connect, or warn about an untrusted certificate, because the certificate Dovecot presents is expired, mismatched to the hostname, or not the one the client expects.
• Delivery and quota errors. A message bounces or is deferred because the mailbox is over quota or the LMTP handoff failed.

The useful habit is to ask which side of the chain the symptom belongs to. If sending fails, look at Postfix. If reading, logging in, or filing mail fails, look at Dovecot. That single question usually cuts the search space in half before you touch any configuration.

Postfix is the SMTP server (Mail Transfer Agent, or MTA) in a mail stack: it accepts mail from the internet or from your own users, decides where each message should go, and hands it off to the next hop. You need it if you want to send or receive mail at all — it is the component that actually speaks SMTP on port 25 and the submission ports. It does not store mailboxes for reading (that is Dovecot's job), does not filter spam on its own (that is Rspamd's job), and does not give you a web interface. In a containerized suite like mailcow, Postfix is one container among several, and most of what you configure is relay, ports, TLS, and the mail queue.

The core job: receive, relay, deliver

Postfix does three things in sequence, and almost every problem you will hit maps to one of them:

• Receive — accept an inbound SMTP connection, check whether the recipient domain is one it handles, and take responsibility for the message.
• Relay — decide the next destination. For local recipients it passes the message to the delivery agent (in mailcow, Dovecot's LMTP service). For outbound mail it looks up the recipient domain's MX record and opens a connection there.
• Deliver — complete the handoff, or hold the message in the queue and retry if the remote side is unavailable.

The queue is the key mental model. A message Postfix has accepted but not yet delivered lives in the queue, and it stays there until delivery succeeds or the retry window expires. That is why "mail is stuck" almost always means "look at the queue," not "look at the mailbox."

How Postfix differs from the rest of the stack

These components are often confused because they all touch email, but they operate at different layers:

A useful way to hold this in your head: Postfix is the postal service, Dovecot is the mailbox on your wall, Rspamd is the mailroom inspector, and the web UI is the administration office. They are separate processes with separate logs, which is why a "mail problem" needs to be localized to one of them before you start changing configuration.

Where Postfix sits in a containerized suite like mailcow

mailcow packages Postfix, Dovecot, Rspamd, SOGo, Nginx, and supporting services as separate Docker containers orchestrated together. Postfix is one of them, and it is the container that binds the SMTP ports. Its configuration is generated from the suite's own settings rather than edited directly in most cases — you change a domain, relay, or TLS option through the suite, and the Postfix configuration is regenerated to match.

This matters practically: if you hand-edit Postfix config files inside the container, those edits can be overwritten the next time the suite regenerates configuration or you update. Treat the suite's settings as the source of truth and the container's files as generated output.

mailcow's own release notes show Postfix tracked as a versioned component alongside the rest of the stack — for example, the Mooly 2026 update bumped Postfix to 3.10.12 together with Rspamd 4.1.0 and Nginx 1.30.3. That is the pattern to expect: Postfix updates arrive as part of suite updates, not as something you patch independently.

Configuration touchpoints you will actually deal with

Most day-to-day Postfix work in a managed suite comes down to four areas:

• Relay — sending outbound mail through a smarthost instead of directly, common when your host blocks port 25 or you want a provider to handle deliverability. You set the relay host and credentials; Postfix routes all outbound mail through it.
• Ports — port 25 for server-to-server mail, and submission ports (typically 587 with STARTTLS, or 465 with implicit TLS) for your own users' mail clients. If clients can receive but not send, the submission port or its authentication setting is the first thing to check.
• TLS — certificates for inbound and outbound connections. Expired or mismatched certificates produce connection failures that look like delivery problems but are actually handshake problems.
• Queue handling — inspecting, flushing, or deleting queued messages. This is the operational lever when mail is delayed.

Typical failure symptoms and where to look first

The general rule: if the message never left your server, it is Postfix. If it left and arrived but the user cannot see it, it is Dovecot. If it arrived and should have been blocked, it is Rspamd.

Deciding whether you need to think about Postfix at all

If you run a managed mail suite, Postfix is present whether or not you configure it directly — you inherit it as part of the stack. You only need to engage with it when you change relay settings, adjust ports or TLS, or troubleshoot delivery and queue behavior. If you are building a mail server from components, Postfix (or an equivalent MTA) is not optional: without an SMTP server, nothing sends or receives mail, and the rest of the stack has nothing to store or filter.

When a Docker build fails or a container exits immediately, the fix usually starts with reading the error correctly. Docker separates two phases: build time (the image is being created from your Dockerfile) and run time (a container is starting from a finished image). Most errors belong clearly to one phase, and identifying the phase narrows the cause quickly. This guide walks through how to read the output, isolate the layer where things break, and use Docker CLI commands to inspect and debug.

First: Decide Which Phase Is Failing

If you are unsure, run the build and the container separately rather than chaining them. That alone tells you which half of the problem you own.

Reading Docker Build Output

Build output is sequential. The failure is almost always at the last step shown, not the first. Docker prints each instruction and its result; the first non-zero exit stops the build.

Common build errors and their root causes

COPY failed: file not found in build context The path you referenced does not exist relative to the build context you passed. Check that:

• The file is inside the directory given to docker build (often .).
• A .dockerignore file is not excluding it.
• You are not copying from outside the context (Docker cannot reach parent directories).

RUN command returns exit code 1 (or another non-zero) The command inside the container failed. This is usually an application-level problem, not a Docker problem: a missing package, a wrong path, a failed download, or a command that assumes a shell feature your base image lacks. Read the lines above the error — the real message is often printed there.

failed to solve / buildkit errors BuildKit reports the failing instruction and often a hint. Treat the hint as a starting point, not a guarantee. Reproduce the failing command manually by running an interactive container from the previous stage's image.

no matching manifest for <platform> The image you are pulling does not publish a variant for your architecture. Confirm the image supports your platform, or build for the platform the image provides.

A practical build-debug loop

1. Build with plain output so steps are visible: docker build -t myapp .
2. Note the last successful step.
3. Start an interactive shell from that intermediate image (or from the base image) and run the failing command by hand.
4. Fix the Dockerfile, rebuild, repeat.

If the build is slow, reorder instructions so frequently changing steps come last — but do this only after the error is fixed, not while debugging.

Reading Container Startup Failures

A container that exits immediately is doing what it was told: its main process ended. Docker does not keep a container alive if its entrypoint/command finishes.

Step 1: Get the exit code

docker ps -a

Look at the STATUS column. An exit code of 0 usually means the process completed successfully but was not meant to be a long-running service. Codes like 1, 127, or 137 point to different causes:

• 127 — command not found (wrong entrypoint, missing binary, or a shell path issue).
• 1 — general application error; check logs.
• 137 — the process was killed, often out of memory or a manual stop.

Step 2: Read the logs

docker logs <container_id>

If the logs are empty, the process may have failed before producing output — a strong sign of a bad entrypoint or a missing executable. Confirm what the container is actually trying to run:

docker inspect <container_id>

Check the Config.Cmd and Config.Entrypoint fields. A common mistake is an entrypoint that references a file not present in the final image, or a shell form that swallows arguments.

Step 3: Run it interactively

Override the entrypoint to get a shell and explore the container's filesystem:

docker run -it --entrypoint sh <image>

From inside, verify the binary exists, the working directory is what you expect, and environment variables are set. This is the fastest way to separate "the image is wrong" from "the runtime configuration is wrong."

Step 4: Check runtime configuration

If the image works interactively but fails normally, the problem is likely configuration:

• Missing environment variables — the app exits when a required variable is absent.
• Port conflicts — the container starts but the host port is already in use; the error appears in docker run output.
• Volume mounts — a mount can hide files the image expected, or point at an empty host directory.
• Networking — the container cannot reach a dependency it needs at startup.

Isolating Dockerfile vs. Image vs. Runtime

Use this decision path:

1. Does the build succeed? If no, the problem is in the Dockerfile or build context.
2. Does the image run interactively? If yes but the normal run fails, the problem is runtime configuration (env, ports, volumes, command).
3. Does it fail in both? The image itself is incomplete — a missing dependency or file baked in at build time.
4. Does it work locally but fail elsewhere? Compare environment, architecture, and mounted data between the two environments.

When to Consult Docker Docs

The official documentation at docs.docker.com is the right reference for:

• CLI command flags — exact options for docker build, docker run, docker inspect, and docker logs.
• Dockerfile instruction semantics — how COPY, RUN, ENTRYPOINT, and CMD interact, especially the difference between shell and exec form.
• Build context and .dockerignore — what gets sent to the daemon and what is excluded.
• Registry and authentication — pull failures tied to login or access.

Use the docs to confirm behavior, not to guess at it. Error messages are usually literal; the documentation explains the rules behind them.

A Reusable Debugging Checklist

• [ ] Identify the failing phase: build or run.
• [ ] For builds, read the last STEP and the lines above the error.
• [ ] For runs, get the exit code with docker ps -a.
• [ ] Read docker logs before changing anything.
• [ ] Inspect Entrypoint and Cmd with docker inspect.
• [ ] Reproduce interactively with --entrypoint sh.
• [ ] Check env vars, ports, and volume mounts.
• [ ] Confirm the image supports your platform.
• [ ] Only then edit the Dockerfile or run command.

Most Docker errors are not mysterious once you know which phase failed and where to look. Read the last step, check the exit code, read the logs, and reproduce interactively. That sequence resolves the large majority of build and startup failures without guesswork.

GitHub is a web platform for hosting Git repositories and collaborating on code. For open-source projects like mailcow, it serves as the place where source code lives, releases are published, bugs are reported, and contributions are reviewed. You can use GitHub without writing any code — browsing a project's repository, reading its changelog, or filing a bug report are all legitimate uses. The one thing to keep straight up front: Git is the version-control tool that tracks changes to files, while GitHub is a hosting and collaboration service built around Git. You can use Git without GitHub, and GitHub hosts projects that use Git.

The core concepts you'll actually encounter

A repository's history is a chain of commits. Branches let people work on changes without disturbing the main line. When a change is ready, it's proposed as a pull request, reviewed, and merged. Issues are the separate track for problems and discussion — they aren't code, but they often drive it.

Finding a project's source, releases, and changelog

For a project like mailcow, the repository is the authoritative source for what's in a given version. A practical path:

1. Open the project's repository page. The file listing and README are the front door — the README usually states what the project is and how to install it.
2. Check the Releases section (often a link in the sidebar) to see tagged versions. Release notes typically list component version bumps and security fixes. mailcow's own blog, for example, publishes entries such as "Mootember 2026 | Unbound 1.26.1, SOGo 5.12.11 & Redis 7.4.11" and "Mooly 2026 | Postfix 3.10.12, Rspamd 4.1.0 & Nginx 1.30.3," each tied to a dated update release.
3. Look for a CHANGELOG file or a changelog link. This is where you confirm exactly which component versions and fixes landed in a release.
4. Use the commits view when you need to know when something changed, not just that it changed.

This matters when you're deciding whether to upgrade. A release note that says it "addresses several security-related issues" and "strongly recommend[s] updating" is a different signal than a routine dependency bump.

Reporting a bug or contributing a change

The workflow is the same across most projects:

• Before filing an issue, search existing issues. Duplicates get closed, and the answer may already be there.
• When filing, include what you did, what you expected, and what happened — plus version numbers. For a Docker-based project, that means the image or release version and relevant logs.
• To contribute code, the usual path is: fork the repository, create a branch, make commits, push, then open a pull request against the upstream project. Maintainers review, request changes, and merge.

You don't need commit access to any of this. Forking and pull requests exist precisely so outside contributors can propose changes without direct write access to the main repository.

GitHub vs. Git, in one example

Say you want to fix a typo in a project's documentation. Git, running on your machine, records your edit as a commit and tracks the branch you made it on. GitHub is where you push that branch and open a pull request so the maintainers can see and merge it. Git did the version tracking; GitHub did the hosting and the collaboration. If you only ever browse a project's releases or read its issues, you're using GitHub and never touching Git directly — which is fine.

Where this leaves you

If your goal is to use a project like mailcow, you mainly need the Releases and changelog views to pick and verify a version. If your goal is to report or fix something, you need issues and pull requests. And if you're trying to understand what changed between two versions, commits and release notes are the record — not the marketing page.

mailcow is a Docker-based mail server suite that bundles the full stack you'd otherwise assemble by hand — Postfix for SMTP, Dovecot for IMAP/POP3, SOGo for webmail and groupware, Rspamd for spam filtering, plus a web admin UI — and ships it as a set of coordinated containers. It fits self-hosters who want a complete, working mail system on their own hardware without wiring each component together, and who can supply a dedicated host, Docker with Compose, a domain, and correct DNS/MX records. If you'd rather not run and patch a mail server yourself, a hosted provider is the more sensible choice.

What's inside the suite

mailcow's value is that these pieces are pre-integrated and versioned together, so you don't have to reconcile their configs yourself:

The project also references tinc for networking between instances. The web admin UI is where you manage domains, mailboxes, aliases, and filtering — the operational surface most users interact with day to day.

What it's actually good at

• One deployable stack. SMTP/IMAP, webmail, groupware, spam filtering, and administration come as a unit rather than as a checklist of separate installs.
• Container-based updates. Releases are published as versioned updates you apply to the running stack, with changelogs describing what changed.
• A real admin UI. Domain, mailbox, and alias management happen in the browser instead of by editing config files.

What you need before it makes sense

• A dedicated host — mail servers want a stable, known IP.
• Docker plus Compose installed and working.
• A domain you control, with correct DNS and MX records pointing at the host. Getting this wrong is the most common reason mail silently fails to arrive or gets rejected.
• Willingness to apply updates, including security ones, on an ongoing basis.

How it compares to the alternatives

• Versus building your own Postfix/Dovecot stack: you trade full control over every config file for a maintained, integrated bundle. mailcow is faster to a working state; a hand-built stack is more flexible if you have unusual requirements.
• Versus hosted mail: self-hosting gives you control over data and configuration, but you own deliverability, DNS, patching, and uptime. Hosted mail removes that operational load.

Where to follow releases and upgrades

Release notes, changelogs, and upgrade guidance live on mailcow.email. The blog carries dated update posts — for example, the September 2026 update covering Unbound 1.26.1, SOGo 5.12.11, and Redis 7.4.11, and the August 2026 revision bumping Redis, SOGo, and ClamAV while addressing security issues in those components. There's also a dedicated upgrade tag and upgrade guides (such as Debian 12 to Debian 13) for major version transitions.

A few things worth knowing from the project's own posts:

• Updates are frequently security-driven and the project explicitly recommends applying them — the March 2026 revision and the May 2026 revision both fix CVEs in bundled components.
• Behavior changes do land in updates: the January 2026 release introduced limited EAS/DAV access and restricted alias sending, and a 2026 update introduced forced 2FA.
• The team changes over time — a maintainer announced departure effective May 2026 — so treat the blog as the authoritative source for current state rather than any single snapshot.

If you're evaluating mailcow, the practical test is whether you can meet the host, Docker, and DNS prerequisites and commit to applying updates. If yes, it gets you to a functioning mail server with far less assembly than a manual stack. If not, that's the signal to look at hosted mail instead.