The history of Dovecot: the dovecote that became IMAP

In July 2002 a Finn who had already written irssi released an IMAP server built not to be Courier or UW. He called it Dovecot — a pigeon house. Five years later, on 13 April 2007, 1.0.0 arrived. Timo Sirainen noted: “almost five years, but it is ready”. Twenty-four years later, Dovecot 2.4.5 (28 August 2026) is still the IMAP server most of the internet uses: the 2020 Open Email Survey measured 2,9 million servers and a 76,9% share. Postfix delivers; Dovecot stores and retrieves.

Tampere, irssi, and an IMAP server that would not crash

Timo Sirainen came from IRC. He created irssi, the terminal client an entire generation of Linux administrators used. In the early years after 2000 he worked at a small company in Finland that needed IMAP for internal email. Courier was the “lightweight” standard. UW IMAP, from the University of Washington, was the academic standard. Both had reputations for security holes and painful configuration. Timo wanted the opposite: secure by design, fast, easy to bring up.

The name is the building: dovecot is the pigeon house, the boxes in the wall where pigeons enter. Pigeonhole, the Sieve project that came later, is the compartment — the mail slot. The metaphor fits: IMAP does not transport letters (SMTP does that). IMAP is the cabinet. The teal logo — two pigeons/chevrons in flight — represents that wall.

The first years were hobby work and contracts. Rackspace brought him in for a year. Portugal Telecom, half a year. Companies paid for features; the code was opened. In 2011 he formalized Dovecot Oy with an open-core model: CE for free, what telecoms and large ISPs need (clustering, support, later Pro) paid. That funded the open-source developers’ salaries. He said so at the time, and the company repeated it in 2025 when someone asked whether Dovecot was “going proprietary”.

2002–2007: five years to 1.0

The first public release was in July 2002. Version 1.0.0 came only on 13 April 2007, after rewriting nearly everything. Timo told the list he did not expect 1.0.1 soon, unless someone was sitting on a serious bug waiting for 1.0. Anyone wanting new features should move to 1.1. mbox and Maildir from the beginning — compatible with Courier and UW, so clients already reading mailboxes on disk would not break. dbox was born during the 1.x series (1.0 alpha, redesign in 1.1) and only truly matured in 2.0.

The process design was already that of the Dovecot we know: a master, least-privilege children, dovenull and dovecot as system users. Login separate from IMAP. Its own index for flags and cache, avoiding rereading the whole Maildir on every IDLE. Former Courier users felt the difference in SELECT on large mailboxes.

2.0, August 2010: LMTP, mdbox, doveadm

Version 2.0.0 arrived on 16 August 2010. Timo was “cautiously optimistic” that 2.0.1 would not need to follow within days. The foundations changed:

• Two system users by default: dovecot and dovenull.
• LMTP for real — the right way for Postfix (and Exim) to deliver to mailboxes without an LDA per message.
• mdbox (multi-dbox): multiple emails per file, indexes Dovecot trusts. Losing the index means losing flags — the warning is still in the documentation.
• doveadm instead of half a dozen binaries. Quotas, kicks, replication, index dumps.
• Pigeonhole could now be installed without patching the core.

Stephan Bosch finalized Pigeonhole 0.2.0 weeks later, for 2.0.2: Sieve (RFC 5228) and ManageSieve (RFC 5804) in one package. The name, again, is the dovecote's compartment. Vacation, fileinto, duplicate, later IMAPSIEVE. Those filtering on the server in 2026 still speak Sieve; this is the interpreter.

2.2 and 2.3: dsync, MSA, Lua

Version 2.2.0 (12 April 2013) rewrote dsync and added per-user flags in shared mailboxes. IMAP extensions modern clients expect. Version 2.3.0 (22 December 2017) introduced a message submission agent — Dovecot also speaks 587 — and Lua authentication. Push notifications, events, the “not just imapd” scope.

In the middle of this, March 2015: Dovecot Oy merged with Open-Xchange AG. Timo, Mikko Linnamäki, and Markku Kenttä became OX partners. Timo on the list: no killing the name, no forcing App Suite underneath IMAP. “I can finally get back to designing new things.” OX gained the backend already running on 57% of active IMAP servers (the figure at the time). CE releases continued. Pro was for telecoms.

What the dovecote does better than Courier

It is not a GUI. It is the cabinet:

• Formats: mbox, Maildir, sdbox (one email per file), mdbox (several). imapc/pop3c if the mailbox lives on another server.
• Index: flags, cache, threads. Maildir synchronizes; dbox assumes the index is the truth.
• Auth: passwd, PAM, LDAP, SQL, Lua, GSSAPI, a SASL authenticator that Postfix 2.3+ and Exim 4.64+ query directly — one password location for SMTP-auth and IMAP.
• ACL, shared, quota, zlib, FTS (today the flatcurve driver). IDLE hibernation in a process imap-hibernate.
• Pigeonhole: Sieve on delivery (LDA/LMTP) and ManageSieve on 4190.

In 2017 Mozilla, through MOSS, paid Cure53 to audit the code. The report is the sort of thing administrators put on slides: despite trying, the testers found three minor issues. “Exceptionally good outcome.” Security was not marketing — it was the 2002 criterion.

2.4: the config that breaks on purpose

Version 2.4.0 arrived on 24 January 2025 after a long wait. Aki Tuomi of Open-Xchange Oy warned the list: the 2.4 package doesn't read 2.3 config. Rewrite it. dovecot_config_version must be the first non-comment line; dovecot_storage_version is also required. Without them the process refuses to start — deliberately, to avoid silently changing defaults. The section plugin {} is gone. Every passdb/userdb now has a name. Berkeley DB is out. Memcached dict is out (Redis replaces it). New variables, named filters, mandatory SSL even in login_trusted_networks when ssl=required.

The package key changed too: 2.4 signs with EF0882079FD4ED32BF8B23B2A1B09EF84EDC5219. Version 2.3 retained the old key. On 12 May 2025 came the lifecycle announcement: everything before 2.3, fully EOL; 2.3 gets only critical security fixes; features and bugs go to 2.4. Distributions packaging 2.3 must work it out with the vendor.

Pro moved to the Palomar architecture (3.x since September 2024). CE did not become proprietary — OX repeated that in December 2025. Large-cluster features live in Pro; the open dovecote remains the best IMAP server for a single machine and medium-sized ISPs.

2026: 2.4.5, Sieve, ML-KEM

Version 2.4.5 and Pigeonhole 2.4.5 were released together on 28 August 2026. A security release, not a toy:

• use-after-free in Sieve editheader — the kind of bug that becomes RCE at delivery.
• SMTP smuggling in submission.
• CVE-2026-40204: creating a mailbox bypassed ACLs.
• OTP (SASL and password scheme) removed.
• Heredoc in config (<<MARKER).
• doveadm auth cache status.
• FTS flatcurve with phrase search.
• ML-KEM-512/768/1024 through OpenSSL 3 — post-quantum KEM in IMAP TLS.
• AEAD in Dovecot key encryption.

Ubuntu 24.04 still packages the distribution's 2.3.x. Those wanting 2.4 go to repo.dovecot.org or compile. Official Docker: dovecot/dovecot. This blog's classic combination remains the same as in 2010: Postfix on 25/587, Dovecot on 143/993, LMTP on the socket, shared SASL. Underneath, Zimbra also talks to a Dovecot — the old coverage is in Installing Zimbra 8.7.1 on Ubuntu.

Timeline

• 2002 — in Tampere, Finland, Timo Sirainen starts Dovecot, tired of IMAP servers that crashed and leaked.
• 2007 — after five years of development, 1.0 is released.
• August 2010 — 2.0 brings LMTP, the mdbox format, and doveadm.
• 2.2 and 2.3 — introduce dsync for replication, the MSA role, and Lua extensibility.
• September 2024 — Pro migrates to the Palomar architecture in the 3.x series.
• 12 May 2025 — new lifecycle: everything before 2.3 reaches its end; 2.3 receives only critical fixes.
• 2.4 — configuration deliberately changes and breaks compatibility; ssl=required becomes standard and the package signing key changes.
• December 2025 — Open-Xchange reaffirms that the community edition remains open.
• 28 August 2026 — 2.4.5 and Pigeonhole 2.4.5: serious security fixes and post-quantum ML-KEM cryptography in TLS.

Wrap-up

A Finnish dovecote, an IRC client, five years to 1.0, and a stubborn refusal to trust IMAP servers that had already leaked. Courier and UW left the scene. Cyrus stayed in the academic niche. Dovecot took three quarters of the planet's IMAP servers, with Postfix on the other side of the queue. 2.4.5, MIT/LGPLv2, Pigeonhole for Sieve, open CE, Pro on Palomar. Timo designed the cabinet. Aki and OX still deliver it.

Its sibling MTA: The history of Postfix. The Unix underneath: UNIX — The Origin of Systems and Linux turns 35.

From the boxes on Tampere's walls to 2.4.5: the dovecote still retrieves the letter. Teal, disk index, hibernating IDLE. The pigeon enters. IMAP responds.