Tune Dovecot: Connection Limits, Quotas, Performance

Dovecot is efficient by default, but busy mail servers hit limits: users with many devices get "too many connections", mailboxes fill up without warning, and brute-force attempts waste resources. This guide covers the Dovecot tuning settings that matter most.

Before you start

Root access to a Dovecot server you manage yourself.
On cPanel servers, use WHM → Service Configuration → Mailserver Configuration instead of editing files – cPanel regenerates Dovecot's config.
Check the current effective config with doveconf -n.

Connections per user and IP

Each IMAP client opens several connections (one per watched folder). Phones, laptops and an office behind one IP can exceed the default of 10.

protocol imap {
  mail_max_userip_connections = 30
}

Put this in conf.d/20-imap.conf. Errors in the log look like Maximum number of connections from user+IP exceeded.

Process limits

In conf.d/10-master.conf:

default_process_limit = 500
default_client_limit = 2000

service imap-login {
  service_count = 1
  process_min_avail = 4
}

service imap {
  process_limit = 1024
}

Each IMAP session uses its own process, so process_limit caps concurrent sessions. Make sure the system's open file and process limits are high enough; Dovecot warns at startup if not.

Mailbox quotas

Enable the quota plugin in 10-mail.conf:
```
mail_plugins = $mail_plugins quota
```
In 20-imap.conf add imap_quota so mail clients can show usage:
```
protocol imap {
  mail_plugins = $mail_plugins imap_quota
}
```

In 90-quota.conf:

plugin {
  quota = maildir:User quota
  quota_rule = *:storage=5G
  quota_rule2 = Trash:storage=+500M
  quota_warning = storage=90%% quota-warning 90 %u
  quota_status_success = DUNNO
  quota_status_overquota = "552 5.2.2 Mailbox is full"
}

Define the quota-warning service as a script that emails the user (see the Dovecot quota documentation).

Per-user quotas can come from your user database instead of the global rule. Recalculate a user's usage with doveadm quota recalc -u user@example.com.

Indexes and storage performance

Keep indexes on fast storage; with many users you can put them on NVMe separately: mail_location = maildir:~/Maildir:INDEX=/var/dovecot/index/%u.
Enable full-text search (FTS) plugins for large mailboxes so server-side search is fast.
Run doveadm force-resync -u user INBOX if a mailbox's index is corrupted.

Protect against brute force

Dovecot 2.3 has auth_failure_delay (default 2s) – keep it.
Use Fail2Ban's dovecot jail to block IPs after repeated failures.
Require TLS (ssl = required) and disable plaintext authentication.

Monitor Dovecot

Active sessions: doveadm who.
Live stats: doveadm stats dump (when stats are enabled).
Logs: journalctl -u dovecot or /var/log/maillog.

Troubleshooting

"Maximum number of connections" errors: raise mail_max_userip_connections.
"service(imap): process_limit reached": raise process_limit if RAM allows.
Quota shows wrong usage: run doveadm quota recalc.
Slow folder opening: indexes on slow disks or very large folders – archive old mail.

FAQ: Dovecot tuning

What is a sensible mail_max_userip_connections?

20–50 suits most setups; very large offices behind one NAT IP may need more.

Should over-quota mail be rejected or bounced?

Reject it at SMTP time using Dovecot's quota-status service with Postfix, so senders get an immediate error rather than a later bounce.

Does Maildir or mdbox perform better?

mdbox is more efficient for very large mailboxes; Maildir is simpler and easier to back up and restore per message.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket