cPanel uses Dovecot to let users read mail over IMAP and POP3. Its settings in WHM decide how many connections each user and IP may open, which protocols and TLS versions are allowed, and how mailboxes are stored. Sensible values prevent both overload and annoying client errors.
MdmHost manages mail server settings on its hosting plans. This guide is for administrators of their own cPanel server with root access.
Before you start
- Root access to WHM.
- Outgoing mail (Exim) is configured separately; see Exim configuration basics.
Open Mailserver Configuration
Go to WHM → Service Configuration → Mailserver Configuration.
Key settings
| Setting | Suggested | Why |
|---|---|---|
| Protocols Enabled | IMAP and POP3 | Disable POP3 only if no customers use it |
| Maximum IMAP Connections Per IP Address | 20–40 | Offices with many devices behind one IP need more |
| Allow Plaintext Authentication | No | Forces TLS so passwords are never sent in clear |
| SSL/TLS protocols | TLS 1.2 and 1.3 | Older protocols are insecure |
| Mailbox format | mdbox (default on new servers) | Efficient for large mailboxes |
| Login process limits | Defaults; raise on very busy servers | Too low causes slow logins at peak |
Note: Changing the mailbox format for existing accounts requires a conversion in WHM (Mailbox Conversion). Do it per account in a quiet period.
Save and verify
- Click Save; WHM restarts Dovecot.
- Test login with a mail client using IMAP port 993 and SSL.
"Too many connections" errors
Users with phones, tablets and laptops, all on one office IP, can exceed the per-IP limit. Symptoms: some devices cannot fetch mail, others can. Raise Maximum IMAP Connections Per IP Address modestly, and suggest clients limit cached connections (for example in Thunderbird's account settings).
Security
- Keep brute-force protection active for IMAP and POP3 logins (see cPHulk and Imunify360 blocks).
- Make sure the mail service has a valid certificate (see service SSL certificates).
Troubleshooting
Clients warn about certificates
Users connect with a hostname that is not on the certificate. Tell them to use the server hostname or mail.theirdomain.com with AutoSSL active.
Dovecot does not start after changes
Check /var/log/maillog for the error, revert the last change and restart with /usr/local/cpanel/scripts/restartsrv_dovecot.
Frequently asked questions
Should I disable POP3?
Only if no customers rely on it. Most users are better off with IMAP, which syncs across devices.
Where are mailbox quotas set?
Per mailbox in cPanel, and the maximum per mailbox in the hosting package.
Does this affect webmail?
Roundcube connects to Dovecot locally, so login and TLS settings apply; per-IP limits rarely matter for webmail.
How do I see current IMAP connections?
Run doveadm who as root to list logged-in users and their connection counts.
What causes slow IMAP on big mailboxes?
Very large folders and old mailbox formats. Encourage archiving and consider converting to mdbox.