Dovecot Secure IMAP and POP3 Mail Server

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Dovecot - Secure IMAP and POP3 Mail Server by cloudimg

Dovecot is one of the most widely deployed open source IMAP and POP3 servers in the world, chosen for its security focus, standards compliance and excellent performance. This image delivers Dovecot 2.3.21 fully installed and hardened, giving you a production ready mailbox server within minutes of launch and skipping hours of manual configuration and security hardening.

### Why this image instead of a DIY setup or a generic image

Many mail server images ship with a shared default password that administrators must remember to change, require manual TLS certificate generation, or leave plaintext authentication enabled on public ports. This image removes those risks: every instance generates its own unique credentials and TLS keys on first boot, so there is no default password to forget, no shared secret across deployments, and no window of exposure. Compared with building from scratch you avoid the usual hours of package installation, user provisioning, TLS configuration, authentication hardening and systemd tuning.

### Ideal use cases

• Small teams moving off shared hosting: launch a dedicated mailbox store on a single instance, pair it with Postfix for SMTP, and own your mail infrastructure.
• Region or network resident mail storage: keep all mailbox data on your own encrypted volumes under your direct control.
• Adding mailbox access to an existing Postfix deployment: this image serves as the IMAP and POP3 backend, receiving mail over LMTP and serving it to clients over TLS.

### How it works

The server is configured as a self contained, secure by default single node mail store:

• Mailbox access: IMAP over TLS on 993 and STARTTLS on 143; POP3 over TLS on 995 and STARTTLS on 110. Any standards compliant client connects securely.
• Storage: mail is kept in Maildir format under a dedicated unprivileged vmail user, safe for concurrent access and easy to back up or snapshot.
• Local delivery: LMTP handles delivery so the setup works end to end with no external dependency.
• Authentication: a Dovecot password file with a SHA512 hashed per instance password. Only the virtual mailbox user can authenticate; system and shell accounts are excluded from mail login.

### Security model, zero trust from first boot

On first boot a one shot service generates a unique mailbox password and hashes it into the Dovecot password database, regenerates the TLS private key and self signed certificate, writes the plaintext login to a root only file, and refuses plaintext authentication on the non TLS ports until STARTTLS upgrades the connection. No image ever ships a usable or default credential. The included user guide covers replacing the self signed certificate with a Let's Encrypt certificate and adding further mailboxes.

### Runs as a standard instance

Dovecot runs as a hardened systemd service. Because it is a standard Linux instance you can snapshot the storage volume for backup, resize it as mail grows, encrypt it at rest, place the instance in your own private network, and restrict inbound access to your known client addresses.

### Getting started

1. Launch the image from AWS Marketplace.

2. Read the per instance mailbox login from the root only credentials file.

3. Point any IMAP or POP3 client at the instance over TLS.

4. Send a test message through LMTP to confirm delivery.

Dovecot provides mailbox access and local delivery; pair it with an MTA such as Postfix for full inbound and outbound SMTP mail flow. It is not webmail and does not send outbound SMTP on its own.

### 24/7 expert support from cloudimg

cloudimg engineers provide round the clock technical support and help with adding mailboxes, connecting clients over TLS, fronting Dovecot with Postfix, installing a Let's Encrypt certificate, Maildir backup strategy and version upgrades.

cloudimg is not affiliated with or endorsed by the Dovecot project or Open-Xchange. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.