Concept: Dovecot is the dominant open-source IMAP and POP3 server on Linux — the component that stores mail and hands it to clients. It is deliberately only the retrieval half of a mail system; delivery is somebody else’s job (Postfix, Exim) on port 25. That split matters when enumerating, because a host running Dovecot without an SMTP daemon can be read from but not sent through.
Impact: Dovecot itself is well-written and rarely the vulnerability. It is an authentication surface and a credential store: it accepts password guesses over IMAP/POP3 at protocol speed, and behind a valid login sits a mailbox that very often contains plaintext credentials for other systems.
How it works
Dovecot listens on four ports by convention: 110 (POP3), 143 (IMAP), 993 (IMAPS), 995 (POP3S). The plaintext ports normally advertise STARTTLS and refuse login until the connection is upgraded.
Authentication is delegated to a configurable backend — system users via PAM, an SQL table, or an LDAP directory. A mail account therefore may or may not correspond to a shell account on the same box.
Mail is stored on disk as Maildir or mbox under each user’s home. Anyone with filesystem access to that path can read mail without authenticating at all.
The capability banner is returned before login and advertises exactly which authentication mechanisms are on offer, which is free reconnaissance for an unauthenticated attacker.
Port Reference
Port
Service
Notes
110
POP3
Legacy; no folders, no server-side search, designed to download and delete
143
IMAP
Usually LOGINDISABLED until STARTTLS
993
IMAPS
Implicit TLS — the practical target for scripted access
995
POP3S
Implicit TLS
Security Quirks & Niche Facts
Nmap’s imap-capabilities / pop3-capabilities output is pre-authentication intelligence.AUTH=PLAIN on 993 means credential guessing is available immediately; LOGINDISABLED on 143 explains a login that fails for reasons unrelated to the password being wrong.
The self-signed certificate leaks the internal hostname. Dovecot generates a cert with the machine’s own name in commonName and the SAN — often the only place an internal hostname appears before any web enumeration.
Identical certificate fingerprints across 110, 143, 993 and 995 confirm one daemon serving all four, so a credential that works on any of them works on all.
No port 25 means no delivery. Any attack path requiring you to send mail — phishing, stored XSS fired at another user’s session — is dead regardless of how vulnerable the webmail client is. Worth establishing early to avoid a rabbit hole.
IMAP is the better enumeration target than POP3 when both are open: folders, server-side SEARCH, and BODY.PEEK for reads that do not mark messages seen. POP3 offers none of the three.
Rate limiting is not on by default. Dovecot ships without connection throttling unless auth_failure_delay or an external tool like fail2ban is configured, which is what makes password spraying against imaps:// practical.
A mail account is not necessarily a shell account. With an SQL or LDAP backend the two namespaces are independent, so a working IMAP credential may not su — and vice versa.