Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Over a year ago I setup a Dovecot 1.2.9 POP3/IMAP server (which works alongside a Postfix SMTP server) with PAM authentication. This has been operating (I believe) without incident until recently (the last 3 days). For some unknown reason attempts to authenticate against the POP3 and IMAP daemons have started failing. Here are the tests I have completed so far, but I am looking for anything I might have missed:

  • telnet pop3 return +OK Dovecot ready. so dovecot is handling the POP3 requests
  • Login from Outlook via POP3 (110) pointing at the Dovecot's internal IP address is successful
  • Login from the same client (with the same configuration) changing only the IP address (the external IP address is NATed from our Watchguard firewall/router to our internal IP address) is unsuccessful
  • Access a different application (Apache on port 80) on the same server by it's external IP address on the same box as the email client is successful
  • I've also confirmed that the Watchguard has allowed the POP3 traffic though when using the external address

One other detail, /var/log/mail.err doesn't show any logged errors, and /var/log/mail.log shows dovecot starting and stopping (when running /etc/init.d/dovecot restart, and when using the internal IP address shows this line:

dovecot: pop3-login: Login: user=<[username]>, method=PLAIN, rip=[User's internal IP Address], lip=[Dovecot's internal address]

If I attempt to authenticate using the external IP address there isn't even a line indicating a failure.

Here is (what I assume to be) the pertinent parts of our dovecot.conf

protocols  = pop3 imap
listen = *
disable_plaintext_auth = no
ssl = no
auth default {
  mechanisms = plain login
  passdb pam {
    args = session=yes dovecot
  userdb passwd {

I'm a bit at wits end, what are some tests I can perform to isolate the problem?

share|improve this question
if nothing shows in the log, i'm going to guess you're not even hitting the server; something's wrong with NAT or firewall decided to start blocking those requests. You wrote that you "confirmed that the Watchguard has allowed the POP3 traffic though when using the external address" - but how? – user16081-JoeT Feb 1 '13 at 23:28
We can see a successful (in green) request hit the Watchguard and get sent to the internal IP address. We see this when we hit port 80 and port 110. – Jason Sperske Feb 1 '13 at 23:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.