Check Dovecot Login Penalties with doveadm penalty

When logins from one address keep getting slower to respond, doveadm penalty shows whether Dovecot's anvil service is quietly throttling it. The command only reads service state: it does not clear a penalty, disconnect anyone, or change configuration. Allow about ten minutes if Dovecot is already running and your account can reach its administrative socket.

This guide describes the installed dovecot-core package, version 1:2.3.21+dfsg1-2ubuntu6.5, whose command reports itself as Dovecot v2.3. Newer releases keep the same core syntax but can add global options, so check man doveadm-penalty on the host you are actually administering.

1. Check the anvil socket before running the report

doveadm penalty normally connects to the Unix socket /run/dovecot/anvil. That location follows Dovecot's base_dir setting, so a customised installation may use a different path. Check the service and socket without changing anything:

$ systemctl is-active dovecot
active
$ ls -l /run/dovecot/anvil
srw-rw---- 1 root dovecot 0 Sep 23 10:20 /run/dovecot/anvil

Your owner, group and timestamp will differ. If the service is inactive, starting it is a separate operational decision outside this read-only check. If the socket exists but your account cannot open it, use an approved administrative account or ask the Dovecot operator for access; do not loosen socket permissions just to make a diagnostic command work.

2. Show all current penalties

Run the command as an ordinary user first. It may need elevated privileges on a default installation, but sudo is not automatically required:

$ doveadm penalty
IP               penalty last_penalty        last_update
192.0.2.222            3 2010-06-15 15:19:27 15:19:27
192.0.2.53             3 2010-06-15 15:19:34 15:19:34

• IP is the tracked address.
• penalty is the current penalty value.
• last_penalty is the latest penalty time.
• last_update is the most recent update time. The dates shown here are the manual's sample data, not a promise about your server's clock.

An empty result is normal when there are no current penalties. Treat the header and exit status as the useful outcome; do not read the example addresses above as real clients.

3. Filter the report to an address or network

Pass an address as the final argument when you are investigating one client:

$ doveadm penalty 192.0.2.53
IP               penalty last_penalty        last_update
192.0.2.53             3 2010-06-15 15:19:34 15:19:34

You can also supply a network in CIDR notation, which is useful when a mail gateway, NAT device or test subnet is the common source:

$ doveadm penalty 192.0.2.0/24
IP               penalty last_penalty        last_update
192.0.2.53             3 2010-06-15 15:19:34 15:19:34
192.0.2.222            3 2010-06-15 15:19:27 15:19:27

Replace the documentation-only 192.0.2.0/24 with a network you are actually authorised to inspect. The argument filters the report; it does not add a penalty and does not touch network configuration.

4. Use an alternative anvil socket when required

Use -a when the anvil socket is not at the default location. The argument can be an absolute local Unix socket path:

$ sudo doveadm penalty -a /srv/dovecot/run/anvil 192.0.2.0/24

It can also be a remote endpoint in the form hostname:port:

$ doveadm penalty -a doveadm-admin.example.net:12345 192.0.2.0/24

The local path in the first example is a placeholder. Verify it against the relevant base_dir and service configuration before running it; the sudo prefix there is illustrative, not a requirement to run every installation as root.

5. Diagnose the common access failures

If the command reports a connection or permission error, capture the exact status immediately:

$ doveadm penalty
$ status=$?
$ printf 'doveadm penalty exit status: %s\n' "$status"
doveadm penalty exit status: 0

A non-zero status means the report was not obtained. Check that the socket path is correct, Dovecot is running, and the invoking account can reach the socket. If you use sudo, run the whole command with it rather than escalating only the status check:

$ sudo doveadm penalty 192.0.2.53
IP               penalty last_penalty        last_update
192.0.2.53             3 2010-06-15 15:19:34 15:19:34

Do not treat an empty report as proof that Dovecot has never penalised anyone: penalty state changes over time, and a filter can legitimately match no rows. For a repeatable incident record, save the output with a timestamp in a protected location, then review and remove that copy under your normal retention policy. The command itself makes no persistent change and has no undo operation.