Create a Safe Maildir with maildirmake.dovecot

You will finish with a new Maildir containing cur, new and tmp, with private mode 0700 permissions. This guide uses maildirmake.dovecot from dovecot-core 2.3.21+dfsg1-2ubuntu6.5 on Ubuntu. Allow about ten minutes, including the checks.

You need a shell and write permission for the destination's parent directory. Creating a Maildir under your own home directory is normally unprivileged. Creating one in a service-owned mail store, or changing its owner, usually requires an administrator or the mailbox owner's permitted account. This command creates directories only. It does not create a Dovecot user, reload Dovecot, or deliver a message.

1. Check the installed command

Confirm the binary and package version before copying an example. This is a read-only check:

$ command -v maildirmake.dovecot
/usr/bin/maildirmake.dovecot
$ dpkg-query -W -f='${Package} ${Version}\n' dovecot-core
dovecot-core 1:2.3.21+dfsg1-2ubuntu6.5
$ maildirmake.dovecot -h
usage: /usr/bin/maildirmake.dovecot directory [user]

The manual describes the second argument as owner; this installed script labels it user. It is a username passed to chown, not a Dovecot configuration name. There are no useful creation switches beyond -h.

2. Choose a destination you can identify

Use an explicit absolute path. The example keeps the new mailbox in a temporary directory so it cannot be confused with a real account's mail store:

$ maildir_root="$HOME/mailboxes"
$ maildir_path="$maildir_root/example.com/alice"
$ mkdir -p "$maildir_root/example.com"

Replace $HOME/mailboxes/example.com/alice with the path your Dovecot user database and mail location expect. The program does not consult Dovecot to discover that path. A typo can create a perfectly valid Maildir in the wrong place, so print it before proceeding:

$ printf 'creating: %s\n' "$maildir_path"
creating: /home/alice/mailboxes/example.com/alice

Do not point this at an existing mailbox until you have checked its contents and ownership. The command uses mkdir -p, then applies mode 0700 to the target and its three Maildir directories. Existing directories are therefore changed to private mode.

3. Create the Maildir

Run the command as the account that owns the destination, or as an administrator when the parent directory requires it:

$ maildirmake.dovecot "$maildir_path"
$ printf 'exit status: %s\n' "$?"
exit status: 0

A successful exit is only the command's result. Check the structure and permissions explicitly:

$ find "$maildir_path" -maxdepth 1 -mindepth 1 -type d -printf '%f %m\n' | sort
cur 700
new 700
tmp 700
$ stat -c '%n %U:%G %a' "$maildir_path"
/home/alice/mailboxes/example.com/alice alice:alice 700

The order of find output is normalised by sort. User and group names will differ on your machine. The useful facts are the three directory names and mode 700 on the Maildir and its children.

4. Add an owner only when you mean to

The optional second argument changes ownership recursively after creation. For example, an administrator can create a mailbox for an existing local account:

# maildirmake.dovecot /srv/vmail/example.com/alice vmail
# stat -c '%n %U:%G %a' /srv/vmail/example.com/alice /srv/vmail/example.com/alice/cur
/srv/vmail/example.com/alice vmail:vmail 700
/srv/vmail/example.com/alice/cur vmail:vmail 700

The # prompt means elevated privileges are expected here. Substitute a real account name and verify it first with getent passwd vmail. Do not use a name copied from an untrusted request without checking it.

5. Understand failures and recovery

If the destination cannot be created, the command exits non-zero. Common causes are a missing parent permission, a path component that is a file, or an invalid owner:

$ maildirmake.dovecot "$maildir_path" no-such-user
chown reports that the user does not exist
$ printf 'exit status: %s\n' "$?"
exit status: 1

With an invalid owner, the directories may already have been created before chown fails. Check them rather than running the command repeatedly:

$ find "$maildir_path" -maxdepth 1 -mindepth 1 -printf '%f %y\n' | sort
cur d
new d
tmp d

Correct the account name and rerun the command if this is the new, empty mailbox you intended. If it was a mistaken empty directory, remove only the empty Maildir directories after checking the exact path:

$ rmdir "$maildir_path/cur" "$maildir_path/new" "$maildir_path/tmp" "$maildir_path"

6. Know what this tool does not manage

A Maildir is a directory layout, not a complete mailbox configuration. This command does not set quota rules, ACLs, namespaces, indexes, user database entries or service ownership policy. The manual calls it very basic and recommends maildirmake for serious Maildir management. Check your deployment's Dovecot documentation before using this helper for production provisioning.

Do not restart Dovecot just because these directories were created. If your deployment discovers mailboxes dynamically, the new path may be usable immediately; if it relies on a user database or static mapping, configure that separately and follow the service's change procedure. Test with the intended account and a harmless mailbox operation before handing the address to a user.