Create a Safe Maildir with maildirmake.dovecot

maildirmake.dovecot builds a brand new Maildir, with the right folders and locked-down permissions, in a single command. This guide uses maildirmake.dovecot from dovecot-core 2.3.21+dfsg1-2ubuntu6.5 on Ubuntu. Allow about ten minutes, including the checks.

You need a shell and write permission for the destination's parent directory. Creating a Maildir under your own home directory is normally unprivileged; creating one in a service-owned mail store, or changing its owner, usually needs an administrator or the mailbox owner's own account. The command creates directories only. It does not create a Dovecot user, reload Dovecot, or deliver a message.

1. Check the Installed Command

Confirm the binary and package version before you copy anything below. This is a read-only check:

$ command -v maildirmake.dovecot
/usr/bin/maildirmake.dovecot
$ dpkg-query -W -f='${Package} ${Version}\n' dovecot-core
dovecot-core 1:2.3.21+dfsg1-2ubuntu6.5
$ maildirmake.dovecot -h
usage: /usr/bin/maildirmake.dovecot directory [user]

The manual calls the second argument owner; this installed script labels it user. Same thing, a username handed straight to chown, not a Dovecot configuration name. There are no useful creation switches beyond -h.

2. Pick a Destination You Can Actually Identify

Use an explicit absolute path. This example keeps the new mailbox in a temporary directory so it cannot be confused with a real account's mail store:

$ maildir_root="$HOME/mailboxes"
$ maildir_path="$maildir_root/example.com/alice"
$ mkdir -p "$maildir_root/example.com"

Swap $HOME/mailboxes/example.com/alice for the path your Dovecot user database and mail location actually expect. The program never consults Dovecot to find that path, so a typo here can create a perfectly valid Maildir in entirely the wrong place. Print it before you proceed:

$ printf 'creating: %s\n' "$maildir_path"
creating: /home/alice/mailboxes/example.com/alice

Do not point this at an existing mailbox until you have checked its contents and ownership. The command runs mkdir -p, then applies mode 0700 to the target and its three Maildir directories, so anything already there gets switched to private mode too.

3. Create the Maildir

Run the command as the account that owns the destination, or as an administrator when the parent directory requires it:

$ maildirmake.dovecot "$maildir_path"
$ printf 'exit status: %s\n' "$?"
exit status: 0

A successful exit only tells you the command finished, not that everything is right. Check the structure and permissions explicitly:

$ find "$maildir_path" -maxdepth 1 -mindepth 1 -type d -printf '%f %m\n' | sort
cur 700
new 700
tmp 700
$ stat -c '%n %U:%G %a' "$maildir_path"
/home/alice/mailboxes/example.com/alice alice:alice 700

sort just normalises the order of the find output. Your user and group names will differ. What matters is the three directory names and mode 700 on the Maildir and its children.

4. Add an Owner Only When You Mean It

The optional second argument changes ownership recursively after creation. An administrator can use it to create a mailbox for an existing local account:

# maildirmake.dovecot /srv/vmail/example.com/alice vmail
# stat -c '%n %U:%G %a' /srv/vmail/example.com/alice /srv/vmail/example.com/alice/cur
/srv/vmail/example.com/alice vmail:vmail 700
/srv/vmail/example.com/alice/cur vmail:vmail 700

The # prompt means elevated privileges are expected here. Substitute a real account name and check it first with getent passwd vmail. Never use a name copied from an untrusted request without verifying it.

5. Know Your Failure and Recovery Options

If the destination cannot be created, the command exits non-zero. Common causes: a missing parent permission, a path component that turns out to be a file, or an invalid owner:

$ maildirmake.dovecot "$maildir_path" no-such-user
chown reports that the user does not exist
$ printf 'exit status: %s\n' "$?"
exit status: 1

With an invalid owner, the directories may already have been created before chown fails. Check them rather than running the command over and over:

$ find "$maildir_path" -maxdepth 1 -mindepth 1 -printf '%f %y\n' | sort
cur d
new d
tmp d

If this is the new, empty mailbox you meant to create, fix the account name and rerun the command. If it was a mistaken empty directory, remove only the empty Maildir directories after double-checking the exact path:

$ rmdir "$maildir_path/cur" "$maildir_path/new" "$maildir_path/tmp" "$maildir_path"

6. Know What This Tool Will Not Do

A Maildir is a directory layout, not a full mailbox configuration. This command sets no quota rules, ACLs, namespaces, indexes, user database entries or service ownership policy. The manual even calls it very basic and recommends maildirmake for serious Maildir management. Check your deployment's Dovecot documentation before leaning on this helper for production provisioning.

Do not restart Dovecot just because these directories now exist. If your deployment discovers mailboxes dynamically, the new path may work immediately; if it relies on a user database or static mapping, configure that separately and follow the service's own change procedure. Test with the intended account and a harmless mailbox operation before handing the address to anyone.