1.6. Configuring an LMTP socket and LMTPS listener

Procedure

1. Verify that the LMTP protocol is enabled:

   # doveconf -a | grep -E "^protocols"
   protocols = imap pop3 lmtp

   The protocol is enabled, if the output contains lmtp.

2. If the lmtp protocol is disabled, edit the /etc/dovecot/dovecot.conf file, and append lmtp to the values in the protocols parameter:

   protocols = ... lmtp

3. Depending on whether you need an LMTP socket or service, make the following changes in the service lmtp section in the /etc/dovecot/conf.d/10-master.conf file:

   • LMTP socket: By default, Dovecot automatically creates the /var/run/dovecot/lmtp socket.

     Optional: Customize the ownership and permissions:

     service lmtp {
       ...
       unix_listener lmtp {
         mode = 0600
         user = postfix
         group = postfix
       }
       ...
     }

   • LMTP service: Add a inet_listener sub-section:

     service lmtp {
       ...
       inet_listener lmtp {
         port = 24
       }
       ...
     }

4. Configure firewalld rules to allow only the SMTP server to access the LMTP port, for example:

   # firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv4" source address="192.0.2.1/32" port protocol="tcp" port="24" accept"
   # firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv6" source address="2001:db8:2::1/128" port protocol="tcp" port="24" accept"
   # firewall-cmd --reload

   The subnet masks /32 for the IPv4 and /128 for the IPv6 address limit the access to the specified addresses.

5. Reload Dovecot:

   # systemctl reload dovecot

Verification

1. If you configured the LMTP socket, verify that Dovecot has created the socket and that the permissions are correct:

   # ls -l /var/run/dovecot/lmtp
   srw-------. 1 postfix postfix 0 Nov 22 17:17 /var/run/dovecot/lmtp

2. Configure the SMTP server to submit emails to Dovecot using the LMTP socket or service.

   When you use the LMTP service, ensure that the SMTP server uses the LMTPS protocol or sends the STARTTLS command to use an encrypted connection.