Important note

The text below is obsolete for users. All accounts have an INBOX on the mail server in Hamburg.

Please see for more information and especially for the configuration of the email clients

The IMAP Server

At the Zeuthen site mail for users is stored on the IMAP server There are no other IMAP servers on site. IMAP is the protocol for accessing the mail stored on that server.

For sending and receiving mail another protocol, SMTP, is used. Consequently we have chosen the name for the SMTP server, which is also known as outgoing mail server. The name is an alias for

The name should however not be used for the SMTP server, as the SSL certificate for the SMTP server is issued for and not This is important for delivering mail using TLS or SMTP Auth.

Information on that topic is contained in the talks on email given on Oct. 6 2009 and is still mostly valid: deutsche and english version

see also

Main characteristics of the IMAP server

The IMAP server is based on a recent release of dovecot (2.2.18 as of June 23, 2015). It has been built with support for the sieve language (dovecot-pigeonhole, mail filtering for dovecot, version 0.4.8) and also implements the managesieve protocol to manipulate sieve scripts (see below). The following features are compiled in and are configured respectively:

Using the IMAP server

The following sections describe the use of as the primary IMAP mail server. Users reading their mail elsewhere are not affected.

The mail stores

The client needs to tell to the mail server only the folder name, then mail is stored (in the default name space) in the folder with the given name. We have configured only one name space for IMAP, this is the default namespace (called #mdbox). There the mdbox format is used as with INBOX. By using folders on the server mails in there are accessible from all mail clients that support IMAP, i.e. basically world wide access after successful authentication.


The recommended way of authenticating is using Kerberos5 by presenting a valid ticket from the IFH.DE realm. If a computer outside DESY Zeuthen is used then a Kerberos 5 ticket should be obtained before starting your mail reader.

Under Linux/Unix this can be achieved with the command

kinit <username>@IFH.DE

On Windows systems the Network identity manager from MIT Kerberos for Windows has to be used (do not request Keberos4 tickets). Some Clients do need additional configuration options before K5 Auth is working (see below).

Access to the imap server is always encrypted. This means the TLS or SSL protocol must be used. This also means on the client side (the computer from where you start the mail reader) the Telekom CA certificate which is the final certificate authority for our server has to be in place. This should be the case for most recent operating system installations. Please see the mail reader specific sections for details if you have problems related to that.

Authentication using username and password is possible as well. Both authentication methods have successfully been tested with alpine, thunderbird and many more mail clients. In Outlook Kerberos5 authentication is not working yet.

Mail Filtering

The IMAP server does have an integrated filter called sieve that is engaged whenever new mail is delivered to the INBOX on The filter language is described in The dovecot documentation comes with Examples of sieve filters. More information on sieve and its support in dovecot can be found at

Filters can be created or modified only from computers belonging to the DESY (Zeuthen) domain. An interface to manage mail filters is the web interface. Filters get installed on in the location /var/spool/sieve/<username>.sieve and are not directly accessible to users.

Alternatively the squirrelmail web mail interface can be used to create filter rules. After login go to the "Filters" page. Also squirrelmail is only accessible within DESY.

When creating a sieve filter with one of the graphical interfaces meta data are generated to allow further manipulation of the filter rules. These meta data are not compatible between the two web interfaces. Therefore creating a rule with one interface and changing it with another one is not possible.

If there is no user defined filter then the global filter default.sieve is engaged:

require "fileinto";
if header :contains "X-Spam-Level" "*****" {
  fileinto "junk";

It filters all spam mails into the folder junk on the mail server, is not a local folder. More sophisticated mail filters can be created by using the web interface. Using the basic mode (the default) guarantees that syntactically correct filters get created without knowing the sieve language syntax. Advanced users can write their own sieve script. If there is no syntax error a (compiled) .svbin file is generated, otherwise a .sieve.err file is written that contains the error message. As it resides on the mail server, only administrators get access to these files. Therefore usage of the advanced mode is not recommended.

Creation of own filter rules should be simple as the web interfaces are fairly intuitive. The complete removal of own filter scripts using the web interface is somewhat tricky. It can be achieved selecting "Advanced options", then writing "default" into the "Delete script name" field, selecting the "No" button beneath "Activate Script?" and then click on "Save changes"

See also mail filter.

Vacation/Absence message

This is most comfortably done using the squirrelmail web mail interface discussed above. After logging in and having clicked the Filters menu you can add new mail filter rules. It is important to define a first rule to filter away spam in order to not generate vacation messages for spam mails. This is done by having a Condition Message Header X-Spam-Level contains ***** AND an action Move to Folder junk. Save the rule by pressing the 'Add new Rule' button. Then create another rule by clicking on Add a new rule in the 'Current Mail Filtering Rules' screen.

A new screen is displayed. In the condition part select Always in the first field instead of 'Message'. If you want to be more specific e.g. with a condition Message Header 'From' or Message Body contains <some string> you can define other conditions. Then in the action part select Vacation/Autoresponder and modify at least the field Your addresses. Please make sure to fill in all addresses on which you receive mail (separated by comma) in the action field.

After having saved this rule by pressing the Add new rule button you can disable it until you really need it or in order to store it for later use. Please note that the order of rules is important and that the spam filter should always be the first rule.


Currently there is a global mail quota limit of 2000 MB configured. This is existing for safety reasons only and can be increased for individual users on request. The mail quota setting and its current usage can be displayed using the command

  check_inbox [-h]

If the mail quota for a user has been changed, the mail client has to be restarted, otherwise the changed quota does not become effective.

Delivery to the INBOX takes place even if quota is exceeded (up to 1000 MB in addition) but saving to folders would then not be possible. When the quota limit is exceeded and the additional INBOX limit of 1GB more as well then mail delivery is temporarily suspended until the INBOX is cleaned up. If that does not take place for 5 days, mail is bounced back as undeliverable. When the user is over quota, moving mails around is no longer possible, only deleting is still possible.


A backup of all the mail folders on the IMAP server is done to tape daily at 11pm. The restore of mails from backup needs operator assistance. In exceptional cases it is even possible to recover deleted mails. For restore requests please contact the Zeuthen user office.

IMAPServer (last edited 2017-08-18 14:26:58 by GötzWaschk)