allow_nets extra field

The allow_nets field is a comma separated list of IP addresses and/or networks where the user is allowed to log in from. If the user tries to log in from elsewhere, the authentication will fail the same way as if a wrong password was given.

Example: allow_nets=,,,

IPv6 addresses are also allowed. IPv6 mapped IPv4 addresses (eg. ::ffff: are converted to standard IPv4 addresses before matching. Example: allow_nets=::1,2001:abcd:abcd::0:0/80,

Using “local” matches any auth connection that doesn’t have an IP address. This usually means internal auth lookups from e.g. doveadm. Example: allow_nets=,local

passwd-file example


Keyword ‘local’

The keyword local is accepted for Non-IP connections like Unix socket. For example, with a Postfix/LMTP delivery setup, you must include local for Postfix to verify the email account:

passdb {
  driver = static
  args = password=test allow_nets=local,

Otherwise, you will see this error in the log:

[/var/run/dovecot/lmtp] said: 550 5.1.1 <> User doesn't exist: (in reply to RCPT TO command))