DOVEADM-KICK(1)

👑 DOVEADM-KICK 👑

okay bestie, gather round, because this is doveadm-kick from the Dovecot manual pages (section 1) and it is literally the "you're done here, log off" button. It disconnects users by user name and/or IP address. no cap. 💅

---

🌸 NAME 🌸

doveadm-kick — Disconnect users by user name and/or IP address ✨

---

🦋 SYNOPSIS 🦋

okay so there are four whole vibes of this command, and you pick based on what you're mad at:

doveadm [GLOBAL OPTIONS] kick [-a anvil_socket_path] [-f passdb_field]
[-h dest_host] user_mask

doveadm [GLOBAL OPTIONS] kick [-a anvil_socket_path] [-f passdb_field]
[-h dest_host] ip [/ bits]

doveadm [GLOBAL OPTIONS] kick [-a anvil_socket_path] [-f passdb_field]
[-h dest_host] user_mask ip [/ bits]

doveadm [GLOBAL OPTIONS] kick [-a anvil_socket_path] [-f passdb_field]
-h dest_host

---

💖 DESCRIPTION 💖

doveadm's kick command is the one that disconnects users by user_mask and/or the ip address they're connected from. it's giving bouncer energy but for IMAP. 🚪

here's the tea on the four forms:

• First form — every user whose login name matches the user_mask argument gets disconnected. bye boo 👋
• Second form — every user connected from the given IP address or network range gets disconnected. the whole block, gone.
• Third form — only the users connected from the given IP address or network range and with a matching login name get disconnected. both boxes checked or you stay.
• Last form — all proxy connections to the given destination host are disconnected. not a single user, just the pipes to that host. 🫶

---

🫶 GLOBAL OPTIONS 🫶

these are the global doveadm(1) options, not kick-exclusive, but they apply here too:

• -D — Enables verbosity and debug messages. it's yapping mode, but make it diagnostic. 🗣️
• -O — Do not read any config file, just use defaults. The dovecot_storage_version setting defaults to the latest version, but can be overridden with -o. raw-dogging the defaults, iconic.
• -k — Preserve entire environment for doveadm, not just import_environment setting. the whole env, not a sampler platter.
• -v — Enables verbosity, including progress counter. progress bar girlies rise 🙌
• -i instance-name — If using multiple Dovecot instances, choose the config file based on this instance name. See instance_name setting for more information. multi-instance besties, this one's for you.
• -c config-file — Read configuration from the given config-file. By default it first reads config socket, and then falls back to /etc/dovecot/dovecot.conf. You can also point this to config socket of some instance running compatible version.
• -o setting=value — Overrides the configuration setting from /etc/dovecot/dovecot.conf and from the userdb with the given value. In order to override multiple settings, the -o option may be specified multiple times. stack them like bracelets. ✨

---

🎀 OPTIONS 🎀

these are the kick-specific ones, the actual main characters:

• -a anvil_socket_path — This option is used to specify an absolute path to an alternative UNIX domain socket. By default doveadm(1) will use the socket /rundir/anvil. The socket may be located in another directory, when the default base_dir setting was overridden in /etc/dovecot/dovecot.conf.
• -f passdb_field — Alternative username field to use for kicking, as returned by passdb. Only the passdb fields beginning with the user_ prefix are tracked. lowkey picky, but fair. 🙈
• -h dest_host — Disconnect proxy connections to the given dest_host. bye proxy 🫡

---

🌈 ARGUMENTS 🌈

• ip [/ bits] — ip or ip / bits is the host or network, from which the users are connected.
• user_mask — Is a user's login name, or the alternative username (user_* field) if the -f parameter is used. Depending on the configuration, a login name may be for example jane or ⟨john@example.com⟩. It's also possible to use '*' and '?' wildcards (e.g. -u *@example.org). wildcards?? we love a flexible queen 👑

---

⭐ EXAMPLE ⭐

If you don't want to disconnect all users at once, you can check who's currently logged in first. peek before you yeet. 👀

The first example demonstrates how to disconnect all users whose login name is 3 characters long and begins with ba:

doveadm who -1 ja\*

username                      service pid ip
jane                          imap   8192 ::1
jano                          imap   8196 ::2
james                         imap   8203 2001:db8:543:2::1

doveadm kick jan?
# The connections for jane and jano are kicked.

The next example shows how to kick user foo's connections from 192.0.2.*:

doveadm who -1 foo

username                     service pid ip
foo                          imap   8135 fd95:4eed:38ba::25
foo                          imap   9112 192.0.2.53
foo                          imap   8216 192.0.2.111

doveadm kick foo 192.0.2.0/24
doveadm who f\*

username                  # service (pids) (ips)
foo                       1 imap    (8135) (fd95:4eed:38ba::25)

notice how the fd95:4eed:38ba::25 connection survived? yeah. you only kicked the 192.0.2.0/24 ones. kick doesn't do "and also everything else", bestie. read the args. 💀

---

🔥 REPORTING BUGS 🔥

Report bugs, including doveconf -n output, to the Dovecot Mailing List ⟨dovecot@dovecot.org⟩. Information about reporting bugs is available at: ⟨https://dovecot.org/bugreport.html⟩

(include the doveconf -n output, fr fr — the maintainers need it or they'll be asking in the group chat forever 🧚)

---

💜 SEE ALSO 💜

• doveadm(1)

---

that's the whole page, bestie. this revision is f979264, and it's dated April 2026 — so if you're reading this from the future, hiiii, hope your anvil socket is healthy. mwah, bye! 💖✨🎀🦋🌸💅