DOVEADM-MAILBOX-CRYPTOKEY(1)

🌸 DOVEADM-MAILBOX-CRYPTOKEY 💅

okay bestie, so this is a page from the Dovecot manual — it's the doveadm-mailbox-cryptokey one, aka the mail crypt plugin management era of your life. Let's get into it 🎀

---

✨ NAME ✨

doveadm-mailbox-cryptokey — mail crypt plugin management, no cap. it's giving key management main character energy 🔑

---

🦋 SYNOPSIS 🦋

doveadm [-o crypt_user_key_password=password] [GLOBAL OPTIONS] mailbox
cryptokey export|generate|list|password [options] [arguments]

---

💖 DESCRIPTION 💖

Generate a new keypair for a user or for a folder. The new keypair gets marked as active, periodt. ✨

---

👑 OPTIONS 👑

doveadm mailbox cryptokey can be used to manage your user's cryptographic keys. that's the whole vibe fr fr.

---

🌈 GLOBAL OPTIONS 🌈

these are the global doveadm(1) options, the ones that apply everywhere 💫

• -D — turns on verbosity and debug messages. yapping mode: enabled 🗣️
• -O — don't read any config file at all, just use the defaults. the dovecot_storage_version setting defaults to the latest version, but you can override it with -o.
• -k — preserve the entire environment for doveadm, not just the import_environment setting. keep the whole vibe, not a fragment 🫶
• -v — enables verbosity, including a progress counter. progress bar girlies rise 🙈
• -i instance-name — if you're running multiple Dovecot instances, pick the config file based on this instance name. see the instance_name setting for more info.
• -c config-file — read configuration from the given config-file. by default it first reads the config socket, and then falls back to /etc/dovecot/dovecot.conf. you can also point this at the config socket of some instance running a compatible version.
• -o setting=value — overrides the configuration setting from /etc/dovecot/dovecot.conf and from the userdb with the given value. and to override multiple settings, just stack the -o option as many times as you want 💅
• -f formatter — specifies the formatter for formatting the output. the supported formatters are:
  • flow — prints each line with key=value pairs.
  • json — prints a JSON array of JSON objects.
  • pager — prints each key: value pair on its own line and separates records with form feed character (^L).
  • tab — prints a table header followed by tab separated value lines.
  • table — prints a table header followed by adjusted value lines.
• -o crypt_user_key_password=password — Dovecot option, needed if you use password protected keys 🔐

---

💜 OPTIONS 💜

(same heading name, different energy — these are the ones for this command specifically)

• -A — if the -A option is present, the command will be performed for all users. using this option in combination with system users from userdb { driver = passwd } is not recommended, because it contains also users with a lower UID than the one configured with the first_valid_uid setting. 😭

When the SQL userdb module is used, make sure that the userdb_sql_iterate_query setting matches your database layout.

When using the LDAP userdb module, make sure that the userdb_fields setting and the userdb_ldap_iterate_fields setting match your LDAP schema. otherwise doveadm(1) will be unable to iterate over all users. no cap, it just won't.

• -F file — execute the command for all the users in the file. this is similar to the -A option, but instead of getting the list of users from the userdb, they're read from the given file. the file contains one username per line. 📄
• --no-userdb-lookup — do not perform a userdb lookup. use the USER environment variable to specify the username.
• -S socket_path — the option's argument is either an absolute path to a local UNIX domain socket, or a hostname and port (hostname:port), in order to connect a remote host via a TCP socket.

This allows an administrator to execute doveadm(1) mail commands through the given socket. 🧚

• -u user/mask — run the command only for the given user. it's also possible to use '*' and '?' wildcards (e.g. -u *@example.org). wildcard slay ⭐

---

🎀 SUBCOMMANDS 🎀

export [-U] | mailbox-mask

• -U — operate on user keypair only

Exports user's or folder's keypair(s) in PEM format. if the keys are password protected, -o is needed. 🔥

generate [-Rf [-U] | mailbox-mask]

• -U — operate on user keypair only
• -R — re-encrypt all folder keys with current active user key
• -f — force keypair creation; normally a keypair is only created if none is found

Generates a new keypair for user or folder. if you want to generate a new user key and use it to secure your folder keys, use generate -u username -UR. 🫶

If you want to password-protect your key here, use -o.

list [-U] | mailbox-mask

• -U — operate on user keypair only

List all keys for user or folder. no password is required. easy peasy 💅

password [-N | -n password] [-O|-o password] [-C]

• -O — ask for old password
• -o old-password — provide old password
• -N — ask for new password
• -n new-password — provide new password
• -C — clear (unset/remove) the password. your key will not be protected by a password.

Set, change or clear the password from your user key. glow-up for your credentials ✨

---

🌟 SEE ALSO 🌟

doveadm(1), doveadm-mailbox(1) — go read those too, bestie 📚

---

and that's the whole page!! this one's from Dovecot, version tag f979264, dated April 2026 — so yeah, it's fresh 💖 thanks for reading my little manpage rewrite, ily, go manage those crypt keys responsibly 👑🌸