anvil tracks per-user and per-IP connection counts so a single malicious or buggy client can't exhaust your process pool.
Recommended limits in local.conf:
mail_max_userip_connections = 20
20 concurrent IMAP connections per (user, IP) pair. Most clients use 1–5; 20 catches bugs without breaking mail.
Per-service caps:
service imap-login {
process_limit = 1000
service_count = 1
}
service imap {
process_limit = 1024
}
Watch the metrics:
doveadm stats dump | grep "auth"
Sustained auth failures from a single IP are usually credential stuffing — feed those IPs to fail2ban.
Sign in to keep track of what you have read.