Dovecot 2.3+ defaults are reasonable but always pin them explicitly in local.conf:
ssl = required
ssl_min_protocol = TLSv1.2
ssl_cipher_list = ECDHE+AESGCM:ECDHE+CHACHA20:!aNULL:!MD5
ssl_prefer_server_ciphers = yes
ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.example.com/privkey.pem
ssl_dh = </etc/dovecot/dh.pem
Generate a 4096-bit DH parameter file once:
openssl dhparam -out /etc/dovecot/dh.pem 4096
ssl = required means cleartext IMAP/POP3 (143, 110) require STARTTLS before AUTH. Auth attempts in cleartext are refused. For maximum strictness:
disable_plaintext_auth = yes
Sign in to keep track of what you have read.