Three common auth backends

1. passwd-file (small static deployments):

/etc/dovecot/users:

alice@example.com:{SHA512-CRYPT}$6$abc...:5000:5000::/var/mail/vhosts/example.com/alice

conf.d/10-auth.conf:

passdb {
  driver = passwd-file
  args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/users
}
userdb {
  driver = passwd-file
  args = username_format=%u /etc/dovecot/users
}

2. SQL (most hosting setups):

conf.d/auth-sql.conf.ext:

passdb { driver = sql; args = /etc/dovecot/dovecot-sql.conf.ext }
userdb { driver = sql; args = /etc/dovecot/dovecot-sql.conf.ext }

/etc/dovecot/dovecot-sql.conf.ext:

driver = mysql
connect = host=127.0.0.1 dbname=mail user=mail password=secret
default_pass_scheme = SHA512-CRYPT
password_query = SELECT email AS user, password FROM users WHERE email='%u' AND active=1
user_query = SELECT '/var/mail/vhosts/%d/%n' AS home, 5000 AS uid, 5000 AS gid, \
  CONCAT('*:bytes=', quota_bytes) AS quota_rule FROM users WHERE email='%u'

3. LDAP (enterprise): conf.d/auth-ldap.conf.ext with hosts, base, pass_filter, user_filter. Works great with FreeIPA, Samba AD, OpenLDAP.

🎯 Always hash passwords with SHA512-CRYPT or ARGON2I. Never store plaintext, MD5, or unsalted SHA-1.