Dovecot answers 30.7 million times as an application and 32 times as a title

Mail is the oldest service on most networks and the one whose exposure numbers are least trustworthy. Six queries run on 2026-10-27 show why: app="Dovecot" returns 30,701,808, title="Dovecot" returns 32, port=993 returns 10,793,423, port=143 returns 12,138,709, port=25 returns 27,574,512, app="Postfix" returns 9,440,325, app="Roundcube" returns 62,217 and title="iRedMail" returns 18.

Method

All queries were run on 2026-10-27 between 18:11Z and 18:14Z with pagesize=1. The totals above are the total field as returned.

Nothing was sent to any mail server, and no address was tested for relaying or for user enumeration.

The thirty-million figure is a text count

Dovecot is an IMAP and POP3 server. It does not serve HTTP. Its protocol responses begin with * OK and a capability list, and no part of that is an HTML title, a body or a header that a document index can match.

So an application fingerprint of 30.7 million cannot be counting Dovecot servers answering HTTP. It is matching the string dovecot wherever it appears in an indexed response: configuration files served by mistake, package listings, changelogs, error pages, documentation, forum posts, a Received header on a web archive page, a status dashboard.

The corresponding title count, 32, is close to the real number of pages that present Dovecot as the subject of a page, and 32 is small because almost nothing on the web is titled Dovecot.

The pair is a clean illustration of what an application fingerprint is: a string match against indexed content, not a protocol handshake.

Port counts are the usable layer, with a caveat

port=993 at 10,793,423 and port=143 at 12,138,709 are listener counts. They are large because every mail client that connects to a hosted mailbox touches one of these ports, and because a hosting provider with a few thousand domains behind one IP contributes a handful of listeners that serve millions of users. Populations of infrastructure do not scale with populations of people.

The caveat is the same one that applies everywhere: a listener on 143 could be IMAP, could be a proxy in front of IMAP, could be something else that a scanner recorded.

port=25 at 27,574,512 is the clearest case, because 25 is the port every mail exchanger in the world must answer on. The total is close to a count of MX hosts reachable from the internet, and it says nothing about whether those hosts are Postfix, Exchange, Exim, a cloud gateway or a filtering appliance.

app="Postfix" at 9,440,325 is a text count again, and its size relative to the port total is a reminder that the word appears in banners, Received headers, documentation and configuration samples.

What is actually worth checking

The interesting exposure in mail is not the size of the listener population. It is a small set of configuration facts, and each has a check that does not depend on an internet index.

• Open relay. Confirm smtpd_recipient_restrictions and the authorisation rules in Postfix, or the equivalent, and test from an external address to a domain you do not own. Modern default configurations reject this; a hand-edited one may not.
• User enumeration. VRFY and EXPN should be disabled, and the IMAP greeting should not distinguish a valid mailbox from an invalid one. The check is a connection and two commands against your own server.
• Submission authentication. Port 587 should require authentication and STARTTLS, and 25 should not offer submission at all on an edge host.
• Webmail. app="Roundcube" at 62,217 is the webmail tier, and a webmail login is a full mailbox credential with a browser session in front of it. Roundcube's own history makes the version check worth doing, and the version is visible in the login page of many installs.
• Bundled stacks. title="iRedMail" at 18 is a very small number for a widely deployed bundle, which suggests the bundle's pages title themselves as the webmail or the admin console rather than as the bundle. A count of 18 is not a count of iRedMail installations; it is a count of pages that name it.

The last point generalises. When a product's own name is not in its interface, the title field cannot find it, and the honest report says the index cannot measure that product rather than printing a small number as if it were the population.

Reporting mail exposure

Give the field for each number. A sentence that says 30 million Dovecot servers would be wrong in a way that survives proofreading, because the sentence looks like a measurement. The accurate summary is that the listener layer is large, the product layer is not measurable from text matching, and the configuration checks above are where the risk actually sits.

References

• ZoomEye queries recorded 2026-10-27T18:11Z to 2026-10-27T18:14Z: app="Dovecot" 30,701,808; title="Dovecot" 32; port=993 10,793,423; port=143 12,138,709; port=25 27,574,512; app="Postfix" 9,440,325; app="Roundcube" 62,217; title="iRedMail" 18
• Dovecot documentation on the IMAP greeting and on authentication configuration
• Postfix documentation on relay restrictions and on disabling VRFY
• Roundcube release and security advisory history
• iRedMail documentation on the components included in the bundle