A customer reports that Outlook keeps asking for their password, or that mail stops syncing on their phone as soon as they open the laptop. The password is fine. The mail log tells the real story: Dovecot is refusing new IMAP sessions because that mailbox already has too many open connections from the same IP address.
This article covers the two Dovecot limits that cause dropped IMAP and POP3 logins on cPanel servers, how to confirm which one you are hitting, and how to change them without your edits being overwritten on the next cPanel update.
Confirm the error
Search the mail log first. On AlmaLinux, Rocky, and CloudLinux the file is
/var/log/maillog:
grep -E "user\+IP exceeded|process_limit" /var/log/maillog | tail -20
You will see one of two patterns:
imap-login: Maximum number of connections from user+IP exceeded (mail_max_userip_connections=20): user=<info@example.com>, rip=198.51.100.23
master: Warning: service(imap): process_limit (512) reached, client connections are being dropped
They have different causes and different fixes. Don't raise one when you are hitting the other.
Per-user connection limit
Dovecot's mail_max_userip_connections caps simultaneous sessions for one mailbox from
one source IP. WHM exposes it under Service Configuration → Mailserver Configuration
as two fields:
| WHM setting | Default | Protocol |
|---|---|---|
| Maximum IMAP Connections Per IP Address | 20 | IMAP |
| Maximum POP3 Connections Per IP Address | 3 | POP3 |
WHM's label says "per IP", but Dovecot counts the user and IP together. Twenty different mailboxes behind one office NAT do not share a budget. One mailbox opened on six devices behind that same NAT does.
Find the client holding the sessions
List live sessions per mailbox, sorted by count:
doveadm who | sort -k2 -nr | head -20
username # proto (pids) (ips)
info@example.com 19 imap (41213 41220 41227 ...) (198.51.100.23)
Any mailbox near the limit from a single IP has a client problem. The usual suspects:
- Thunderbird caches up to 5 connections per account by default, and runs a separate IDLE session for every folder with "check for new messages" enabled.
- Outlook opens extra sessions for each shared folder and search.
- One mailbox on several devices behind the same NAT. A reception inbox left open on four desktops and three phones will reach 20 during normal use.
- Stuck clients that reconnect without closing old sessions, usually after a Wi-Fi drop.
Decide whether to raise it
If one or two mailboxes hit the limit, fix the client first: reduce Thunderbird's cached connections, turn off per-folder new-mail checks, or move the shared inbox to delegated access. If a whole office hits it every morning, raise the limit.
Raise it in steps. 20 → 40 covers nearly every legitimate office setup. Setting it
above 100 hides broken clients rather than fixing them, and every IMAP session is a
separate imap process that counts against the server-wide cap below.
After saving in WHM, confirm the running value:
doveconf mail_max_userip_connections
If you changed the template instead of the WHM field, rebuild and restart:
/usr/local/cpanel/scripts/builddovecotconf
/usr/local/cpanel/scripts/restartsrv_dovecot
Server-wide process limit
The process_limit reached warning means the whole server has run out of mail process
slots, not just one customer. WHM's Maximum Number of Mail Processes defaults to 512.
Once it is reached, every new IMAP and POP3 login is dropped, and every customer on the
server sees authentication prompts.
Check how close you are:
ps -C imap --no-headers | wc -l
ps -C pop3 --no-headers | wc -l
On a shared server with 300+ active mailboxes, 512 is tight during business hours. Raising
it costs RAM: each imap process is small at idle but grows with mailbox size and search
activity, and WHM caps each at Process Memory Limit for Mail (512 MB by default). Check
free memory at peak before doubling the limit. On a CloudLinux server where mail shares a
box with PHP workers, pair the change with a look at
LVE tuning.
Rule out cPHulk and the firewall
If the log shows neither message but users still get password prompts, the block is
happening before Dovecot. Check whether cPHulk has flagged the office IP after a burst of
retries from a misconfigured phone. Our cPHulk tuning guide
covers whitelisting and the CLI unblock commands. On servers running CSF, csf -g 198.51.100.23 shows whether LFD has blocked the address. The
cPHulk vs CSF/LFD comparison explains which layer blocks
which service.
Official references
What does 'Maximum number of connections from user+IP exceeded' mean in Dovecot?+
How do I increase mail_max_userip_connections on cPanel?+
Is the Dovecot connection limit per IP or per user?+
Why does Outlook keep asking for my password on a cPanel mailbox?+
What is a safe Maximum Number of Mail Processes value?+
Next steps
- Keep outbound mail healthy with SPF, DKIM, and DMARC on cPanel
- Scan inbound mail for malware with Imunify Email on cPanel
- Review the other defaults in WHM tweak settings worth changing
- Need a license for a new mail node? See cPanel license options or compare tiers