diff --git a/config/fail2ban/dovecot-pop3imap.conf b/config/fail2ban/dovecot-pop3imap.conf
new file mode 100644
index 0000000..146c153
--- /dev/null
+++ b/config/fail2ban/dovecot-pop3imap.conf
@@ -0,0 +1,3 @@
+[Definition]
+failregex = (?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed|Aborted login \(\d+ authentication attempts).*rip=(?P<host>\S*),.*
+ignoreregex =
\ No newline at end of file