← Back to home
Comparison · Comms

Dovecot vs Subsplash

A side-by-side editorial comparison of Dovecot and Subsplash — release velocity, themes, recent moves, and the top alternatives to consider.

Dovecot vs Subsplash: at a glance

FeatureDovecotSubsplash
SectorCommsComms
Velocity score0.06.3
Sparks · 30d01
Top themesmail server, imap, cve cadence, config rewritechurch-management, workflow-automation, ai-assistants, giving-reconciliation
Last editorial update1h ago17h ago
WebsiteVisit →

What is Dovecot?

Dovecot's 2.4 rewrite is still being paid for — twelve CVEs across two releases, two of them 2.4 regressions.

Dovecot 2.4 broke configuration compatibility outright in January 2025 and the line has been stabilizing ever since. The last two releases are dominated by security work: 2.4.3 shipped eight CVEs including SQL and LDAP injection when auth_username_chars is empty — both labelled v2.4 regressions — and 2.4.4 added four more, among them a fakeable CRAM channel binding and an incomplete earlier fix. Alongside that, 2.4.4 permanently drops root privileges in indexer-worker, quota-status and script-login before they serve requests.

Read the full Dovecot trajectory →

What is Subsplash?

Subsplash is wiring automation and AI through the church admin stack it already owned

Workflows came out of beta in mid-July with per-step email automation, then immediately gained completion notifications for team leaders. Around it, the administrative surfaces are being rebuilt in sequence: Transfers and reconciliation now tracks who reconciled what and when, Groups gained member limits with a Full badge and finder filters, and event managers can register guests and waive payments directly from the dashboard. The AI line is filling in too — Trends AI added media and campaign data on top of giving, people, attendance and groups, following the natural-language People Assistant in May.

Read the full Subsplash trajectory →

Dovecot vs Subsplash: editorial side-by-side

D
Dovecot
COMMS
0.0

Dovecot's 2.4 rewrite is still being paid for — twelve CVEs across two releases, two of them 2.4 regressions.

◆ Current state

Dovecot 2.4 broke configuration compatibility outright in January 2025 and the line has been stabilizing ever since. The last two releases are dominated by security work: 2.4.3 shipped eight CVEs including SQL and LDAP injection when auth_username_chars is empty — both labelled v2.4 regressions — and 2.4.4 added four more, among them a fakeable CRAM channel binding and an incomplete earlier fix. Alongside that, 2.4.4 permanently drops root privileges in indexer-worker, quota-status and script-login before they serve requests.

◆ Where it's heading

The 2.4 line is a rewrite absorbing its own cost. Dependencies are being replaced rather than pinned — libicu swapped for an in-house unicode library, libpcre2 brought in for regular expressions — and the process model is being tightened, with permanent privilege drops and a reworked service_reuse_port that pre-creates one socket per process. IMAP4rev2 and UTF-8 mail remain behind build flags and config toggles, so the modern-protocol work is real but deliberately unshipped.

◆ Prediction

Expect the CVE cadence to keep tracking the areas the rewrite touched — auth escaping, IMAP parsing limits and the variable expansion introduced in 2.4 — rather than long-settled code. The experimental IMAP4rev2 and mail_utf8 flags are the obvious candidates to graduate once the security churn slows, though nothing in these entries sets a date.

S6.3

Subsplash is wiring automation and AI through the church admin stack it already owned

◆ Current state

Workflows came out of beta in mid-July with per-step email automation, then immediately gained completion notifications for team leaders. Around it, the administrative surfaces are being rebuilt in sequence: Transfers and reconciliation now tracks who reconciled what and when, Groups gained member limits with a Full badge and finder filters, and event managers can register guests and waive payments directly from the dashboard. The AI line is filling in too — Trends AI added media and campaign data on top of giving, people, attendance and groups, following the natural-language People Assistant in May.

◆ Where it's heading

Two threads run in parallel and are starting to meet. One is turning manual church-admin chores into configured automation — workflows that send their own emails, notify on completion, and enforce group capacity without a staff member watching. The other is putting a natural-language layer over an increasingly complete data set, which only becomes useful once giving, attendance, media and campaigns all live in the same place. Recent releases have been closing the gaps in that data set.

◆ Prediction

The obvious convergence is Workflows becoming triggerable from the data — a Trends AI segment or People Assistant query that drops matching people onto a workflow board automatically. Reconciliation gaining an export or accounting-package integration is the other near-term candidate given how much structure was just added to Transfers.

Alternatives to Dovecot and Subsplash

Other Comms products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Dovecot or Subsplash.

See all Dovecot alternatives → · See all Subsplash alternatives →

Recent activity from Dovecot and Subsplash

Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.

  1. 23h agoSubsplashTransfers & Reconciliation
  2. 7d agoSubsplashBe notified by email when a Workflow Card is complete
  3. 20d agoSubsplashIntroducing Group Member Limits + Group Finder Improvements
  4. 22d agoSubsplashEmail Automations for Workflows
  5. 28d agoSubsplashRegister Guests & Waive Payments from Dashboard
  6. 1mo agoSubsplashMedia and Campaign Data in Trends AI
  7. 2mo agoDovecotFour more CVEs, and root is dropped permanently
  8. 3mo agoDovecotEight CVEs, two of them 2.4 regressions
  9. 9mo agoDovecotlibicu replaced in-house; IMAP4rev2 lands experimental
  10. 1y agoDovecotFirst 2.4 patch, carrying the new signing key
  11. 1y agoDovecotDovecot v2.4.0
  12. 1y agoDovecotHeader limits imposed after CPU exhaustion CVEs

Frequently asked questions

What is the difference between Dovecot and Subsplash?

They serve adjacent needs but don't currently overlap on shipped themes. Subsplash is currently shipping more aggressively (velocity 6.3 vs 0.0), with 1 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.

Is Dovecot better than Subsplash?

Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Subsplash is currently shipping more aggressively (velocity 6.3 vs 0.0), with 1 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Comms products to evaluate alongside.

What are the best alternatives to Dovecot?

Top Dovecot alternatives in Comms are ranked by recent ship velocity. Browse the "Dovecot alternatives" section above for the current picks, or visit /alternatives/dovecot for the full list with editorial commentary on each.

What are the best alternatives to Subsplash?

Top Subsplash alternatives in Comms are ranked by recent ship velocity. Browse the "Subsplash alternatives" section above for the current picks, or visit /alternatives/subsplash for the full list with editorial commentary on each.