...I had under my eyes the solution I have not seen: * user=foo lrw Public user=bar lrwstipekxa Public/* user=bar lrwstipekxa I was enough (in my case) add the initial "*" wildcards, like this: * user=info at mydomain.com lrwsi where the "*" wildcards means all groups. I have verified and so the configuration is perfect, the user can not delete their own messages The fact remains that on the wiki dovecot ACL these steps, in the case of virtual users, are not clear, at least in my opinion. :-) I hope at least that my experience can be of assistance to other users. Many many thanks! Davide