dovecot - Dec 2016 - Correct user for replication

Hi

I've set up replication with the settings below.

With these settings, aggregator runs as user dovecot and replicator as
user root. Are those the recommended settings or should I change them,
in particular for replicator which is running as a privileged user?

service aggregator {
  fifo_listener replication-notify-fifo {
    mode = 0666
    user = vmail
  }
  unix_listener replication-notify {
    mode = 0666
    user = vmail
  }
}
service replicator {
  unix_listener replicator-doveadm {
    mode = 0660
    group = mail
  }
}

service doveadm {
  inet_listener {
    port = 999
    ssl = yes
  }
}
ssl_client_ca_file = /etc/pki/tls/cert.pem

doveadm_password = secret

plugin {
  mail_replica = tcps:hostname.domainname.tld:999
}

thanks

John