This documentation is for Dovecot v2.x, see wiki1 for v1.x documentation.

Finishing Basic Configuration

Unless you're going to have only virtual users and you don't care about their passwords, switch back to disable_plaintext_only = yes and set up SSL.

Plaintext authentication is still allowed from localhost, so you can have your webmail application to connect to Dovecot without using SSL or even having to configure it.