Finishing Basic Configuration
Unless you're going to have only virtual users and you don't care about their passwords, switch back to disable_plaintext_only = yes and set up SSL.
Plaintext authentication is still allowed from localhost, so you can have your webmail application to connect to Dovecot without using SSL or even having to configure it.