Hi, can confirm this bug with stretch now being stable. This should be fixed fast as it results in brute-force protection for Dovecot being inactive.
Workaround is to add the correct logpath into jail.local: logpath = /var/log/mail.log (I wouldn't use auth.log, not every fail is logged there.) Regards Andreas