>> (b) Indicate to Dovecot in some way other than the dovecot-shared file >> which permissions to use for any messages created? > > In v1.2 the permissions are taken from parent directory.
Hmm, that might be the best solution then, an upgrade to 1.2. Fwiw, I also tried NOT using the dovecot-shared file and just relying on the UMASK=007 directive I put in .procmailrc to create the messages with the correct permissions..... and that worked! Well, as far as the messages themselves go. However, the dovecot.index, dovecot.index.log, and dovecot-uidlist all got rewritten with only user permissions and created problems. I'm guessing dovecot-shared is the only way to make sure those files keep their correct permissions?
David