Through port 4190 (ManageSieve, RFC 5804) clients upload Sieve scripts to the mail server: filter rules, forwards and vacation replies that run server-side, even when no client is open. In Dovecot the service comes from Pigeonhole; Roundcube (managesieve plugin), Nextcloud Mail and Thunderbird add-ons use it.
If webmail runs on the same server, 127.0.0.1 is enough. Make it public only if external clients need to edit filters, and then require STARTTLS. Older guides mention port 2000 – that is obsolete.
Typical: the vacation reply can't be saved in webmail because port 4190 is blocked or the TLS certificate doesn't match the hostname.
Check
nc -v mail.example.com 4190