The versionlock plugin is used to restrict updates on packages listed in the version lock.

Currently, the F28 dovecot packages are broken, so I added the following:

$ dnf versionlock list
Last metadata expiration check: 1:37:37 ago on Thu 12 Apr 2018 12:49:14 AEST.
dovecot-pigeonhole-1:2.2.33.2-2.fc28.*
dovecot-1:2.2.33.2-2.fc28.*

Using 'dnf -y update', it acts as it should:

$ dnf check-update
Last metadata expiration check: 1:38:01 ago on Thu 12 Apr 2018 12:49:14 AEST.

dovecot.x86_64                1:2.2.34-1.fc28    fedora
dovecot-pigeonhole.x86_64     1:2.2.34-1.fc28    fedora

$ dnf -y update
Last metadata expiration check: 1:38:04 ago on Thu 12 Apr 2018 12:49:14 AEST.
Dependencies resolved.
Nothing to do.
Complete

However, when the dnf-automatic.timer fires, the two packages in the versionlock are upgraded to the newer updates available.

Extract from /var/log/dnf.rpm.log:
2018-04-12T03:59:18Z INFO Upgraded: dovecot-1:2.2.34-1.fc28.x86_64
2018-04-12T03:59:19Z INFO Upgraded: dovecot-pigeonhole-1:2.2.34-1.fc28.x86_64
2018-04-12T03:59:19Z INFO Cleanup: dovecot-pigeonhole-1:2.2.33.2-2.fc28.x86_64
2018-04-12T03:59:19Z INFO Cleanup: dovecot-1:2.2.33.2-2.fc28.x86_64

Right now, this kills the dovecot install due to broken packages being in the repo.