IMAP backup: how it works and what it copies
Outlook, Thunderbird and the mail app on your phone all talk to the server over IMAP. A backup tool can read your mailbox the same way, with nothing to install and no special arrangement with your provider.
IMAP is fairly simple. The app connects to the server, asks which folders exist and what is in them, then downloads the messages it does not have yet. Thunderbird does this, and so does your phone. A backup tool does the same thing, except that it never writes anything to the server.
IMAP also has commands to delete, move and flag messages. A backup has no reason to use them, so istorel only opens read-only connections. If our service were ever compromised, an attacker could read your email through it, but could not delete or change anything.
Two numbers that save copying everything again
Copying a mailbox once is easy. Copying it several times a day without downloading everything each time is harder, and IMAP handles it with two numbers.
Each folder has a UIDVALIDITY value, and each message has a UID that the server should never reuse. If you store both, the next run only needs to ask for messages with a UID higher than the last one you saw. That is much faster than downloading the whole mailbox again.
Some migrations make the server renumber its messages, and when that happens the folder’s UIDVALIDITY changes. The backup then has to read the folder again from scratch instead of trusting the old numbers. It does not happen often, but a tool that misses it can end up filing messages under the wrong number without any warning.
If a backup tool does not check UIDVALIDITY, messages can get mixed up without any error showing. You usually find out when you try to restore one.
What happens to deleted messages
On each run, the tool asks the server for the list of UIDs in a folder and compares it with the previous list. Any UID that is missing belongs to a message deleted since the last run. A sync tool would then delete those messages from its own copy too, because its job is to keep both sides the same.
A backup keeps them. It records that they are no longer on the server and holds on to their content. That is how it differs from a mirror: a mirror on a NAS covers you if a disk fails, but if a folder is emptied on the server, the mirror empties it too.
The limits of IMAP
IMAP only carries email. Calendars and contacts use other protocols, CalDAV and CardDAV, and files are somewhere else again. A tool that backs up your mailbox does not necessarily back up your calendars, contacts or files, so it is worth asking.
You also need an account that is allowed to read the mailbox. Most providers now ask for an app password rather than the main account password. Some, Microsoft first of all, no longer accept passwords at all and require OAuth. With those providers, a plain IMAP login with a password will not work.
- Email, yes. Calendars, contacts and files, no.
- You usually need an app password, and you can revoke it at any time without affecting the rest of the account.
- Exchange Online no longer accepts passwords over IMAP: you have to use OAuth.
Why this is useful
A backup built on one provider’s API only works with that provider, and it breaks when the API changes. An IMAP backup works with Infomaniak, Gandi, OVHcloud, a Dovecot server you run yourself, or an old Zimbra install you inherited from a previous IT contractor.
If you look after email for your clients, you can use one tool and one method for all of them, whichever provider they picked.