A mailbox is a provider's service, a local copy and a set of commitments, and each can fail independently. Account lockouts, billing problems, accidental deletions and account closures all remove mail that you may need later. A useful backup is a copy you can read without the provider, that is up to date enough to matter, and that you have actually restored once. This article covers three practical routes and how to encrypt what you keep.
Route one: a full export
The simplest route is an export. ITProMail provides a mail export as mbox from Account > Export. An mbox file holds one folder's messages in a single text file, with each message beginning with a line that starts From . Many tools read it, including Thunderbird, mutt and neomutt. Export regularly, keep the file with a date in its name, and check that the message count in a folder matches what the webmail shows.
The limitation is freshness. An export is a snapshot, so it is only as recent as your last run. It is best for periodic archives and for moving mail elsewhere once.
Route two: one-way IMAP mirroring
A mirror keeps a local copy of the mailbox current. The safest form is one-way: the server is read, the local copy is written, and nothing is deleted on the server. mbsync, from the isync project, can do this and stores messages as Maildir, one file per message. A minimal configuration looks like this:
IMAPAccount itpromail
Host imap.itpromail.com
Port 993
User justin@example.com
PassCmd "pass show itpromail"
SSLType IMAPS
SystemCertificates yes
IMAPStore itpromail-remote
Account itpromail
MaildirStore itpromail-local
Path ~/Mail/itpromail/
Inbox ~/Mail/itpromail/INBOX
SubFolders Verbatim
Channel itpromail
Far :itpromail-remote:
Near :itpromail-local:
Patterns *
Create Near
Remove None
Expunge None
Sync Pull
SyncState *
The settings that matter for a backup are Sync Pull, which moves data only from the server to the local copy, and Remove None with Expunge None, which stop deletions on the server from being mirrored locally. Run it with mbsync itpromail, and schedule it with cron, launchd or a systemd timer. The password comes from a password manager rather than the file, and the account uses an app password.
Route three: imapsync between accounts
imapsync copies mail from one IMAP server to another, which is useful for a second account at a different provider. It is a migration tool first, but it works for backups. Keep passwords in files readable only by you, and start with a dry run so you can see what would change:
imapsync \
--host1 imap.itpromail.com --ssl1 --user1 justin@example.com --passfile1 ~/.config/imapsync/src.pass \
--host2 imap.example.net --ssl2 --user2 backup@example.net --passfile2 ~/.config/imapsync/dst.pass \
--dry
When the output matches what you expect, remove --dry and run it again. Without a delete option, imapsync leaves messages on the destination that were removed from the source, which is what you want for a backup. Check the options for your version before relying on them.
Encrypting backups
A backup holds the same private information as the mailbox, and often in a less protected place. Encrypt it before it leaves the machine. For a single archive, GnuPG can encrypt symmetrically with a strong cipher:
tar -czf mail-2026-10-31.tar.gz Mail/
gpg --symmetric --cipher-algo AES256 --output mail-2026-10-31.tar.gz.gpg mail-2026-10-31.tar.gz
rm mail-2026-10-31.tar.gz
For repeated backups, a deduplicating tool with built-in encryption is easier. restic encrypts every repository by default and asks for a repository password:
restic -r /mnt/backup/mail init
restic -r /mnt/backup/mail backup ~/Mail
Store the passphrase or repository password in a password manager and in one offline location. An encrypted backup whose key is lost is indistinguishable from no backup.
Test the restore
A backup that has never been restored is an assumption. At least once, restore a folder into a scratch location, open it in a client, and confirm the messages and attachments are readable. Record checksums for archive files so you can detect corruption later:
sha256sum mail-2026-10-31.tar.gz.gpg > mail-2026-10-31.tar.gz.gpg.sha256
A simple routine
- Mirror the mailbox locally on a schedule, one-way, with deletions not propagated.
- Take an mbox export or an encrypted archive at a longer interval, such as monthly.
- Keep at least one copy off the device that holds your primary mail.
- Restore a sample folder every few months.
Backups also raise a retention question: deleting a message from the provider does not delete it from your archives. The retention article covers how to think about that. For the export options in the account, see the export guide.