Email is where invoices, contracts, password resets, tax notices and years of correspondence live. Most people assume their provider keeps it safe forever. Providers are generally reliable, but accounts get locked, compromised, closed when a subscription lapses, or emptied by a mistaken bulk delete. A copy outside the provider is worth having.
The good news is that almost every email service supports IMAP, a standard protocol that lets any client read and copy your mail. That makes backup straightforward.
Step 1: get credentials that work with IMAP
Most providers no longer let IMAP tools log in with your normal password, especially if you use two-factor authentication. You usually need one of these:
- An app password: a separate, generated password used only by one app. If it leaks, you revoke it without changing your main password.
- OAuth sign-in: the tool opens a browser window, you sign in with the provider, and the tool gets a token. Some providers now require this.
Gmail
- IMAP server:
imap.gmail.com, port 993, SSL/TLS. - Turn on 2-Step Verification for your Google account, then create an app password from your Google Account security settings. If you do not see the option, your account type or admin may not allow it, and you will need a tool that supports OAuth.
- Gmail uses labels rather than folders. Over IMAP, each label appears as a folder, and [Gmail]/All Mail contains every message. Backing up All Mail alone avoids duplicates; backing up every label gives you the folder structure but stores some messages several times.
Zoho Mail
- IMAP server:
imap.zoho.infor accounts on Zoho’s India data centre,imap.zoho.comfor others. Use the one matching where your account is hosted; port 993, SSL. - Enable IMAP access in Zoho Mail settings (under Mail Accounts).
- If two-factor authentication is on, generate an application-specific password from Zoho Accounts security settings.
Outlook.com and Microsoft 365
- IMAP server:
outlook.office365.com, port 993, SSL. - Microsoft has been moving away from basic password authentication for IMAP. For many accounts you will need a backup tool that supports OAuth (modern authentication). For Microsoft 365 business accounts, your administrator may also need to allow IMAP access.
Other providers
Look for “IMAP settings” in your provider’s help pages. You need the server name, port (almost always 993 with SSL/TLS), username (usually your full email address) and a password or app password.
Step 2: pick a method
Option A: an IMAP sync tool
These copy your mailbox to a local folder or to another IMAP server, and only fetch new messages on later runs. Popular open source choices:
- isync (mbsync) and OfflineIMAP download mail into a local Maildir folder (one file per message).
- imapsync copies one IMAP account to another, useful for keeping a second mailbox as a backup.
These are command-line tools, best for people comfortable with a terminal. Run them on a schedule (cron on Linux, Task Scheduler on Windows).
Option B: a desktop email client
Thunderbird can download a full copy of your mailbox for offline use. With the ImportExportTools NG add-on, you can export folders to mbox files, which are a widely supported format. This is the easiest option for non-technical users, but you must remember to run it.
Option C: the provider’s export
- Google Takeout exports Gmail as an mbox file.
- Zoho Mail and Microsoft 365 have export options in their settings or admin consoles.
Exports are good for an occasional full snapshot, but they are manual and slow for large mailboxes.
Step 3: store the copy properly
A local Maildir or mbox file on your laptop is one more copy, but it is still on one device. Treat it like any other important data:
- Keep it in a folder that is itself backed up, ideally to a different location.
- Encrypt it if it is stored anywhere you do not fully control. Email contains sensitive information.
- Keep more than one version, so a mistaken deletion at the source does not wipe the backup on the next sync.
A sync tool mirrors deletions unless you tell it not to. Check your tool’s settings so that deleting mail on the server does not delete it from your backup.
Step 4: check it
Every few months:
- Open the backup in a mail client (Thunderbird can open mbox files and Maildir folders) and search for an old message.
- Check that recent mail is present, which confirms the scheduled job is still running.
- Confirm your app password has not been revoked. Changing your main password sometimes revokes app passwords automatically.
A checklist
- ☐ App password or OAuth access set up for each mailbox
- ☐ IMAP enabled in the provider’s settings where required
- ☐ Backup tool chosen and scheduled
- ☐ Tool configured not to propagate deletions to the backup
- ☐ Backup stored in at least two places
- ☐ Restore checked by opening and searching the backup
- ☐ Business mailboxes, shared inboxes and former employees’ mailboxes included
Closing note
triplicate is being built to back up any IMAP mailbox, using an app password, into the same two-region, encrypted storage as your other data. It is not live yet; see what we plan to support or join the waitlist.
Keep reading
Organising bills, receipts and warranties so you can find them when it counts
Thermal receipts fade, GST invoices get lost and warranty claims need proof. A simple system for Indian households to keep bills findable for repairs and ITR.
RPO and RTO explained
Recovery Point Objective and Recovery Time Objective in plain terms, how to pick sensible values, and how they shape your backup design and costs.
Ransomware recovery for small businesses
What to do in the first hours after ransomware hits a small business, how backups decide the outcome, and how to prepare before it happens.