All help articles

Importing mail from another server

Mail in another account (Gmail, Outlook.com, Fastmail, a company server) can be copied here over IMAP, folders, read marks and dates included.

Starting an import

• Users: in webmail, Settings → Import mail from another account. Fill in the other server's IMAP host (such as imap.gmail.com), the security (TLS on port 993 for almost every provider, or STARTTLS on 143), the username and password there, and optionally folders to skip and a date to start from. Then Start import.
• Administrators: Import next to the user on the tenant's page (or the team's page in the domain admin panel), or corpsuite mailbox import amy@acme.com host=imap.example.com username=amy password=-.

The import runs on the server, so the browser can be closed. Its progress shows on the same card, and the user gets an email when it is done or if it stops. Cancel stops it; what was copied stays.

Many providers do not accept the normal password for IMAP: Gmail, iCloud, Yahoo and Outlook.com with two-step sign-in need an app password made in that account's security settings, and Gmail needs IMAP turned on.

What is copied

• Every folder, except virtual ones whose mail is in other folders too (Gmail's All Mail, Starred and Important) and the folders you skip.
• INBOX, Sent, Drafts, Junk, Trash and Archive go to the matching folders here, found by their special-use flags or their usual names ("Sent Items", "[Gmail]/Sent Mail", "Deleted Items" and so on). Other folders go to a folder of the same name, made when missing, with subfolders kept.
• Read, starred, answered and draft marks, and each message's received date. Messages marked deleted are left behind.
• Mail into Junk does not teach the spam filter.

Running it again

An import remembers where it got to in each folder, and skips any message already in the target folder (same Message-ID and size). Running a new import later, for example on the day you move your MX records, copies only what arrived since. A mailbox that fills up stops the import with a message saying so; free space or ask for more, and start it again.

Safety

• The other account's password is sealed with the server's key while the import waits or runs, and removed when it ends. It is never shown again.
• Imports only connect to servers on public addresses, over TLS with a valid certificate, so they cannot be used to reach into the server's own network.
• One import per account runs at a time; the server runs two at once.

For developers

GET/POST /api/mail/imports and DELETE /api/mail/imports/{id} in api/webmail.yaml; /v1/tenants/{tenantId}/accounts/{accountId}/imports in api/openapi.yaml.