Archive mail from the server without touching the server

Which mailboxes

Anything that speaks IMAP. Sign-in is prepared for the most common cases:

Microsoft 365 and Outlook.com

You sign in on Microsoft's own page; MailVault never sees your password and renews its access itself afterwards. Outlook.com needs IMAP switched on in its settings, Microsoft 365 does not. A shared mailbox is collected through a licensed account whose sign-in it uses.

Gmail and Google Workspace

With an app password: once two-step verification is on, Google issues a separate password for a single program, which can be revoked on its own. IMAP has to be on in Gmail's settings.

Any other IMAP server

At a hosting provider or in your own building: server, user name and password are enough. By default the connection is encrypted, on port 993.

Read-only, even when Microsoft says “write”

Mailboxes are opened with EXAMINE, IMAP's read-only mode, and messages are fetched with BODY.PEEK, which does not set the read flag. The client rejects changing commands such as STORE, EXPUNGE or MOVE before they leave the machine.

Microsoft's sign-in still says “read and write access to your mail”. For IMAP, Microsoft offers exactly one permission, IMAP.AccessAsUser.All, and it includes writing. Whether it is used, your server will show you: after a collection no message is marked as read and no flag has changed.

MailVault writes to a mail server only when you explicitly ask it to, such as when you restore an archived message to a mailbox. That, too, goes into the audit journal, with the server and the mailbox.

Collect automatically, without a window open

An archive that only fills up when someone remembers has gaps, and a gap looks exactly like a fortnight in which nobody wrote. So MailVault can collect by itself: every hour, every day at a time, or every week on a day.

Collection is carried out by the macOS scheduler (launchd), not by an open window. The Mac has to be on with a user logged in. If it was asleep at the scheduled time, the run happens once when it wakes. The outcome of every run – how many messages, which account failed and why – is written to the audit journal.

Unattended collection needs a way to sign in without you: the saved password, or the Microsoft sign-in that MailVault renews itself. A password sealed behind Touch ID is off limits to the scheduler, by design; at three in the morning nobody is there to give the fingerprint.

One job, one copy

To the job on the Mac, a copy of the archive – a backup restored somewhere else, a second copy on another disk – is the same archive. It collects into the copy the schedule was applied from, and that stays so when another copy is opened:

• The other copy is not collected, and Run Now is not available there. MailVault names the location of the copy that is collected.
• Switching automatic collection off in the other copy switches it off for that copy only; the job stays as it is.
• Only Apply in the other copy moves the job to it, and the copy collected until then is collected no longer.

So a backup cannot quietly fill up while the archive everybody relies on stands still. An archive that has been moved rather than copied takes its job along the next time it is opened.

Every message once, byte for byte

The message is stored as the server delivers it, with every header, attachment and signature, together with its mailbox, flags and delivery time. Each message is identified by its SHA-256. When the same message turns up again in the next collection or from a second folder, it is recognised and not stored twice. Identical attachments are stored only once.

On reading, every message is put back together and checked against its original SHA-256. Between the message that went in and the one that comes back out, there is not a byte of difference.

Finding gaps before anyone asks

If an archive has no ongoing collection set up, the compliance view shows it as an open point, with a button that opens the setup. On the command line, mailvault gaps looks for mail the archive should hold and does not, such as conspicuously quiet days.

When Microsoft asks for approval

In most Microsoft 365 organisations an individual may not give an app access to their own mailbox. An administrator approves the application once for the whole organisation, and everyone else then signs in normally.

MailVault recognises this case and, instead of an error, shows the link that has to be opened, together with a prepared email to send to the administrator. If you administer the tenant yourself, you open the link directly. It ends on a page that fails to load; the approval has been recorded by then.