Use imapsync over SSH to copy email between providers

imapsync copies messages between two IMAP mailboxes, along with the folder structure and compatible flags. It is a one-way copy, not an exact mirror: it does not migrate contacts, calendars, rules or metadata that either server does not expose over IMAP.

A common use is changing email provider, for example when moving to our hosting services. The synchronisation should be repeated and checked to reduce the risk of missing messages during the switch.

Before you start, create the destination mailbox, list the folders and check their quotas. Run a first synchronisation without any deletion options, review the folder mapping, counts and errors, and fix any differences before changing the mail flow.

If you would rather we prepared the migration, ask support what is included for your service. To do it yourself, check that you have SSH access and imapsync available; the graphical alternative is explained in Migrate email from the panel.

Continuing the example above, if you want to synchronise a source email account with a destination email account, you will first need the login details for both accounts; if the destination account is new, create it in cPanel first.

Use app passwords or temporary credentials where the provider allows them. Google Workspace may require OAuth2 or an authorised app password, and Microsoft 365 requires OAuth in modern configurations; check the specific procedure for the source. Do not write passwords in imapsync's arguments: they would be visible in the shell history and could appear in the process list. For providers that still accept this authentication, save each password in a separate file outside the web root and protect it before running the synchronisation:

umask 077
read -rsp 'Contraseña temporal de origen: ' IMAPSYNC_PASS1; printf '\n'
read -rsp 'Contraseña temporal de destino: ' IMAPSYNC_PASS2; printf '\n'
printf '%s\n' "$IMAPSYNC_PASS1" > "$HOME/.imapsync-pass1"
printf '%s\n' "$IMAPSYNC_PASS2" > "$HOME/.imapsync-pass2"
unset IMAPSYNC_PASS1 IMAPSYNC_PASS2
chmod 600 "$HOME/.imapsync-pass1" "$HOME/.imapsync-pass2"

imapsync \
--host1 SERVIDOR_IMAP_ORIGEN --user1 CUENTA_ORIGEN --passfile1 "$HOME/.imapsync-pass1" --ssl1 --sslargs1 SSL_verify_mode=1 \
--host2 SERVIDOR_IMAP_DESTINO --user2 CUENTA_DESTINO --passfile2 "$HOME/.imapsync-pass2" --ssl2 --sslargs2 SSL_verify_mode=1

Before the real copy, run the same command with --dry added. Check in the output how the folder names map to each other and fix any inclusion, exclusion or renaming rules you need. Then remove --dry to start the actual synchronisation.

How long it takes depends on the volume, the connection and the providers' limits. Review the final summary and the errors; the terminal closing or progress no longer showing does not prove the copy has finished.

--ssl1 and --ssl2 encrypt both connections. Also add SSL_verify_mode=1 to --sslargs1 and --sslargs2 to require certificate validation, and do not carry on if it fails. Once you have finished and verified the migration, delete the files with the following command:

rm "$HOME/.imapsync-pass1" "$HOME/.imapsync-pass2"

Then revoke or rotate the credentials you used.

The imapsync documentation covers uses such as Gmail, Exchange and Microsoft 365 and has many options. Some are destructive: --delete1 deletes messages from the source and --delete2 can delete messages from the destination that are not in the source. Do not use them in a basic migration; test the copy without deletion options first and check both mailboxes.

In a migration, run a second synchronisation immediately before changing the MX records and another once propagation has finished. Keep the source accessible during that period, compare folders and counts at both ends and open a sample of messages and attachments. Do not delete the old mailboxes until you have confirmed that they no longer receive email and that recovery from the destination works.

Read the result

Check the exit code, the errors and any identified messages missing from the destination. A difference in total size does not by itself prove anything was lost: servers can count differently and Gmail shows the same message under several labels.

Start with one mailbox and keep its parameters and log somewhere private. If the connection drops, check the cause and repeat with the same folder criteria; do not add deletion options to try to make the figures match.

The password preparation block uses Bash (read -rsp): run it in that shell, not in a console that interprets those options differently. Do not turn on tracing such as set -x or the --showpasswords option when handling credentials.