Learn Mailserver - Backup & Migration

#Introduction

Every configuration we've built since episode 3 would be wasted if email data were lost. Broken disks, hacked servers, or human error — all of it is real. This episode builds two capabilities: reliable backup and smooth migration.

We'll back up the Maildir and the database, restore them when needed, then move email between servers using doveadm backup/sync and imapsync. By the end of the episode, you'll have a backup ritual that can run automatically.

#What Needs to Be Backed Up

Mail server data is split into three layers:

• Mailbox — the email contents in Maildir. This is the largest and most valuable data.
• Database — virtual user accounts, aliases, and webmail settings.
• Configuration — main.cf, /etc/dovecot, /etc/letsencrypt, and map files.

Don't just back up the Maildir. Losing the database means losing all accounts — and losing the configuration means losing weeks of work. All three go on the backup schedule.

#Backing Up the Database

Dump the database with mysqldump and compress the result:

mysqldump --single-transaction -u mail -p maildb | gzip > /backup/maildb-$(date +%F).sql.gz
mysqldump --single-transaction -u roundcube -p roundcubemail | gzip > /backup/roundcubemail-$(date +%F).sql.gz

--single-transaction produces a consistent dump without locking tables for long. Delete dumps older than the retention period so the backup disk doesn't pile up:

find /backup -name "*.sql.gz" -mtime +30 -delete

#Backing Up the Maildir

Maildir is very backup-friendly because it's file-based. There are two approaches:

• Full snapshot with rsync — simple, but copies all files every time.
• Incremental with doveadm backup — copies only what changed, and handles conflicts between users correctly.

doveadm backup is the official and safest method, because it understands the Maildir format and synchronization state:

doveadm backup -u admin@example.com /backup/vmail/

The version for all mailboxes:

doveadm backup -A /backup/vmail/

doveadm backup -A is one of the most common patterns in production. Because it's incremental, the second and subsequent backups are much faster. For the backup scheme, call rsync or doveadm backup from cron:

0 2 * * * doveadm backup -A /backup/vmail/

#Restore and Integrity Verification

Restore in Maildir is easy: because each message is a file, recovery is just copying back. doveadm backup also works as a restore — the direction is simply reversed:

doveadm backup -u admin@example.com /backup/vmail/admin@example.com/

After restoring, verify the integrity of the Maildir structure:

find /var/mail/vhosts -type f | wc -l
ls -la /var/mail/vhosts/example.com/admin/Maildir/

Make sure the cur/, new/, and tmp/ folders exist and tmp/ is empty — a healthy Maildir has no leftover files in tmp/ (files there indicate an interrupted write).

#Migrating to a New Server

Full migration means moving all layers at once: database, Maildir, and configuration. There are two main paths:

Path 1 — doveadm sync between servers. To move email directly without going through a backup:

doveadm -D sync -u admin@example.com 'imapc:user=admin@example.com:pass=rahasia@old.example.com'

Path 2 — imapsync. A popular tool that moves email between any IMAP servers, even non-Dovecot ones:

imapsync --host1 old.example.com --user1 admin@example.com --password1 'rahasia' \
         --host2 new.example.com --user2 admin@example.com --password2 'rahasia-baru'

Both preserve folders and email flags. Choose doveadm sync when both sides are Dovecot; choose imapsync when either side isn't Dovecot.

#Offsite Backup Strategy

Local backups aren't enough — fire, flood, or ransomware doesn't care about your server's location. Apply the 3-2-1 pattern: three copies, two different media, one offsite. A concise implementation example:

• Daily local copy in /backup.
• Weekly rsync copy to a NAS or another VPS.
• Monthly copy to object storage (for example R2 or S3).

rsync -az /backup/ backup@offsite.example.com:/backup/

Test restores periodically — a backup that's never been restore-tested is only an illusion of safety. Record restore times in your documentation; episode 22 will make this part of the production checklist.

#Conclusion

Episode 12 is done. Key takeaways:

• Back up three layers: Maildir, database, and configuration.
• mysqldump --single-transaction for consistent dumps.
• doveadm backup -A for incremental Maildir synchronization.
• Restore is reversing the doveadm backup direction; verify tmp/ is empty afterward.
• Migration uses doveadm sync (Dovecot-to-Dovecot) or imapsync.
• Apply the 3-2-1 pattern and test restores periodically.

Your data is safe. In episode 13 we lock the gate: Authentication & SASL — connecting Postfix to Dovecot's auth socket, requiring authentication for submission, and choosing secure mechanisms. See you in episode 13!