How to Take an Email Backup

What an email backup has to contain

An email backup is a copy of every mailbox that lives somewhere other than the server you are protecting. It has to include the inbox, the sent folder, any folders you file into, and the attachments. Contacts and calendars are separate stores, so a mail-only archive will not bring them back.

Your hosting provider's backup is not your backup. A server backup exists so the provider can rebuild a failed machine, it runs on their retention window, and restoring it usually replaces the whole account rather than one mailbox. That is a fine safety net and a poor archive.

• Scope: all mailboxes on the domain, not only the one you read.
• Format: MBOX, PST or EML, all of which a desktop client can reopen.
• Location: a disk you control, ideally two, not the same server and not only the same cloud account.
• Proof: one message restored from the archive into a working mailbox.

The rest of this page follows that order for cPanel hosting, Gmail, Outlook and any IMAP mailbox, and ends with the restore test that most guides skip.

Back up mailboxes on cPanel hosting

cPanel gives you two useful paths: a full account backup that includes the mail directory, and direct access to the mail folders in File Manager. The first is a complete snapshot; the second lets you pull one domain's mail without the websites.

1. Log in to cPanel, open Files, then Backup, and choose Download a Full Account Backup. The archive includes home directories, databases and the mail store.
2. For one domain only, open File Manager, enable Show Hidden Files, and go to mail, then the domain folder. Each mailbox is a directory with cur, new and tmp subfolders holding raw message files.
3. Compress the mailbox directory and download the archive, so thousands of small files move as one.
4. Record the date, the domain and the mailbox count in a text file beside the archive. Six months later you will not remember which copy is which.

A full account backup restores by replacing the account, so keep it for disaster recovery. For a single mailbox, the File Manager route or the IMAP sync below is safer. The step-by-step for the archive itself is in the cPanel full backup guide.

Back up Gmail and Google Workspace mail

Google Takeout is the supported export: it produces an MBOX file per mailbox that Thunderbird, Apple Mail and most archiving tools can open. It can also run on a schedule, which turns a one-off download into a monthly copy.

1. Open Google Takeout while signed in to the account you want to export.
2. Click Deselect all, then tick Mail only, so the archive does not include Drive and Photos.
3. Choose the export format and a destination, then set the frequency to every two months if you want an automatic repeat.
4. Create the export and wait for the email with the download link. Large mailboxes take hours, not minutes.
5. Download the zip, keep it off the Google account, and note the export date.

Takeout downloads mail, but it does not restore into Gmail on its own. To put messages back you import the MBOX through a desktop client, or use a paid migration tool. Plan that before you need it, not after an account is locked.

Back up Outlook and Microsoft 365 mailboxes

Classic Outlook on Windows exports to a PST file, which contains mail, calendar and contacts for the folders you select. The new Outlook for Windows and Outlook on the web have no local export, so use Takeout-style tooling or a desktop client for those accounts.

1. In Outlook for Microsoft 365, 2024, 2021, 2019 or 2016, open File, then Open and Export, then Import/Export.
2. Choose Export to a file, then Outlook Data File (.pst).
3. Select the account and tick Include subfolders, so filed mail comes with the inbox.
4. Pick a destination outside the profile folder, and set a password on the file.
5. Repeat for each mailbox. One PST per mailbox keeps restores simple.

Microsoft 365 keeps deleted mail for a limited retention window and keeps the mailbox itself on their servers. That protects you from a mistaken delete, not from a cancelled licence, a departing employee or a ransomware event in the tenant. The PST is the copy you own.

The universal method: sync any IMAP mailbox to Thunderbird

If you would rather not depend on a provider's export tool, sync the mailbox to a desktop client. IMAP copies every folder to your disk, works on cPanel, Gmail, Outlook and Zoho alike, and gives you a copy you can read without any service.

1. In Thunderbird, add the account as IMAP: your mail host, port 993 with SSL/TLS, and the full email address as the username.
2. Right-click each remote folder and choose Subscribe if it is not already visible.
3. Let Thunderbird download the folders, then select them, right-click and choose Offline, then Download Now for the folders that were not cached.
4. Copy the profile folder, or export each folder with an MBOX-aware tool, to your backup disk.
5. Open one message from the copy with the network disconnected. If it renders with its attachment, the copy is real.

This is also the safest way to prepare a host migration: the local copy exists before the DNS changes, so a missing mailbox on the new server is an inconvenience rather than a loss.

Which email backup format to keep

Keep MBOX for archives you may need to search, PST if your team lives in Outlook, and EML for individual messages you must hand to someone else. The format matters less than being able to open it in five years.

Avoid PDF as a mail backup. It drops attachments, loses the sender headers a dispute may need, and cannot be imported anywhere.

Test the restore before you trust the backup

A backup you have never restored is a hope. The test takes ten minutes and is the only thing that separates an archive from a file you cannot use.

1. Create a test mailbox on the same domain, or use a spare address you control.
2. Import one folder from the archive into it, using the client's Import or drag-and-drop.
3. Open a message with an attachment and confirm the file opens.
4. Reply to it and check the sent folder records the reply, which proves the mailbox is not read-only.
5. Write the result and the date in the same note as the archive, then delete the test mailbox.

If the import fails, the usual causes are a truncated download, a password-protected PST with a forgotten password, or an archive taken while the mailbox was mid-sync. Re-take it rather than repairing it.

A backup schedule that survives a bad week

Monthly is enough for most small businesses; weekly for accounts that carry orders, invoices or legal correspondence. Whatever the interval, keep two copies on different media and one of them off site.

• Run the export on a fixed date and name the file with that date, so the newest copy is obvious.
• Keep twelve months of monthly archives, then delete the oldest after a successful restore test.
• Store one copy away from the server and the office: an external disk at home, or object storage in a different account.
• Record who runs it. A schedule with no owner stops the first month that person is on leave.
• Before any migration or DNS change, take an extra copy and label it with the change.

The same discipline applies to the website files and databases, which is the point of the 3-2-1 rule. If mail is business-critical and nobody in the company will run a monthly export, a managed backup service is cheaper than the month you lose the invoices.