DOVEADM-BACKUP(1)

👑 DOVEADM-BACKUP — Dovecot's one-way mailbox synchronization feature ✨

okay bestie, welcome to doveadm-backup, aka the Dovecot page about one-way mailbox synchronization 💅 this is from section 1 of the manual (that's "user commands", iykyk), and it covers the whole dsync saga — sync, backup, all the modes, all the algorithms. grab a snack, this one's a journey 🍓

---

✨ SYNOPSIS ✨

doveadm [GLOBAL OPTIONS] sync [-u user | -A | -F file | --no-userdb-
lookup] [-S socket_path] [-1fPR] [-l secs] [-r rawlog path] [-m mailbox]
[-g mailbox guid] [-n namespace | -N] [-x exclude] [-a all mailbox] [-s
state] [-T secs] [-t start date] [-e end date] [-O sync flag] [-I max
size] [-p setting=value] destination

doveadm [GLOBAL OPTIONS] backup [-u user | -A | -F file | --no-userdb-
lookup] [-S socket_path] [-fPR] [-l secs] [-r rawlog path] [-m mailbox]
[-g mailbox guid] [-n namespace | -N] [-x exclude] [-a all mailbox] [-s
state] [-T secs] [-t start date] [-e end date] [-O sync flag] [-I max
size] [-p setting=value] destination

🫶 side note for the eagle-eyed besties: sync gets the -1 flag, backup does NOT. that's not a typo, that's the whole plot twist.

---

💖 DESCRIPTION 💖

okay so dsync (short for doveadm sync, we're on nickname basis) is Dovecot's mailbox synchronization feature. it's giving multitool because it can do like four different jobs: two-way syncing of mailboxes, making backups of mails, and converting mailboxes from/to different mailbox formats. and the way that it works within the same server OR between different servers (via ssh(1) or tcp connections)?? iconic. you can also reach remote mailboxes via the IMAP protocol, which is literally how people use dsync for mailbox migration purposes 🦋

the three modes, ranked 🎀

you run dsync in one of three modes:

• doveadm backup does one-way synchronization. if there are any changes in the destination they will be reverted, so the destination will look exactly like the source. no thoughts, just mirror 🪞
• doveadm sync does two-way synchronization. it merges all changes without losing anything. both the mailboxes will end up looking identical after the synchronization is finished. mutual, consensual, both parties thriving 💖
• doveadm sync -1 performs one-way synchronization. if there are any changes in the destination, they will be preserved and the new changes will be merged on top of them. this merging doesn't currently work perfectly, so its use should be limited. its main purpose is that during mailbox migration you can run doveadm backup multiple times, then switch mails to be delivered to the new mailbox and run doveadm sync -1 once more to transfer any last new mails from the old mailbox.
  • the one-way algorithm is the same as two-way dsync algorithm except the source account is not modified. it fetches the message's GUID (Global UID), which is used to identify any conflicting UIDs in messages. as long as the source and destination side has matching UID<->GUID mapping, those emails are assumed to be synced correctly. only after the first mismatch will changes begin. 👀

Example: Source mailbox has messages UID 1..5; source mailbox is synchronized using doveadm backup to the destination. Subsequently, UID 6 is delivered to the source mailbox and UID 1 is expunged from the destination mailbox. In this example, UID 1 is kept removed (in destination) because UID 1..5 have identical Date+Message-ID headers. UID 6 is not seen in destination so it's copied.

If both source and destination have UID 6, but the messages are different, the headers don't match and both the messages are kept in the destination but they're given new UIDs 7 and 8 just to be sure any client didn't get confused about what UID 6 actually was. Thus, one-way sync begins to quickly diverge from the source mailbox once changes start to occur on either side; one-way sync should therefore normally only be used within a short period of time after a doveadm backup or doveadm sync command was used to synchronize the mailboxes.

😭 bestie this is the important part: one-way sync is a short-term relationship. don't let it linger. it will diverge.

---

the three algorithms 🧚

there are also three different synchronization algorithms:

• Full synchronization (-f parameter) scans through all the messages in all the mailboxes. this guarantees that everything will be synchronized, but it's unnecessarily slow for incremental synchronization. it's giving "I did not read the assignment, I just did the whole assignment" 💀
• Fast synchronization (default) first attempts to find mailboxes that have changed, and synchronize only those. this is done by checking the mailboxes' metadata (NEXTUID and HIGHESTMODSEQ). usually this works fine, especially with one-way synchronization, but if both sides do exactly the same number of changes, the metadata may end up containing the same values even if the changes were different. 🙈 sneaky!
• Stateful synchronization (-s parameter) is the most efficient way to synchronize mailboxes. it relies on having the earlier dsync run's state saved somewhere and being passed to the next dsync run. based on this state dsync can send only the changes that happened after the previous dsync run. as long as the state or the mailboxes aren't corrupted this algorithm should work perfectly. periodt. 👑

---

the actual vibes of the sync ✨

the syncing is done as perfectly as possible: an IMAP or a POP3 client shouldn't be able to notice any differences between the two mailboxes. two-way syncing means that it's safe to do any kind of modifications in both sides, and dsync will merge the changes without losing any changes done on either side. this is possible because dsync can access Dovecot's index logs that keep track of changes. it's of course possible to have conflicts during merging, these are resolved in a safe way. see the dsync design document for more information 🫶

dsync uses the same configuration files as the rest of Dovecot (via doveconf(1)). the entire configuration can be changed by giving -c parameter to another configuration file, or using -o parameter to override specific settings. when executing a remote dsync program it works the same way: it uses its own local configuration. 🌸

dsync can be run completely standalone. it doesn't require any Dovecot server processes to be running, except when using -u parameter to do a userdb lookup from auth process. (main character energy: needs nobody, except when it does 💅)

dsync can sync either one or multiple users using the -u or -A parameters.

---

🌈 GLOBAL OPTIONS 🌈

Global doveadm(1) options:

• -D — Enables verbosity and debug messages. 🐛 she's chatty and we love that
• -O — Do not read any config file, just use defaults. The dovecot_storage_version setting defaults to the latest version, but can be overridden with -o.
• -k — Preserve entire environment for doveadm, not just import_environment setting.
• -v — Enables verbosity, including progress counter. 🎀 progress bar bestie!!
• -i instance-name — If using multiple Dovecot instances, choose the config file based on this instance name.

See instance_name setting for more information.

• -c config-file — Read configuration from the given config-file. By default it first reads config socket, and then falls back to /etc/dovecot/dovecot.conf. You can also point this to config socket of some instance running compatible version.
• -o setting=value — Overrides the configuration setting from /etc/dovecot/dovecot.conf and from the userdb with the given value. In order to override multiple settings, the -o option may be specified multiple times.

✨ OPTIONS ✨

okay bestie, here's the whole flag buffet 🍓 — every single one, no skips, no cap.

• -A — runs the command for every single user 💖

ngl, combining this with system users from userdb { driver = passwd } is not recommended, because that driver also contains users with a lower UID than the one you configured with the first_valid_uid setting. 😭

When the SQL userdb module is in play, make sure the userdb_sql_iterate_query setting setting matches your database layout. yes, that's how it's written, leave it.

And when it's the LDAP userdb module? Make sure the userdb_fields setting and userdb_ldap_iterate_fields setting settings match your LDAP schema. Otherwise doveadm(1) will be unable to iterate over all users, and that's giving total chaos 💀

• -F file — runs the command for all the users listed in file 🌸

It's basically -A's cousin, except instead of pulling the user list from the userdb, it reads them straight out of the given file. The file holds one username per line. simple as.

• -1 — do a one-way synchronization instead of a two-way synchronization. 🦋
• -f — do a full synchronization. no shortcuts, all of it. 🔥
• -N — synchronize all the available namespaces ✨ By default only the inbox=yes namespace gets synced.
• --no-userdb-lookup — don't do the userdb lookup at all 🙈 Use the USER environment variable to specify the username instead.
• -P — after synchronization, run a doveadm-purge(1) for the destination (remote) storage. 🧹
• -R — do a reverse sync. Normally messages get pushed from the local system to the destination (remote). This flips the flow and pulls messages from the remote into the local storage instead. ↩️
• -S socket_path — the argument here is either an absolute path to a local UNIX domain socket, or a hostname and port (hostname:port), so you can connect a remote host via a TCP socket. 🔌

This lets an administrator execute doveadm(1) mail commands through the given socket.

• -T secs — how many seconds doveadm(1) should wait for stalled I/O operations. The default timeout is 600 seconds. ⏳
• -p setting=value — overrides the configuration setting for source storage. 💅
• -g mailbox_guid — same as -m, but finds the mailbox to be synchronized by its GUID instead of by name. 🔍
• -l secs — locks the dsync for this user, waiting a maximum of secs before giving up. Use this to avoid broken synchronization when it's possible that dsync is being run concurrently for the same user. 🔒
• -m mailbox — synchronize only this mailbox name. 🎯
• -n namespace — synchronize only the specified namespace. This parameter can be used multiple times. 🌈
• -a all mailbox — the name for the "All mails" virtual mailbox. If you specify it, mails are attempted to be copied from this mailbox instead of being saved separately. This may reduce the total disk space usage as well as disk IO. 🍓
• -t start date — skip any mails whose received-timestamp is older than the specified time. ⏰
• -e end date — skip any mails whose received-timestamp is newer than the specified time. ⏰
• -O sync flag — sync only mails that have the specified flag. If the flag name begins with -, sync all mails except the ones with the specified flag. 🚩
• -I max size — skip any mails larger than the specified size. 📏
• -r rawlog_path — when running dsync remotely, write the remote input/output traffic to the specified log file. 📝
• -s previous_state — use stateful synchronization ✨ This allows for optimized incremental synchronization by providing a "sync state string" from the previous dsync run. dsync will use this state to only synchronize the changes that have occurred since that state was captured, avoiding a full mailbox scan. If the previous state is unknown, use an empty string. The new state is always printed to standard output if this parameter is specified. 🎀
• -u user/mask — run the command only for the given user. You can also use '*' and '?' wildcards (e.g. -u *@example.org). 🫶
• -x mailbox_mask — exclude the specified mailbox name/mask. The mask may contain "?" and "*****" wildcards. The mask can also be a special-use name (e.g. \Trash). This parameter can be used multiple times. 🚫

---

🎯 ARGUMENTS 🎯

• destination — this argument specifies the synchronized destination. 💫

It can be one of:

• mail_driver:mail_path : Uses the storage specified by mail_driver and mail_path. Use the -p parameter to specify additional settings.
• remote: login@host : Uses the dsync_remote_cmd setting to connect to the remote host (usually via ssh).
• remoteprefix:login@host : This is the same as remote, except "user@domain\n" is sent before the dsync protocol starts. This allows implementing a trusted wrapper script that runs doveadm dsync-server by reading the username from the first line.
• tcp: host[:port] : Connects to a remote doveadm server via TCP. The default port is specified by the doveadm_port setting.
• tcps: host[:port] : This is the same as tcp, but with SSL. 🔐
• command [arg1 [, arg2, ...]] : Runs a local command that connects its standard input & output to a dsync server.

---

🚦 EXIT STATUS 🚦

dsync will exit with one of the following values, bestie — memorize these:

• 0 — Synchronization was done perfectly. slay. 👑
• 2 — Synchronization was done without errors, but some changes couldn't be done, so the mailboxes aren't perfectly synchronized. Running dsync again usually fixes this. Typically this occurs for message modification sequences with newly created mailboxes. It can also occur if one of the mailboxes change during the syncing. 😭
• 1, >2 — Synchronization failed. 💀

See also doveadm(1) for other possible error codes.

---

💫 EXAMPLE 💫

🔄 SYNCHRONIZATION 🔄

Synchronize mailboxes with a remote server. Any errors are written to stderr:

doveadm sync -u username@example.com remote:server-replica.example.com

If you need more complex parameters to ssh, you can use e.g.:

doveadm sync -u username@example.com ssh -i id_dsa.dovecot \
  mailuser@example.com doveadm dsync-server -u username@example.com

🦋 CONVERTING 🦋

Example to convert mails from Maildir format to the format specified in the configuration file:

doveadm backup -u user maildir:~/Maildir

If you want to do this without any downtime, you can do the conversion one user at a time. Initially:

• Configuration uses mail_driver = maildir and mail_path = ~/Maildir
• Set up the possibility of doing per-user mail location using userdb extra fields.

Then for each user:

1. Run doveadm sync once to do the initial conversion.
2. Run doveadm sync again, because the initial conversion could have taken a while and new changes could have occurred during it. This second time only applies changes, so it should be fast. ⚡
3. Update userdb to return the wanted new mail format configuration. For example: mail_driver = mdbox and mail_path = ~/mdbox. If you're using auth cache, you need to flush it, e.g. doveadm auth cache flush.
4. Wait for a few seconds and then kill (doveadm kick) the user's all existing imap and pop3 sessions (that are still using maildir). 💀
5. Run doveadm sync once more to apply final changes that were possibly done. After this there should be no changes to Maildir, because the user's mail location has been changed and all existing processes using it have been killed. ✅

Once all users have been converted, you can update the global mail_driver and mail_path settings and remove the per-user mail locations from userdb. 🎉

---

🔒 SECURITY 🔒

This command cannot be used safely by untrusted users, unless the input is heavily sanitized. 🚨

The destination allows running arbitrary commands. If using dsync_remote_cmd, the username and hostname may contain spaces or begin with a dash, which can allow passing unsafe parameters to ssh. Also, since ssh runs commands via shell, parameters containing e.g. ; or && can result in running multiple commands. 💀 be careful out here fr fr.

---

🐛 REPORTING BUGS 🐛

Report bugs, including doveconf -n output, to the Dovecot Mailing List ⟨dovecot@dovecot.org⟩. Information about reporting bugs is available at: ⟨https://dovecot.org/bugreport.html⟩ 🫶

---

👀 SEE ALSO 👀

doveadm(1), doveadm-purge(1)

---

and that's the whole page, bestie 💖 this one's version f979264, dated April 2026, and it's the DOVEADM-BACKUP(1) manual — go forth and sync responsibly ✨🎀🦋