Module 4 · 4.2

English ▾

Nederlands English Deutsch Français Español

Copying mailboxes with IMAP

Module 4: Moving email · Reading time: 11 minutes

Learning objective: After this lesson you can copy a mailbox from Google or Microsoft to a European mailbox, you know why you need OAuth or an app password to do so, and you can estimate how long it takes and what doesn't come along.

Key concepts: IMAP migration, copying (not moving), imapsync, OAuth 2.0, basic authentication, app password, Gmail labels, repeated synchronisation (delta), mbox, pst file

Copying, not moving

An email move with IMAP works like a removal firm working with two keys: one for your old mailbox and one for your new one. It logs in to both, goes through your old mailbox folder by folder, and places each message in the same folder in your new mailbox. Nothing changes in your old mailbox.

That has two big advantages:

Nothing gets lost. If something goes wrong, everything is still with the old provider.
You can repeat it. A good migration tool recognises messages that have already been copied and skips them. If you run the copy again a day later, only the new messages are added. That's called a delta synchronisation, and you need it during the transition period (lesson 4.4).

The best-known programme for this is imapsync, open source and used by many providers behind their own migration tool. You don't need to install it yourself: most mail providers have a migration tool in their panel that does it for you.

What you arrange beforehand

Create the new mailboxes, with the same addresses as now. For Bakkerij De Korrel that's twelve personal mailboxes, plus info@ and bestellingen@.
Check the storage. Check how big each old mailbox is (module 3, lesson 3.2) and make sure the new mailbox is at least as big, with some extra room. If the new mailbox fills up, the copy stops.
Tidy up. You don't need to move anything you don't want to keep. Deleting a folder with ten years of newsletters saves hours.
Arrange access to the old mailbox. That's the trickiest part with Google and Microsoft, see below.
Look up the server name of the old IMAP server. For Gmail that's imap.gmail.com, for Microsoft 365 and Outlook.com it's outlook.office365.com. Migration tools fill these in automatically for well-known providers.

Logging in to Google and Microsoft: why your password no longer works

In the past, a migration tool simply logged in with your email address and password. That's called basic authentication. Because passwords often leak, the big providers have shut that down.

Microsoft has switched off basic authentication for IMAP and POP in Exchange Online (Microsoft 365) from October 2022, and for personal Outlook.com accounts in September 2024. A migration tool therefore needs to log in via OAuth 2.0: you log in yourself on a Microsoft page, give the tool permission, and the tool receives a temporary key (a token) instead of your password. Your password never reaches the tool.

In a business Microsoft 365 environment, the administrator may have set things up so that users can't give permission to external apps themselves. In that case, the administrator has to approve the migration tool first in the admin centre. Plan that in advance, because that's often the person who's just gone on holiday.

Google has also stopped accepting ordinary passwords for IMAP in Google Workspace since 30 September 2024 (for personal Gmail accounts this was already the case earlier). If the migration tool can't do OAuth with Google, you use an app password: a separate 16-character password that's only for that one connection. You can only create an app password if two-factor authentication is switched on for the Google account. In Google Workspace, the administrator may also have disabled app passwords.

After the move, revoke the app password, or revoke the permission for the migration tool. Don't leave any open doors behind.

Gmail labels become folders

Gmail doesn't have folders but labels. One message can have several labels. Via IMAP, Gmail shows each label as a folder, plus a few special folders such as [Gmail]/All Mail (or [Gmail]/Alle berichten), [Gmail]/Sent Mail and [Gmail]/Spam.

The consequence for a copy:

A message with two labels ends up in two folders after the move, as two copies. Your mailbox can therefore become bigger than it was in Gmail.
The All Mail folder contains everything again. Good migration tools skip it or only copy what isn't stored anywhere else. Check the review step to see which folders are included.
Archived mail (without a label) only appears in All Mail. If you skip that folder entirely, you'll miss those messages. The easiest approach is to give archived mail in Gmail an "Archive" label beforehand.

Microsoft 365 has ordinary folders, but also folders that aren't mail: Calendar, Contacts, Tasks, Notes. Via IMAP you sometimes see these as empty or odd-looking folders. Migration tools usually skip them. You move the contents separately (module 5).

How long does it take?

That mainly depends on the number of messages and the size of the attachments, and on how quickly the old provider lets you retrieve them. Google and Microsoft throttle large amounts of IMAP traffic. A small mailbox is done in minutes, a mailbox of tens of gigabytes can take a day or longer. That's why you start the first copy well ahead of the switchover, while everyone just keeps working in the old mailbox.

For Bakkerij De Korrel that means: the first copy of all mailboxes on Monday, the DNS switch on Wednesday evening (lesson 4.3), and another delta copy on Thursday and again a week later.

When IMAP isn't possible

Sometimes IMAP doesn't work, for example because the administrator of the old environment won't give permission or has already left. Then there are two ways out:

An export. Classic Outlook can export a mailbox as a pst file. Google Takeout delivers your mail as an mbox file. You then import such a file with a mail program such as Thunderbird (which has an import function) into your new IMAP mailbox, or your provider helps you with it. That's more work and less tidy: folder structure and read/unread status don't always come across properly.
Via your mail program. Put the old and new account side by side in a mail program and drag the folders across. Fine for a small mailbox, unwieldy for twelve staff members.

An export is also a sensible backup to make just before you cancel your old subscription (lesson 4.4 and module 8).

In practice: what it looks like with a provider

In My WebOké, the migration tool is called Email migration (under My Products). It has five steps: Source, Destination, Review, Migrate and Done. At Source you choose the old provider. If you choose Outlook, Hotmail or Live, or enter outlook.office365.com as the server, the Sign in with Microsoft button appears: you get a code, log in at Microsoft and accept. If you choose Gmail, the tool asks for an app password and adds a link to the right Google page. At Review you see how many messages and folders were found, and which folders aren't included because they are calendar or contact folders. The move continues on the server if you close the page, and a repeated move skips messages that are already there. In DirectAdmin there's also IMAPSync Migrations, which only works with a password and therefore not with the Microsoft login.

Other European providers have similar migration tools, sometimes under names such as "import mail" or "IMAP import". For any tool, watch out for three things: can it do OAuth with Microsoft and Google, can it run repeatedly without duplicating, and does it show you what doesn't come along.

Summary

An IMAP move copies; your old mailbox stays unchanged, and you can repeat the copy without duplicates.
Microsoft no longer accepts passwords for IMAP: log in with OAuth, possibly after approval by the administrator. With Google you use OAuth or an app password (with two-factor authentication).
Gmail labels become folders; a message with two labels appears twice after the copy, and archived mail only appears in All Mail.
Start the first copy well ahead of the DNS switch; large mailboxes can take a day.
If IMAP doesn't work, a pst or mbox export is the way out. Afterwards, revoke app passwords and permissions.

Quiz

1. What happens to the old mailbox during an IMAP move? It gets emptied
It stays unchanged; the messages are copied
It gets automatically cancelled
It gets a forward set up to the new mailbox

An IMAP move copies. That means you can test safely and copy again later.

2. Why doesn't the ordinary password of a Microsoft 365 mailbox work in a migration tool? Because Microsoft doesn't support IMAP
Because the password is too short
Because Microsoft has switched off basic authentication for IMAP and requires OAuth
Because the MX records haven't been changed yet

Since October 2022, IMAP for Exchange Online only works with modern authentication (OAuth). You log in at Microsoft yourself and give the tool permission.

3. A message in Gmail has the labels "Customers" and "2025". What do you see after an IMAP move? The message is only in Customers
The labels become tags in the new mailbox
The message gets lost
The message is in Customers and in 2025, as two copies

Gmail shows labels via IMAP as folders. A message with two labels therefore ends up in two folders.

4. The bakery switches the MX on Wednesday. Mail still arrived at Microsoft between the first copy (Monday) and the switch. What do you do? Run the move again on Thursday; messages that are already there get skipped
Nothing, that mail comes across automatically
Empty all mailboxes and start again
Switch the MX back

A repeated (delta) copy only fetches the new messages. That's why you run it after the switch, and again a week later.

5. The administrator of the old Microsoft 365 environment doesn't allow external apps and can't be reached. What's a realistic way out? Ask all staff members for their passwords
Make a pst export per mailbox in classic Outlook and import it
Switch basic authentication back on yourself
Leave the mail where it is and start again

A pst export (or mbox from Google Takeout) is more work, but works without the administrator's permission for an external app.

Exercise

Exercise A4.2: Check the servers of your new provider. Enter the IMAP and SMTP server name that your new (or intended) mail provider gives you. The tool checks whether IMAP on port 993 and SMTP on port 587 or 465 are reachable, whether the certificate is valid for that name and not about to expire, and whether your domain has records that let mail programs find the settings themselves.

Exercise A4.2: Check the servers of your new provider

Fill in the IMAP and SMTP server of your new provider (you'll find these in the provider's documentation). The program looks up the addresses and, if the mail port check is enabled, makes a secure connection (IMAP 993, SMTP 465 or 587 with STARTTLS) without logging in or sending anything.

IMAP server (for example imap.provider.eu)

SMTP server (for example smtp.provider.eu)

Your domain (for findability via SRV/autoconfig) (optional)

What you enter and what we find isn't stored. Your browser remembers your answers and whether you've passed the exercise. If you're signed in, we only save that you got the exercise (almost) right in My courses; you can delete that there too.

Exercise E4.2: Trial migration of one mailbox. Move one mailbox (your own, or a test mailbox) with a migration tool. Note the login method, the number of messages and folders before and after, which folders didn't come along, and how long it took. Afterwards, revoke the app password or the permission.

Exercise E4.2: Trial migration of one mailbox

Copy one mailbox (your own or a test mailbox) to the new provider with a migration tool, and then do it again (delta).

The new mailbox is big enough.
I tidied up beforehand.
With Gmail: archived mail came across too.
I revoked the permission or app password afterwards.

Which migration tool, and how do you log in at the old provider (OAuth / app password / password)?

Number of messages and folders before and after; which folders didn't come across, and why?

Duration of the first and second copy; did anything end up duplicated in the second copy?

Also save my answers in My courses (so you can view and download them on any device). Don't include any passwords or other secrets.

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing