Mailboxes grow forever unless someone decides otherwise. Big mailboxes slow down mail apps, fill quotas and make backups and migrations painful, while some mail must be kept for legal reasons. An email retention and archiving policy solves both sides. This guide shows how to plan one.
Before you start
Find out what you are legally required to keep (for example invoices and contracts often have fixed retention periods depending on your country) and what you must not keep longer than necessary under privacy laws such as GDPR. If in doubt, ask your accountant or legal adviser.
Archive vs backup
| Backup | Archive | |
|---|---|---|
| Purpose | Recover from loss or damage | Long-term retention and search |
| Retention | Days to weeks, rotating | Years, per policy |
| Mailbox stays… | Unchanged | Smaller (old mail moved out) |
| Example | Daily JetBackup snapshots on MdmHost | Exported yearly folders, archive mailbox |
Write a simple retention policy
- Trash and Junk: delete automatically after 30 days.
- General mail: keep in the mailbox for 1–2 years.
- Business records: move to an archive and keep for the legally required period.
- Personal data: delete when no longer needed.
- Leavers: export or convert the mailbox to a shared archive, then remove the account.
Auto-clean Trash and Junk
- Dovecot (self-managed): schedule
doveadm expunge -A mailbox Trash savedbefore 30dand the same for Junk with cron. - cPanel: many mail apps and Roundcube can empty Trash on logout; server-side, cPanel offers automatic deletion of old Trash/Spam for accounts in recent versions under email account settings, depending on configuration.
Archive old mail
- Archive folders: mail apps such as Thunderbird and Outlook can move mail older than X into yearly archive folders.
- Local export: export old folders to files (MBOX, PST) stored with your backups.
- Separate archive mailbox: move old mail into a dedicated archive account using IMAP or
imapsync. - Dedicated archiving services: journal copies of all mail with search and legal hold, useful for regulated businesses.
Keep quotas healthy
- Large attachments use the most space – share files via links instead.
- Check mailbox size in cPanel → Email → Email Accounts or with
doveadm quota get -u user. - Warn users before quotas fill up.
GDPR and privacy
- Keep personal data only as long as necessary for its purpose.
- Document your retention periods.
- Make sure archives and backups are secured and access-controlled.
- Have a process to find and delete personal data on request where required.
FAQ: email archiving and retention
Is a backup enough for compliance?
Usually not. Backups rotate and are hard to search; retention requirements generally need a dedicated archive.
How large should a mailbox be?
Smaller is faster. Many organisations keep active mailboxes under a few gigabytes and archive the rest.
Can I recover mail deleted by an expunge rule?
Only from backups within their retention window – set rules carefully and communicate them to users.