Safely Move or Copy Dovecot Mail with doveadm

You will move or copy messages matching a Dovecot search query into an existing mailbox, for one user or a controlled list of users. The examples use Dovecot 2.3.21+dfsg1-2ubuntu6.5 from the Debian package dovecot-core installed on this machine. Allow about fifteen minutes, plus time to confirm the query against the right account.

These commands change mailbox state. A move removes each matching message from its source mailbox after placing it in the destination. A copy leaves the source message in place. You normally need the privileges and Dovecot administration access appropriate to the deployment, so use an administrative shell where your installation requires it.

1. Confirm the installed command and destination

Check the binary and package before relying on examples from a different Dovecot release:

$ command -v doveadm
/usr/bin/doveadm
$ dpkg-query -W -f='${Package} ${Version}\n' dovecot-core
dovecot-core 1:2.3.21+dfsg1-2ubuntu6.5

The destination mailbox must already exist. Check the account's mailbox list without changing anything:

$ doveadm mailbox list -u [email protected]
INBOX
Archive/2026

Replace [email protected] and Archive/2026 with real values. Mailbox names are not inferred from the destination argument. If the destination is missing, the move or copy fails. Create a mailbox separately only after reviewing your site's mailbox policy.

2. Preview the match with a read-only search

Use doveadm search with the same user and query you intend to change. This lists matching mailbox GUIDs and message UIDs without moving or copying messages:

$ doveadm search -u [email protected] mailbox INBOX BEFORE 2026-10-01 SINCE 2026-09-01

The output is data for the messages that match. An empty result means the filter found nothing; it is not a reason to broaden the query casually. Search keys are case-insensitive. Multiple keys are combined with AND by default, so the example selects messages in INBOX whose internal date is from 1 September 2026 through 30 September 2026.

Dates and date semantics belong to the installed doveadm-search-query(7) interface. If the boundary matters, test a small known set first and inspect the returned UIDs. Parentheses used with OR may need shell escaping.

3. Move messages for one user

After checking the preview, run the same query with move and the destination before the query:

$ doveadm move -u [email protected] Archive/2026 mailbox INBOX BEFORE 2026-10-01 SINCE 2026-09-01
$ printf 'exit status: %s\n' "$?"
exit status: 0

A successful command normally returns to the shell without a message. The status check must run immediately afterwards. Status 0 means the command completed successfully; it is not a substitute for checking the destination and source mailboxes.

This is a destructive mailbox operation. There is no general inverse that can reliably restore the original message placement after later mail activity. If the selection is wrong, stop immediately, preserve the command and logs, and use your Dovecot backup or restore procedure. Do not run a guessed reverse move.

4. Copy instead when the source must remain

The copy command has the same argument shape, but copied messages are not expunged from the source:

$ doveadm copy -u [email protected] Archive/2026 mailbox INBOX BEFORE 2026-10-01 SINCE 2026-09-01
$ printf 'exit status: %s\n' "$?"
exit status: 0

Copy is the safer first test when you need to validate a destination, a filter, or a downstream workflow. It can still create duplicates in the destination if you repeat it, so treat a successful copy as a state change. Recovery is to remove only the known copied messages using a separately verified selection, or restore from backup; do not delete the whole destination mailbox.

5. Target several users deliberately

Use -u with a user or wildcard mask when the scope is explicit:

$ doveadm copy -u '*@example.org' Archive/2026 mailbox INBOX FLAGGED
$ printf 'exit status: %s\n' "$?"
exit status: 0

Keep the wildcard quoted so the shell does not expand it against local file names. For a fixed batch, -F reads one username per line:

$ sed -n '1,5p' /secure/path/users.txt
[email protected]
[email protected]
$ doveadm copy -F /secure/path/users.txt Archive/2026 mailbox INBOX FLAGGED

Review the file immediately before running the command. The -A option iterates all users found in the configured user databases and can include system users when a passwd user database is in use. That is a broad administrative action. For SQL or LDAP, iteration settings must match the user database or some users may not be visited. Prefer an explicit file when you need an auditable scope.

6. Use a source user only when the identity boundary is valid

The optional form user SOURCE_USER applies the query to the source user's mail location. For example:

$ doveadm copy -u [email protected] Archive/2026 user [email protected] mailbox INBOX ALL

The installed manual documents a limitation: the user selected by -u and SOURCE_USER must currently share the same UID and GID. Do not assume that two addresses are interchangeable. Confirm the account mapping and access policy first, especially when moving between tenants or namespaces.

7. Verify the result

Run a read-only status check for both mailboxes using the same user:

$ doveadm mailbox status -u [email protected] messages unseen INBOX Archive/2026
INBOX messages=...
Archive/2026 messages=...

The exact counts depend on the mailbox at the time of the check. For a move, repeat the original search against INBOX and confirm that the intended matches are gone. For a copy, confirm that the source still contains them and that the destination contains the expected increase. If another delivery or client action is running, counts can change while you verify them.

Add -v when you need progress output. Add -D only when diagnosing a failure and handle its output as operational data. The -S option selects a local UNIX socket or a remote hostname:port; use it only when your Dovecot administration design requires that connection.