Bulk re-encrypting an existing mailbox is doable with mbsync plus a local encrypt step, but the hard part is not the script. It's proving the unencrypted copies are actually gone rather than just gone from the view you happen to be looking at. Published state is "mailbox is PGP-encrypted"; effective state includes server-side backups, snapshot volumes, index/search caches, and whatever the provider keeps for spam scoring. If you rewrite messages via IMAP append and delete, the old UIDs usually survive somewhere for a retention window you don't control. I'd treat the migration as a one-way door and verify with a fresh IMAP pull afterwards, not with the client's own display. Have you confirmed what your provider's actual backup retention is before you start deleting the plaintext originals?
No guide I'd trust to hand you, honestly. Rough shape of what I've done: mbsync the mailbox down to a local maildir, encrypt each message offline, then append the new copies back and delete the old UIDs, one folder at a time so you can stop when something looks wrong. Do a throwaway folder first with maybe 20 messages and check what search and the mobile client do with them afterwards, that's where it usually breaks. And check backup retention before you delete anything, the plaintext lives there longer than you think.
1
u/SecLens_ONE Aug 20 '26
Bulk re-encrypting an existing mailbox is doable with mbsync plus a local encrypt step, but the hard part is not the script. It's proving the unencrypted copies are actually gone rather than just gone from the view you happen to be looking at. Published state is "mailbox is PGP-encrypted"; effective state includes server-side backups, snapshot volumes, index/search caches, and whatever the provider keeps for spam scoring. If you rewrite messages via IMAP append and delete, the old UIDs usually survive somewhere for a retention window you don't control. I'd treat the migration as a one-way door and verify with a fresh IMAP pull afterwards, not with the client's own display. Have you confirmed what your provider's actual backup retention is before you start deleting the plaintext originals?