Self-Hosted Mail-Archiver: M365, IMAP, Search, and Compliance Exports

Legal asks for every email with a vendor from 2019. The live mailbox holds ninety days. Someone exported PSTs once, but nobody trusts the folder names. You need search across accounts, attachments intact, and an audit trail that says who opened what.

Mail-Archiver (~2.2k GitHub stars, GPL-3.0, C#) is a self-hosted web app for exactly that: sync mail from multiple sources into Postgres-backed storage, search and preview in a dashboard, export mbox or zipped EML, and optional compliance knobs like deletion lock and access logs. Docs live at mail-archiver.org and the GitHub Pages index.

What it does

• Scheduled sync from IMAP, Microsoft 365 (Graph), personal Microsoft accounts (Outlook.com with a shared OAuth client), and import-only accounts for existing archives.
• M365 tenant import — bulk pull mailboxes from a tenant, skip disabled accounts, pick all or selected users.
• Search and preview — filters, attachments, optional storage of full raw .eml for DKIM and forensics.
• Export and migration — mbox/EML export; mailbox-to-mailbox copy with folder structure preserved; mbox and ZIP EML import.
• Retention — delete from the mail server after N days while keeping local archive rules separate; local retention jobs still run even when manual delete is locked.
• Multi-user — per-account permissions, OIDC SSO, dashboard stats, detailed access logging (logins, searches, exports).
• Integrations — read-only REST API v1 with scoped API keys; optional MCP server at /mcp for AI agents (search_emails, get_email, etc.) without handing agents live IMAP passwords.

UI ships in 14 languages with dark mode. The app listens on HTTP port 5000 inside Docker; you terminate TLS at nginx or Caddy, which upstream explicitly requires.

Why self-host?

Archive under your policy. Retention, export, and "no one deletes evidence" settings live on your VM, not a SaaS archive whose contract changed mid-audit.

Microsoft-heavy shops. Graph and tenant-wide import are first-class. That is a different sweet spot from pure IMAP archivers (we covered Rust Bichon for embedded IMAP search and dedupe without Postgres).

API and MCP without exposing mail credentials. Scripts and agents read the archive through keys scoped to users, not shared mailbox passwords on every laptop.

Canadian hosting. Beauharnois or Toronto VPS plus nightly Postgres backups gives a clear answer when privacy reviews ask where archived mail and access logs reside.

GPL-3.0. Fine for internal compliance archives; read license obligations if you offer Mail-Archiver as a multi-tenant service to outsiders.

Quick Docker start

services:
  mailarchive-app:
    image: s1t5/mailarchiver:latest
    restart: always
    environment:
      - ConnectionStrings__DefaultConnection=Host=postgres;Database=MailArchiver;Username=mailuser;Password=CHANGE_ME;
      - Authentication__Username=admin
      - Authentication__Password=CHANGE_ME_TOO
      - TimeZone__DisplayTimeZoneId=America/Edmonton
    ports:
      - "5000:5000"
    volumes:
      - ./data-protection-keys:/app/DataProtection-Keys
    depends_on:
      postgres:
        condition: service_healthy

  postgres:
    image: postgres:17-alpine
    environment:
      POSTGRES_DB: MailArchiver
      POSTGRES_USER: mailuser
      POSTGRES_PASSWORD: CHANGE_ME
    volumes:
      - ./postgres-data:/var/lib/postgresql/data

docker compose up -d, put HTTPS in front, change defaults, add accounts under Email Accounts, assign users if needed. Back up Postgres and attachment storage per the project's backup guide.

Who it's for (and who should skip it)

Good fit: SMBs and MSPs archiving order@-style mailboxes alongside M365; compliance-minded teams wanting access logs and deletion lock; shops experimenting with MCP over a read-only mail corpus.

Skip it: if you only need live webmail (use your provider); if disk and Postgres ops are non-starters; if you wanted a minimal single-binary IMAP vault with no Microsoft story (see Bichon).

Hosting in Canada

Mail-Archiver is Postgres plus growing blob storage for messages and attachments. Plan disk growth, encrypt backups, and firewall the app behind TLS-only access.

Talk with Swift Host for VPS sizing, reverse proxy setup, and backup scope for Mail-Archiver on Canadian infrastructure. We are in St. Albert and actually answer the phone.