Lazy Expunge Plugin (lazy-expunge)

The lazy expunge plugin provides a "second-chance" to recover messages that would otherwise be deleted from a mailbox by user action.

It does this by moving the message to a defined location (either a mailbox, or a namespace -- see below for further details) when a user deletes the message from a mailbox.

This behavior is useful for a variety of reasons:

1. Protect against misconfigured clients (e.g. POP3 client that deletes all messages)
2. Protect against accidental deletion (user error)
3. Archiving

Generally, lazy-expunge is configured so that the expunged mails are not counted in the user's quota. Unless being used for archiving, autoexpunge should be used to prune the mailbox to control storage usage.

Settings

lazy_expunge_mailbox

Default	[None]
Value	string
See Also	lazy-expunge storage locations

The mailbox to move messages to when expunged. This setting MUST be defined or else lazy-expunge plugin will not be active.

lazy_expunge_mailbox = .EXPUNGED
namespace inbox {
  mailbox Drafts {
    lazy_expunge_mailbox =
  }
  namespace "External accounts" {
    lazy_expunge_mailbox =
  }
}

lazy_expunge_only_last_instance

Default	no
Value	boolean

If yes, only move to expunged storage if this is the last copy of the message in the user's account. This prevents the same mail from being duplicated in the lazy-expunge folder as the mail becomes expunged from all the folders it existed in.

This setting prevents copying mail to the lazy-expunge folder when using the IMAP MOVE command. When using COPY/EXPUNGE, this setting prevents duplicates only with the following mailbox formats:

• Maildir (with maildir_copy_with_hardlinks = yes, which is the default)
• sdbox/mdbox

Configuration

Storage Locations

Mailbox

Messages that are expunged are moved to a single mailbox.

This is the simplest configuration. The mailbox is created automatically.

You probably also want to hide it with an ACL from the user, if recovery is only expected to be an action performed by an admin/operator.

To move to a mailbox, do NOT add a trailing delimiter to the lazy_expunge_mailbox setting.

Example Configuration

dovecot.conf

namespace inbox {
  mailbox .EXPUNGED {
    autoexpunge = 7days
    autoexpunge_max_mails = 100000

    # Define ACL so that user cannot list the .EXPUNGED mailbox
    acl owner {
      rights = rwstipekxa
    }
  }
}

mail_plugins {
  lazy_expunge = yes
  acl = yes
}
acl_driver = vfile

# Move messages to an .EXPUNGED mailbox
lazy_expunge_mailbox = .EXPUNGED

mailbox .EXPUNGED {
  # Expunged messages most likely don't want to be included in quota:
  quota_ignore = yes
}

You could also leave the permissions empty if you don't want to allow clients to access it at all.

Copy Only the Last Instance

If a mail has multiple copies within a user account, each copy is normally moved to the lazy expunge storage when it's expunged.

Example: this may happen when moving a message to Trash, as clients can issue IMAP COPY command to copy the message to Trash before expunging the message from the original mailbox. Deleting later from Trash would result in two copies of the same message in the lazy expunge storage.

You can enable lazy_expunge_only_last_instance to copy only the last instance to the expunge storage. This ensures that only a single copy of a message will appear in the expunge storage.

WARNING

This feature only works with certain storage setups. See lazy_expunge_only_last_instance for further information.

Quota

Generally, it is desired that messages in expunge storage are NOT counted towards user quota, as the messages seen by the user will not match-up with the size of the quota otherwise (especially if expunge storage is hidden from users via ACL).

Example to exclude expunged storage from the quota:

quota "User quota" {
  quota_storage_size = 1GB
}
mailbox .EXPUNGED {
  # Exclude .EXPUNGED mailbox from the quota
  quota_ignore = yes
}

See quota plugin.

Cleaning Up

Doveadm

Doveadm can be used to manually clean expunge storage.

Example to delete all messages in .EXPUNGED namespace older than one day:

doveadm expunge mailbox '.EXPUNGED/*' savedsince 1d

Autoexpunge

Set autoexpunge configuration for expunge storage to automatically clean old messages.

See Namespaces.