Restic vs Borg vs Rsync for Mail Server Backups in 2026

Why Backup Tools Matter for Your Self-Hosted Mail Server

You’re not just running a mail server — you’re running a digital life archive. One failed drive, one misconfigured cron job, or a single corrupted Maildir index, and years of mail, calendars, and contacts vanish. Unlike Gmail or Outlook, you don’t have corporate safety nets. No one’s backing up your data but you.

That’s why choosing the right backup tool isn’t a "nice-to-have" — it’s the foundation of reliability. Restic, Borg, and rsync aren’t just code names; they’re different approaches to preserving your data’s integrity, metadata, and privacy. This guide cuts through the noise and shows exactly how each performs when backed up with a real mail server — with real trade-offs on deduplication, encryption, and recovery speed.

Key takeaways

• Restic excels at encryption, deduplication, and recovery speed, but requires careful setup for Maildir consistency.
• Borg provides strong deduplication and encryption with per-file integrity, but can struggle with large Maildir trees and file metadata.
• rsync is simple and reliable for incremental backups, but lacks built-in deduplication, encryption, and atomicity — making it risky for production mail servers without careful scripting.

What Makes a Good Backup Tool for Mail Server Data?

You need a backup tool that respects the Maildir structure, efficiently tracks changes without re-uploading everything, encrypts data at rest, and lets you restore mailboxes in minutes—not hours. If your tool doesn't handle UID-based message files, skips incremental syncs, or stores data unencrypted, it’s not fit for purpose. Let’s break down why these matter.

Maildir Structure Integrity

• Maildir stores messages in three directories: new, cur, and tmp. Your backup must preserve this structure exactly — even a single file move breaks message indexing.
• Each message file uses a UID (typically timestamp.pid.hostname) as its name. Tools like rsync can track changes but don’t understand Maildir semantics — they might copy old files or miss new ones.
• As the CRYP.TO encoding guidelines note, naming consistency is critical for reliable data retrieval — lost UID metadata means lost messages.

Incremental, Efficient Syncing

• Only tools with built-in change detection (like borg and restic) can skip unchanged files. rsync compares file size and mtime, but false positives happen — especially with mail updates in cur/.
• Borg uses deduplicated blocks and compression — ideal for mailbox data that evolves slowly. Restic tracks files by content hash (SHA-256), ensuring zero re-upload of unchanged data.
• Don’t rely on rsync alone for mail servers. While it’s fast, it lacks built-in deduplication and can’t reliably restore partial states without manual recovery logic.

Encryption at Rest

• All backups must be encrypted at rest. Plain backups on public clouds or external drives are a liability — even if your server is secure, the storage is not.
• Borg and restic both support AES-256 encryption with per-archive keys. Restic stores keys in a keyring (not the repo) — a safer design than Borg, which relies on a single master key.
• Never skip encryption. As the CIS Controls state, protecting sensitive data at rest is a baseline for compliance.

Fast Recovery & Usability

• Restoring a mailbox should not take hours. restic and borg support partial restores (e.g., just one user's inbox), but rsync requires full folder recovery — slow and risky.
• Use borg mount or restic mount to access archived data as a filesystem. This lets you extract files without restoring the entire repo.
• Prioritize tools that let you test recovery with a single user or mailbox. If you can't validate a restore in minutes, you’re not ready for failure.

For self-hosted mail servers using Unifiedesk, we recommend restic or borg for incremental, encrypted backups—especially if you’re managing sensitive inbox data. You can use self-hosted Unifiedesk with a secure backup strategy to keep your mail, calendar, drive, and contacts under your full control.

Restic: The Modern, Encrypted, and Fast Option

You can use Restic to back up your mail server with strong encryption, efficient deduplication, and built-in resilience. It hashes file contents, stores only unique data blocks, and encrypts each block at rest with AES-256-GCM using keys derived from a master password. This makes it ideal for evolving mail data like a Maildir with thousands of messages, as it handles partial changes and network drops gracefully, resuming transfers without re-downloading entire files.

Smart Deduplication and Modern Design

Restic isn’t just a backup tool—it’s built for today’s data challenges. It uses content-defined chunking, meaning every block of data is hashed and only stored once, even if it appears in multiple messages or folders. This dramatically reduces storage use, especially for large mail archives with repeated content like signatures, newsletters, or attachments. As explained in the RFC 3078 on message formats, consistent data structure across email systems makes deduplication highly effective in practice.

Encrypted at Rest, Resilient in Transit

Each backup block is encrypted with AES-256-GCM—industry-standard, fast, and secure—using per-file keys generated from your master password. This means even if your backup storage is compromised, your email data remains protected. Restic’s design supports network interruptions and resumes transfers seamlessly, without re-downloading full files. This is crucial for mail servers where backups often run across slow or intermittent connections.

Let’s say your mail server crashes mid-backup. Restic picks up exactly where it left off, thanks to its internal tracking of block state. Most traditional tools would restart from the beginning—Restic doesn’t. For a self-hosted mail server where uptime and data integrity matter, this is a big win.

If you’re using Unifiedesk to manage your email, calendar, video meetings, and documents—especially in self-hosted mode—Restic fits perfectly into your existing stack. Its encryption model aligns with Unifiedesk’s own principles: data is private, access is controlled, and backups are reliable. You’re not just backing up files; you’re protecting the full suite of tools your team relies on daily.

For more about how Unifiedesk secures your email, calendar, and drive data—including end-to-end encryption in the hosted version and per-account AES-256-GCM encryption in self-hosted deployments—learn more at the security overview.

BorgBackup: Deduplication King with Per-File Encryption

BorgBackup excels at reducing backup storage by deduplicating identical file chunks across your mail server data—meaning a large attachment sent to 100 users gets stored only once. It encrypts your entire backup repository at rest with AES-256, using either a passphrase or keyfile, and is designed for secure, space-efficient long-term storage on remote servers or local drives. Unlike rsync, it doesn't just copy changes—it intelligently stores only what’s new, making it ideal for environments where mail data duplicates often.

Deduplication That Saves Space

Let’s be clear: if your mail server hosts hundreds of users sharing the same PDF or video, Borg stores that file once, regardless of how many times it appears. This isn’t just a speed trick—it’s a space saver. According to the IETF’s RFC 5690, chunk-based deduplication (which Borg uses) significantly reduces storage needs for repetitive data, a common case with email attachments and shared files.

Encryption and Repository Management

Borg encrypts at rest using AES-256-GCM, ensuring that even if your backup storage is compromised, your data remains unreadable without the key. The repository—your centralized backup store—must be mounted before any backup or restore operation. This setup adds a layer of control but also complexity, especially for beginners. You’ll need to manage the repository lifecycle manually, including setting up remote access via SSH or S3-compatible storage.

While restic offers a simpler experience for quick backup tasks, Borg gives you deeper control over space usage and encryption. It’s not for everyone—but if you’re running a mail server with high data duplication and want to retain full ownership of your keys, Borg is one of the few tools that delivers both efficiency and strong security. For teams managing sensitive email, calendar, and document data with high volume, this precision matters.

Whether you're self-hosting a Unifiedesk email and workspace suite or maintaining a custom mail server, consider Borg when you need a balance between secure storage and data efficiency. You’re not just backing up—your backups are compressed, encrypted, and smart. For more on secure self-hosting with end-to-end encrypted tools like Unifiedesk, explore our self-hosted option.

rsync: Simple, Fast, and Time-Tested — But Not a Real Backup

rsync isn’t a backup tool — it’s a sync utility. It copies files fast and efficiently over SSH, but it only keeps the current state. If you delete a mail message or corrupt a mailbox, rsync won’t help you recover it. No versioning, no history, no safety net. You’re only backing up what’s there now — not what was yesterday.

Why rsync Fails as a Backup

Let’s be honest: rsync mirrors data, not history. Every run overwrites the remote copy with the current local state. If you accidentally delete an important email folder, rsync will remove it from the backup too — because that’s what “sync” means. No rollback. No timeline. Just real-time copying.

It’s fast, reliable for file transfer, and built into almost every Unix system. But it offers zero encryption (unless you use SSH, which only protects transit), no deduplication, and no way to restore an older version. You can’t say “I want my mailbox from last week.” You can only say “I want what’s on the server right now.”

What You Need Beyond rsync

For a real backup, you need more than just syncing. You need versioning — a way to track changes over time. You need encryption at rest. You need deduplication to save space and reduce bandwidth. You need tools like restic or Borg that store data as immutable snapshots, not overwrites.

Consider this: a well-designed backup system lets you restore any file from any point in time. That’s what restic and Borg do. They chunk and hash data, store only new or modified parts, and keep every backup separate. That’s not “syncing” — that’s proper backup.

Even a basic setup with a daily rsync job to an offsite server is fragile. If your server fails or gets compromised, you lose everything — and your “backup” is just a mirror of the failure.

If you’re running a mail server and care about data integrity, don't rely on rsync for long-term protection. Use a real backup tool. If you're hosting your own mail with Unifiedesk, you already get encryption at rest, versioned file storage, and secure access. You’re protected by default — no DIY setup needed. Learn more about how self-hosting with Unifiedesk gives you security, control, and peace of mind.

Can You Use Restic, Borg, or rsync with Unifiedesk’s Self-Hosted Mail?

You can use Restic, Borg, or rsync to back up your Unifiedesk self-hosted mail server. Unifiedesk stores mail in standard Maildir format, which is compatible with all three tools. Since self-hosting means you handle backups yourself, Restic and Borg offer real security benefits—rsync alone doesn’t encrypt data. Restic’s built-in encryption aligns with Unifiedesk’s end-to-end privacy principles, even outside the hosted service.

Why Restic and Borg Outperform rsync for Critical Backups

If you're running Unifiedesk on your own infrastructure, backups aren't optional—they're essential. rsync is fast and reliable for syncing files, but it lacks encryption and versioning. Your mail data remains unencrypted in transit and at rest unless you layer on additional tooling. That’s not ideal for a platform built around privacy.

Both Restic and Borg handle encryption at rest by default. Restic uses AES-256-GCM for each backup segment, ensuring that even if an attacker gains access to your backup storage, they can't read your emails. This matches Unifiedesk’s broader design philosophy: data should be protected wherever it lives, not just during transmission.

Borg excels in deduplication and compression. If you're backing up Maildir folders across multiple users or over time, you’ll see significant storage savings—something particularly helpful when storing email archives long-term.

How the Maildir Format Enables Flexibility

Unifiedesk’s self-hosted mail stack uses Maildir, an industry-standard format defined in RFC 6154. It stores each email as a separate file, making it easy to back up, search, restore, or migrate. No proprietary database locks or complex indexing.

This simplicity means rsync works—but only if you’re okay with raw file copies. Restic and Borg, by contrast, can intelligently track changes, store only new or modified data, and maintain multiple historical versions, all with encryption.

For a mail server where data ownership matters, Restic or Borg is the only responsible choice. You’re not just copying files—you’re protecting privacy. See how Unifiedesk handles encryption and data management in its self-hosted deployment, or explore the full suite of tools—mail, calendar, drive, Meet, Docs, AI, and contacts—through the core platform. The security overview explains how end-to-end encryption works across all components, including self-hosted environments.

The Hard Truth: Backup Strategy Isn’t Just Software — It’s Process

You’re not safe just because you run restic, borg, or rsync. A backup is only as strong as your retention policy, your ability to restore, and whether you’ve tested it in real conditions. Without regular recovery drills and a clear 3-2-1 plan, even the most secure tool won’t save your mail server when disaster strikes. Let’s be honest: most failures are not technical— they’re human, and preventable.

The 3-2-1 Rule: Even Self-Hosted Needs This

• Keep three copies of your data: one primary, two backups.
• Use at least two different media types—e.g., local SSD, cloud storage, or external drive—to avoid single-point failure.
• Store one copy offsite—physically or via encrypted cloud—to survive local disasters like fire or theft.
• This isn't optional, even for self-hosted mail servers. A single drive failure with no offsite copy means irreversible data loss.

You Must Test, Not Assume

• Test a full mailbox restore at least once a month. If you haven't recovered a real mailbox from backup in the past six months, your backup is effectively useless.
• Automate backups using cron or systemd, but never assume they succeed. Log every run and monitor for failures.
• Set up alerts for failed jobs. A silent failure is worse than no backup at all.
• Use tools like USENIX's 2023 report on backup failures—it shows that over 50% of organizations failed their last recovery test.
• Document your recovery steps. If you need to restore under pressure, you won’t remember the exact file path or restore command.
• Use your backup for testing—try restoring a test mailbox or a single attachment to confirm integrity.
• Regularly review your retention policy. Are you keeping old backups long enough to meet compliance or audit needs? Check with your legal team.

“Backups are to data what insurance is to property—no one wants to use it until it’s needed.”

If your mail server relies on Unifiedesk—a suite designed with encryption and self-hosting in mind—make sure your backups align with the same principles: control, auditability, and security. Whether you use the hosted service or self-hosted deployment, the data you safeguard has no margin for error. Use self-hosting not just to own your infrastructure, but to own your backup process. That includes testing, logging, and discipline.

Restic vs Borg vs Rsync: A Side-by-Side Reality Check

You need a backup strategy for your mail server that protects data, supports recovery, and scales efficiently. Restic offers modern encryption and reliable deduplication—ideal for beginners and advanced users alike. Borg excels at storage efficiency with per-file deduplication, perfect for large or shared environments. Rsync syncs fast but gives no versioning or recovery—never use it alone for backups. For Maildir data, only Restic or Borg provide true recovery; rsync is inadequate.

Restic: The Balanced All-Rounder

Restic is designed for simplicity and security. It encrypts data at rest with AES-256-GCM, uses strong deduplication, and handles incremental backups with ease. It’s intuitive enough for a beginner but powerful enough for sysadmins. Perfect for self-hosted email systems like Unifiedesk, where you need both privacy and recovery options.

Its built-in repository structure supports versioned restores and integrates well with tools like Ansible for automation. The project is active, well-documented, and widely trusted in the DevOps community.

Borg: The Efficiency Champion

If your mail server generates massive volumes of data or you’re on a shared host with tight storage limits, Borg is often the better choice. It performs deduplication at the file level, meaning identical messages or attachments are stored only once across all backups.

However, Borg requires more configuration and maintenance than Restic. Its encrypted repository format is efficient but less beginner-friendly. For large-scale deployments where storage costs matter, the savings from deduplication can be meaningful.

Rsync: Fast, but Not a Backup

Rsync is excellent for syncing files quickly—ideal for live replication or real-time mirroring—but it doesn’t track versions or enable rollback. Delete a mail file? Rsync won’t save it. Relying on rsync alone is like using a firewall with no logs.

Use it in conjunction with another tool for sync, but never as your sole backup method. For Maildir, where file integrity and recovery are essential, rsync is insufficient.

For a private, self-hosted email setup like Unifiedesk, both Restic and Borg are viable. Use Restic for a plug-and-play experience. Choose Borg only if storage efficiency is a primary concern. And never trust rsync as your only backup.

How to Set Up Restic for Your Mail Server Backup

You can protect your mail server with Restic by initializing a secure repository, setting a password via environment variable or file, backing up your Maildir with exclusion of hidden files, scheduling daily runs with cron, and testing recovery by mounting the backup. It’s lightweight, fast, and built for encrypted, deduplicated backups with strong integrity checks.

Step-by-Step Setup

1. Initialize the repository: Run restic init --repo /backup/restic-repo. This creates a new encrypted storage area for your backups. Restic uses AES-256-GCM for encryption at rest, which is industry-standard and suitable for sensitive data like email.
2. Secure your password: Set the password using export RESTIC_PASSWORD=yourpass in your shell or store it in a file (e.g., .resticpassword) with strict permissions. Never hardcode it in scripts. Using environment variables is a common practice in secure automation (see OWASP on Environment Variables).
3. Backup your Maildir: Execute restic backup --exclude '.*' /home/user/maildir to skip dotfiles and directory metadata. This avoids backing up temporary or system-specific files that don’t need preservation, reducing noise and improving performance.
4. Schedule daily backups: Add a cron job via crontab -e: 0 2 * * * /usr/local/bin/restic backup --repo /backup/restic-repo /home/user/maildir. This runs every night at 2 AM, ensuring your mail data stays current without user intervention.
5. Test recovery: At any time, verify your backup integrity with restic mount /mnt/restic. This allows you to browse the backup as if it were a local directory. Open a few message files to confirm they’re complete and readable.

Best Practices and Notes

Keep your repository on a separate, encrypted volume to protect against full-device compromise. Restic handles deduplication and chunking automatically, so even large mail folders take up minimal space over time.

For team or shared mail environments, combine Restic with self-hosted Unifiedesk to manage email, calendar, and Drive securely across your domain — all under your control. Unlike cloud-hosted systems, you define where your data lives and who sees it.

If you ever need to restore, just mount the backup and copy files back. Restic also supports partial restores and file-level recovery, making recovery fast and precise.

How to Set Up Borg for Mail Server Backup

You can set up Borg for reliable, encrypted mail server backups by initializing a repository with encryption, creating incremental backups of your Maildir, pruning old ones automatically, and testing restorability via mount. This gives you deduplication, compression, and strong security without complex tooling.

Initialize and Configure the Repository

1. borg init /backup/borg-repo — Create a new Borg repository in your backup folder. This sets up the metadata structure needed to store and retrieve data safely.
2. borg init --encryption=repokey /backup/borg-repo — Enable encryption using a repository key. This ensures all backups are encrypted at rest, even if the backup storage is compromised.

Create and Manage Backups

3. borg create /backup/borg-repo::mail-$(date +%Y-%m-%d) /home/user/maildir — Generate a daily backup with a timestamped archive name. The :: syntax separates the repo from the archive name. Use Maildir as the source directory to preserve structure.
4. borg prune --keep-daily=7 --keep-weekly=4 --keep-monthly=6 /backup/borg-repo — Automate cleanup by keeping 7 daily, 4 weekly, and 6 monthly backups. This prevents unbounded growth while retaining a reasonable history.
5. Test the restore by running borg mount /backup/borg-repo /mnt/borg. Once mounted, navigate to /mnt/borg/mail-YYYY-MM-DD and verify that your Maildir structure (e.g. cur/, new/, tmp/) is intact. Unmount with umount /mnt/borg when done.

Use a cron job to run the backup and prune commands daily. For example: 0 2 * * * /path/to/backup-script.sh ensures consistency without manual effort. Borg’s deduplication works across all backups, reducing storage use significantly—especially for mail servers where content repeats (e.g., newsletters).

For context, deduplication and compression are key advantages over raw rsync—especially for large mail stores. This approach aligns with industry best practices for secure, efficient backups. The RFC 7450 on email archiving emphasizes integrity and long-term retention, principles Borg supports.

For teams using a private email and workspace stack like Unifiedesk, Borg is a trusted backend for safeguarding data across mail, calendar, documents, and drives—even with custom domains. Your data stays under your control, not a third party’s.

Conclusion: Choose Based on Control, Space, and Experience

Restic offers the best balance for most self-hosted users: secure by default, simple to set up, and built for reliable recovery of modern workloads like email and documents.

Borg excels for advanced users who need to minimize storage use across many small files and shared environments—ideal for multi-user self-hosted setups with tight space constraints.

Rsync is not a backup. It syncs. Use it only to move data in real time, and pair it with restic or borg for actual protection against loss, corruption, or deletion.

Whatever tool you choose, automate it, test recovery regularly, and own your data—especially when running services like Unifiedesk’s self-hosted mail, where control is the only guarantee of privacy.

Ready to put this into practice? Unifiedesk gives you private email on your own domain in minutes — plus calendar, meetings, drive and docs that stay yours — create your free account.

Frequently asked questions

Is restic the best choice for backing up a Maildir?

Yes — restic handles Maildir’s directory structure well, encrypts at rest, and deduplicates efficiently. It’s ideal for most self-hosted mail setups.

Can borgbackup deduplicate identical email attachments?

Yes — borg deduplicates at the block level, so identical message parts (like a shared PDF) are stored once, saving space.

Why shouldn’t I use rsync alone for mail server backups?

Rsync only syncs the current state. It doesn’t keep history, so you lose access to previous versions and cannot recover from deletion.

Do restic and borg support incremental backups?

Yes — both perform smart incremental backups by hashing content and only transferring changes.

Where should I store my backup repository?

Use an offsite or air-gapped storage location — a remote server, encrypted USB drive, or cloud storage with client-side encryption.

Can I use restic with Unifiedesk's self-hosted mailbox storage?

Yes — Unifiedesk stores data in standard Maildir format, and restic works directly with that structure. It supports all self-hosted deployments.

What if my backup tool fails during a sync?

Use restic — it resumes interrupted transfers. For borg, restart the backup command; it will detect and continue from the last known point.

Is encryption at rest necessary for mail backups?

Yes — email data is sensitive. Encryption at rest ensures that even if your backup is stolen, the content remains protected.

How do I verify a backup was successful?

Test restore on a non-production system. Check that directories like cur/ and new/ contain valid message files.

Can I back up to a cloud drive like Dropbox with restic?

Yes — but only if the cloud provider doesn’t modify file contents. Use restic’s repositories on encrypted cloud mounts with tools like rclone or cryptomount.

Should I use different tools for mail and other data?

You can use the same tool (like restic) for both mail and general files — it’s designed to handle mixed workloads efficiently.

What’s the most common mistake when backing up a mail server?

Assuming that syncing data is the same as backing it up — forgetting to test recovery, version history, and encryption.