Klytic

Home›Guides›Email

Email · Understand

Email backup, deletion and server outages

The trash, the service backup and platform failover do not address the same accident. A backup independent of the server can bring back a deleted message, even one deleted on purpose, provided it was backed up before deletion and the date is still within the retention period. When the server goes down, incoming mail waits at the sender’s end: what matters then is the time to restore service and how many messages you are willing to lose.

Updated October 20266 minOfficial sources cited

Three safety nets, three accidents

People say “it’s backed up” for very different mechanisms. Each one catches one type of accident, with one person who acts and one limit.

Safety netWho actsWhat it catchesIts limit
Trash and recovery folderThe user, in their mailboxA recent mistakeShort duration, and nothing if the mailbox itself is deleted or compromised
Service backupThe operator, on requestReturning a message, a folder or a mailbox to a past stateThe retention period, and the interval between two backups
Platform failoverThe operator, without a requestThe outage: mail keeps arriving or resumesDoes not bring back a deleted message

The copy that the vendor or host keeps for its own availability, on several disks or several servers, belongs to the third safety net. It protects against hardware failure. It does not protect against deletion: a deleted message is deleted immediately on every replica. This is the most common confusion between redundancy and backup.

Does a backup bring back a deleted message?

Yes, within three limits.

  • The retention period. With 30-day retention, a message deleted six weeks ago is no longer in any backup. If the deletion is only discovered at year-end closing, the backup comes too late.
  • The recovery point. A backup is a snapshot. A message that arrived at 10:05 a.m. and was deleted at 10:40 a.m., before the next backup, was never captured. The closer together the backups, the smaller this window; it is never zero.
  • The purpose. A backup is for going back in time. It does not replace archiving over several years, which keeps messages so they can be produced, with its own rules on retention and access.

Deliberate deletion deserves particular attention. A disgruntled employee who empties their mailbox, or an attacker who has taken over an administrator account, can delete messages and try to delete the backups too. Hence the value of a backup that no one can modify during its retention period, including an email administrator. The ANSSI guide on backup recommends isolating backup servers within the administration system, and advises examining how a WORM-type solution actually achieves immutability rather than taking the word on trust.

Independent of the server: what it means

An independent backup lives outside the email system it protects. In practice:

  • it is stored on another system, preferably at another site, so that an incident in the server room does not take it out too;
  • the credentials that administer the email system are not enough to delete it;
  • it is encrypted, so the copy does not become a second way into the messages;
  • it is tested. ANSSI puts it simply: backups must be tested regularly. A backup that has never been restored remains an assumption.

The same guide recommends the “3-2-1” rule, which starts with three separate copies of the data, and defines an offline backup as a backup on a medium disconnected from any information system. These notions apply to email as much as to files; how they apply to documents is covered in versioning, replication and backup.

Example. In a 25-person firm (hypothetical case), an employee deletes a client’s folder by mistake, empties the trash, and only notices the following Monday. The recovery folder no longer holds anything useful. The previous Friday’s backup contains the folder. The operator restores it into the mailbox; only messages that arrived and were deleted between two backups are missing.

When the server goes down

Email copes well with short outages. A sending server that cannot reach yours, or that receives a temporary error, keeps the message in its queue and retries. As long as the outage lasts less than the time after which the sender gives up, usually counted in days, nothing is lost: the mail arrives when the service returns. The guide migrating email without interruption explains this mechanism in detail. A filtering gateway placed in front of the email service plays the same role: it holds the accepted message until the server responds.

What users see is different: no more webmail, phones that stop syncing, messages that cannot be sent. That duration is what the first indicator measures.

RTO (recovery time objective, the maximum tolerable downtime): the target time to get the service running again. RPO (recovery point objective, the maximum tolerable data loss): the amount of data, expressed as a duration, that you accept to lose if storage has to be rebuilt from the last backup.

The RPO does not concern mail waiting at the senders’ end: that mail arrives when the service returns. It concerns messages already delivered to mailboxes, and user actions, since the last backup, in the event that the storage itself is lost. An RPO of under 2 hours means that at most two hours of that history would need to be rebuilt. These are objectives: ask how they are measured and tested.

Changing servers without changing your domain

A prolonged outage, the end of a contract or the acquisition of your provider may force you to change email services. Your domain and your addresses do not change: the MX record points to the new platform. The method, with coexistence, copy passes, and consistent SPF, DKIM and DMARC, is described in migrating email without interruption. It is not repeated here.

Frequently asked questions

Does redundancy replace backup?

No. Redundancy also replicates deletions. It protects against hardware failure, not against an error or a deliberate deletion.

Is a message received during an outage lost?

Generally not: the sender keeps it and retries. It is lost only if it is permanently rejected, or if the outage lasts longer than the sender’s give-up delay.

Are thirty days of backup enough?

To go back after an error, often yes. To keep messages for several years, no: that is the role of archiving. See archiving messages.

Does a mailbox compromise need to be discovered quickly?

Yes, because the retention clock is running. Upstream protection is the job of the filtering gateway; see protecting the email system you already have.

Where Klytic stands

For Klytic Mail, all three safety nets exist and are separate.

  • On the user side, the dumpster folder lets users recover deleted messages themselves, at no cost.
  • On the service side, email is backed up every hour. Backups are encrypted, retained for 30 days, replicated across several sites and immutable: once written, a backup can no longer be modified or deleted. They are monitored continuously and restores are tested every month. For this, Klytic relies on WeDoBack services, described on the Security and backup page.
  • On the platform side, the published objectives are service restoration in under 4 hours (RTO) and no more than 2 hours of data lost (RPO). Placed in front of the email service, Klytic MTA temporarily holds, encrypted, any message whose destination server is unavailable.

Restoring a message, a folder or a mailbox is requested from support, specifying the item concerned and the approximate date. It is included in the event of a service malfunction, a deliberate deletion by an employee or an account deleted too early during a departure (up to 3 requests per month), or an attack suffered despite properly protected workstations. After an accidental deletion, a user error, or if workstations were insufficiently protected, it is handled as a paid support ticket. The dumpster folder, at no cost, remains the first resort. The procedure is described in restoring a message or a mailbox.

What the offer does not cover: self-service restore by users beyond the dumpster folder, and retention beyond 30 days through backup. To keep messages for several years, legal archiving is available as an option.

This page describes a general framework. The commitments that apply are those in your contract.

Sources

Consulted in October 2026.

  • ANSSI, “Sauvegarde des systèmes d’information : les fondamentaux” (Backing up information systems: the fundamentals, version 1.1): definition of offline backup, “3-2-1” rule, regular backup testing, isolation of backup servers, examination of the immutability mechanism, correspondence between PDMA and RPO, DMIA and RTO. cyber.gouv.fr
  • Klytic, Security and backup: frequency, retention, encryption, replication, immutability, monthly tests, target RTO and RPO, restoring an email, a folder or a mailbox. klytic.com
  • Klytic, Frequently asked questions: hourly backup excluding telephony, recovery objectives, temporary holding by Klytic MTA when the destination server is unavailable. klytic.com
  • Klytic, Migrating email without interruption: sender queues in the event of a temporary error, role of the MX record, coexistence. klytic.com

See a restore before you sign

During the trial, ask for a deleted message to be restored: you will see how long it takes, who acts and where it reappears.

Start the free trial →

Security and backup

Further reading

Use · EmailRestoring a message or a mailboxRecover a deleted message yourself first, free of charge, from the dumpster folder. Beyond that, Klytic support restores over 30 days, included or billed by cause.4 min readRead →Understand · Documents & document managementVersioning, replication and document backupThree mechanisms, three failures. Why a DMS that already keeps versions must still be backed up, shown failure by failure.6 min readRead →Understand · Email securityProtecting the email system you already haveMicrosoft 365, Google Workspace, Exchange: you can add a security gateway without changing email services. What changes, who sets it up, the limits.7 min readRead →

Welcome offer

30 days free trial, migration support included

No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.

🚀 Start the free trial See pricing