What Is an MBOX File? One Text File, Many Messages and Four Ways to Split Them
An MBOX file stores many email messages in one text file, so copy it before you open it. Jump to your question below, or work through it in order.
What Is an MBOX File? Many emails in one text file, and one name for four formats
Short answer
MBOX files end in .mbox, and one stores many email messages in one text file. Every message starts with a line that begins with From, and the next message follows it. Thunderbird and Apple Mail use the format.
We read 17 public MBOX files with four readers, and we damaged one small MBOX file in 46 ways. On 26 of the 31 harmful edits at least one reader printed other messages and no warning, and our own script flagged 29.
To see the parts, go to the inside part. To check an MBOX file, follow the six steps. To judge risk, read the safety part.
An MBOX file stores many email messages in one text file, and its name ends in .mbox. Every message starts with a line that begins with the word From, so a reader can see where one message ends and the next begins. Thunderbird and Apple Mail use the format.
MBOX is a name for a family of mailbox formats. Wikipedia’s article on mbox says the messages follow one another in a single text file. FileInfo describes the .mbox ending the same way, and it adds that Apple Mail and Thunderbird support the format.
RFC 4155 registers the media type application/mbox. It is an informational document from September 2005, so it is not an Internet standard. It says the .mbox ending is neither required nor expected, and a mailbox can have any name.
Why one name covers four formats
No single document defines every MBOX file. Wikipedia lists four variants, called mboxo, mboxrd, mboxcl and mboxcl2. It ties them to different Unix mail systems. They differ in how they quote body lines that start with From and in whether they use a Content-Length header. The split part shows the difference.
RFC 4155 does not name the variants and does not mention Content-Length. It says many programs escape body lines that begin with From and others do not. So two programs can write different bytes for the same mailbox.
Who writes MBOX files today
Thunderbird stores every folder in one file by default. Mozilla’s article on Maildir calls that the default format of one file per folder. Maildir, which stores one message per file, is off by default.
Apple Mail imports MBOX files through the File menu, with Import Mailboxes and the choice Files in mbox format. Apple’s support page also says Export Mailbox saves every mailbox as an .mbox package.
Google’s help page on downloading your data says Gmail labels go into an X-Gmail-Labels header in the download file. The page does not name MBOX, but the viewer pages from SysTools and Freeviewer list Google Takeout .mbox files.
Where our MBOX files come from
We wrote one small MBOX file ourselves, so it contains no private mail. It has 6 messages in 2,889 bytes and follows the mboxrd rules. One message has an attachment, one has two text parts and one has an encoded Subject. We also wrote a twin in the mboxcl2 form, with 3,005 bytes, for the Content-Length tests.
We damaged the MBOX file in 46 ways and added 7 files that are not MBOX files, so we have 53 copies.
We also read 17 public MBOX files. Four come from the test folders of git, six from MimeKit, five from Mailpile, one from Apache James and one from the Stalwart mail-parser. They add up to 11,732,459 bytes and 244 messages.
Four readers split every MBOX file. They are the mailbox module of Python 3.13, the mailsplit command of git 2.43, formail 3.24 from procmail and the Perl module Mail::Mbox::MessageParser 1.5111. The file command 5.45 named the type, and our own 90 line Python script checked the structure. We did not use Thunderbird or Apple Mail.
MBOX file facts at a glance
| Property | Value |
|---|---|
| Meaning | A mailbox. It stores many email messages in one text file. |
| Made by | Thunderbird, Apple Mail and other mail programs. FileInfo calls it a Unix format that Apple Mail and Thunderbird now support. |
| Format | Text. Every message starts with a From line. Four variants exist, and no single standard covers them. |
| Start | The word From and a space, then the sender and a date. 14 of our 17 public MBOX files start that way. |
| Signature | None. There are no magic bytes to check. |
| Media type | application/mbox, from the informational RFC 4155 of September 2005. |
| Line endings | A line feed alone, says RFC 4155. 16 of our 17 public MBOX files use it. |
| Opens with | Thunderbird, Apple Mail and any text editor. Free readers like Python and viewers from SysTools and Freeviewer also read it. |
| Size in our set | 150 to 10,536,315 bytes for the public MBOX files, with a median of 1,630 bytes. |
| Our tests | 17 public MBOX files, 53 copies of one MBOX file, four readers and a 90 line script. |
Wrong page? Look at the EML page for one message, the EMLX page for Apple Mail messages, the PST page for Outlook data files or the MSF page for Thunderbird folder indexes.
What Is Inside an MBOX File? A From line, headers, a blank line and a body, six times over
An MBOX file is a list of messages. Every message has a From line, headers, a blank line and a body. The writer puts a > in front of any body line that could pass for a new From line.
The figure cuts our 2,889 byte file into its six messages, and then cuts message 1 into its parts. Every message in the MBOX file has the same layout.
From asha@example.org Mon Oct 12 09:15:02 2026
From: Asha Verma <asha@example.org>
To: Ben Okafor <ben@example.net>
Subject: Welcome to the Northwind team
Date: Mon, 12 Oct 2026 09:15:02 +0000
Message-ID: <m1@example.org>
Hi Ben,
Welcome to the Northwind team.
>From the Northwind team, welcome aboard.
>>From the old thread: please ignore.
Your desk is on the second floor.
AshaThe From line of an MBOX file
The text of RFC 4155 describes the line as the word From, a space, the address of the sender, another space and a UTC timestamp. The timestamp has no time zone and follows the form of the C function ctime. The RFC adds that programs write the address and the date in many ways.
Our public MBOX files show it. From nobody appears in 5 of them, a sender that git writes. From - appears in 5, and MAILER-DAEMON appears in 2. An email address appears in 5.
Do not mix up the From line with the From header. The line has no colon, and it belongs to the mailbox. The header has a colon, and it belongs to the message. Every message in our MBOX file has both.
The headers of an MBOX message
Headers follow the From line. A header has a name, a colon and a value, and a line that starts with a space or a tab continues the line before it. Our messages have From, To, Subject, Date and Message-ID headers. The multipart ones add MIME-Version and Content-Type.
Programs add headers of their own. Our fifth message has an X-Gmail-Labels header and an X-Mozilla-Status header, so we can test how readers cope with both. Google’s help page says no mail client recognizes the X-Gmail-Labels header now.
The blank line and the body of an MBOX message
A blank line ends the headers. The body follows it and ends where the next From line begins. A body can have parts. Our second message has two parts joined by a boundary line, and the second part is a base64 attachment named parts.csv.
A reader sees lines and nothing more. It does not know a part from the text of a letter, so a body line that starts with From can fool it. The next part shows the fix.
Quoting body lines in an MBOX file
Our first message has two body lines that start with From. The writer put a > in front of one line and >> in front of the other. A reader that finds the quotes knows these lines are not new messages, and an mboxrd reader takes one > off again.
Line endings and encoding in an MBOX file
RFC 4155 says the default format ends every line with a line feed and never with a carriage return and a line feed. 16 of our 17 public MBOX files follow that rule. One of them, james-Inbox, uses CRLF.
An MBOX file has no encoding of its own. It stores bytes, and every message names its own character set in a header. One public MBOX file, mimekit-unmunged, starts with a UTF-8 byte order mark. Bytes before the first From line are a fault in our tests (copy 30).
We read this layout from one small MBOX file, 17 public MBOX files, the RFC and the documents of three readers. We did not use Thunderbird or Apple Mail, so they can read some of these parts in other ways.
How Does a Reader Find the End of a Message? Two ways to find it, and four ways to quote From lines
A reader finds the end of a message in one of two ways. It looks for the next From line, or it trusts a Content-Length header. The four variants differ in how they quote body lines and in whether they use that header.
The figure shows two body lines written four ways. The first line starts with From, and the second already starts with >From. Only mboxrd lets a reader get both lines back exactly as they were.
mboxo and mboxrd
mboxo puts a > in front of body lines that start with From. A line that already starts with >From stays as it is. Wikipedia calls the result irreversible, because a reader that takes one > off loses the quote the original had.
mboxrd also adds a > to lines that start with >From, so a line can become >>From. Taking one > off every such line restores the original. Debian’s mbox(5) page describes both schemes in the same way.
Python follows the older rule. Its mailbox documentation says the mbox class writes mboxo and does not take the > off when it reads. git has an option for the other rule. Its --mboxrd flag reverses the escaping, says the git mailsplit page.
mboxcl and mboxcl2
A Content-Length header gives the size of the body in bytes. A reader that trusts it can skip to the end of the body and expect the next From line there. Wikipedia says mboxcl and mboxcl2 come from the mail tools of Unix System V Release 4. mboxcl still quotes From lines, and mboxcl2 does not.
Debian calls mboxcl the mboxo form with a Content-Length header. RFC 4155 does not mention the header, and Python’s documentation says its reader ignores it. So an mboxcl2 file, which has no quotes, can look like more messages than it has. Python read 7 messages from our mboxcl2 file and not 6 (copy 19).
What this means for your MBOX files
You do not need to know the variant to open an MBOX file in Thunderbird or Apple Mail. You need it when two tools disagree. If one reader finds more messages than another, look for body lines that start with From and for Content-Length headers.
Our script reads MBOX files in any of the four forms. It counts a From line as a separator only when it looks like one, and it trusts a Content-Length only when the next From line is where the header points. The check part shows its output.
What Do 17 Public MBOX Files Contain? Four readers, 244 messages and only 5 files they agree on
We read 17 public MBOX files with four readers. All four printed the same message count for 5 files only. git stopped on 6 files and Perl on 7. The 17 are test files, so they show how projects write MBOX files and not every MBOX file you can find.
The figure lists the 17 files by size, with the message count that every reader printed. The reference count comes from the project’s own test code for 8 files and from our own count for the other 9.
Where the MBOX files come from
Sizes range from 150 to 10,536,315 bytes, with a median of 1,630 bytes. The biggest file, mimekit-jwz, has 152 messages. The smallest, mailpile-no-subject, has 1. Every MBOX file is a test file, so none belongs to a person.
We left out three more git test files. Two are body text with no From line, and one is a single message with no From line. None is a mailbox, so we could not count its messages.
What the MBOX files show
16 of the 17 files use line feeds, and james-Inbox uses CRLF. One file starts with a UTF-8 byte order mark. Four files have Content-Length headers, 68 lines in all. Four files have quoted From lines, 17 in all.
The From lines differ too. From nobody appears in 5 files and From - in 5. MAILER-DAEMON appears in 2 files and an email address in 5. A reader has to accept all of them.
What the four readers did with the MBOX files
Python matched the reference count on 15 files. It printed 3 messages for two files that have 2, git-sample and mimekit-unmunged. Both have a body line that starts with From and has no quote.
git matched on 11 files and stopped on 6 with the message corrupt mailbox. Perl matched on 9 and stopped on 7 with the message Not a mailbox. Both stopped on the same 5 files, all from MimeKit. Many of their From lines have no date, and some have a dash in place of the sender.
formail matched on 7 files and never stopped. It printed fewer messages than the reference for 9 files and more for 1. mimekit-jwz gave 27 messages and not 152.
What our script flagged in the MBOX files
Our script matched the reference count on all 17 files. We tuned its rules on these files, so that is not a test of the script. We tested it on 53 copies instead. It raised 56 flags on 12 of the 17 files and none on the other 5.
The flags are facts about the MBOX files and not faults of the people who wrote them. Several of these files are test files that were built to be odd, like one with Content-Length values that do not match.
| Flag | Count |
|---|---|
| A message has no Subject | 10 in 5 files |
| Content-Length does not match the body | 10 in 3 files |
| A Message-ID appears twice | 8 in 1 file |
| A boundary is never opened | 6 in 2 files |
| A header line has no colon | 6 in 2 files |
| A From line has no blank line before it | 5 in 1 file |
| A body line starts with From and is not quoted | 3 in 2 files |
| Base64 text has a bad character | 3 in 1 file |
| The file does not start with a From line | 2 in 2 files |
| A boundary is never closed | 2 in 1 file |
| A byte order mark comes first | 1 in 1 file |
What the numbers do not show about MBOX files
We read the MBOX files with four readers, and we did not use Thunderbird or Apple Mail. The MBOX files come from test folders. A mailbox that has grown for ten years, or one with attachments of 25 MB, can behave in other ways. We cannot say how Thunderbird reads these files, only how our checks do.
What Happens When an MBOX File Is Damaged? 53 copies, and no warning from any reader
We damaged one MBOX file in 46 ways, added 7 files that are not MBOX files and read all 53 copies with four readers and our own script. No reader printed a warning. On 26 of the 31 harmful edits at least one reader printed other messages and no word.
We changed one thing at a time and sorted the copies into six groups. They cover the From line, quoting and Content-Length. The last three cover bytes and line endings, headers with parts and files that are not MBOX files. Copy numbers match the rows of the figure.
We compared every reader with the six messages we wrote. For 13 edits the right answer changes, like a removed Subject, so we changed the reference to match. We also turned every >From line back into a From line before we compared, so a reader that leaves the quotes in place is not counted as wrong.
Green means the messages we expected, or a flag on a damaged copy. Amber means other messages and no word of warning. Red means the reader stopped with an error. A gray band marks an edit that changes no message, so any amber or red there is a false alarm.
No reader printed a warning about a damaged MBOX file
Python and formail never stopped. git stopped on 10 copies and Perl on 10. Stopping is the only way a reader said anything. On 31 harmful edits the readers stopped on 4 copies only, which are copies 9, 29, 30 and 31. On the other 27 no reader said anything.
On 26 of the 31 harmful copies at least one reader printed other messages. On 10 copies all four did. They are copies 2, 5, 6, 10, 12, 15, 23, 32, 36 and 37.
On 5 harmful copies all four readers printed the damaged message as it was. They are copies 40 to 44. They remove a Subject, repeat a Message-ID, remove a closing boundary, break a base64 line and remove another one. A reader that splits an MBOX file is not a checker, so it passes these on.
Four readers, four sets of rules
Python printed the messages we expected on 10 harmful copies and other messages on 21. It ignores Content-Length, as its documentation says, so it read 7 messages from all eight copies of the mboxcl2 file (copies 19 to 26). That includes copy 19, which is not damaged.
git stopped on 3 harmful copies and printed other messages on 10. Its stops are copy 9, where the first From line is gone, copy 30 with the byte order mark and copy 31 in UTF-16. It printed the expected messages on 18.
formail printed the expected messages on 13 harmful copies and other messages on 18. It read the CRLF copy (copy 27) as 1 message, and it did the same with the CR copy (copy 28). Perl stopped on 2 harmful copies and printed the expected messages on 16.
Perl’s stop on copy 29, where one message uses CRLF, is the most helpful message we saw. It says it found a mix of Unix and Windows line endings and suggests a tool like dos2unix. We did not test that fix.
Damage that fools MBOX readers
Copy 15 added a quote to the From line of message 4. All four readers printed 5 messages, because message 4 became part of message 3. No reader said so, and our script flagged nothing. We cannot separate this copy from a mailbox that has 5 messages.
Copy 2 wrote one From line as from in lowercase, and copy 10 added a second From line right after the first. All four readers printed 5 messages for the first and 6 or 7 for the second, with no word. Our script flagged both.
Copies 36 and 37 cut the MBOX file. One stops at 60 percent of its size, and the other stops inside the headers of message 5. All four readers printed the pieces as if they were complete. Our script named the open boundary and the headers that end too soon.
Copy 32 put a NUL byte into a body, and every reader passed it on. Copy 44 removed one line of base64 text, and every reader passed that on too. Our script flagged the NUL byte and missed the base64 line.
Damage that does not matter in an MBOX file
15 edits change no message. Our script flagged none of them. Every reader gave a false alarm on some of them. Python raised 2, git 4, formail 5 and Perl 4. Both git and Perl stopped on copy 28 and printed other messages on three more.
Copies 3, 7 and 8 give a From line with no date, an ISO date and no sender. Python read all three as expected. git, formail and Perl printed other messages for every one of them.
Copy 28 ends every line with a carriage return alone, the old Mac style. git and Perl stopped on it, and Python and formail printed 1 message and not 6. RFC 4155 says a line feed must end every line, so a strict reader can refuse the MBOX file.
Files that are not MBOX files
Seven copies are not MBOX files. Copy 47 is one message with no From line, copy 48 is a plain text note and copy 49 is a ZIP archive. Copy 50 is a SQLite database, copy 51 is an EMLX style message and copy 52 is an empty file. Copy 53 has one From line.
Perl stopped on all 7. git stopped on 6. Python and formail never stopped. They printed 0 or 1 messages from a ZIP archive and a SQLite database, with no error. Our script flagged all 7.
The file command named 44 of the 53 copies ASCII text, and it called 2 of them mail. It never named a copy an MBOX file. It does not look for From lines, so it cannot separate a mailbox from a letter.
Our MBOX script sees structure and misses meaning
Our script flagged 29 of the 31 harmful copies and none of the 15 harmless ones. It missed copies 15 and 44. It checks lines, headers, boundaries and base64 text. It cannot know that a quote should not be there or that a line of base64 text is gone.
What the groups show
| Group | What we found |
|---|---|
| A. From line (1 to 10) | Six edits are harmful and four are not. git stopped on copy 9, where the first From line is gone. Python and formail never stopped. Our script flagged all six harmful edits. |
| B. Quoting (11 to 18) | Four edits are harmful. Python printed other messages on all four. Copy 15 fooled all four readers and our script. |
| C. Content-Length (19 to 26) | Python read 7 messages from every copy, because it ignores the header. git and Perl printed the expected messages on all harmful copies except copy 23. Our script flagged all seven. |
| D. Bytes and line endings (27 to 37) | The UTF-16 copy stopped git and Perl. The byte order mark stopped git, and mixed line endings stopped Perl. The two cut copies fooled all four readers. |
| E. Headers and MIME (38 to 46) | No reader stopped. Copies 40 to 44 passed through all four. Our script flagged 7 of the 8 harmful edits and missed the removed base64 line. |
| F. Other kinds of file (47 to 53) | Perl stopped on all seven and git on six. Python and formail printed 0 or 1 messages and no error. Our script flagged all seven. |
Read the grid with care. Green cells mean the messages we expected. We did not use Thunderbird or Apple Mail, and we compared text and not every byte. Every test changed one thing in one small MBOX file.
What Does Our Expert Say About MBOX Files? A note from Neeraj Singh on trusting a mailbox with care
Copy an MBOX file before you open it, and keep the original. An MBOX file is a list of mail kept as text, and many tools read it in their own way. Our test shows 26 damaged copies where at least one reader printed other messages and no word.
Expert insight
An MBOX file is easy to open and hard to trust. In our test no reader printed a warning, and on 26 of 31 damaged copies at least one reader printed other messages anyway. Copy the MBOX file first, read it with two tools and compare the counts.
Why an MBOX mailbox needs care
People think a mailbox is easy, because it is only text. An MBOX file is a database written as text. One missing blank line can merge two messages, and a stray quote can hide one.
The readers add a second risk. They split an MBOX file and move on, so a damaged message can pass without a word. Read the MBOX file with two readers, compare the counts and add a script that checks the structure.
Keep the original. Copy the MBOX file before you open it, and write down its SHA256 hash. The hash shows which file you received and whether a later copy differs.
How Do You Open an MBOX File? Thunderbird, Apple Mail, a text editor, free tools or a viewer
Thunderbird and Apple Mail open an MBOX file. To read one without a mail program, use a text editor or a free tool like Python or git. You can also use a viewer from SysTools or Freeviewer. Copy the MBOX file before you open it.
We read MBOX files on Linux with free tools. We did not use Thunderbird, Apple Mail, the SysTools viewer or the Freeviewer viewer, so the steps for those come from their own pages.
Open an MBOX file in Thunderbird
Mozilla’s Maildir article says Thunderbird stores mail as one file per folder by default. Mozilla’s profile article gives %APPDATA%\ as the place for profiles on Windows, and ~/ on a Mac.
To open the profile folder, click the menu button and choose Help, then Troubleshooting Information. Under Application Basics, select the Open Folder button next to the profile folder. Close Thunderbird before you copy files out of it.
We found no Mozilla page with steps for loading an MBOX file that came from somewhere else, so we give none.
Open an MBOX file in Apple Mail
- Open Mail and choose Import Mailboxes from the File menu.
- Select Files in mbox format and click Continue.
- Find the folder that contains your MBOX files and select it.
- Look for a new mailbox named Import in the sidebar. Drag folders and messages from it into your other mailboxes.
These steps come from Apple’s guide to importing mailboxes, and we did not test them. The page adds that Export Mailbox in the Mailbox menu saves every mailbox you select as an .mbox package. It does not overwrite an earlier export and adds a number to the name instead.
Open an MBOX file in a text editor
An MBOX file is text, so Notepad, TextEdit and any code editor open it. You see the From lines, the headers and the base64 text of the attachments as they are. We did not test editors. Work on a copy and do not save, because an editor can change the line endings.
Open an MBOX file with free tools
Four free tools read MBOX files from a command line, and we used all four. The mailbox module of Python and the Perl module Mail::Mbox::MessageParser are libraries. The git mailsplit command and formail, which comes with procmail, are programs.
python3 -c "import mailbox; print(len(mailbox.mbox('mailbox.mbox')))"
6
grep -c '^From ' mailbox.mbox
6The first line asks Python for the length of the mailbox. The second counts the lines that start with From and a space. Both printed 6. The count from grep is a quick check only, because it also counts a body line that starts with From and has no quote.
Open an MBOX file with a viewer
Two vendors list viewers for MBOX files on Windows. We tested neither, and both pages come from the vendors.
SysTools MBOX Viewer
Read MBOX files on Windows without a mail program
Freeviewer MBOX Viewer
Read MBOX files on Windows without a mail program
The SysTools page lists a free MBOX Viewer, version 4.0, that opens MBOX, MBS and MBX files. It does not need a mail program, and it loads Thunderbird profiles on its own. The page says the free version only previews emails with attachments. PDF export needs the Pro edition, and PST, MSG, EML and CSV export needs Pro+.
The Freeviewer page lists the variants mboxo, mboxrd, mboxcl and mboxcl2. It also lists Google Takeout files. It says the free edition reads data in the software panel only. The export formats match the SysTools list. The page says reading has no size limit, and its two lists of Windows versions disagree, so check the page before you install.
FileInfo’s page on .mbox files lists Thunderbird, Apple Mail, Evolution, Outlook 365 on Mac and any text editor as programs that open .mbox files.
Open an MBOX file on a Mac or on Linux
A text editor works on any system, and Apple Mail is the route on a Mac. Python, git, formail and Perl work on Linux, where we used them. The two viewers are Windows programs. Our script needs Python 3 and nothing else.
How the readers did on our damaged copies
Every reader gets its own row below. The numbers cover our 31 harmful edits, and the false alarms are the harmless edits that a reader still misread.
| Reader | On our damaged copies |
|---|---|
| Python 3.13 | On the 31 harmful copies, printed the expected messages on 10 and other messages on 21. Never stopped. It raised 2 false alarms on the 15 harmless copies. |
| git 2.43 | On the 31 harmful copies, printed the expected messages on 18 and other messages on 10. Stopped on 3. It raised 4 false alarms on the 15 harmless copies. |
| formail 3.24 | On the 31 harmful copies, printed the expected messages on 13 and other messages on 18. Never stopped. It raised 5 false alarms on the 15 harmless copies. |
| Perl module 1.5111 | On the 31 harmful copies, printed the expected messages on 16 and other messages on 13. Stopped on 2. It raised 4 false alarms on the 15 harmless copies. |
| file 5.45 | Named 44 of the 53 copies ASCII text and never named one an MBOX file. |
| Our script | Flagged 29 of the 31 harmful copies and all 7 files that are not MBOX files. It raised no false alarms on the 15 harmless copies. |
How Do You Check an MBOX File? Six steps, and a 90 line script
Check an MBOX file in six steps. Hash it, read its first line, name its type, count the messages with two readers and use our script to check the structure. No check proves that every message is right.
The six steps to check an MBOX file
- Copy the MBOX file, write down its SHA256 hash and work on the copy.
-
Read the first line with
head -n 1 mailbox.mbox. 14 of our 17 public MBOX files start with a line that begins with From and a space. -
Name the type with
file mailbox.mbox. It says ASCII text for an MBOX file, so it cannot confirm the type. Use it to spot an empty file, a database or binary data. - Count the messages with two readers, like Python and git. If the counts differ, look for body lines that start with From and for Content-Length headers.
- Use the script below. It reads the structure and names every fault it can see.
- Stop if the script names a fault, the readers disagree or the MBOX file did not come from a source you trust. Get the original again.
sha256sum mailbox.mbox
35f3207d9d351966a4abe4c174652690d88c09f897dd3f3aacb7a6e517936eaa mailbox.mbox
head -n 1 mailbox.mbox
From asha@example.org Mon Oct 12 09:15:02 2026
file mailbox.mbox
mailbox.mbox: ASCII textThe 90 line script that reads MBOX files
The Python script below does steps 2 and 5. It decides what the MBOX file is, finds the From lines that start messages and reads the headers and the body of every message. It names every fault it finds. It changes no file and starts nothing.
It treats a line as the start of a message only when the line looks like a From line, with a date, a dash or an address after the word. It trusts a Content-Length header only when the next From line is where the header points.
It also checks for a byte order mark, NUL bytes, mixed line endings, a missing Subject, a repeated Message-ID, an open boundary and bad base64 text.
#!/usr/bin/env python3
"""mbox_peek.py: check the structure of an mbox file. It reads the file and changes nothing."""
import re, sys, base64, binascii
def peek(path):
d = open(path, 'rb').read()
P = []
if not d.strip(): return ['empty file'], 0, ''
if d[:2] in (b'\xff\xfe', b'\xfe\xff') or (len(d) > 3 and d[1:2] == b'\0' and d.count(b'\0') > len(d) // 4):
return ['UTF-16 text, not an mbox file'], 0, ''
if d[:2] == b'PK' or d[:15] == b'SQLite format 3':
return ['not an mbox file (%s)' % ('ZIP archive' if d[:2] == b'PK' else 'SQLite database')], 0, ''
if d.startswith(b'\xef\xbb\xbf'): P.append('byte order mark before the first line'); d = d[3:]
if d.count(b'\0'): P.append('%d NUL byte(s)' % d.count(b'\0'))
crlf = d.count(b'\r\n'); cr = d.count(b'\r') - crlf; lf = d.count(b'\n') - crlf
eol = 'CRLF' if crlf and not lf and not cr else 'CR' if cr and not lf and not crlf else 'LF' if lf and not crlf and not cr else 'mixed'
if eol == 'mixed': P.append('mixed line endings')
t = d.decode('latin-1').replace('\r\n', '\n').replace('\r', '\n')
L = t.split('\n'); off = [0]
for x in L: off.append(off[-1] + len(x) + 1)
HDR = re.compile(r'[!-9;-~]+:|[ \t]')
def lead(i): return i == 0 or L[i - 1] == ''
def head_next(i): return i + 1 < len(L) and bool(HDR.match(L[i + 1])) and L[i + 1][0] not in ' \t'
DATE = r'\d\d:\d\d|\d{4}-\d\d-\d\d'
def form(x):
m = re.match(r'(From|from|[ \t]+From)([ \t]+)(\S+)(.*)$', x)
if not m: return None
rest = m.group(4).strip()
good = m.group(1) == 'From' and '\t' not in m.group(2) and (re.search(DATE, x) or m.group(3) == '-' or not rest)
if good: return 'ok'
return 'bad' if (re.search(DATE, x) or m.group(3) == '-' or '@' in m.group(3)) and not rest.startswith('wrote') else None
froms = [i for i in range(len(L)) if L[i].startswith('From ')]
if not froms and not any(form(x) for x in L[:3]):
return ['no From line found: not an mbox file' + (', one email message' if HDR.match(L[0]) else '')], 0, ''
seps = [i for i in range(len(L)) if form(L[i]) and (re.search(DATE, L[i]) or head_next(i)) and (form(L[i]) == 'ok' or lead(i) or head_next(i))]
for i in seps:
if form(L[i]) == 'bad': P.append('line %d is a damaged From line' % (i + 1))
elif not lead(i) and not L[i].startswith('From -'): P.append('line %d has no blank line before it' % (i + 1))
if not seps or seps[0] != 0: P.append('the file does not start with a From line')
ids, q, ok_spans = {}, 0, []
for n, s in enumerate(seps, 1):
nxt = seps[n] if n < len(seps) else len(L)
h = s + 1
while h < nxt and L[h] != '': h += 1
hdr = L[s + 1:h]
if h >= len(L): P.append('message %d ends inside its headers' % n); continue
if any(not HDR.match(x) for x in hdr): P.append('message %d has a header line without a colon' % n)
hd = '\n'.join(hdr)
if not re.search(r'(?mi)^subject:', hd): P.append('message %d has no Subject' % n)
mid = re.search(r'(?mi)^message-id:\s*(\S+)', hd)
if mid:
if mid.group(1) in ids: P.append('message %d repeats the Message-ID of message %d' % (n, ids[mid.group(1)]))
ids[mid.group(1)] = n
body = t[off[h + 1]: off[nxt]]
cls = re.findall(r'(?mi)^content-length:\s*(\S+)', hd)
if len(set(cls)) > 1: P.append('message %d has two Content-Length lines that disagree' % n)
elif cls and not cls[0].isdigit(): P.append('message %d has a Content-Length that is not a number' % n)
elif cls and eol == 'LF':
end = off[h + 1] + int(cls[0])
if end >= len(t) - 1 or t[end:end + 6] == '\nFrom ': ok_spans.append((s, nxt))
else: P.append('message %d has a Content-Length of %s, but its body is %d bytes' % (n, cls[0], len(body) - body.endswith('\n\n')))
q += len(re.findall(r'(?m)^>+From ', body))
for bd in re.findall(r'(?i)boundary="?([^";\s]+)', hd):
if '--' + bd + '\n' not in body: P.append('message %d never opens boundary %s' % (n, bd))
elif '--' + bd + '--' not in body: P.append('message %d never closes boundary %s' % (n, bd))
st, lines, parts = 2 if re.search(r'(?mi)^content-transfer-encoding:\s*base64', hd) else 0, [], []
for x in body.split('\n'):
if st == 2 and x.startswith('--'): parts.append(lines); st, lines = 0, []
elif st == 2: lines.append(x)
elif st == 1 and x == '': st = 2
elif st == 0 and re.match(r'(?i)content-transfer-encoding:\s*base64', x): st = 1
if st == 2: parts.append(lines)
for part in parts:
part = [x for x in part if x.strip()]
if any(not re.fullmatch(r'[A-Za-z0-9+/=]*', x) for x in part): P.append('message %d has an invalid character in base64 text' % n)
else:
try: base64.b64decode(''.join(part), validate=True)
except binascii.Error: P.append('message %d has base64 text of the wrong length' % n)
for i in froms:
if i in seps: continue
own = [(n, s, e) for n, (s, e) in enumerate(zip(seps, seps[1:] + [len(L)]), 1) if s < i < e]
if own and (own[0][1], own[0][2]) in ok_spans: continue
P.append('line %d starts with From inside message %d and is not quoted' % (i + 1, own[0][0] if own else 1))
return P, len(seps), '%d message%s, %s bytes, %s, %d quoted From line%s' % (len(seps), '' if len(seps) == 1 else 's', format(len(d), ','), eol, q, '' if q == 1 else 's')
if __name__ == '__main__':
for f in sys.argv[1:]:
P, n, s = peek(f)
print(f + ': ' + (s or 'not an mbox'))
print('\n'.join(P) if P else 'no problem found')On our intact MBOX file it finds 6 messages and 2 quoted From lines and reports no problem. It read all 17 public MBOX files, 11.7 MB, in about a third of a second. It raised 56 flags on 12 of them, and the study part lists the flags.
python3 mbox_peek.py mailbox.mbox
mailbox.mbox: 6 messages, 2,889 bytes, LF, 2 quoted From lines
no problem foundpython3 mbox_peek.py copy-2.mbox
copy-2.mbox: 6 messages, 2,889 bytes, LF, 2 quoted From lines
line 69 is a damaged From line
python3 mbox_peek.py copy-20.mbox
copy-20.mbox: 6 messages, 3,005 bytes, LF, 1 quoted From line
message 2 has a Content-Length of 449, but its body is 499 bytes
python3 mbox_peek.py copy-29.mbox
copy-29.mbox: 6 messages, 2,914 bytes, mixed, 2 quoted From lines
mixed line endings
python3 mbox_peek.py copy-36.mbox
copy-36.mbox: 3 messages, 1,733 bytes, LF, 2 quoted From lines
message 3 never closes boundary bndBCopy 10 shows how one fault can bring a second. We added a From line right after the first, so the script found 7 messages and named both the missing blank line and the message with no Subject.
python3 mbox_peek.py copy-10.mbox
copy-10.mbox: 7 messages, 2,936 bytes, LF, 2 quoted From lines
line 2 has no blank line before it
message 1 has no SubjectTwo copies are not MBOX files. Copy 31 is UTF-16 text, and copy 48 is a plain text note. The script stops on both and says why.
python3 mbox_peek.py copy-31.mbox
copy-31.mbox: not an mbox file
UTF-16 text, not an mbox file
python3 mbox_peek.py copy-48.mbox
copy-48.mbox: not an mbox file
no From line found: not an mbox fileWhat the script cannot see
The script reads structure and not meaning. It printed no problem for copy 15, where a quote on a From line merged message 4 into message 3. It also printed no problem for copy 44, where one line of base64 text is gone.
python3 mbox_peek.py copy-15.mbox
copy-15.mbox: 5 messages, 2,890 bytes, LF, 3 quoted From lines
no problem found
python3 mbox_peek.py copy-44.mbox
copy-44.mbox: 6 messages, 2,812 bytes, LF, 2 quoted From lines
no problem foundLook at the first line of every box. Our intact MBOX file has 6 messages, 2,889 bytes and 2 quoted From lines. Copy 15 shows 5 messages and 3 quoted lines, and copy 44 shows 2,812 bytes. The script cannot know what you expect, but you can. Write down these numbers for your original and compare them with every copy.
The script never checks that a name, an address or a number is right. We tuned its rules on the 17 public MBOX files, so it knows the faults we tested and no others. An MBOX file that passes can still read in other ways in Thunderbird, which we did not use.
Want the causes of an error? Go to the causes.
Is an MBOX File Safe to Open and Share? Reading starts nothing, and sharing shows your mail
An MBOX file is safe to read and not safe to share. Reading it as text starts nothing, but it contains the text of your mail. Treat every MBOX file as private data.
Reading an MBOX file with a text editor, a script or a reader starts nothing. The risk is the data. An attachment inside the MBOX file is a normal attachment, so treat it as you would an attachment in an email. We scanned no file for malware, and the 17 public MBOX files are test files.
What is inside an MBOX file
parts.csv.
Replies repeat older mail in an MBOX file
A reply quotes the message it answers. Our fourth message repeats three lines of the third. So an MBOX file that seems to have one thread can show text from messages you did not plan to share.
Before you share an MBOX file
- Open your copy in a text editor and look at what it contains.
- Ask if the other side needs every message. Send fewer when you can.
- Split the MBOX file into one file per message with git or formail, and send only the messages that are needed.
- Send the MBOX file over a channel you trust, and send its SHA256 hash by another route.
- Delete your extra copies when the other side confirms the MBOX file.
Look before you send. Read the Subject lines and the quoted text of every message you plan to send. Our fifth message is an invoice, and the MBOX file names the people who wrote to one another.
Why Will Your MBOX File Not Work? Eight causes, and what to do about every one
MBOX files fail for eight reasons. The MBOX file can be another kind or cut short. A From line, a body line or a Content-Length header can be wrong. The line endings, the bytes or the headers can be odd. A reader can also be the problem.
The table lists what we saw in our 53 copies and what the readers said. We tested four readers and a script on Linux. Read every fix as a first step and not the final answer.
| Cause | Details and fix |
|---|---|
| You have a different kind of file | The .mbox ending can hide other kinds of file. Copy 47 is one message with no From line, copy 48 is a plain text note and copy 49 is a ZIP archive. Copy 50 is a SQLite database, copy 51 is an EMLX style message and copy 52 is an empty file. Copy 53 has one From line. Perl stopped on all 7 and git on 6. Python and formail never stopped, and they printed 0 or 1 messages from the ZIP archive and the SQLite database. Our script flagged all 7. Fix: Read the first line. 14 of our 17 public MBOX files start with From and a space. |
| A From line is damaged or missing | A lowercase from (copy 2), a space before From (copy 5) and a tab after From (copy 6) made all four readers print other messages. Removing the first From line (copy 9) stopped git. A second From line right after the first (copy 10) gave 7 messages in three readers and 6 in Perl. Fix: Look at the line the script names and compare it with a good From line. |
| A body line starts with From | An unquoted body line (copy 11) and an MBOX file with every quote removed (copy 13) gave other messages in Python only. A body line that looks like a valid From line (copy 12) fooled all four readers. So did a quote added to a From line (copy 15), and our script missed that one. Fix: Compare the counts of two readers, and look for body lines that start with From. |
| Content-Length is wrong or ignored | Python read 7 messages from all eight Content-Length copies (copies 19 to 26), because it ignores the header. git and Perl printed the expected messages on every damaged copy except copy 23, where the header is gone. Our script flagged all seven damaged copies. Fix: Compare the header with the size of the body, as the script does. |
| The line endings are mixed or odd | CRLF on every line (copy 27) made formail print 1 message. A carriage return alone (copy 28) stopped git and Perl, and Python and formail printed 1 message. Mixed endings (copy 29) stopped Perl, which suggests dos2unix. We did not test that fix. Fix: Read the line endings with the script, and change them on a copy only. |
| The bytes at the start or inside are odd | A UTF-8 byte order mark (copy 30) stopped git, and the other three printed other messages. A UTF-16 file (copy 31) stopped git and Perl, and Python and formail printed 0 or 1 messages. A NUL byte in a body (copy 32) passed through all four readers. Fix: Look for a byte order mark with the script, and save the MBOX file again as plain text from the program that wrote it. |
| The MBOX file is cut short | A cut at 60 percent (copy 36) and a cut inside the headers of message 5 (copy 37) fooled all four readers. They printed the pieces as if they were complete. Our script named the open boundary and the headers that end too soon. Fix: Compare the size and the hash with the source. |
| The headers or the parts are broken | No reader stopped on any of the nine edits to headers and parts. On copies 40 to 44 all four printed the damaged message as it was. formail printed other messages on three copies (38, 39 and 46). Our script flagged 7 of the 8 harmful edits and missed the removed base64 line. Fix: Read the MBOX file with the script, which names the message and the header. |
When the reader is the problem and not the MBOX file
Three harmless edits show it. Copies 3, 7 and 8 give a From line with no date, an ISO date and no sender. Python read all three as expected, and git, formail and Perl printed other messages. Try a second reader before you call an MBOX file bad.
Fix an MBOX file in seven steps
- Copy the MBOX file, write down its SHA256 hash and work on the copy.
-
Read the first line with
head -n 1 mailbox.mbox. It should begin with From and a space. - Compare the size and the hash with the source. An MBOX file that is cut short can still look like a mailbox to every reader.
- Read the MBOX file with the check script, and note every fault it names.
- Count the messages with two readers. When they differ, look for body lines that start with From and for Content-Length headers.
- If the script says the line endings are mixed, change them on a copy. Perl names dos2unix for that job, and we did not test it.
- If the MBOX file is damaged, copy it again from its source or from a backup. If you cannot, export the mail again from the program that wrote it.
We did not test repairs on files from other people. An MBOX file that passes our script can still fail in Thunderbird, and an MBOX file that fails in the script can still load there. Only the program you use knows what it accepts.
What to send when you ask for help
If a forum or a support team asks about your MBOX file, send these lines. They show what the MBOX file is and where the readers stopped, and they save rounds of questions. Remove names and email addresses first.
Subject: MBOX file will not open
File: name, size in bytes and SHA256 hash
First line: the output of head -n 1 mailbox.mbox
Type: the output of file mailbox.mbox
Script: the output of mbox_peek.py
Readers: the message counts from Python and git
Program: the mail program and its version
History: where the MBOX file came from and what changedNot an error, but a question about similar files? Go to the versus part.
How Do You Convert an MBOX File? Split it, read it in Python or use a vendor tool
You can split an MBOX file into one file per message with git or formail, and read it in Python. A converter reads the MBOX file and writes new files, and the original stays unchanged. Renaming an MBOX file does not convert it.
This part reports what we tested on Linux with free tools. We did not test the vendor viewers or any mail program, so our claims about them come from their own pages.
Split an MBOX file into one file per message
The git mailsplit page describes the command, and formail comes with procmail. We split our MBOX file with both. git wrote 0001 to 0006 and printed 6. formail wrote msg.000 to msg.005 and printed nothing.
mkdir out
git mailsplit -o./out mailbox.mbox
6
ls out
0001
0002
0003
0004
0005
0006
mkdir out2
formail -s sh -c 'cat > out2/msg.$FILENO' < mailbox.mbox
ls out2
msg.000
msg.001
msg.002
msg.003
msg.004
msg.005Both commands keep the From line at the top of every file, and both leave the quotes in place. Message 1 of our MBOX file has two quoted lines, and both are still there in file 0001.
Take the quotes off an MBOX file
Our MBOX file follows the mboxrd rules, so a reader can undo the quotes. The git option --mboxrd takes one > off every quoted line. The first box below shows the split without the option, and the second box shows the same lines with it.
sed -n 10,12p out/0001
Welcome to the Northwind team.
>From the Northwind team, welcome aboard.
>>From the old thread: please ignore.
mkdir out3
git mailsplit --mboxrd -o./out3 mailbox.mbox
6
sed -n 10,12p out3/0001
Welcome to the Northwind team.
From the Northwind team, welcome aboard.
>From the old thread: please ignore.Use the option only on an mboxrd file. On an mboxo file the quotes are not reversible, and a line that began with >From in the original loses its first quote.
Read an MBOX file in Python
Python’s mailbox module gives every message as an object. It printed the six Subject lines of our MBOX file. The third line still shows the encoded word, because the MBOX file stores it that way.
python3 -c "import mailbox; [print(m['Subject']) for m in mailbox.mbox('mailbox.mbox')]"
Welcome to the Northwind team
Parts list for October
Meeting notes =?UTF-8?B?Y2Fmw6k=?=
Re: Meeting notes
Invoice 4471
Re: Invoice 4471Convert an MBOX file with a vendor tool
The pages of SysTools MBOX Viewer and Freeviewer MBOX Viewer list PDF export in the Pro edition and PST, MSG, EML and CSV export in Pro+. We tested neither. A free edition only reads the MBOX file on screen, so check the limits on their pages first.
What you cannot convert by renaming an MBOX file
Renaming an MBOX file to .eml or .pst does not convert it. An EML file stores one message, and a PST file is an Outlook data file. Copy 49 shows that the .mbox ending can hide a ZIP archive, and copy 50 shows the same for a SQLite database.
| Task | What we know |
|---|---|
| MBOX to one file per message | Tested with git mailsplit and formail. Both wrote six files and kept the From line and the quotes. |
| Quotes removed |
Tested with git mailsplit --mboxrd. It restored the lines of message 1 as we wrote them.
|
| MBOX to a list of Subjects | Tested with Python. It printed the six Subject lines. |
| MBOX to EML | Not tested. SysTools and Freeviewer list EML export in the Pro+ edition. |
| MBOX to PST | Not tested. SysTools and Freeviewer list PST export in the Pro+ edition. |
| MBOX into Apple Mail | Not tested. Apple’s page lists the import steps. |
How Does an MBOX File Differ From EML, EMLX, MSF and PST Files? One mailbox, one message, an index and an Outlook file
An MBOX file stores many messages in one text file. An EML file stores one message. An EMLX file is one Apple Mail message, an MSF file is a Thunderbird folder index and a PST file is an Outlook data file. Maildir stores one file per message.
People mix these types up because all of them store email. The table sorts them by what they store and which program writes them.
| Type | What it is |
|---|---|
| MBOX | Many messages in one text file. Thunderbird and Apple Mail use the format, and a From line starts every message. |
| EML | One email message in one file. Our guide to EML files covers it. |
| EMLX | One message in the format of Apple Mail. Copy 51 shows that it starts with a byte count line and not a From line. Our guide to EMLX files covers it. |
| MSF | A Thunderbird summary of a mail folder. It is an index and not the mail. Our guide to MSF files covers it. |
| PST | An Outlook data file, and not a text file. Our guide to PST files covers it. |
| Maildir | One file per message, in folders. Mozilla says Thunderbird has it off by default. |
| MAB | A Thunderbird address book and not mail. Our guide to MAB files covers it. |
Two more mail files look alike. A DBX file stores Outlook Express folders, and an OLM file is an Outlook for Mac export. Neither is an MBOX file, and a viewer for one does not read the other.
What Is the MBOX File Format Made Of? The facts we could check, and where they came from
An MBOX file is a list of messages in a text file, and no single standard covers every variant. The facts below come from RFC 4155, Wikipedia, Debian, Python, Mozilla, Apple, Google and our checks of 17 public MBOX files and 53 copies.
| Part | What we checked |
|---|---|
| Name | MBOX is a family of mailbox formats called mboxo, mboxrd, mboxcl and mboxcl2. No single document defines all four. (Wikipedia, Debian) |
| Endings | RFC 4155 says .mbox is neither required nor expected. Our public MBOX files end in .mbox, .mbx or .mboxrd, and three have no ending. (RFC 4155, our MBOX files) |
| Media type | application/mbox, in the informational RFC 4155 of September 2005. It is not an Internet standard. (RFC 4155) |
| Signature | None. Neither Wikipedia nor RFC 4155 defines one. 14 of our 17 public MBOX files start with From and a space. (RFC 4155, our MBOX files) |
| From line | The word From, a space, the sender, a space and a UTC timestamp in the ctime style. Our public MBOX files also use From nobody, From - and MAILER-DAEMON. (RFC 4155, our MBOX files) |
| Messages | A From line, headers, a blank line and a body. The next From line ends the body. (RFC 4155, our MBOX file) |
| Quoting | mboxo puts a > before body lines that start with From. mboxrd also does it for lines that start with >From. RFC 4155 prescribes no escape syntax. (Wikipedia, Debian, RFC 4155) |
| Content-Length | mboxcl and mboxcl2 use it to find the end of a body. RFC 4155 does not mention it, and Python ignores it. 4 of our 17 public MBOX files have it. (Wikipedia, Python, our MBOX files) |
| Line endings | A line feed alone, says RFC 4155. 16 of our 17 public MBOX files use it, and one uses CRLF. (RFC 4155, our MBOX files) |
| Characters | RFC 4155 says the default format uses seven bit characters and that eight bit data needs an encoding and a header. Copy 33 has a raw eight bit byte in a Subject, and all four readers read it as expected. (RFC 4155, our MBOX file) |
| Eudora | Wikipedia says Eudora writes the constant string ???@??? in place of the sender. (Wikipedia) |
| Mozilla | Wikipedia says Mozilla, Netscape and Thunderbird use an mboxrd variant. Mozilla says Thunderbird stores one file per folder by default. (Wikipedia, Mozilla) |
| Apple Mail | Imports files in mbox format and exports mailboxes as .mbox packages. (Apple) |
| Gmail labels go into an X-Gmail-Labels header in the download file. (Google) | |
| Our counts | 17 public MBOX files, 53 copies of one MBOX file, four readers and a 90 line script. |
About the values we list
Rules about the format come from the RFC 4155 memo, Wikipedia’s mbox page and the Debian manual page for mbox. Counts come from our own files. Where the documents disagree or say nothing, we say so in the table.
What we left out
We damaged one small MBOX file that has 6 messages, one attachment and one encoded Subject. Files with 25 MB attachments, many labels or ten years of mail can react in other ways. We did not damage an MBOX file in the mboxcl form beyond the Content-Length edits.
We did not use Thunderbird or Apple Mail and tested no Windows program. We compared text and not every byte. We used four readers on Linux, so Thunderbird and the vendor viewers can behave in other ways.
The public MBOX files come from test folders and not from personal mail accounts. We left out locking, which Wikipedia says differs between variants. We also left out mailbox sizes beyond 10.5 MB.
Sources checked
For the format, see RFC 4155 at the RFC Editor, Wikipedia’s mbox article and Debian’s mbox(5) manual. For the readers, see Python’s mailbox documentation and git’s mailsplit documentation.
For the programs, see Mozilla’s Maildir support page, Mozilla’s article on profiles, Apple’s page on mailboxes and Google’s help page on your data. For the .mbox ending, see the FileInfo entry. Every count came from files and scripts in our research folder.
Frequently Asked Questions About MBOX Files
What is an MBOX file?
An MBOX file stores many email messages in one text file, and its name can end in .mbox. Every message starts with a line that begins with From and a space. Thunderbird and Apple Mail use the format.
How do I open an MBOX file?
Import it into Apple Mail or Thunderbird, or read it as text in any editor. A free tool like Python or git splits it into messages, and viewers from SysTools and Freeviewer read it on Windows. We tested the free tools and not the mail programs or the viewers.
Is an MBOX file a virus?
No. An MBOX file is text, and reading it starts nothing. It contains your mail, so it is private data, and an attachment inside it needs the same care as in an email. We scanned no file for malware.
How do I check an MBOX file?
Hash the MBOX file, read its first line and count the messages with two readers. Then use our 90 line script, which names broken From lines, wrong Content-Length headers, open boundaries and bad base64 text. It flagged 29 of 31 damaged copies and none of 15 harmless ones.
Why do two readers show different message counts?
Readers split an MBOX file in different ways. Python starts a new message at every line that begins with From and a space, and it ignores Content-Length. git, formail and Perl want a date or a dash too. Our four readers agreed on only 5 of 17 public MBOX files, so compare two of them.
What is the difference between mboxo, mboxrd, mboxcl and mboxcl2?
mboxo and mboxrd differ in how they quote body lines that start with From. mboxrd also quotes lines that start with >From, so a reader can undo the quotes. mboxcl and mboxcl2 add a Content-Length header, and mboxcl2 leaves out the quotes. Wikipedia lists all four.
Can I convert an MBOX file to PST, EML or PDF?
Yes, but not by renaming it. SysTools and Freeviewer list PDF export in the Pro edition and PST, MSG, EML and CSV export in Pro+. We tested neither. With free tools, git mailsplit and formail split an MBOX file into one file per message.
Does Thunderbird use MBOX files?
Yes. Mozilla says Thunderbird stores mail as one file per folder by default, and it calls that the default format. Maildir, which stores one file per message, is off by default. Mozilla’s profile article lists where the profile folders are.
Does Google Takeout give an MBOX file?
The SysTools and Freeviewer pages say their viewers read Google Takeout .mbox files. Google’s help page says Gmail labels go into an X-Gmail-Labels header in the download file. It adds that no mail client recognizes that header now.
Does an MBOX file have a signature or magic bytes?
No. Neither RFC 4155 nor Wikipedia defines one. Files start with From and a space, and 14 of our 17 public MBOX files do. A first line that differs is a warning sign and not proof.
Can I edit an MBOX file in a text editor?
You can read it, but do not edit it by hand. A quote added to one From line merged two messages in our test, and no reader and no script warned us. Copy the MBOX file first, edit the copy and count the messages again with two readers.
What does a From line look like?
It is the word From, a space, the sender, a space and a UTC date. RFC 4155 describes it, and our public MBOX files also use From nobody, From - and MAILER-DAEMON. The From line has no colon and belongs to the mailbox, while the From header has a colon and belongs to the message.
Still Stuck With an MBOX File? Two routes out, and where to look next
Read the first line and follow the seven steps. The cause table lists what to try in order.
Look at how a message is built, and then start our script.
Is it one message? An EML file stores one email message. Our page on EML files covers it, and the versus part shows how the two differ.
Is it from Apple Mail? An EMLX file is one Apple Mail message. Our page on EMLX files covers the format.
Is it an Outlook file? A PST file is an Outlook data file, and an OLM file is an Outlook for Mac export. Our page on PST files and our page on OLM files cover them.
Is it a Thunderbird index? An MSF file summarizes a mail folder. Our page on MSF files covers it.
Is the data unknown? Our page on DAT files covers files with no clear type, and the file extension resource library lists many more.
Is your type missing? Send it on the submit a file type page.