mbox(5) File Formats Manual mbox(5)
mbox - file containing mail messages
The most common format for storage of mail messages is mbox format. An mbox is a single file containing zero or more mail messages.
A message encoded in mbox format begins with a From_ line, continues with a series of non-From_ lines, and ends with a blank line. A From_
line means any line that begins with the characters F, r, o, m, space:
From email@example.com Sat Jan 3 01:05:34 1996
Date: 3 Jan 1996 01:05:34 -0000
From: God <firstname.lastname@example.org>
To: email@example.com (D. J. Bernstein)
How's that mail system project coming along?
The final line is a completely blank line (no spaces or tabs). Notice that blank lines may also appear elsewhere in the message.
The From_ line always looks like From envsender date moreinfo. envsender is one word, without spaces or tabs; it is usually the envelope
sender of the message. date is the delivery date of the message. It always contains exactly 24 characters in asctime format. moreinfo is
optional; it may contain arbitrary information.
Between the From_ line and the blank line is a message in RFC 822 format, as described in qmail-header(5), subject to >From quoting as
HOW A MESSAGE IS DELIVERED
Here is how a program appends a message to an mbox file.
It first creates a From_ line given the message's envelope sender and the current date. If the envelope sender is empty (i.e., if this is
a bounce message), the program uses MAILER-DAEMON instead. If the envelope sender contains spaces, tabs, or newlines, the program replaces
them with hyphens.
The program then copies the message, applying >From quoting to each line. >From quoting ensures that the resulting lines are not From_
lines: the program prepends a > to any From_ line, >From_ line, >>From_ line, >>>From_ line, etc.
Finally the program appends a blank line to the message. If the last line of the message was a partial line, it writes two newlines; oth-
erwise it writes one.
HOW A MESSAGE IS READ
A reader scans through an mbox file looking for From_ lines. Any From_ line marks the beginning of a message. The reader should not
attempt to take advantage of the fact that every From_ line (past the beginning of the file) is preceded by a blank line.
Once the reader finds a message, it extracts a (possibly corrupted) envelope sender and delivery date out of the From_ line. It then reads
until the next From_ line or end of file, whichever comes first. It strips off the final blank line and deletes the quoting of >From_
lines and >>From_ lines and so on. The result is an RFC 822 message.
COMMON MBOX VARIANTS
There are many variants of mbox format. The variant described above is mboxrd format, popularized by Rahul Dhesi in June 1995.
The original mboxo format quotes only From_ lines, not >From_ lines. As a result it is impossible to tell whether
From: firstname.lastname@example.org (D. J. Bernstein)
>From now through August I'll be doing beta testing.
Thanks for your interest.
was quoted in the original message. An mboxrd reader will always strip off the quoting.
mboxcl format is like mboxo format, but includes a Content-Length field with the number of bytes in the message. mboxcl2 format is like
mboxcl but has no >From quoting. These formats are used by SVR4 mailers. mboxcl2 cannot be read safely by mboxrd readers.
There are many locking mechanisms for mbox files. qmail-local always uses flock on systems that have it, otherwise lockf.
The delivery date in a From_ line does not specify a time zone. qmail-local always creates the delivery date in GMT so that mbox files can
be safely transported from one time zone to another.
If the mtime on a nonempty mbox file is greater than the atime, the file has new mail. If the mtime is smaller than the atime, the new
mail has been read. If the atime equals the mtime, there is no way to tell whether the file has new mail, since qmail-local takes much
less than a second to run. One solution is for a mail reader to artificially set the atime to the mtime plus 1. Then the file has new
mail if and only if the atime is less than or equal to the mtime.
Some mail readers place Status fields in each message to indicate which messages have been read.
maildir(5), qmail-header(5), qmail-local(8)