Scan IMAP mailboxes (Gmail, Outlook/M365, and more) for messages and attachments.
- Category
- Collaboration
- Source type
- Produces
- emailattachment
Mailboxes are the least-governed data store in most organisations. Contracts, invoices, spreadsheets of customer data, credentials sent “just this once” — they all live there indefinitely, in attachments nobody has looked at in years.
What you need to connect
An IMAP host and port (993 for IMAPS), and the mailbox login. For Gmail and Outlook / Microsoft 365, use an app password rather than the account password — it’s revocable and scoped to one application.
Any IMAP server works: Gmail, Outlook, Yahoo, Fastmail, Zimbra, Dovecot, whatever you run yourself.
What Classifyre reads
Each message becomes an asset — sender, recipients, subject and body — and each attachment becomes a separate asset linked back to its email.
Scope the scan by:
- Folders — Inbox only, or Sent, Archive, and any custom folder.
- Date range — messages on or after a date, before a date, or both.
- Unread only — for a monitoring-style scan.
- Attachment size cap — oversized attachments still produce an asset with their metadata; only the bytes are skipped.
Attachments are read with the shared file pipeline: see Supported File Formats for everything it can open, and OCR & Transcription for reading text out of images, audio and video.
Metadata on every asset
Asset kind · email
| Field | Type | Always present | What it is |
|---|---|---|---|
| message_id | string | Yes | RFC 5322 Message-ID header (stable dedup key) |
| subject | string | Yes | Email subject line |
| from_address | string | Yes | Sender email address (From header) |
| to_addresses | string[] | No | Recipient addresses (To header) |
| cc_addresses | string[] | No | Carbon-copy addresses (Cc header) |
| date | string | No | Message date (ISO 8601) |
| folder | string | No | Mailbox folder the message was fetched from |
| sender_domain | string | No | Domain parsed from the From address |
| reply_to | string | No | Reply-To header |
| in_reply_to | string | No | In-Reply-To header (parent message id) |
| references | string | No | References header (thread chain) |
| has_html | boolean | No | Whether the message has an HTML body part |
| attachment_count | integer | No | Number of attachments on the message |
| spf | string | No | SPF result parsed from Authentication-Results |
| dkim | string | No | DKIM result parsed from Authentication-Results |
| dmarc | string | No | DMARC result parsed from Authentication-Results |
Asset kind · attachment
| Field | Type | Always present | What it is |
|---|---|---|---|
| size_bytes | integer | Yes | Raw byte size |
| mime_type | string | Yes | MIME type |
| parse_error | string | No | Set when content extraction failed |
| filename | string | Yes | Original file name |
| image_width | integer | No | Width in pixels |
| image_height | integer | No | Height in pixels |
| page_count | integer | No | Number of pages (pdf) |
| paragraph_count | integer | No | Number of paragraphs (docx) |
| table_count | integer | No | Number of tables (docx) |
| row_count | integer | No | Number of data rows |
| columns | object[] | No | Columns as {name, type} objects (type may be empty for csv/xlsx) |
| encoding | string | No | Detected character encoding |
| json_root_type | string | No | Root JSON type: object, array, or scalar |
| top_level_keys | integer | No | Number of top-level keys when the root is an object |
| array_length | integer | No | Length when the root is an array |
| parent_email_hash | string | Yes | Hash of the parent email asset |
| sha256 | string | No | SHA-256 of the attachment bytes |
| is_inline | boolean | No | Whether the attachment is inline (e.g. embedded image) |
| content_id | string | No | Content-ID header for inline parts |
Lineage
Lineage
This source records no lineage. Nothing in the system it reads describes data moving from one place to another, so no FLOW edges are produced. Related items are still linked — see Lineage & Relationships for what those links mean and how they differ from lineage.
Worth knowing
- Messages are read, never modified. Nothing is marked as read, moved or deleted by a scan.
- Attachments are where the findings are. The body of an email is usually innocuous; the spreadsheet attached to it usually is not.
- A shared or archive mailbox is often the better target than an individual one — it’s where retention actually accumulates.
Configuration
Beyond the fields below, every source also has the settings shared by all of them: the sampling strategy, the detectors to run, the scan schedule, and the compute limits for its scan jobs.
Required
Without these, the source will not save.
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| required | object | Yes | —no extra properties | — |
| host | string | Yes | IMAP server host (e.g. imap.gmail.com, outlook.office365.com) | — |
| port | integer | No | IMAP server port (993 for IMAPS)min 1, max 65535 | 993 |
Secrets
Stored encrypted and never shown again after you save them. See Configuration & Fields.
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| masked | object | Yes | —no extra properties | — |
| password | string | Yes | Account or app-specific password (use an app password for Gmail/Outlook) | — |
| username | string | Yes | Mailbox login (usually the full email address) | — |
Optional
Everything you can tune. Sensible defaults apply when you leave them alone.
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| optional | object | No | —no extra properties | — |
| connection | object | No | Transport-level connection controls.no extra properties | — |
| connection.timeout_seconds | integer | No | Socket timeout for IMAP operationsmin 1 | 30 |
| connection.use_ssl | boolean | No | Connect over implicit TLS (IMAPS). Disable only for STARTTLS/plain servers. | true |
| scope | object | No | Which messages and attachments to ingest.no extra properties | — |
| scope.before_date | string | No | Only fetch messages before this date (ISO 8601 date) | — |
| scope.folders | array | No | Mailbox folders to scan | ["INBOX"] |
| scope.folders[] | string | No | — | — |
| scope.include_attachments | boolean | No | Emit attachments as separate assets linked to the email | true |
| scope.max_attachment_size_bytes | integer | No | Skip downloading attachment bytes above this size (still emits a metadata-only asset). Unset means no limit.min 0 | — |
| scope.since_date | string | No | Only fetch messages on/after this date (ISO 8601 date, e.g. 2026-01-01) | — |
| scope.unseen_only | boolean | No | Only fetch unread (UNSEEN) messages | false |