mbox was never standardised as one format.
RFC 4155 (2005) registered the
application/mbox media type, described the common ground and defined a
default format. The variants below are described in Mutt’s
mbox(5) manual
page and manual; the status flags come from Mutt’s parse.c and
Thunderbird’s nsMsgMessageFlags.idl. All were read 2026-11-12. Each
message inside is an RFC 5322 message; mbox(5) says
lines are separated by line feeds, and RFC 4155’s default format requires a single
line feed, never CR LF.
The From_ line
Every message starts with a separator line: the four characters
From, a space, the envelope sender, white space, then a time stamp in
the form C’s asctime() prints:
From alice@example.com Thu Nov 12 21:30:00 2026- The sender is an
addr-specaddress taken from the envelope. - RFC 4155’s default format puts the UTC time when the message was received, with
no time zone. RFC 4155 notes that other programs write local time and other forms;
mbox(5) says readers should accept two-digit years (70 and up meaning 19xx, below
70 meaning 20xx) and zone names such as
CET DST. - In the default format each message ends with an empty line, so every message after the first is preceded by two line ends; the file ends when no more data or separator lines follow.
Variants
| Variant | Message ends | Escaping of From lines in bodies |
|---|---|---|
| mboxo | At the next From_ line | Only plain From lines at the start of a body line get a > in front. A line that already read >From is left alone, so it is unquoted wrongly on reading. |
| mboxrd | At the next From_ line | Already-quoted lines (>From , >>From , …) get one more > too, so reading can remove exactly one. |
| mboxcl | As mboxo, with a Content-Length field giving the number of bytes in the body | As mboxo, so any mboxo reader can read it. |
| MMDF | Each message is surrounded by lines of four Control-A characters | Not described; Mutt’s manual notes that four Control-A characters may also appear in bodies. |
Nothing in the file says which variant it is. RFC 4155 lists the other habits it
found: some programs escape From lines only after a blank line or
when they look like a separator, some add second escapes, and some do not escape
at all; its default format prescribes no escaping.
Status headers
mbox(5) says many mail programs put a Status: field in each message
to show which have been read. The letters below are the ones Mutt reads:
| Field | Letters or bits |
|---|---|
Status | R read, O old, r replied. |
X-Status | A replied, F flagged, D deleted. |
X-Mozilla-Status, X-Mozilla-Status2 | Thunderbird’s message flags (the low and high halves): 0x0001 read, 0x0002 replied, 0x0004 marked, 0x0008 expunged (removed at the next compaction), 0x0010 subject had Re:, 0x0020 elided, 0x0040 feed message, 0x0080 offline, 0x0100 watched, 0x0200 sender authenticated, 0x0400 partial, 0x0800 queued, 0x1000 forwarded, 0x2000 redirected, 0xE000 priority (the source says this is no longer used); 0x10000 new, 0x40000 ignored thread, 0x200000 IMAP deleted, 0x400000 and 0x800000 delivery-report needed and sent, 0x1000000 template, 0x0E000000 labels, 0x10000000 has attachments. Elided, new and offline are runtime flags that are not written. |
Locking
mbox(5) gives three locking methods, used alone or together: fcntl
(advised over NFS), flock (mostly BSD), and a dot lock, where a program
makes a temporary file in the same folder, hard-links it as
name.lock, checks the link with stat, and later deletes
name.lock to unlock. When several are combined, the file is locked only
once all of them are held. Which method a system uses is local policy, and every
program on it must use the same one.