Backup

DeepFilter's configuration accumulates over time: domain definitions, email flow, whitelists and blacklists, users, quarantine thresholds and the DKIM signing keys belonging to your domains. All of that configuration is held on a single server; a hardware failure, a bad change or a move to a new server instantly turns it into work that has to be rebuilt by hand, one item at a time. Some data exists nowhere else: DKIM private keys are generated only on this server, and if they are lost you have to generate new keys, update your DNS records and accept the signing gap that opens up in the meantime.

Backup captures all of that configuration into a single file and restores it when needed. You use this screen when you are building the server from scratch, when you want a safe point to return to before a major change, or when you are moving the configuration to another server.

A backup is a configuration backup, not a data backup. The contents of quarantined emails, email traffic history, logs and the artificial intelligence model do not go into the backup; these are data produced at runtime or distributed by the central system.

Included in the backup	Not included in the backup
General system settings	Contents of quarantined emails
Domain definitions	Email traffic history and analytics
Email flow (server and relay definitions)	Log files
Whitelists and blacklists	Artificial intelligence model (comes from the central system)
Domain/user security actions (SPF, DKIM, RBL)	Learning data (produced at runtime)
Quarantine thresholds and settings	Pending email queues
Users and their roles	Security (TLS) certificates (renewed automatically)
DKIM private keys belonging to domains
Email templates
License information

note

A restore brings back only the configuration; it does not bring back lost quarantined emails, traffic history or logs. Do not rely on the backup for that data.

Settings

The three settings below determine where the daily automatic backup is written, how many copies are kept and in what form it reaches you, and they are stored permanently with Save Settings. The encryption password, on the other hand, is not a persistent setting: it is entered at the moment you download the backup (or send it by email) — see Backup Encryption.

Backup Directory

Determines the local folder on the server that automatic backups are written to. (default: /var/lib/deepfilter/backups)

Why it exists: You decide which disk the backups accumulate on; that way you can direct backups to a separate partition or to a persistent storage area.

If you change the value: The path you give becomes the sole target of subsequent backups; if you leave it empty the default is used. The path can only be under one of the permitted locations: /var/lib/deepfilter, /var/lib/backups, /mnt, /media, /srv, /opt/deepfilter. System folders (/etc, /root, /usr) are rejected for security reasons; if you give an invalid path the system silently falls back to the default directory.

Watch out: To back up to an external disk, USB drive or network share, you have to mount that storage under one of the permitted paths. A remote server or cloud address cannot be given directly from the screen; the ways to take a copy off the server are Send by Email and the manual Download Backup operation.

Number of Backups to Keep

Determines how many of the most recent copies are kept in the backup directory. (default: 7; permitted range 3–30)

Why it exists: Backups pile up with every change; without a limit the disk fills. This number strikes the balance of "enough to go back, not so many that the disk swells".

If you change the value: If you raise the number you can return to older states but more disk space is used; if you lower it you save disk space but the history you can go back to gets shorter. The oldest backups beyond the number are deleted automatically. If the value you enter is outside the 3–30 range, it is pulled into that range.

Send by Email

While on, it also sends the backup file to the recipient you specify as an email attachment after an automatic backup is taken. (default: off)

Why it exists: It makes sure a copy of the backup also exists off the server; even if the server becomes completely unreachable, you can get to the latest configuration from your mailbox.

If you turn it on: When you turn the switch on, fields for the recipient address and an optional encryption password appear. From then on, every automatic backup produces an email. On days when the configuration has not changed no backup is taken, so no email is sent on those days either. If you turn it off, backups stay only in the directory on the server.

Watch out: If the email delivery fails (the recipient is wrong, the delivery path is closed) the backup is still counted as successful — the file has been written to disk. In other words, the email not arriving does not mean the backup was not taken.

Backup Encryption

If you set an Encryption password while downloading a backup or sending it by email, the file is encrypted with that password to the AES-256-GCM standard; if the password is left empty, a plain (unencrypted) file is produced. (default: unencrypted)

Why it exists: The backup contains the DKIM private keys belonging to your domains. Those keys falling into third-party hands through a backup file opens the door to forged (impersonating) email being sent in your domain's name. Encryption protects the contents when the file leaves the server (email, download, external disk).

If you set one: The file can only be opened with that password. The password is processed with a strong key derivation (600,000 iterations), which slows down password-guessing attacks. If you do not set one, anyone who obtains the file can read the entire configuration, including the DKIM keys.

danger

If you lose the encryption password you can never access the backup again — there is no other recovery path for an encrypted backup. Keep the password somewhere safe, separate from the backup itself. Because the backup contains DKIM private keys, setting a password is strongly recommended for every backup that will leave the server.

Automatic Backup

Automatic backup runs every day at 03:00 (Türkiye time). Each time, the current configuration is compared with the previous backup; if there is no change, no new file is written, so the disk does not fill with unnecessary copies. In addition, every time the software is updated, this comparison is skipped on the first start after the update and a guaranteed backup is taken — that way the configuration at the moment each new version comes into service is always recorded.

Prerequisites

• Review the Backup directory and Number of backups to keep values (see Settings).

Steps

1. On Management → Backup, go to the Automatic Backup Settings section.
2. Edit the Backup directory and Number of backups to keep values if needed.
3. If you also want a copy of the backup by email, turn the Send by email switch on and enter the recipient address.
4. Click the Save Settings button.

Verification — how to know it worked

• The settings take effect at the next 03:00 run. If you want to verify immediately, make any configuration change; you will see a new file appear among those accumulating in the backup directory.

Downloading a Backup

The Download Backup operation collects all of the current configuration on the spot and downloads it straight to your browser; it does not write a file to the backup directory on the server. It is used to grab a copy quickly or to move a backup to another server.

Prerequisites

• If you want to encrypt the file (recommended because of the DKIM keys), prepare a strong password and keep it somewhere safe.

Steps

1. On Management → Backup, go to the Download Backup section.
2. Enter a password in the Encryption password field (if you leave it empty the file downloads unencrypted).
3. Click the Download button.

Verification — how to know it worked

• The configuration file downloads to your browser. This operation does not change the backup directory on the server.

Restoring a Backup

A restore applies the configuration in the backup file you select to the system. The operation runs as a single unit (atomically): all current settings are deleted and the values from the backup are written in their place. If an error occurs, no change is applied and the system stays as it was.

Prerequisites

• You must have a backup file to restore — either a file you downloaded earlier or one of the files accumulating in the backup directory on the server.
• If the file is encrypted, have the password you set during encryption to hand.
• A restore replaces the current configuration entirely; back up the current system first.

caution

A restore overwrites all current settings — this is a full replacement, not a merge. If you do not back up the current system before restoring, you can never return to the configuration you had at that moment.

Steps

1. On Management → Backup, go to the Upload Backup (Restore) section.
2. Select the backup file to restore.
3. If the file is encrypted, enter the password.
4. Confirm the restore.

Verification — how to know it worked

• When the operation completes you see a summary: the number of tables and rows applied, the DKIM keys written back to the server, the license decision and any warnings.
• After the restore, the email flow and filtering settings are automatically rebuilt from the restored records. If a problem occurs during that rebuild, the restore is still counted as successful and the relevant problems are listed separately within the summary.

note

You will not hit a license conflict when moving a backup to another server: if the target system has no license, the license in the backup is applied; if the target already has a different license, the backup's license is skipped and the current license is kept. If it is the same license, nothing changes.

Troubleshooting

The backup directory I gave is not accepted, the setting reverts to the default. — The backup directory can only be under one of the permitted locations (/var/lib/deepfilter, /var/lib/backups, /mnt, /media, /srv, /opt/deepfilter); system folders are rejected for security reasons. Mount an external disk or network share on one of these paths and point the directory there.

No new automatic backup file is being created. — If the configuration has not changed since the previous backup, this is expected behaviour; the system does not write the same content a second time. A new backup is created when you change a setting or when the software is updated. If you want a copy to hand right away, you can download the current configuration to your browser with Download Backup.

I cannot restore an encrypted backup, I get a password error. — An encrypted backup can only be opened with the correct password. Make sure you entered the password correctly; if the password is lost, there is no recovery path for the backup.

The license in the backup I restored was not applied. — If the target system already has a different license, the backup's license is deliberately skipped and the current license is kept. To change the license, use the Management → License screen.