You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

El Capitan Mail.app causes massive load on Cyrus IMAPd server

Hello,


Updating three of our 40 users to El Capitan has caused a service-affecting emergency for the entire company. There is some sort of interop problem here. I admit it could be a misconfiguration of our Cyrus IMAPd server, but we use it successfully with a great number of IMAP client applications, Apple Mail.app included, until that all changed on October 1.


Background:

Cyrus IMAPd maintains three files for each IMAP mailbox:


1. cyrus.header

2. cyrus.index

3. cyrus.cache

These files can grow to be very large (especially the cyrus.cache file)



For some reason, this latest version of Apple Mail seems to get itself into a tight loop talking to our Cyrus IMAPd, causing the cyrus.cache to get repeatedly re-written (or at least written to heavily). With only three employees' IMAPd clients checking their email, the disk sub-system of the IMAP server is almost completely consumed, resulting in high IOWAIT times, terrible performance for all other clients, and even rejection of new incoming connections (because of the extreme load).



Steps to Reproduce:


1. Configure Apple Mail to connect to my email account (which contains a lot of messages, and a lot of folders)

2. Wait until mail check is completed.

3. Open Mail.app's connection doctor, tell it to show detail, and an intense stream of "EXPUNGE, OK Completed" scrolls past.



Expected Results:


We expect to see an idled IMAPd connection once the initial mail check is complete - it should not checking again for 15 minutes as we have configured it do.



Actual Results:


Disk I/O on our IMAPd server is thrashed, and we see the following type of messages repeating over and over in Mail's logs:



Oct 5 22:06:07 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Read: 16156.18 OK

Oct 5 22:06:07 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16157.18 EXPUNGE

Oct 5 22:06:07 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * EXISTS 459

Oct 5 22:06:07 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * RECENT 9

Oct 5 22:06:07 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: 16157.18 OK

Oct 5 22:06:07 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16158.18 IDLE

Oct 5 22:06:07 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: +

Oct 5 22:06:07 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Wrote: DONE

Oct 5 22:06:07 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Read: 16158.18 OK

Oct 5 22:06:07 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16159.18 EXPUNGE

Oct 5 22:06:08 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * EXISTS 459

Oct 5 22:06:08 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * RECENT 9

Oct 5 22:06:08 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: 16159.18 OK

Oct 5 22:06:08 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16160.18 IDLE

Oct 5 22:06:08 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: +

Oct 5 22:06:08 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Wrote: DONE

Oct 5 22:06:08 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Read: 16160.18 OK

Oct 5 22:06:08 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16161.18 EXPUNGE

Oct 5 22:06:08 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * EXISTS 459

Oct 5 22:06:08 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * RECENT 9

Oct 5 22:06:08 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: 16161.18 OK

Oct 5 22:06:08 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16162.18 IDLE

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: +

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Wrote: DONE

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Read: 16162.18 OK

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16163.18 EXPUNGE

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * EXISTS 459

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * RECENT 9

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: 16163.18 OK

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16164.18 IDLE

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: +

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Wrote: DONE

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Read: 16164.18 OK

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16165.18 EXPUNGE

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * EXISTS 459

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * RECENT 9

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: 16165.18 OK

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16166.18 IDLE

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: +

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Wrote: DONE

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Read: 16166.18 OK

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16167.18 EXPUNGE

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * EXISTS 459

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * RECENT 9

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: 16167.18 OK

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16168.18 IDLE

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: +

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Wrote: DONE

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Read: 16168.18 OK

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16169.18 EXPUNGE

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * EXISTS 459

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * RECENT 9

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: 16169.18 OK

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16170.18 IDLE

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: +

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Wrote: DONE

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Read: 16170.18 OK

Oct 5 22:06:09 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16171.18 EXPUNGE

Oct 5 22:06:10 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * EXISTS 459

Oct 5 22:06:10 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * RECENT 9

Oct 5 22:06:10 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: 16171.18 OK

Oct 5 22:06:10 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16172.18 IDLE

Oct 5 22:06:10 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: +

Oct 5 22:06:10 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Wrote: DONE

Oct 5 22:06:10 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Read: 16172.18 OK

Oct 5 22:06:10 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16173.18 EXPUNGE

Oct 5 22:06:11 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * EXISTS 459

Oct 5 22:06:11 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * RECENT 9

Oct 5 22:06:11 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: 16173.18 OK

Oct 5 22:06:11 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16174.18 IDLE

Oct 5 22:06:11 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: +

Oct 5 22:06:11 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Wrote: DONE

Oct 5 22:06:11 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Read: 16174.18 OK

Oct 5 22:06:11 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16175.18 EXPUNGE

Oct 5 22:06:11 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * EXISTS 459

Oct 5 22:06:11 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * RECENT 9

Oct 5 22:06:11 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: 16175.18 OK

Oct 5 22:06:11 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16176.18 IDLE

Oct 5 22:06:11 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: +

Oct 5 22:06:11 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Wrote: DONE

Oct 5 22:06:11 Mail[17422] <Debug>: <0x7f8f890c8a30:[Idle mailbox=Trash - darren@dazza]> Read: 16176.18 OK

Oct 5 22:06:11 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16177.18 EXPUNGE

Oct 5 22:06:12 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * EXISTS 459

Oct 5 22:06:12 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: * RECENT 9

Oct 5 22:06:12 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Read: 16177.18 OK

Oct 5 22:06:12 Mail[17422] <Debug>: <0x7f8f890c8a30:[Selected mailbox=Trash - darren@dazza]> Wrote: 16178.18 IDLE


There's many thousands of these lines in Mail's syslog.


I'm a bit of a newcomer to Apple's forums, please let me know if there's other information I can provide.


-Darren

Mac Pro (Late 2013), OS X El Capitan (10.11)

Posted on Oct 6, 2015 7:19 PM

Reply
30 replies

Oct 23, 2015 2:28 AM in response to DevCB

I don't think this is the problem. Apple's own IMAP servers at ME.COM also reply "OK Completed" in response to an EXPUNGE. But they don't go loopy:.

WROTE Oct 23 10:23:12.613 ...-- host:p04-imap.mail.me.com -- port:993 -- socket:0x7fd49fcce4a0 -- thread:0x7fd49fc79f40

71.235 EXPUNGE

READ Oct 23 10:23:12.932 ... -- host:p04-imap.mail.me.com -- port:993 -- socket:0x7fd49fcce4a0 -- thread:0x7fd49fc79f40

71.235 OK Completed


Also, I haven't been able to replicate the problem in a non-Trash mailbox.

The IMAP specs says that OK EXPUNGE COMPLETED is the correct answer

The text that you refer to in RFC 3501 "EXPUNGE COMPLETED" is optional text (see 7.1.1 of the RFC). The protocol only requires the "OK". The client understands that it refers to the EXPUNGE because it matches the response tag to the command tag: that's the 71.235 in the sample above.


Even if it were required, Mail should not be repeating a command every tenth of a second. It could easily take longer than that for the expunge to complete.

Oct 23, 2015 5:21 AM in response to IanEiloart

For whatever reason, the conversation with the Cyrus IMAPd service (at least, for our implementation), leads to this loop condition. When I disabled the two features as per my last post, the problem stopped immediately.


The expunge command and arguments were second hand information I received from the mail admin with others on the Cyrus forums. I'll ask him for specifics on what his fellow admins found. The gist of it was that the behavior was due to this particular conversation going awry.

Oct 23, 2015 6:56 AM in response to IanEiloart

I first thought this was a bug with an older version of Cyrus but he insisted that this was an Apple problem.


This morning the mail admin sent me this thread: [trimmed to pertinent info]


------snip--->

Hi Eric,

If they are thinking that the example in the RFC is the specification, they are

not correct. The IMAP server responses to determine completion of the EXPUNGE

command are "OK" for a completed EXPUNGE, "NO" for a failure, and "BAD for unknown

command or invalid arguments. Everything after those words are not germane to

whether or not the command completed. The tag is what links the OK to the EXPUNGE

command and not the "EXPUNGE completed". Sigh, they had it right and now it is

broken.

<-----snip---

To which Bron G. replied with some very helpful information:

-->SNIP>>>


Actually, the ImapTest command complained about this too:


http://imapwiki.org/ImapTest


From RFC3501:


response-tagged = tag SP resp-cond-state CRLF



resp-cond-state = ("OK" / "NO" / "BAD") SP resp-text

; Status condition


resp-text = ["[" resp-text-code "]" SP] text


text = 1*TEXT-CHAR


So the exact text after the OK response doesn't matter, but it MUST be SP followed by at least 1 TEXT-CHAR.


This is pretty easy to patch in 2.3.x if you're forced to remain there for reasons. It is, of course, fixed in later versions.


Bron.

<---SNIP


So, it appears that this is a problem with older versions of Cyrus--not El Capitan. Patching the server should resolve this issue.

Oct 26, 2015 9:10 AM in response to dazza321

I logged a bug report with Apple Enterprise support case 964810266. Someone called me to day to update me and that the engineers are working on it.


Even if the bug is with Cyrus (which I'm now hearing is dubious), the behavior of the client application is a problem so they're looking to address it.


I logged all the session data with our Cyrus server and got the admin to grab some telemetry data from his end. I did a similar process with a gmail account and logged the session.


For us, disabling the COMPACT MAILBOXES feature stops the issue with cyrus. I was not able to replicate the same behavior with GMail--with or without the feature enabled.

Nov 25, 2015 7:01 AM in response to Mactotum

Jumping in here to mention this exact behavior is also present when talking to an Exchange 2003 IMAP server. The mitigating workarounds tossed about here also work on this server (unchecking compact box). Otherwise logs get hammered with EXPUNGE dialogs.


Yes I know 2003 is way end of lifed but I'm a victim of circumstance here so we're still using this POS.

Dec 4, 2015 4:53 AM in response to barangus

(Sorry for my english, its not my native language)


I've upgraded to MacOS10.11.2 Beta5 now and still see this behavior. I'm not convinced that it is a problem of a special imap server version or even a special imap server software. I expect that if an imap server processes EXPUNGE commands efficiently without unneccesary I/O you will not recognize these endless IDLE/DONE/EXPUNGE commands on the server as high load. But as faster your server can ACK an expunge command and as lower your network delay is, as faster Mail will send IDLE/DONE/EXPUNGE resulting in more network traffic, drained accu power, etc. As these packets are only a few bytes small no other IMAP admin might have realized it.


I'm not an apple guru, but googling around i found that you can watch the IMAP traffic of Mail. You need to start it from a terminal window in the following way:


/Applications/Mail.app/Contents/MacOS/Mail -LogActivityOnPort 993


(replace 993 by 143 if you talk on this port to your server)


Could someone with a different server than cyrus-imap 2.3 or exchange 2003 and without experiencing this problem so far please check if Mail even there runs in an IDLE/DONE/EXPUNGE loop or not?


In my settings, Prefs/Accounts/Advanced/Compact mailboxes automatically is checked and greyed out. This is important because if I uncheck move deleted message to trash and uncheck compact mailboxes I do not see this loop. For me it also takes some time until the loop starts, you need to wait until other activity of mail has finished. Sometimes I also need to focus/unfocus mail windows, select some mail folders or open and close Mail/About window to start the loop.


The output should look like this, pay attention to the almost no delay between IDLE and DONE:


WROTE Dec 04 13:34:15.492 [kCFStreamSocketSecurityLevelTLSv1_0] -- host:xxx -- port:993 -- socket:0x7fb06d652940 -- thread:0x7fb06d0e2eb0

17.3 EXPUNGE


READ Dec 04 13:34:15.777 [kCFStreamSocketSecurityLevelTLSv1_0] -- host:xxx -- port:993 -- socket:0x7fb06d652940 -- thread:0x7fb06d0e2eb0

* 1449 EXISTS

* 1 RECENT

17.3 OK Completed


WROTE Dec 04 13:34:15.787 [kCFStreamSocketSecurityLevelTLSv1_0] -- host:xxx -- port:993 -- socket:0x7fb06d652940 -- thread:0x7fb06d0e2eb0

18.3 IDLE


READ Dec 04 13:34:15.831 [kCFStreamSocketSecurityLevelTLSv1_0] -- host:xxx -- port:993 -- socket:0x7fb06d652940 -- thread:0x7fb06d0e2eb0

+ idling


WROTE Dec 04 13:34:15.832 [kCFStreamSocketSecurityLevelTLSv1_0] -- host:xxx -- port:993 -- socket:0x7fb06d652940 -- thread:0x7fb06d0c3810

DONE


READ Dec 04 13:34:15.875 [kCFStreamSocketSecurityLevelTLSv1_0] -- host:xxx -- port:993 -- socket:0x7fb06d652940 -- thread:0x7fb06d0c3810

18.3 OK Completed


WROTE Dec 04 13:34:15.875 [kCFStreamSocketSecurityLevelTLSv1_0] -- host:xxx -- port:993 -- socket:0x7fb06d652940 -- thread:0x7fb06d0c3810

19.3 EXPUNGE

....


Thanks!

Dec 12, 2015 2:44 AM in response to dazza321

I'm running 10.11.2 final now. With mail 9.2 (3112). No change.


I think the problem is not the EXPUNGE but the IDLE command. Sending an IDLE command and immediately abort it by a DONE command does not make sense in my eyes. Maybe a corrupted timer or a typo in the source code. Something like instead of waiting 10s before sending DONE it waits 10us...


Some sites request it's Mac Mail users to disable IDLE command in account settings now.... this might have advantage not only from server point of view.

From user point of view you should save battery power and network traffic if disabled...

Dec 30, 2015 11:58 AM in response to thaurog

I see the same behavior and log entries when setting up Yahoo mail on the new Macbook Pro I got for my wife, nor can she receive mail from Yahoo on her iPad or iPhone using the Apple mail app. There has not been the same issue with her Gmail account though. The really odd part to this issue is that her old Macbook can still receive mail at will and both are running the same version of El Capitan. I have tried deleting the mail folder and files to get a fresh start and tried copying the files and folders over from her old Macbook but nothing seems to work.

El Capitan Mail.app causes massive load on Cyrus IMAPd server

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.