How could one archive all emails sent from employees?

Question

My client runs a small business. This business has a small number of employees. They are currently hosted through GoDaddy for web and email.

For legal reasons the client would like to archive emails sent by their employees. Currently the emails are all done through POP3 so all the email is basically housed in files on individual machines (remember, small business).

It's been proposed an inexpensive solution to this would be to have all emails BCC'd to a main account so that conversations with the outside would could be archived and tracked. I have not investigated it myself personally but apparently GoDaddy can do something along these lines for all incoming email but not for outgoing email.

What would be the cheapest/easiest way to archive incoming/outgoing email from employees of a small company?

UPDATE:

I've modified the title to reflect employees not users. The goal of this is to archive sent emails for legal reasons. This is something the employees will be cognizant of and on board with.

The bottom line here is to basically emulate a feature of a larger-class platform through a smaller, cheaper platform. If the answer is "can't do it, buy an Exchange license" that's fine.

My apologies for phrasing this so poorly. I understand why there was so much confusion.

Answer 1

I won't take part in the debate, but here is the how-to for Postfix - in the main.cf file, add this line:

sender_bcc_maps = hash:/etc/postfix/conf/sender_bcc

and into the sender_bcc file:

@yourdomain.com [email protected]

Thus, every time someone from the domain sends an email, the bcc_account will receive it

Answer 2

Many companies have legal obligations that require they keep a copy of messages sent and received by their employees. Because this is such a common request, pretty much every viable, business-class email platform has some form of archiving either built in or they provide the necessary hooks for third parties to add those features.

If GoDaddy does not provide archiving as a hosted service upgrade, you have limited options. Many other mail hosters do provide this service for an additional fee per mailbox. Typically, the company compliance officer(s) is given access to a web interface through which they can do discovery and review messages and typically there are some basic filters/reports built in.

It sounds like you're looking for something less formal and more ad-hoc and that the employer doesn't have legal reasons for this access but is instead a control-hungry pig. Luckily for his employees, implementing something like this at the client level is tough. I can imagine some ways of doing it but without knowing a lot more about the customer (are they using GoDaddy's POP/IMAP hosting or their white label Exchange hosting?, how are the clients configured for outbound mail? etc), I can't give you any more info.

Answer 3

I just implemented a mail archiving solution for a client a few weeks ago. We went with a 3rd party called Smarsh. Their primary focus is the finance industry (Sarbanes-Oxley and the like). In this case you would have to switch to hosting your email on their servers since you don't have an onsite email server. Rates are around $15-20/user/month. Once you do, they automatically archive all incoming and outgoing emails. You can also upload employee emails to your online archive using PST files.

You can find them here: http://smarsh.com. Alternatively you can host your own email server onsite and change your DNS/Email settings so that all incoming and outgoing emails go through Smarsh.

You may want to do some comparison shopping by Google-ing "email archiving" and see the various companies out there.

Answer 4

There can be many reasons for this - in many jurisdictions emails are or can be business documents and thus must be kept for sometimes x years.

Anyhow, your client needs to get real here. BCC to him is useless - if it is for legal reasons. He needs to get a business email platform with archiving functions. THis rules out cheapo and interesting enough pretty much every Linux MTA.

The client must:

• BLock all SMTP conversation on his firewalls to make sure this is not bypassed
• Run all email through a proper class email system. If he is too cheap to pay for Exchange himself (SBS is relatively cheap, seriously), he can do so for example by renting exchange mailboxes from a hosting provider WITH THE PROPER ARCHIVING FEATURES.

It really runs down to the need of a business platform. GoDaddy, pretty obviously, does not provide such features, so the client has to move on. Like always in life, the cheapest most crappy offer may simply not do what is needed ;)

That being said, there are also ethican considerations. In most jurisdictions it is illegal for the boss to do get readable copies without the employees being notified about it (make them sign a paper they are informed). While the boss has the right to read all business emails, notification of employees that correspondence is monitored may be required. This is different for a proper archiving solution, as this merely makes sure emails are kept, but does not automatically allow access to them.

Answer 5

I work for a company which has legal obligations to archive all of our email for multiple years. In our case, we're required to show that our system captures everything sent to our users. Something like a BCC would definitely fail since this is a manual method which could leave out email intentionally or accidentally.

We chose to have another company (Microsoft Forefront) filter and archive our email. From a regulatory standpoint it was just easier to show that we were complying with the full legal requirements. If your client has these same types of legal obligations and is attempting to do this on the cheap, I think he'll find that the hassles associated with internal archiving far exceed the costs of outsourcing it. This is especially true if he's in a highly regulated industry.

This might require moving hosts. I'd first start by getting a good understanding of the legal obligations then look at how you would go about proving you're complying with the law during an audit. If you're outsourcing the entire mail system already, it might make sense to just move the email to a company specific to that industry. For example, the financial industry has a ton of providers that have email hosting, archiving, filtering, and compliance testing all rolled into one. However, without a clear understanding of your legal requirements, your client could be at risk which is bad for business.

Answer 6

Ignoring the ethical issue (ethics are a massive variable, not a constant), there may also be legal issues but that will depend entirely on local laws. Yours will almost certainly be different to those that apply to me but I suggest this should be checked. If local laws prohibit this then the rest becomes, or at least should become, a non-issue.

Whether what you propose is even possible is going to depend on a bunch of things, such a the software being used, but it would have to be set up by the host. Contact GoDaddy about this. If they cannot or will not help then you can either accept that as the end of the story or look for a provider that will.

Answer 7

EDIT

Since the asker has now clarified that he's interested in archiving, not BCCing, you can do this out-of-the-box with Outlook without Exchange: by setting up an IMAP or POP3 account in Outlook to the GoDaddy account, Outlook will store the mail in a .PST file; you can also enable auto-archiving of older items, which will create an archive.pst file. Probably best would be to store these on a mapped drive (you can do this with group policy) and back it up accordingly.

If you'd like a centralized method (or the users aren't using Outlook), you can implement something like fetchmail to periodically fetch the users' mail from GoDaddy and storing it locally to disk; it's quite robust and supports several formats.

Answer 8

I am a late-comer, my apologies.

First, if the client has these kinds of issues, then the GoDaddy hosting is just not appropriate.

Second, as TomTom alluded to in several places, bcc to another account may not may not stand up to legal challenge. For other uses it should be fine, particularly if the bcc_account is backed up frequently. But to be legally above board, a legitimate write-only archiving solution should be employed.

My primary recommendation is to go to a hosted exchange solution, and include archiving. At Rackspace, it will cost $13/user/month including archiving.

My secondary recommendation is to go with either MS Exchange, MS Small Business Server or Ipswitch iMail. See my answer to a related question about Exchange in a small network for more information.

Hosted exchange is far more cost-effective than either MS solution, and likely beats Ipswitch as well.