Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My client runs a small business. This business has a small number of employees. They are currently hosted through GoDaddy for web and email.

For legal reasons the client would like to archive emails sent by their employees. Currently the emails are all done through POP3 so all the email is basically housed in files on individual machines (remember, small business).

It's been proposed an inexpensive solution to this would be to have all emails BCC'd to a main account so that conversations with the outside would could be archived and tracked. I have not investigated it myself personally but apparently GoDaddy can do something along these lines for all incoming email but not for outgoing email.

What would be the cheapest/easiest way to archive incoming/outgoing email from employees of a small company?

UPDATE:

I've modified the title to reflect employees not users. The goal of this is to archive sent emails for legal reasons. This is something the employees will be cognizant of and on board with.

The bottom line here is to basically emulate a feature of a larger-class platform through a smaller, cheaper platform. If the answer is "can't do it, buy an Exchange license" that's fine.

My apologies for phrasing this so poorly. I understand why there was so much confusion.

share|improve this question

migrated from superuser.com May 4 '10 at 1:01

This question came from our site for computer enthusiasts and power users.

    
In your defense, this is a site to ask technical questions and those of us (myself included) that responded at least in part with non-technical comments weren't being too helpful. Your update helps but the original question was pretty clear. I think we're all also employees in addition to being geeks and many of us have had controlling, micromanaging bosses and your question perhaps touched a nerve. :) –  icky3000 May 5 '10 at 16:09
add comment

8 Answers 8

I won't take part in the debate, but here is the how-to for Postfix - in the main.cf file, add this line:

sender_bcc_maps = hash:/etc/postfix/conf/sender_bcc

and into the sender_bcc file:

@yourdomain.com the_bcc_account@yourdomain.com

Thus, every time someone from the domain sends an email, the bcc_account will receive it

share|improve this answer
3  
+1 for the only technical response to the asker's question. –  gravyface May 4 '10 at 20:33
    
-1 for being not legally binding an thus worthless ;) –  TomTom May 5 '10 at 16:09
    
I'll tell you why I said : "I won't take part of the debate". I manage a customer service's mail platform. They needed to see everybody's sent mails, so if someone deals with a customer, the guy from the customer service must be able to see what others have written. (And sometimes when you call an agency, they tell you "ahh I see that my colleague, blah blah"). So there ain't any legal issue here and it's a similar case ;) –  Razique May 6 '10 at 6:59
add comment

Many companies have legal obligations that require they keep a copy of messages sent and received by their employees. Because this is such a common request, pretty much every viable, business-class email platform has some form of archiving either built in or they provide the necessary hooks for third parties to add those features.

If GoDaddy does not provide archiving as a hosted service upgrade, you have limited options. Many other mail hosters do provide this service for an additional fee per mailbox. Typically, the company compliance officer(s) is given access to a web interface through which they can do discovery and review messages and typically there are some basic filters/reports built in.

It sounds like you're looking for something less formal and more ad-hoc and that the employer doesn't have legal reasons for this access but is instead a control-hungry pig. Luckily for his employees, implementing something like this at the client level is tough. I can imagine some ways of doing it but without knowing a lot more about the customer (are they using GoDaddy's POP/IMAP hosting or their white label Exchange hosting?, how are the clients configured for outbound mail? etc), I can't give you any more info.

share|improve this answer
    
+1 for the only one in a long list of questionable posts who actually focused on legal requirements first ;) –  TomTom May 4 '10 at 7:57
    
TomTom: there was no mention of legal requirements, nor did he say "archiving" -- his question asked if he could automatically BCC the users' emails to someone, presumably without their knowledge. This is not the same as "archiving" which could be trivial implemented with something like fetchmail periodically grabbing their IMAP mail. It's a poorly phrased question, and one that strikes a nerve with most people as it appears to be an unethical request. Note: the asker still hasn't mentioned archiving in his question, so please refrain from calling us idiots for no reason. –  gravyface May 4 '10 at 20:20
    
@gravyface: You're right, this was a poorly phrased question from the word go. My apologies. Really, all the client is trying to do is emulate a function found in a more expensive solution like Exchange. Nothing more. All the employees are on board with this. –  Schnapple May 4 '10 at 20:59
add comment

There can be many reasons for this - in many jurisdictions emails are or can be business documents and thus must be kept for sometimes x years.

Anyhow, your client needs to get real here. BCC to him is useless - if it is for legal reasons. He needs to get a business email platform with archiving functions. THis rules out cheapo and interesting enough pretty much every Linux MTA.

The client must:

  • BLock all SMTP conversation on his firewalls to make sure this is not bypassed
  • Run all email through a proper class email system. If he is too cheap to pay for Exchange himself (SBS is relatively cheap, seriously), he can do so for example by renting exchange mailboxes from a hosting provider WITH THE PROPER ARCHIVING FEATURES.

It really runs down to the need of a business platform. GoDaddy, pretty obviously, does not provide such features, so the client has to move on. Like always in life, the cheapest most crappy offer may simply not do what is needed ;)

That being said, there are also ethican considerations. In most jurisdictions it is illegal for the boss to do get readable copies without the employees being notified about it (make them sign a paper they are informed). While the boss has the right to read all business emails, notification of employees that correspondence is monitored may be required. This is different for a proper archiving solution, as this merely makes sure emails are kept, but does not automatically allow access to them.

share|improve this answer
1  
Why does this rule out a Linux MTA? What is the problem with using an MTA (Linux or not) which just keeps a copy of every email sent? –  sleske May 4 '10 at 22:13
    
A copy is not an archive. Archives must follow certain rules to be court legal - one of hem being tha you can nto easily delete stuff. A copy in a mailbox will get you in court trouble immediately. Can you proove you did not insert anything after the fact, or delete part of it? Proper archive systems are hard to manipulate. –  TomTom May 5 '10 at 3:50
add comment

I work for a company which has legal obligations to archive all of our email for multiple years. In our case, we're required to show that our system captures everything sent to our users. Something like a BCC would definitely fail since this is a manual method which could leave out email intentionally or accidentally.

We chose to have another company (Microsoft Forefront) filter and archive our email. From a regulatory standpoint it was just easier to show that we were complying with the full legal requirements. If your client has these same types of legal obligations and is attempting to do this on the cheap, I think he'll find that the hassles associated with internal archiving far exceed the costs of outsourcing it. This is especially true if he's in a highly regulated industry.

This might require moving hosts. I'd first start by getting a good understanding of the legal obligations then look at how you would go about proving you're complying with the law during an audit. If you're outsourcing the entire mail system already, it might make sense to just move the email to a company specific to that industry. For example, the financial industry has a ton of providers that have email hosting, archiving, filtering, and compliance testing all rolled into one. However, without a clear understanding of your legal requirements, your client could be at risk which is bad for business.

share|improve this answer
add comment

I just implemented a mail archiving solution for a client a few weeks ago. We went with a 3rd party called Smarsh. Their primary focus is the finance industry (Sarbanes-Oxley and the like). In this case you would have to switch to hosting your email on their servers since you don't have an onsite email server. Rates are around $15-20/user/month. Once you do, they automatically archive all incoming and outgoing emails. You can also upload employee emails to your online archive using PST files.

You can find them here: http://smarsh.com. Alternatively you can host your own email server onsite and change your DNS/Email settings so that all incoming and outgoing emails go through Smarsh.

You may want to do some comparison shopping by Google-ing "email archiving" and see the various companies out there.

share|improve this answer
add comment

Ignoring the ethical issue (ethics are a massive variable, not a constant), there may also be legal issues but that will depend entirely on local laws. Yours will almost certainly be different to those that apply to me but I suggest this should be checked. If local laws prohibit this then the rest becomes, or at least should become, a non-issue.

Whether what you propose is even possible is going to depend on a bunch of things, such a the software being used, but it would have to be set up by the host. Contact GoDaddy about this. If they cannot or will not help then you can either accept that as the end of the story or look for a provider that will.

share|improve this answer
    
YOu miss ethical and legal issues here. In most jurisdictions businesses are required to keep copies for x years of all business documents, and - emails are part of that. –  TomTom May 4 '10 at 7:55
    
@TomTom, didn't you read my comment before typing yours? Try reading the first paragraph. Also, don't make sweeping statements like "in most jurisdictions" unless you actually KNOW the legal requirements that apply everywhere, rather than just your little patch. Remember, this is a global web site. –  John Gardeniers May 4 '10 at 8:40
    
So what? What funny ethics to people have in your country that a business is not allowed to monitor it's own internal systems? As long as employees are notified, there is no enthical reason, in no jurisdiction. –  TomTom May 4 '10 at 8:52
    
TomTom is obviously on a troll rampage here: he's conveniently twisting the asker's question to mean "archiving for legal requirements" instead of "my boss wants to spy on his employees" which is an invasion of privacy in many jurisdictions too. There's no mention of archiving at all in the original question, the boss wants to snoop in real-time on his employees email activity. That's all. –  gravyface May 4 '10 at 20:29
    
@gravyface, I read the question the same way, even though the OP has now stated that archiving is the objective. Nevertheless, TomTom's comments still indicate he/she didn't actually read my answer before ranting. –  John Gardeniers May 4 '10 at 21:34
add comment

EDIT

Since the asker has now clarified that he's interested in archiving, not BCCing, you can do this out-of-the-box with Outlook without Exchange: by setting up an IMAP or POP3 account in Outlook to the GoDaddy account, Outlook will store the mail in a .PST file; you can also enable auto-archiving of older items, which will create an archive.pst file. Probably best would be to store these on a mapped drive (you can do this with group policy) and back it up accordingly.

If you'd like a centralized method (or the users aren't using Outlook), you can implement something like fetchmail to periodically fetch the users' mail from GoDaddy and storing it locally to disk; it's quite robust and supports several formats.

share|improve this answer
1  
You need to start listening to reality. It is required by law. Emails are business documents, can conclude contract negotiations and thus fall under retention laws. Exchange actually has archiving functions since 2007. Check microsoft.com/exchange/2010/en/us/Archiving-and-retention.aspx –  TomTom May 4 '10 at 7:56
    
Yes this has been supported on Exchange for a while now, and if 2007 didn't cut it - 2010 can dump everything into a separate mailbox as well. –  Oskar Duveborn May 4 '10 at 8:08
    
Archiving yes, "automatically BCCing to someone"? no. –  gravyface May 4 '10 at 20:05
    
@gravyface yeah, archiving is the goal here, not spying. The reason BCC was brought up was because it's a cheap solution. I phrased the question poorly and I understand why it sounded flaky before. –  Schnapple May 4 '10 at 21:01
    
Archiving of all mail, in both directions, is fully supported on Exchange 2003 as well. –  John Gardeniers May 4 '10 at 21:26
show 1 more comment

I am a late-comer, my apologies.

First, if the client has these kinds of issues, then the GoDaddy hosting is just not appropriate.

Second, as TomTom alluded to in several places, bcc to another account may not may not stand up to legal challenge. For other uses it should be fine, particularly if the bcc_account is backed up frequently. But to be legally above board, a legitimate write-only archiving solution should be employed.

My primary recommendation is to go to a hosted exchange solution, and include archiving. At Rackspace, it will cost $13/user/month including archiving.

My secondary recommendation is to go with either MS Exchange, MS Small Business Server or Ipswitch iMail. See my answer to a related question about Exchange in a small network for more information.

Hosted exchange is far more cost-effective than either MS solution, and likely beats Ipswitch as well.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.