I work as an IT guy in a law firm. I am recently asked to make a system wherein all the outgoing emails coming from our server to our clients will be put on hold first and wait for approval before it gets sent to the client.

Our mail server uses Exim (that's what it says in cPanel). I am planning to create filters where the outgoing emails will be forwarded to an editor account. Then, the editor will review and edit the contents of the email. When the editor already approves the email, it will then get sent to the client by the editor but still using the original sender in the "From:" and "Reply-To:" field.

I found some pointers from this site => http://www.devco.net/archives/2006/03/24/saving_copies_of_all_email_using_exim.php.

Once the filters are in place, I want to make a simple PHP interface for the editor to check the forwarded emails and edit them if necessary. The editor can then click on an "Approve" button that will finally deliver the message using the original sender.

I'm also thinking that maybe a PHP-less system will be enough. The editor can receive the emails from his own email client edit them and simply send the email as if he is the original sender.

  1. Is my plan feasible?
  2. Will there be issues that I have overlooked?
  3. Does it have the danger of being treated as spam by the other mailservers since I'll be messing up the headers?

Update: (April 6, 2012) The above questions are probably vague so here is a more specific question: 1. Can I possibly forward ALL outgoing messages going OUTSIDE our domain to be sent to another address and NOT to the actual recipient?


Is my plan feasible?

No, not really. The problem is (almost) anything in an email and email header can be changed and spoofed. Also anyone in your company can send email through any other server they like to (unless you block all their internet access, oh wait, you can't, they still have their smartphones etc.), seemingly coming from your company. If an employee in your company wants to avoid the scrutiny of the PHB they just use an outside email server (MTA).

You don't even have to worry about deliverability, say if the rDNS or EHLO greeting doesn't match the return-path. Just make the return-path's domain be the same as the outgoing MTA, but change the From: address to be from your company and almost everyone thinks it IS from your company.

Will there be issues that I have overlooked?

Yes, always. It is a pointless exercise and it is trivial to circumvent. To avoid yourself and your co-workers any headaches you need to explain this to your PHB and convince her or him that it's the wrong way to go. There are better ways to approach this. But those lie more in company policy, educating and hiring the right employees, and specific regulations than in extreme (and easy to avoid) measures limiting one's freedom. These kind of draconian measures have a knack of biting you back in the long run, almost without exception.

Does it have the danger of being treated as spam by the other mailservers since I'll be messing up the headers?

Not likely. Anything in the headers can be spoofed and changed (see above). That's pretty much the standard, MTAs add and change things in the headers all the time. Whether you do it as a human, or create a script to change things, the MTA doesn't really care. As long as it is validated and accepted by the MTA it should not have much more of a chance to be marked as spam (within reason of course).

Anyways, I don't want to think any more about this truly horrendous idea. :-(

  • Thanks for the comprehensive reply. I'm still trying to understand all of those. Actually, the monitoring isn't really about security or something. It's simply like part of the business workflow NOT a restriction to the employees. It's like employee => editor => client. The editor simply makes sure that everything in the employee's email is correct. It's not like spying on the employees. – dashmug Apr 6 '12 at 8:21
  • The employees are aware of this workflow. Maybe "moderating" is the more appropriate term instead of "monitoring". – dashmug Apr 6 '12 at 8:23
  • "..Also anyone in your company can send email through any other server they like to, seemingly coming from your company.." That's not a problem since SPF record added to domain. – Kondybas Apr 7 '12 at 8:15
  • SPF will not prevent this, SPF is a flawed concept to begin with, but that's a whole other story. – aseq Apr 8 '12 at 3:15

Unfortunately the answer to your question is yes, it is possible to implement such a system, but thankfully not easily.

Since you work for a law firm, I'm surprised that nobody has brought up the issues surrounding accountability and authenticity in setting up such a horrid system. When dealing with any form of communication, setting up a non-interactive middleman is a terrible idea and the results will quickly become comparable to playing broken telephone with your clients.

The quickest way to set up a system according to your specification is to run 2 instances of Exim; one instance to handle incoming messages and spool them to disk, and another instance to handle delivery of the spooled messages. The basic workflow for this situation would be as follows:

  1. Instance 1 of Exim handles new messages and writes them to a spool directory, say /var/spool/exim-in/
  2. A custom written application will read messages from /var/spool/exim-in/input/ and allow the editor to make the required changes or delete the message from the spool altogether. The application will then move the message into a new spooling directory, say /var/spool/exim-out/
  3. Instance 2 of Exim now handles delivery of the messages located in the spool directory /var/spool/exim-out/

Configuring Exim to do this isn't very difficult, and similar configurations can be garnered by viewing a typical MailScanner setup, which also separates Exim into two queues, with messages only being able to move from one queue to the other through MailScanner. See this page for a quick overview as to how MailScanner is configured with Exim.

Less trivial would be writing the application that would provide an interface for handling the editing and approval process that you require. There are an endless number of hurdles you would face if you attempted to write such an application, such as correct header parsing and dealing with complex MIME-type messages. You would essentially be re-writing a typical MUA such as Outlook or Thunderbird; unless of course, your editor person doesn't mind looking at raw SMTP data and HTML, in which case you can simply display it as plain text.

In short, don't do it. Not only is it a terrible idea, but you are bound to run into many implementation hurdles which make this endeavour completely infeasible for an individual developer.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.