I've searched the serverfault and Google, but did not find anything related to my question yet.

So, I have a customer that wants to read all emails sent by his employees. I've configured a VPS with dovecot and sendmail. So he wants to controlthe quality of service by monitoring all the sent emails from our server.

What the solution may be?

P.S.: VPS is on Ubuntu. ISPmanager installed and Roundcube as the webmail agent.

  • Artem, welcome to SF. I hope you'll forgive me for pointing out that local etiquette is that, once you're happy with an answer to your question, you accept it by clicking the "tick" outline next to it. This drives the SF reputation system for both you and the author of that answer. I wouldn't presume to suggest that this question has been fully-answered, yet, but you've asked one other question on SF, and that one has some pretty good answers, one of which you might wish to accept. My apologies if you already know all this. – MadHatter Jun 21 '13 at 9:00
  • I've solving somewhat similar task — to intercept all outgoing mail from web service host. Yes indeed I may do this at application level, but I have both Yii and Django sending mails, so easiest place to configure is OS level. – spacediver Nov 10 '13 at 22:17

The short answer is "you can't".

The longer answer, from the sendmail FAQ, is

How can I automatically copy messages based on sender or recipient addresses?

It would require custom programming [...] Note that no such feature has been added to sendmail. When asked about this one of the sendmail developers said it was "because we still believe a bit in privacy."

Basically, the person who's asking you to do this is foolish to believe that it can be done. Sure, you could use a different MTA, maybe something written by people who don't care about privacy. But unless he proxies and screens all outbound HTTP and blocks all other outbound TCP including HTTPS, and all outbound UDP full-stop, he hasn't a hope of preventing a determined employee from emailing something, somehow.

Moreover, although we can't do legal advice here, you may find that computer privacy legislation in your jurisdiction forbids or tightly regulates email interception, and it is possible that you could find yourself liable for what you implement.

30,000-foot view: this is a social problem. Don't look for a technical solution. That never works.

  • Well, I am not the fan of reading other emails. This was just technical requirement form the customer. – Max Krizh Jun 21 '13 at 9:16
  • 1
    I hear you, but part of our job as consultants (actually, quite a big part) is to know when we're being asked to implement something stupid, and to talk the customer out of it. – MadHatter Jun 21 '13 at 9:18
  • 1
    If it's a social problem, it's quite strange to see purposeful technical limitation introduced by sendmail devs. Why don't they sell unsharpened knives as well? – spacediver Nov 10 '13 at 22:15
  • It's not a limitation they've introduced, it's a capability they've chosen not to add. Sendmail also doesn't play tetris; that's also not a deliberate limitation. – MadHatter Nov 10 '13 at 22:19
  • 1
    In many countries it is a LAW that all financial related electronic communications be archived and retained secure for set time periods. Now while a company cannot block all messages it can be limited from damages by archiving per regulations all official channels of communication. If an employee figures out a way to bypass official channels then he is the target and the company is less open to prosecution and lawsuites. Sometimes it is very necessary to journal messages. Enron and Bernie Madoff showed this. Holier than thou programmers are not needed. Ones that implement requirements are. – Bill Rosmus Sep 17 '15 at 18:07

sendmail : How to copy outgoing messages using milter

Consider using an archiving milter:


In standard non set root uid installations milter can process/archive all messages passing via sendmail server.

P.S. I do consider reading employees emails by the employer WITHOUT PRIOR WRITTEN WARNING as unacceptable.

  • I would do this with MIMEDefang – adamo Jun 24 '13 at 12:37
  • MIMEDEfang may be an option worth to consider for "all in one" solutions e.g. archiving and anti_spam+anti_virus with in SMTP session rejects. – AnFi Jun 24 '13 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.