How could one archive all emails sent from employees?

I won't take part in the debate, but here is the how-to for Postfix - in the main.cf file, add this line:

sender_bcc_maps = hash:/etc/postfix/conf/sender_bcc

and into the sender_bcc file:

@yourdomain.com [email protected]

Thus, every time someone from the domain sends an email, the bcc_account will receive it

Many companies have legal obligations that require they keep a copy of messages sent and received by their employees. Because this is such a common request, pretty much every viable, business-class email platform has some form of archiving either built in or they provide the necessary hooks for third parties to add those features.

If GoDaddy does not provide archiving as a hosted service upgrade, you have limited options. Many other mail hosters do provide this service for an additional fee per mailbox. Typically, the company compliance officer(s) is given access to a web interface through which they can do discovery and review messages and typically there are some basic filters/reports built in.

It sounds like you're looking for something less formal and more ad-hoc and that the employer doesn't have legal reasons for this access but is instead a control-hungry pig. Luckily for his employees, implementing something like this at the client level is tough. I can imagine some ways of doing it but without knowing a lot more about the customer (are they using GoDaddy's POP/IMAP hosting or their white label Exchange hosting?, how are the clients configured for outbound mail? etc), I can't give you any more info.

I just implemented a mail archiving solution for a client a few weeks ago. We went with a 3rd party called Smarsh. Their primary focus is the finance industry (Sarbanes-Oxley and the like). In this case you would have to switch to hosting your email on their servers since you don't have an onsite email server. Rates are around $15-20/user/month. Once you do, they automatically archive all incoming and outgoing emails. You can also upload employee emails to your online archive using PST files.

You can find them here: http://smarsh.com. Alternatively you can host your own email server onsite and change your DNS/Email settings so that all incoming and outgoing emails go through Smarsh.

You may want to do some comparison shopping by Google-ing "email archiving" and see the various companies out there.

There can be many reasons for this - in many jurisdictions emails are or can be business documents and thus must be kept for sometimes x years.

Anyhow, your client needs to get real here. BCC to him is useless - if it is for legal reasons. He needs to get a business email platform with archiving functions. THis rules out cheapo and interesting enough pretty much every Linux MTA.

The client must:

• BLock all SMTP conversation on his firewalls to make sure this is not bypassed
• Run all email through a proper class email system. If he is too cheap to pay for Exchange himself (SBS is relatively cheap, seriously), he can do so for example by renting exchange mailboxes from a hosting provider WITH THE PROPER ARCHIVING FEATURES.

It really runs down to the need of a business platform. GoDaddy, pretty obviously, does not provide such features, so the client has to move on. Like always in life, the cheapest most crappy offer may simply not do what is needed ;)

That being said, there are also ethican considerations. In most jurisdictions it is illegal for the boss to do get readable copies without the employees being notified about it (make them sign a paper they are informed). While the boss has the right to read all business emails, notification of employees that correspondence is monitored may be required. This is different for a proper archiving solution, as this merely makes sure emails are kept, but does not automatically allow access to them.

I work for a company which has legal obligations to archive all of our email for multiple years. In our case, we're required to show that our system captures everything sent to our users. Something like a BCC would definitely fail since this is a manual method which could leave out email intentionally or accidentally.

We chose to have another company (Microsoft Forefront) filter and archive our email. From a regulatory standpoint it was just easier to show that we were complying with the full legal requirements. If your client has these same types of legal obligations and is attempting to do this on the cheap, I think he'll find that the hassles associated with internal archiving far exceed the costs of outsourcing it. This is especially true if he's in a highly regulated industry.

This might require moving hosts. I'd first start by getting a good understanding of the legal obligations then look at how you would go about proving you're complying with the law during an audit. If you're outsourcing the entire mail system already, it might make sense to just move the email to a company specific to that industry. For example, the financial industry has a ton of providers that have email hosting, archiving, filtering, and compliance testing all rolled into one. However, without a clear understanding of your legal requirements, your client could be at risk which is bad for business.