Google Apps BCC all Inbound and Outbound email

Question

I am working with a company on a migration from a standard POP3 email provider over to Google Apps premier.

The owner of the company currently receives copies of all INBOUND and OUTBOUND email into Outlook by way of server aliases (inbound) and outlook settings (outbound). It is a bit kludgey.

Upon the transition to Google Apps, I need to have a equivalent system in place. I have lookd high and low, but not yet found the answer.

The google auditing API looked very promising, but since it attaches the raw message as a text attachment, that is not equitable.

Update:

After discussing this with Postini Support, there is indeed a way to accomplish it. Essentially, you setup an inbound and an outbound content filter that matches everything, and instruct Postini to copy each message to a specific quarantine. Said quarantine should be a user that is never know or used, otherwise it may end up mixing good mail with spam. Finally, an admin can release the quarantine to HIS mailbox, therefore resulting in getting a copy of everything.

The inconvenient part is that there is no automatic delivery. I am looking into ways to automate that...

Solution

It is possible using the routing options available in Google apps and a second mail server to save a copy of all messages provided you have either the Premier or Education edition. Basically you have to setup an inbound and outbound gateway and you can run everything through another mail server which along with some advanced rules can result in a spare copy of the message being saved on the email archive server, or you can forward it to another address somewhere.

See these two pages for details about setting up the mail routing in the Google interface.

• http://www.google.com/support/a/bin/answer.py?hl=en&answer=60730
• http://www.google.com/support/a/bin/answer.py?hl=en&answer=178333

There are some downsides to setting up an external archive system.

• Since incoming email will be delivered through your mail server Google will not see the actually sender. Google's SPAM filter will be a lot less effective. You will probably need to run a SPAM filter on your gateway/archive box.
• This setup is far more complex and likely to break. Kludgey, describes this method as well.
• Trouble-shooting in the case of failures or problems will be a lot more difficult since there are many places for things to break.
• This requires you to have a spare email server setup somewhere with enough capacity to capture all the email you want to save.
• You must have a very good understanding of how to setup message relaying. On the gateway you will need to set it up to allow some relaying, but you must only allow relaying under the right conditions or your server will be abused by spammers.

I am not aware of any simple tutorials for doing this so you are going have to know your favorite MTA pretty well to get all the routing, relaying, and message archiving setup properly.

Comments

[Will Dixon]

Please make sure that all users of the system are aware of the fact that their communications are being monitored, which may or may not be in violation of your local laws on wiretapping (depending where you live). Also make sure that whoever's getting these duplicates isn't sending "read receipts" or you may end up leaking the fact that you're spying on them.

[Zoredache]

BTW, I have actually set this up, and used it in a couple places, it can be made to work. Using Google solution is probably much easier.

[gahooa]

I agree that this can be done, but not without the disadvantages you mentioned, particularly replacing part of Google's infrastructure (which is a primary reason to be there in the first place). Thanks for the specific pointers!

[Falcon Momot]

It is nice when you at least provide a summary of what the solution linked is. Links become dead.