Want to save all outgoing email to read later...

[RandyL712]

I have a customer who wants to monitor all outgoing email (to see what his employees are sending their customers). What's the easiest way to set this up? If it's possible, probably invisibly forwarding all outgoing email to his private email box would work.

[JPC-Martin]

Some webmail and mail clients like Horde provide option to cc every outgoing mail automatically.

There is another way to check outgoing emails from some specific email/domain that is check email logs from server and read their body but this is tough job and you must have root access for this.

Also there is many software availble on the internet , do this job efficiently. i.e Spector CNE , you can also google on such tools

[RandyL712]

I may not have explained the need well.

We host a domain - DOMAIN.com - and the owner of that company wants to be able to read every outoging email his employees send, so that he can monitor the level of customer service they're providing.

And of course, we want to do it as easily as possible. If it's possibly to secretly forward every outgoing email into a private email box that he has access to, or something like that, that'd be perfect. We're open to other suggestions on how to accomplish this.

Thanks!

[Vinayak]

Login to WHM as root:

Main >> Service Configuration >> Exim Configuration Editor

Check the name & location of "System Filter File", mine is at
/usr/local/cpanel/base/eximacl/antivirusandspam.exim

Now edit this file in your favorite editor and insert this code:

For collecting outgoing mails only

### START OF OUTGOING MAIL FORWARDING ###

if first_delivery
   and ("$h_from:" contains "user@domain.com")
then
   unseen deliver "monitor@domain.com"
endif 

### END OF OUTGOING MAIL FORWARDING ###

For collecting both outgoing and incoming mails:

### START OF OUTGOING + INCOMING MAIL FORWARDING ###

if first_delivery
   and ("$h_to:, $h_cc:" contains "user@domain.com")
   or ("$h_from:" contains "user@domain.com")
then
   unseen deliver "monitor@domain.com"
endif

### END OF OUTGOING + INCOMING MAIL FORWARDING ###

Above method will silently/invisibly forward mails to the mail ID monitor@domain.com (change it to actual mail ID where you want all the mails to be delivered, this could be an internal or external mail ID)

Chane user@domain.com to actual mail ID that is to be monitored.

You have to make one entry per user between the comments.

Like I have

### START OF OUTGOING + INCOMING MAIL FORWARDING Company-1###
Entry - 1

Entry - 2

Entry - 3
### END OF OUTGOING + INCOMING MAIL FORWARDING Company-1 ###

### START OF OUTGOING + INCOMING MAIL FORWARDING Company-2###
Entry - 1

Entry - 2

Entry - 3
### END OF OUTGOING + INCOMING MAIL FORWARDING Company-2 ###

Important: If the system filter mentioned in WHM is "/etc/cpanel_exim_system_filter_custom" change it to something like "/etc/cpanel_exim_system_filter_custom", otherwise cPanel update will overwrite it.

Don't forget to restart Exim.

[RandyL712]

Where in the file should that code be placed? I put it at the bottom and it didn't work.

Also - can I simply put a domain name to catch all emails? such as:

### START OF OUTGOING + INCOMING MAIL FORWARDING ###

if first_delivery
   and ("$h_to:, $h_cc:" contains "@domain.com")
   or ("$h_from:" contains "@domain.com")
then
   unseen deliver "monitor@domain.com"
endif

### END OF OUTGOING + INCOMING MAIL FORWARDING ###

I want to catch ALL email to/from this domain. (From being most important)

THANK YOU!

[Vinayak]

You must already be having an entry

if not first_delivery
then
  finish
endif

So put the filter code below that. Save the file, and restart exim

service exim restart

Yes you can use "@domain.com"

[RandyL712]

Working great, thanks so much.

[sphost]

Important: If the system filter mentioned in WHM is "/etc/cpanel_exim_system_filter_custom" change it to something like "/etc/cpanel_exim_system_filter_custom", otherwise cPanel update will overwrite it.

Don't forget to restart Exim.

can you tell me how to do it either through WHM or ssh?

thanks

[RandyL712]

He already told you how to do it during the shell session:

restart exim

service exim restart

In WHM there are restart links at the bottom of the left navigation bar.

[crazyaboutlinux]

this script is only a part of particular domain e.g domain.com but what about other domains which are hosted & if they want same

in my server there are more than 150 domains are hosted e.g mydomain.com , mydomain.org , testdomain.com , testing.com

In mydomain.com there 5 email accounts
test1@mydomain.com
test2@mydomain.com
test3@mydomain.com
test4@mydomain.com
test5@mydomain.com

all email which are sent from those ids must be copy to monitor@mydomain.com

same thing for testdomain.com
test1@testdomain.com
test2@testdomain.com
test3@testdomain.com
test4@testdomain.com
test5@testdomain.com

all email which are sent from those ids must be copy to Owner@testmydomain.com

same thing for testing.com , mydomain.org

[Vinayak]

Nilesh, you need to repeat those steps for each domain that you want to monitor.

[crazyaboutlinux]

Nilesh, you need to repeat those steps for each domain that you want to monitor.

but there are more than 200 domains hosted on our server

how can is this problem to do this ?

[Vinayak]

Does all the 200 domain owners need this to be done?

[crazyaboutlinux]

Does all the 200 domain owners need this to be done?

yes they want

[Vinayak]

Well then I am afraid, you have to repeat the steps for all the domains.