Skip to main content
Sign in
Deutsch Español Français Italiano

SMTP Journaling

Email journaling is the process of forwarding a copy of each message in transit from the mail server, sending it to the LibraCyber Email Archiver. The Archiver receives the journaling emails on port 25 using SMTP protocol and archives them through a SMTP listener. The main benefit of using journaling is compliance, because each email is archived in real time.

Authentication

Four different authentication methods are available to identify the incoming emails:

  • IP: the incoming emails are identified by the source IP, i.e. the IP address of the server that has sent the journaling email to the Archiver. This authentication method is particularly useful when you are sure that all the emails coming from the a specific server should be all archived within the same LibraCyber Email Archiver tenant.
  • IP and domain: this method is useful when a single mail server can send to the Archiver emails which should be archived withing different tenants of the LibraCyber Email Archiver. By specifying the domain of the envelope recipient you can disambiguate and associate the emails to the right tenant. For example, suppose that two tenants are configured on the Archiver: tenantA, archiving emails of domainA.com, and tenantB, archiving emails of domainB.com. The mail server is always the same, so all the journaling emails are coming, for example, from IP address 10.1.2.3. In order to disambiguate the tenant which each email should be assigned to, you can configure two different listener: on tenantA you can configure a listener for IP 10.1.2.3 and domain domainA.com; on tenantB you can configure a listener for IP 10.1.2.3 and domain domainB.com.
  • SMTP: with this method, emails are authenticated with the username and the password that the sender used for connecting to the archiver SMTP (also known as SMTP Auth). If the same server should send emails for different tenants on the LibraCyber Email Archiver, you can configure multiple listeners on different tenants.
  • SPF: the domain of the envelope sender is validated via SPF in order to associate each email to its tenant. This autentication method is particularly useful when using Microsoft 365 or Google Workspace.

Difference between SMTP Journaling and SMTP Forwarding

SMTP Forwarding is just a plain email forward to the Archiver. The email server is configured to forward all the emails in transit to the LibraCyber Email Archiver. Technically this is equivalent to adding the Archiver as a BCC (blind carbon-copy, i.e. a hidden additional recipient).

SMTP Journaling is a little bit more complex: The original emails are forwarded to the Archiver as an attachment and in the body of the journaling email there are some additional information, for example the internal mailboxes the email has been delivered to (useful especially when the recipient email address is shared between multiple mailboxes). Only some email servers support SMTP journaling (Exchange and M365 for example). If your mail server supports SMTP journaling, then you can configure your Archiver Listener with type “Journaling”. If you are just using plain email forwarding then choose “Forwarding” as the listener type.

Allowed inactivity hours

The LibraCyber Email Archiver periodically checks if the listeners you have configured are actively used to archive new emails.

  If the Archiver detects that a listener is inactive, a notification is sent to the administrators. The allowed inactivity time before sending the email notification is customizable and the default value is 48 hours.

Listener uniqueness

Please note that you cannot configure two or more listeners with the same authentication method configuration. This is because listeners are used by the LibraCyber Email Archiver the associate each journaling emails to the correct tenant and this association must be unique.

Related articles