What is email journaling and why do you need it?

When people talk about keeping emails, they can use three terms: backing up, archiving, and journaling. Some use the words interchangeably, not realising that these are three distinct processes. You can save your organisation time, money and trouble by understanding their different meanings.

Backing up, archiving, and journaling

Email backup is a short-term way to help with disaster recovery. You may periodically save emails to a server or hard drive for a few days or weeks – this is backing them up. Importantly, messages can be deleted in between backups. So, this is not a good way to retain important emails for a long time.

Journaling is the copying of particular outgoing and incoming emails in your mail server. It creates a journal, or record, of these messages. It’s available in Exchange and Lotus Notes Domino. You can also journal with other email systems, such as Gmail, using facilities like “Mailbox Reader”.

Email archiving is what you do to retain journaled emails for the long term: storing them in a secure repository, or archive.

Why journaling is important

Your organisation’s email retention or archival strategy defines which messages you need to keep, where to keep them, and how long they need to be kept. Normally, you have to retain an email because:

• your industry (e.g. financial services) says you must keep it for a certain number of years
• you might need it for e-Discovery, as evidence of who said what, in case of any future litigation
• you’ve decided it could have some other future value (e.g. a business lead).

Journaling creates the true, original or ‘golden copy’ of an email that needs to be retained.

Microsoft introduced the feature to help businesses stay compliant. Email journaling happens before archiving, and it’s important not to confuse the two, as the real business example below shows us.

How journaling works

Let’s consider Microsoft 365/Exchange online. It enables you to journal messages sent to or received by a specific user, a group, or an entire organisation.

If you go to Exchange admin center, then, under Compliance Management, click on ‘journal rules’, you can create rules for whose emails and which of them to journal, and where you want them to be sent – an email address which must be outside your organisation’s Microsoft 365.

(With an on-premise Exchange Server, you have two options for storing journaled emails: either put them in a dedicated mailbox from which they can be collected later by your archiving solution, or use SMTP to send them directly to a separate archive.)

Warning: journaling creates a lot of email, so your destination address needs to have ample storage space.

Journal rules

There are three aspects to Microsoft 365 journal rules:

• Journal rule scope: you can define which messages you want the Journaling agent to journal. They can be only internal messages, only external messages, or both.
• Journal recipient: specify the SMTP address of the recipient you’d like to journal: a mailbox, distribution group, mail user, or contact.
• Journaling mailbox: name one or more mailboxes you’d like journal reports to be sent to. These must be outside Microsoft 365.

In addition to copying the email message and attachments, journaling provides BCC information and allows you to include the expanded distribution list, giving you a ‘wrapper’ that shows who the members of the distribution list were at the instant the email was sent or received.

The company that mistook journaling for archiving

Many organisations just journal their emails without archiving them, thinking the two processes are the same. This can lead to problems, as the following example shows.

For 18 months, a company we know journaled mail from its 30,000 mailboxes to a dedicated mailbox. Over a 30-day period, 16.5 million emails (1.6-7 TB of data) would flood into that dedicated location. So, every month, the company created a new journal mailbox, and over time, they had 18 of these. They thought this was archiving.

Not only was this costing them a lot of money, keeping what amounted in the end to about 30 TB+ of data in expensive Exchange storage. Also, when they needed to find particular emails stored in these mailboxes, trying to search through millions of them via Outlook took forever.

These issues led the company to realise that they needed a dedicated archiving solution – one that could store their precious golden copies securely, and enable employees to find particular emails quickly. After weighing up various solutions, the company chose Cryoserver.

The archiving solution for 100% journaling

Not all archiving solutions use journaling. For example, the native archiving in Microsoft 365 doesn’t. Often, these solutions are policy-based, where you create a rule which says, if an email matches that rule, put a copy into the archive, which might happen, days, weeks or months later. Therefore, you only get a portion of the emails going into the archive.

If you want a compliant archive – 100% of the record, an evidential repository – then journaling is essential. That’s why Cryoserver ensures all your email is journaled and then stored in a secure, encrypted independent archive.

If you’d like to know more about journaling and archiving, or see Cryoserver in action, get in touch - we’d be delighted to help you.