Email archiving and retention on self-hosted mail

Email archiving and retention on self-hosted mail: why the mailbox server is not the record

The mailbox server alone cannot be the record. If your firm is a broker-dealer, bank or insurer moving mail in-house, every business communication you must keep needs to reach a separate archiving system through journaling, and that archive has to be designed, operated and tested on its own terms. Mail servers are built to deliver, store and expire messages for users, so a retention rule that depends on a user not deleting something, or on a mailbox quota not being reached, is not a retention rule. The rest of this section sets out why that separation matters and what it asks of your team. This page differs from general mail hosting because the question is no longer how to keep mail flowing. It is whether you can show a regulator that business messages were preserved in an unaltered, searchable form for the required period. Under SEC Rule 17a-4(b)(4), broker-dealers must preserve originals of communications received and copies of communications sent relating to the business, including inter-office communications, for not less than three years. Your mail platform choice does not change that obligation. Stalwart, mailcow and OX App Suite can all act as the mail source that feeds a journal, but none of them replaces the archive layer, and you should confirm with each vendor exactly which journaling or export mechanism it supports in your configuration. Before you select a platform, ask three things. Which system holds the authoritative copy, and who can alter or purge it? How are messages journaled from every delivery path, including outbound relay and any gateway in front of the mail server? And how will you run legal hold and search without touching live mailboxes? DeployOpen plans, implements and documents these systems inside your own infrastructure and prepares the controls and evidence for your assessments, but it does not issue audit reports, attestations or certifications. Those come from your independent auditors and regulators.

Which retention and records requirements shape the archive design

This table maps four retention and access requirements to the archive design they drive on self-hosted mail. Read each row as the requirement, what it means for the build, and the evidence an assessor will ask to see. The main takeaway is that the mailbox server cannot be the record: the archive must capture every relevant message outside the mailbox and control who can change or view it.

Requirement	What it means for the build	Evidence to prepare
SEC Rule 17a-4(b)(4) for broker-dealers	Preserve originals of communications received and copies of those sent, including inter-office messages, for not less than three years. Store them in a non-rewriteable, non-erasable form and keep the archive separate from the mailbox store.	Retention policy mapped to the rule, storage configuration showing write-once behavior, and a sample retrieval of a message from the archive. Confirm the exact storage format with your compliance counsel and archive vendor.
Journaling of all inbound and outbound mail	Configure the mail server to journal every relevant message, including internal, external and BCC copies, to the archive at delivery or submission. Journaling that runs only on selected mailboxes leaves gaps the rule does not allow.	Journaling rules by direction and mailbox group, journal queue monitoring, and reconciliation reports comparing mailbox counts with archive counts.
HIPAA 164.312(b) audit controls where ePHI appears in mail	Where patient information is stored in archived messages, log who searched, viewed, exported or deleted content, and retain those logs. Audit records must be examinable, not just collected.	Archive access logs covering search and export, log retention settings, and documented review procedures for the archive administrators.
FTC Safeguards Rule MFA for archive access	Require multi-factor authentication for every individual who can reach the archive or its admin console, unless the Qualified Individual approves an equivalent control in writing. Apply it to service accounts' human operators as well.	Written MFA policy, identity provider configuration for the archive application, and the written exception record if any equivalent control is used.
DORA Articles 28(3) and 30(2) for hosted archives	If a provider hosts the archive, record the arrangement in the ICT register and state in the contract where data is stored and processed, the notice period for location changes, and how data is returned on exit or insolvency. Test the exit path before relying on it.	Register of information entry, contract clauses on data location and return, and an exit plan that has been tested. Confirm DORA applicability with your legal team.

How journaling separates the archive from the mail server

The core design decision is that the mail server should not be the only place a business message lives. In a journaling setup, the mail platform copies every inbound, outbound and internal message to a separate archive store as it is accepted or delivered. Once that copy exists, deleting a message, purging a mailbox or decommissioning a user no longer removes the record. Confirm in each platform's documentation whether it journals at the SMTP transaction level, through a transport rule or through a connector to an external archive, because the method determines what is captured and when. Stalwart, mailcow and OX App Suite each have their own mechanisms, and the archive design should be validated against the chosen one rather than assumed.

Journaling has to capture more than the messages a user sees. Blind copy recipients are only visible in the envelope, not in the headers that a mailbox displays, so a journal rule that reads only the visible message misses them. Inter-office messages that never leave the platform are another gap, since they can bypass the outbound path where a journal rule is often attached. Test both explicitly: send a bcc message between two internal mailboxes, then confirm the archive holds one copy per required record and that the copy shows the bcc recipient. Document the expected count for each message type so the test can be repeated after upgrades.

The archive must be controlled independently of the people who administer the mail server. If a mailbox administrator can change journal rules, alter retention settings, or delete archived items, the archive is not an independent record. Plan separate roles for the archive, with its own credentials, audit logging of administrative actions, and write-once or immutability settings where the archive product supports them. Ask any archiving vendor or integrator to show how deletion and retention changes are logged and who can approve them. Agree that journal rules are monitored, so a silent change to routing is detected before a gap appears in the records.

Which mail platforms fit a journaling archive design

Stalwart is an all-in-one mail and collaboration server that supports IMAP, JMAP, SMTP, CalDAV, CardDAV and WebDAV in a single product. It is licensed under AGPL-3.0 with an optional Enterprise License from Stalwart Labs, and v0.16.26 was published on October 11, 2026. For an archiving design, its appeal is a small number of moving parts, but the archive path must be proven rather than assumed, because the mail server is only one link in the chain that preserves messages.

Protocol coverage: IMAP, JMAP, SMTP and the DAV protocols sit in one service, which simplifies the boundary where messages enter and leave the mail store.
Licensing choice: AGPL-3.0 covers the community edition, and the optional Enterprise License from Stalwart Labs is a separate commercial decision to confirm against the features you need.
Journaling path: Confirm whether the server can journal every inbound and outbound message, including inter-office mail, to an external archive target without relying on user action.
Operational maturity: Test how the release cadence and upgrade process fit your change control, since v0.16.26 is the reference point for this review.
Archive integrity: Verify that journal copies are complete, time-stamped and tamper-evident in the archive system, not only in the mail server.

Before committing, ask for a written journaling test plan that shows captured messages, retention tags and recovery from the archive.

Components of the archive stack and how they connect

A self-hosted archive is a chain of separate components: the mail server, a journaling point, an archive store, a search and hold layer, and the identity, logging and backup controls around them. Each link needs a named owner and a tested handoff, because a gap at any one of them can leave business messages unpreserved.

Mail server and journaling

The mail server accepts and delivers messages, and journaling copies every inbound and outbound business message to the archive as it passes through. Confirm whether your chosen server, such as Stalwart or mailcow, can journal every message class you need, including internal messages between mailboxes, BCC copies and messages that bypass the normal path. Test with a sample of each type and check that no message depends on a mailbox client to be archived.

Archive store with immutable retention

The archive store holds the preserved copies and enforces the retention period so that records cannot be altered or deleted before they expire. Ask the vendor or integrator how the store prevents modification by administrators, how retention clocks are set per message, and how deletion is logged. Under SEC Rule 17a-4(b)(4), the preservation period for broker-dealer business communications is not less than three years, so the store's retention settings must match that period and your own policy.

Legal hold and search interface

Legal hold freezes specific mailboxes or messages past their normal expiry, and search lets compliance staff find and export records for supervision or eDiscovery. Confirm that holds apply across the archive and override deletion rules, that search covers attachments and metadata, and that exports keep original headers and timestamps. Ask whether reviewers can be scoped to particular custodians and whether every search and export is recorded.

Identity and access controls

Access to the archive is a high-value path, so it needs its own multi-factor authentication, role separation and single sign-on. The FTC Safeguards Rule requires MFA for any individual accessing an information system unless the Qualified Individual approves an equivalent control in writing. Confirm which archive and admin interfaces support OIDC or SAML, and where they do not, plan how accounts, roles and MFA enrollment are managed outside the mail platform.

Audit logging of the archive

Audit logs record who searched, exported, placed holds on, or changed retention settings for archived mail, and they must be kept separately from the systems they describe. Ask where logs are written, whether administrators can alter them, how long they are retained and whether they can be forwarded to your SIEM. For regulated healthcare workloads, the HIPAA Security Rule's audit controls requirement at 164.312(b) also applies to systems holding ePHI.

Backup and recovery of the archive

The archive is the record, so it must be backed up and restorable independently of the mail server. A mailbox restore does not recover archived copies, and a backup of the mail server alone will not capture the archive's index or hold states. Define the backup scope, encryption, copy location and retention of backups, and run a restore test that proves a specific message, with its hold status and metadata, can be recovered and searched.

Rollout phases for a compliant archive on self-hosted mail

The sequence moves from a written records obligation to a tested capture path, enforced retention and legal hold, and then a monitored archive that stays current through mail server upgrades. Each phase closes with a document or test result that the next phase depends on.

Scope the records obligation and retention schedule
Compliance, legal and records owners, with DeployOpen's input on the technical side, define which communications fall under which rule. For a broker-dealer, this starts with the preservation period and scope in SEC Rule 17a-4(b)(4), which covers originals of communications received and copies of communications sent relating to the business, including inter-office messages, for not less than three years. Confirm with counsel whether other regimes, such as state rules or internal policies, add to that. The phase closes with signed requirements listing message types, mailboxes or groups in scope, retention periods, and who may place or release legal holds.
Select mail and archive components
Choose the mail server, such as Stalwart or mailcow, and a separate archive platform that the mail server cannot alter or purge. Check each candidate's license and support model against your obligations, and confirm in writing whether the archive supports write-once or tamper-evident storage, indexing for search, and export in a format your regulator can read. Record the decision and the reasons in an architecture decision record. The phase closes when the components and their data flows are approved by compliance and security.
Configure journaling and test capture of every path
Configure the mail server to journal every inbound, outbound and internal message to the archive, including aliases, distribution lists, shared mailboxes, forwarding rules and messages sent through application relays. DeployOpen's engineers then send test messages through each path and confirm that the archive holds an intact copy with the expected metadata. Include bounced, rejected and deleted-by-user cases where your policy requires them. The phase closes with capture test results that map each path to a passing result, with timestamps and message hashes.
Build legal hold and search
Build the hold function so a designated role can place a hold on a mailbox, a date range or a case, and prevent any deletion or retention expiry for held items until the hold is released. Build search for supervisors and legal teams, with access logging on every query and export. Confirm that holds apply to the archive copy, not to the live mailbox alone. The phase closes with a test script that places a hold, attempts deletion from the live mailbox and the archive, and shows the item remains retrievable, plus a search test with logged results.
Validate retention and deletion rules with compliance
Configure retention classes that match the signed schedule, including the disposal step at the end of each period. Compliance reviews the configuration against the requirements, and a tester attempts early deletion, retention changes by a standard administrator and archive modification. Deletion jobs run in a test environment first, and their logs are reviewed for scope. The phase closes with a retention configuration record that lists each class, its period, the roles that can change it, and the approval date.
Cut over mailboxes in controlled waves
Move users to the new mail platform in waves, confirming after each wave that journaling is active for every migrated mailbox and that historical mail is either imported to the archive or retained in an approved source with its own preservation controls. Keep the old platform's archive readable until the migration is verified and the retention obligation for the legacy data is covered. Document any gaps, such as messages that existed only in a departed provider's archive. The phase closes with a cutover log showing each wave, the capture check result and the open exceptions.
Run ongoing monitoring and upgrade cycles
After go-live, monitor journaling failures, archive storage growth, hold status, failed exports and access logs, with alerts routed to the operations team. Schedule periodic restore and capture tests, and review them when the mail server, archive or operating system is upgraded. Upgrades follow the vendor's release and support policy, so confirm that the archive vendor supports your current mail server version before each change. The phase is complete when monitoring is live, the upgrade procedure includes a capture regression test, and the next review date is recorded.

Evidence regulators and auditors ask for, and what produces it

This table lists the evidence a examiner or auditor is likely to request for an archived mail estate and the component that generates each item. Read it as a checklist for design: if a row has no named producer in your architecture, the evidence will have to be assembled by hand. DeployOpen prepares these records and controls, but regulators and independent auditors decide whether they are sufficient.

Evidence	What it shows	Component that produces it
Capture completeness reports	Messages journaled or archived compared with messages sent and received, by mailbox and period	Journaling from the mail server plus the archive platform's ingestion logs and reconciliation reports
Retention schedule configuration	Retention periods applied to each message class, including the three-year minimum for broker-dealer business communications under Rule 17a-4(b)(4)	Archive platform retention policy export, with dated change history
Legal hold records	Who placed or released a hold, on which custodians or items, and when	Archive legal hold module with immutable audit trail of hold actions
Search and export logs	Searches run, by whom, the query terms, and what was exported for a request	Archive search audit log and export manifests with hash values
Access logs for the archive	Administrator and user logins, role changes and attempts to alter or delete records	Archive identity integration logs, plus OS and database audit logs for the storage tier
Change records for journaling rules	Who changed transport or journaling rules on the mail server, what changed, and approval	Mail server configuration version control and change tickets in the ITSM system
Backup and restore test results	Evidence that archived records can be restored in full and read by the reviewing tool	Backup job reports, dated restore test records and sample message verification logs

How much does self-hosted email archiving cost and how long does it take?

What drives the cost of self-hosted email archiving?

The main drivers are how much mail you must keep, how long you must keep it, and how much of the work your team already covers. Retained volume sets storage size and backup size, and it grows every year you keep mail. The archive component itself may carry its own licensing, and the license terms for some modules or features can be set by custom packaging, limitations or separate fees in the license agreement. Administration time for retention rules, legal hold requests and search also recurs. Ask any quote to split one-time costs (design, migration of historical mail, configuration) from recurring costs (storage growth, licenses, patching, backup testing, support). Ask for each line to name who is paid for it: your staff, a DeployOpen engagement, or a vendor.

How long does a self-hosted email archiving project take?

Duration depends on the scope you agree in writing, the number of mailboxes, the volume of historical mail to ingest, and whether a mailbox migration runs alongside the archive. A journaling setup for new mail can often be scoped separately from the back-catalog import, and each has its own timeline. No fixed duration applies to every environment, so ask any partner to show the phases, the dependencies and the acceptance tests in the written scope before work starts. DeployOpen works to fixed-scope agreements, so the timeline is set in that document rather than estimated from a general template.

What must we provide before an archiving engagement starts?

Three inputs shape almost everything else. First, a written retention policy that states which communications are kept, for how long, and which business units or channels are covered. Second, sign-off from compliance or legal on that policy, including how legal hold and eDiscovery requests are handled. Third, accurate mailbox counts, including shared mailboxes, distribution lists, former employees and any group or resource accounts. You should also provide the current mail platform details, existing journaling or archive exports, and access to the environments where the work will run. Missing inputs are the most common reason fixed-scope timelines slip.

Can our internal team build and run email archiving without a partner?

Often yes, if your team already runs mail infrastructure, understands journaling and has someone who can own retention and compliance evidence. The skills that are easiest to underestimate are journal routing and its failure modes, index and search performance at your volume, backup and restore testing for the archive, and documenting how the records were preserved. A partner can take on any of these as a defined deliverable. Before deciding, check whether your staff can maintain the setup through patches, upgrades and an audit, and whether the people responsible are available for legal hold requests on short notice. Retention rules themselves stay the responsibility of your compliance function.

How does DeployOpen price and scope archiving work?

Most DeployOpen engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. DeployOpen does not publish a price list, so a quote follows from that written scope. The scope usually covers planning the retention design, implementing the archive and journaling path in your own infrastructure, testing restore and search, and documenting the controls. Ongoing support, upgrades and testing are available as retainers. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications, and independent auditors make that determination.

What does a broker-dealer retention period mean for storage planning?

For broker-dealers, SEC Rule 17a-4(b)(4) requires preserving originals of communications received and copies of communications sent relating to the business, including inter-office communications, for not less than three years. That minimum sets a floor, not a plan. Your legal and compliance team may require a longer period, and the rule's other provisions govern how records are stored. Storage planning should therefore model the full retention period you adopt, multiplied by current and projected mailbox volume. Confirm the exact requirements with your compliance counsel, since the rule text is the authoritative source.

What ongoing work should we budget for after go-live?

Plan for recurring work in four areas. Retention and legal hold operations include applying holds, running searches and exporting results for requests. Platform maintenance covers patching the mail server and archive, tracking vendor release notes, and testing upgrades before production. Backup and restore testing confirms the archive can be recovered, not only that backups run. Evidence upkeep means keeping configuration records, access logs and policy versions current for examiners. Each of these can be staffed internally or covered under a support retainer, and the written scope should say which party owns each task and how often it is reviewed.

Which parts of the archiving cost are easiest to underestimate?

Three items are frequently missed. Historical mail migration can cost more than the ongoing archive because it involves reading large mail stores, normalizing formats and reconciling duplicates. Search and eDiscovery performance can require more index capacity than expected once volumes grow. Exit planning is also easy to skip: contracts for ICT services supporting critical functions should include tested exit strategies and data return terms, and the EU's DORA requires these for in-scope financial entities. Ask any partner to show how each of these is priced, estimated and tested in the written scope.

What to ask an implementation partner before archiving mail

Start with the journaling method, because it decides whether the archive ever sees every message. Ask the partner, for the specific platform you are considering, how journaling is configured: whether the mail server copies each message at delivery or submission, whether the copy is sent over SMTP to a separate archive address, and which tenant, domain or global setting controls it. Ask how the archive is protected from the mail server's own administrators, and whether the partner has tested journaling on the exact release you will run. Confirm the vendor's current release notes for journaling behavior rather than relying on a general description. Ask for the exact release versions the partner has tested, since mail platform releases change these settings often.

Next, ask for proof of complete capture, not a description of intent. Require a written test plan that sends messages through every path: internal mail, external mail, blind copy recipients, distribution lists, forwarding rules, aliases, shared mailboxes and mail submitted by applications or copiers. Ask how the partner reconciles message counts between the mailbox store and the archive and how gaps are reported. Confirm how inter-office communications are captured, because SEC Rule 17a-4(b)(4) covers them as well as messages received and sent. Ask the partner to describe its approach to deleted items and draft messages, and whether the retention scope matches your own written records policy.

Finally, settle the contract questions before any data moves. Ask who controls immutability and deletion: which roles can shorten a retention period, release a legal hold or purge an item, and whether those actions are logged to a store the mail administrators cannot edit. Ask how legal hold is applied, searched and released, and who approves each step. For exit, confirm in writing where archived data is stored, the format of the export, how long data return takes, and what happens if the partner stops working with you. DORA Article 30(2) requires ICT contracts to address data return on termination for in-scope financial entities. Finally, ask whether the partner prepares evidence for your assessors, such as configuration exports, test records and retention reports, and confirm in writing that it does not issue audit reports or attestations, which come from independent auditors.

Email archiving and retention on self-hosted mail