Topic: uh-oh - question about smtp servers

[gpw11]

So, generally by default, will an SMTP server make copies of emails being routed through it?  Specifically my work server?

Basically, I run my work email through my phone/other desktops through gmail polling the pop3 work server for recieving mail.  Hilariously, I thought this was set up to also send mail through gmail, rather than route through the SMTP at work.  NOT THE CASE, I actually set it up to route through work's smtp. 

Cool, right?  Nope.  I've definitely sent some emails through that my employers would not be happy about. Mainly little stuff like giving out bid information that I probably shouldn't be. Not a huge deal at all, but I just realized that the gmail server is actually routing the outgoing through the company SMTP server.

So, it's a pretty small company, with maybe only five or six people with corporate email accounts and no other internet monitoring set up (As far as I know).  What are the chances they're getting copies of the outgoing mail? Is it generally a default thing or something you need an extra software package to set up?

Also, my dick might be in there.

[scottws]

No, SMTP servers just route mail by default. There will probably be evidence a mail was sent, the sender and recipient addresses, the subject, and maybe its size, but not it's contents. That is, unless you have a mailbox on the server. If you have a mailbox on the server and it is IMAP or Exchange it would store in your mailbox sent items. With Exchange, if you delete an email, it goes to the soft deleted items cache and sits there until the garbage collection process permanently deletes it. Usually this is 30 days later. However mailboxes can be placed in legal hold where no mail is removed by the garbage collection process and no one can delete it permanently. Also there are mail database backups to consider.

But you mentioned POP3. By default, POP3 is a client managed system: your mail client downloads the email and it is removed from the server. Sent email is stored on the client and not the server.

That said, POP3 can be configured to NOT delete email when a client downloads it. Even then, sent mail wouldn't be stored on the server.

You should be okay if you are trying to hide sent mail from your company, though I would recommend using a service that doesn't involve your work at all to be sure.

[gpw11]

Haha.  That's perfect! Definitely POP3 so safe.

And yeah, I'm always careful to route but actually didn't realize what gmail account my phone was sending from.  I guess the default changed.

[scottws]

I am amazed your company uses POP3.  I thought no one used that anymore because everyone has multiple devices.  They should at least be trying to do IMAP if they don't have Exchange.