Most mail systems can be configured to hand a copy of every message they process to another server — Exchange Online calls it journaling, Google Workspace calls it routing a copy to an additional recipient, and the idea is the same everywhere. SMTP journaling in Bichon receives those copies over SMTP and archives them.
The point is completeness. An IMAP archive only sees what a mailbox still contains, and an SMTP copy only sees what the rules route to it — neither sees a message that was deleted before its first sync, and a BCC recipient's copy may never appear in the mailbox you are archiving. A journal rule captures the message at the moment the mail system processed it, including BCC recipients and purely internal traffic.
Key facts
- Pro / Enterprise. Community still has the embedded SMTP receiver for
NoSyncaccounts, but it has no journal target: one address that receives a copy of every message is a Pro/Enterprise feature. - Delivered over the embedded SMTP server, so
BICHON_ENABLE_SMTPmust be on and encryption must not benone. - Unauthenticated delivery must be allowed. Journal senders normally cannot use SMTP AUTH, but
BICHON_SMTP_AUTH_REQUIREDdefaults totrueand rejects them with530before the CIDR check runs. Set it tofalseand let the CIDR allow-list plus TLS protect the inlet — or configure the sending system to authenticate with any valid API token. - Restricted by source address. The accepted sources are an explicit list of CIDR ranges — and the list must not be empty.
- Archived into a dedicated account created for the target address, where the copies are searchable, exportable and covered by backup like any other mail.
Configuration
| Setting | Default | Description |
|---|---|---|
journal.enabled | false | Turn journaling on |
journal.target_address | — | The single address the mail system delivers journal copies to |
journal.allowed_cidrs | — | Comma-separated source ranges allowed to deliver (10.0.0.0/24, an IPv6 prefix, or a bare IP treated as /32) |
These live in the runtime configuration rather than the environment, and are set on the WebUI page under Settings → Journaling:
| Method | Path | Description |
|---|---|---|
GET | /api/v1/journal/config | Current journaling configuration |
POST | /api/v1/journal/config | Update it; omitted fields are left unchanged |
Both require system:root and a valid Pro/Enterprise license.
Journaling is active only when all of the following hold — the configuration alone is not enough:
journal.enabledis true,- a license covers the Pro/Enterprise edition,
- at least one CIDR is configured,
- the SMTP server is enabled with
starttlsortlsencryption, and BICHON_SMTP_AUTH_REQUIREDisfalse— or the journal sender authenticates with a valid Bichon API token.
A journal delivery to the configured target does not check data:smtp:ingest; authenticating is only the alternative to opening the inlet to unauthenticated peers. Keep the CIDR list tight in either mode.
If a license lapses or is downgraded, journaling stops accepting deliveries on the spot.
What happens on the wire
Journaling is not a separate listener; it is a decision the SMTP server makes mid-session, and it changes several of the replies a mail system will see.
| Step | Behaviour |
|---|---|
MAIL FROM | With BICHON_SMTP_AUTH_REQUIRED=false, an unauthenticated peer that is neither on a TLS session nor inside allowed_cidrs gets 554 5.7.1 Delivery not authorized for this client address. With authentication required, an unauthenticated peer gets 530 instead — before the CIDR gate. Authenticated users are unaffected by the CIDR gate. |
RCPT TO | A journaling transaction takes one recipient only — a second one gets 452 4.5.3 Too many recipients, try again in a new transaction. When the address is the configured target_address, the session is marked as a journaling delivery and accepted with 250 OK. |
DATA | Up to 50 MB per message. The raw bytes are handed to the archiver. On success the reply is 250 2.0.0 OK: queued in Bichon; on failure 451 4.3.0 … try again later, so the sending system retries later rather than discarding the copy. |
That 250 means recorded, not delivered to a mailbox — which is exactly what a journaling rule is asking about.
Copies land in the INBOX of the account for the target address, and go through the same deduplication as every other ingestion path: a message the rule delivers twice is archived once, and the duplicate delivery still gets its 250 so the sender does not retry forever.
Exchange and Gmail differ, and it matters
Exchange Online wraps the original message inside a message/rfc822 part and attaches a journal report. Bichon extracts the inner original and archives that as the message; the outer envelope is preserved unmodified as a journal-report.eml attachment on it, so nothing the mail server generated is lost.
Google Workspace routes the original message directly. There is no outer report to keep, and none is added.
The journal account
Enabling journaling creates a NoSync account named after the target address, tagged with a journal role. Two consequences:
- It cannot be deleted while it is a journal archive — the copies it holds are the point.
- Changing the target address creates a second account. The previous archive is kept rather than merged or discarded, so a misconfigured target does not destroy what was already collected.
Beyond that it is an ordinary local account: search it, export it, and include it in backups like anything else. There is no separate "journal viewer" — the archive is read through the normal message list and search.
Don't confuse this with the audit log. Bichon also keeps a separate tamper-evident audit log (Pro/Enterprise) that records actions taken in Bichon — see Audit Log & Integrity. SMTP journaling archives mail, and is unrelated to that trail.