One of my machines acts as a mail server for a dozen domains. Every week or so, we have at least one angry user claiming that an important email didn't arrive etc. So far there has always been an innocent explanation or it has been due to circumstances outside of our control (eg our qmail logs show that we never received the email in question, or it turns out our user had his mail client running on multiple PCs and periodically checking for new mail - so the message had ended up out his laptop or what-not).

Anyway, this gets a bit tedious. We have to check the qmail logs for the message arriving, check its spam score, then see when this user next logged in via pop3, try to determine from his logins if he's accessing his mailbox simultaneously from different locations etc.

Most recently a user is saying that an important email with an attachment in it didn't arrive. When we checked the qmail logs and found it had arrived, they then decided the the email actually had arrived, but the attachment was missing. I don't think we have way of confirming this from the logs. My guess is that the sender forgot to attach the file, but I can't prove it.

Anyway, rant over. I'm looking for a way to keep a copy of all incoming emails. I know Postfix has the option to bcc all email, but I don't think qmail (which is what we're using) does?

The best alternative I can think of is to capture traffic on 25/tcp with tcpdump, but that's going to increase server load a bit, and I imagine TLS would cause problems.

I'm looking for something similar for pop3: a way to log the commands issued by the user, and perhaps the email itself (we use courier for pop3)

Any thoughts?