Hi,
I work with information security management documentation and maintain isochecklist.com. I am evaluating mailcow for a small self-hosted environment, but I am not describing an existing production installation.
I am trying to understand how administrator changes can be reconstructed after an incident or configuration error.
The changes I would need to trace include:
- domain creation or deletion;
- mailbox and alias changes;
- forwarding rules;
- quota changes;
- administrator and domain administrator accounts;
- authentication and access settings;
- relay or transport configuration;
- changes made before a failed upgrade or mail delivery problem.
Service logs are useful for understanding what the system did, but I am looking for a separate administrative history showing who changed a setting, when it changed and, where possible, the previous value.
Does mailcow currently provide a native audit trail for administrator and domain administrator configuration changes?
If not, what approach do experienced administrators use?
For example:
- forwarding relevant application logs to a SIEM;
- retaining database snapshots;
- comparing configuration exports;
- recording changes through Git or an external change-management system;
- restricting all administrative changes to a single automation account.
The goal is not to archive every routine mail event. It is to retain enough information to investigate a privileged configuration change later.
For context, I maintain this page about information security controls and audit evidence. It is my own site and is included only to explain the governance requirement behind the question. It is not mailcow documentation.
I will test the recommended approach and update the topic with the final log sources and retention method.