How to Document and Audit All Email Addresses on a Domain in 2026

Why You Need a Complete Inventory of Email Addresses on Your Domain

You’ve been hit with a GDPR request to delete all user data. You’re not sure where it all lives. You have no list of who still has access. That’s not a compliance issue—it’s a breach waiting to happen.

Every untracked email account is a known blind spot. It might be a forgotten test mailbox, an old employee’s alias, or a shared inbox with no ownership. These aren’t minor oversights—they’re attack vectors that undermine security, obscure audit trails, and violate data residency rules.

Building a complete inventory of email addresses on your domain isn’t just about tracking who has email. It’s about knowing what data exists, where it’s stored, and who can access it—because you can’t secure, govern, or remove what you don’t know is there. This guide shows you how to document and audit all email addresses on a domain, so you can manage them, migrate them, and protect them—not just assume they’re safe.

Key takeaways

• Untracked email accounts create compliance risks under GDPR and similar laws due to lack of control over data residency and access.
• Without a complete inventory, you cannot enforce security policies, respond to breaches, or verify data deletion requests.
• A documented list of email addresses enables smooth migrations, reduces technical debt, and eliminates forgotten mailboxes that become backdoor entry points.

How to Document and Audit All Email Addresses on a Domain

Start by checking DNS records—MX, SPF, DKIM, and DMARC—to map all active mail services tied to your domain. Then, use your email provider’s dashboard, JMAP or IMAP if self-hosted, and scan for common and unusual email patterns. Cross-reference findings with user lists, aliases, and shared mailboxes. Log every address with role, department, creation date, access level, and last activity to create a complete, auditable record. This process ensures you know exactly who has email on your domain, reducing risk from forgotten accounts or misconfigurations.

Step-by-step: Audit your domain’s email landscape

1. Inspect DNS records for MX, SPF, DKIM, and DMARC. These reveal how mail is routed and authenticated. A missing or misconfigured record can expose your domain to spoofing or deliverability issues. Tools like MXToolbox or RFC 7050 help validate configurations.
2. Check your provider’s user dashboard, if hosted. Look for active users, aliases, shared mailboxes, and team folders. Many providers display lists, but not always with full context—include role and department even if it’s not auto-populated.
3. Scan for unexpected mailboxes. Look for catch-all accounts, unused forwards (e.g., [email protected]), or aliases like contactus@ set up by admins without records. These are common security risks.
4. Query mailboxes directly via JMAP or IMAP if you self-host. Use JMAP’s email.query method or an IMAP client to list all accounts. This gives the most accurate, real-time view of what exists on your server—not just what’s in a dashboard.
5. Use pattern recognition to spot missing entries. Check for admin@, info@, support@, and departmental names like hr@, legal@. Also search for odd variations—jdoe@, sales1@, devops@—that could be unregistered or forgotten.
6. Log every finding in a table. Include: email address, role (e.g., "CEO", "Customer Support"), department, creation date, access level (e.g., "admin", "shared"), and last activity. This structured record is your audit trail.

Keep it actionable and accurate

Don’t assume the dashboard shows everything. Use JMAP or IMAP to verify—especially in self-hosted environments. You’ll catch aliases no UI displays, hidden accounts, or outdated forwards. Even if you use a hosted email service, run this audit quarterly for security and compliance. Unifiedesk’s self-hosted option gives you full control over mailbox access and query capability, while its email platform supports JMAP and full admin visibility for audits.

Use DNS Records to Reveal What’s Actively Handling Email on Your Domain

You can document and audit all email activity on your domain by examining its DNS records: MX records show where incoming mail is routed, SPF identifies authorized sending IPs, DKIM verifies signed outbound mail, and DMARC enforces alignment and reports misuse. Together, they form a complete behavioral map of your domain's email infrastructure — no guesswork, just observable facts.

MX Records: Where Incoming Mail Is Delivered

MX (Mail Exchange) records tell the world which mail servers are responsible for receiving email on your domain. Every incoming message checks your domain’s MX records before delivery. If you’re using a third-party email provider like Unifiedesk, your MX record will point to their servers. Use Google’s DNS lookup tool or MXToolbox to check what’s currently active.

SPF, DKIM, and DMARC: The Foundation of Email Trust

SPF (Sender Policy Framework) lists the IP addresses permitted to send mail on behalf of your domain. This helps you spot unauthorized senders — like if a scammer tries to send from your domain via a compromised server.

DKIM (DomainKeys Identified Mail) adds a digital signature to outbound messages. If a message arrives with a valid DKIM signature from your domain, you can be confident it wasn’t altered in transit and was sent by an authorized server.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together. It tells receiving servers what to do with messages that fail authentication — reject, quarantine, or allow — and sends you aggregate reports. Use RFC 7483 as a reference to understand how DMARC policies work in practice.

Together, these records don’t just protect you — they give you a real-time audit trail. If an unexpected mail server starts receiving messages (e.g., a spoofed IP), a DMARC report can reveal it. You can then act — update your SPF, add a new DKIM key, or reconfigure your MX.

Let’s say you’re using Unifiedesk for email with your custom domain. You can generate the correct MX, SPF, DKIM, and DMARC records in seconds through our onboarding flow. We auto-generate and validate all records using standards like RFC 5321 for SMTP basics and RFC 7483 for DMARC. No guesswork, just reliable infrastructure.

What Each DNS Record Does: A Real-World Breakdown for Auditing

You audit email addresses on a domain by verifying the DNS records that control how mail flows: MX routes incoming messages, SPF authorizes sending IPs, DKIM signs outgoing emails to prove authenticity, and DMARC enforces policies and collects reports on failures. These four records form the foundation of email security and visibility — if they’re missing or misconfigured, you’re flying blind. Let’s break down what each actually does, with real-world context and a reference table you can use daily.

How DNS Records Secure and Audit Your Domain

Think of your DNS records as the official rulebook for how email should be handled for your domain. If a record is wrong, mail gets rejected, spoofed, or misdelivered. You can’t audit email addresses effectively without knowing which records are in place and how they work.

For example, if you see mail from @yourcompany.com coming from an IP not listed in your SPF record, it’s a red flag. If DKIM fails, the message may have been tampered with. DMARC reports tell you exactly when and how these failures happen — and that’s where visibility comes in.

Real-World DNS Record Reference Table

These records don’t just protect — they audit. Each one gives you a different layer of visibility. When you document every record on your domain, you’re not just checking boxes; you’re building a clear map of where mail comes from, where it’s sent, and who’s trying to impersonate you.

Let’s say you notice an SPF failure on a DMARC report. You now know an IP outside your authorized list tried to send mail. Now you can verify if it’s a misconfigured app, a bot, or a breach. That’s the power of a well-documented DNS setup.

Why Self-Hosting Is the Only Way to Fully Audit All Mailboxes

You can only document and audit every email address on your domain if you self-host your mail. Hosted providers hide user counts, mask inactive accounts, and restrict access through opaque APIs. With self-hosting, you query every mailbox directly via JMAP or IMAP, see all active and inactive accounts, and track metadata—no black boxes, no exceptions. This is how true control begins.

Direct Access to Every Mailbox, No APIs Hidden

Most cloud email providers don’t let you query or list all mailboxes programmatically. You’re locked behind fragmented APIs that only expose selected users or roles—often excluding former employees, disabled accounts, or service mailboxes. With your own server running Unifiedesk, you can issue a direct JMAP call to list all user accounts, regardless of status. No third-party gatekeeping. No hidden tiers.

IMAP allows the same level of access, but JMAP is faster and designed for modern clients. Both support full mailbox enumeration when configured properly. This isn’t a feature you enable in a web dashboard—it’s a built-in capability when you own the infrastructure.

Transparency Over Black Boxes

Let’s be clear: hosted services are designed for scalability, not auditability. They often exclude internal accounts from reporting tools, or only show “active” users. You can’t know how many historical mailboxes exist, or whether old accounts still receive mail, unless the vendor tells you—or you self-host.

Without self-hosting, you’re relying on someone else’s definition of “all.” That’s not auditing—it’s trusting. With Unifiedesk’s open-source engine, you can inspect mailbox metadata, key assignments, and activity logs at any time. Every user’s existence, creation date, and last login is visible in your own database. No whitelisted exceptions. No backdoor access you can’t see.

This level of visibility is how organizations meet compliance requirements—not by guessing, but by knowing. It aligns with RFC 8621 (JMAP) and RFC 5248 (IMAP ACLs), both of which emphasize standard, predictable access patterns—exactly what self-hosting provides.

For teams that manage multiple domains, need audit trails, or enforce data residency, self-hosting isn’t optional—it’s necessary. Start with a self-hosted Unifiedesk deployment and see every mailbox, every key, every log. No secrets, no surprises.

How Unifiedesk Simplifies Email Address Inventory and Audit

You can document and audit every email address on your domain in minutes with Unifiedesk’s centralized admin dashboard. See all user accounts, aliases, and shared mailboxes in one place—no manual spreadsheet hunting. Automated DNS records, enforced email authentication, and JMAP-powered automation let you track, verify, and secure every address with confidence. No more guesswork.

• Admins view every active email address, alias, and shared mailbox in a single, real-time dashboard—no external tools or exports needed. Mail is just one part of the full workspace suite.
• When you add a custom domain, Unifiedesk auto-generates and deploys MX, SPF, DKIM, and DMARC records in seconds—no DNS complexity, no risk of misconfiguration, and no manual setup.
• Inbound mail is checked for SPF, DKIM, and DMARC compliance by default. All outbound mail is signed with DKIM, helping prevent spoofing and improving deliverability—this is industry-standard practice, as outlined in RFC 6376.
• Use the AI assistant to scan mail logs for anomalies—like sudden spikes in outbound sends or unusual login patterns—automatically flagging potential account compromises or misconfigurations.
• Thanks to full JMAP support, you can write scripts to programmatically list every email address and role across your domains, enabling automated audits or integration with internal user management systems.

Secure & Auditable by Design

Unifiedesk doesn’t ask you to trust its security—it proves it. Every account has its own encryption key, and all data at rest is protected with AES-256-GCM. For self-hosted setups, you control the keys entirely. The platform also enforces email authentication automatically, aligning with best practices from the Spamhaus and MXToolbox security guidelines.

Scale with Confidence

Whether you’re a small team or managing thousands of email addresses, Unifiedesk scales without complexity. The same dashboard, same enforcement, same audit trail—no new learning curve. Need more storage, shared drives, or meeting features? Upgrade to a paid plan or expand with self-hosted deployment.

How to Build a Policy-Based Email Management System

You can document and audit all email addresses on a domain by defining clear roles (admin, support, finance, HR), assigning a creation date and last activity timestamp to each account, enforcing a 12-month inactivity policy, requiring approval via the admin console or API for new mailboxes, and automatically archiving or deleting unapproved, duplicate, or redundant addresses. This ensures accountability, reduces attack surface, and aligns with industry best practices for identity hygiene.

Step-by-Step: Create a Governance System That Actually Works

1. Define roles and assign only necessary addresses. Limit email accounts to essential roles: one admin, one support, one finance, one HR. No personal or generic addresses like info@ or contact@ unless strictly needed. Every address should map to a real, documented responsibility.
2. Record creation and last activity timestamps. Use your email platform’s native audit logs or automated scripts to track when each mailbox was created and when it was last used. This data helps identify dormant accounts — a common source of security risk, as seen in reports from the CISA Known Exploited Vulnerabilities catalog.
3. Enforce a 12-month inactivity policy. Automatically disable any mailbox that hasn’t sent or received mail in 12 months. This isn’t just about hygiene — outdated accounts are often overlooked during breaches and can be hijacked with little detection.
4. Require approval for new mailbox creation. No new account can be created without explicit approval, either through your admin console or via a documented API call. This stops shadow IT and prevents accidental or malicious account sprawl.
5. Archive or delete unapproved, duplicate, or redundant addresses. Run quarterly audits. Remove any mailbox not tied to a role, with a duplicate, or created without approval. Use tools like RFC 5321 for email address syntax validation to catch malformed or test entries.

Automate What You Can

Let’s not pretend you’ll manually check every address every month. Use the admin API (or a scheduled script) to pull a full list of users, check their last activity, and flag those inactive. Set up automated reminders for role holders to confirm active status — you can run this via Unifiedesk Calendar or a custom workflow tied to your self-hosted deployment.

For teams using multiple domains, create a shared inventory in Unifiedesk Contacts with fields for role, creation date, last activity, and approval status. This becomes your single source of truth.

How to Verify No Unapproved Email Accounts Exist on Your Domain

You can confirm every email address on your domain is authorized by querying your email system via JMAP (or IMAP) as an admin, cross-checking results against your documented user inventory, verifying no accounts lack role or ownership, disabling catch-all forwards, and reviewing DMARC reports for signs of spoofing. This process exposes dormant, unclaimed, or potentially malicious accounts you might otherwise overlook.

Check all accounts directly from your email system

• Log in to your email platform with admin credentials on a trusted device.
• Use a JMAP client or tool—like RFC 8620—to issue a GetAccounts request to list all mailbox accounts on the domain.
• If your system supports filtering, request only active accounts and include fields like name, role, owner, department, and createdDate.
• Compare each result to your official user roster. Discrepancies should be investigated.

Look for suspicious or unmanaged accounts

• Accounts with no role, owner, or department tag are often dormant, misconfigured, or abandoned—potential entry points.
• Check for email addresses that match no known user, employee, or service role—especially if they’re in common patterns like support@, admin@, or info@ without a documented owner.
• Disable catch-all forwards if enabled, as they allow any email to the domain to be delivered, making your domain vulnerable to phishing and spam abuse.
• Review your DMARC reports (via tools like dmarc.org or your email provider’s reporting dashboard) for reports of unauthorized senders attempting to spoof your domain.
• Filter reports by spf=pass and dkim=pass—any failures tied to your domain may indicate misconfiguration or impersonation attempts.

When you run this audit, you’re not just checking for ghosts in the system—you’re protecting against real threats. An unapproved account, even one with no current use, can become a foothold for attackers who exploit forgotten credentials.

Automated checks alone won’t catch all issues—manual review of account metadata and behavior patterns is still essential.

Tools like Unifiedesk’s JMAP API give you full visibility. You can manage your domain’s mail setup securely, with built-in enforcement of SPF, DKIM, and DMARC—helping you verify your domain’s integrity. For teams managing multiple domains, self-hosted options let you retain full control over audit logs and access. See how you can run your own email and workspace infrastructure with full auditability.

What to Do When You Find Undocumented or Duplicate Email Addresses

You’ve found untracked or duplicate email addresses on your domain—don’t panic. Isolate them, audit their purpose, and act. If inactive, remove them. If active, add them to your official inventory with owner, role, and department. Then update your email policy to close the gap. This keeps your domain secure, compliant, and manageable.

Step-by-Step: Action Plan for Undocumented or Duplicate Addresses

1. Isolate the address from active mail flows. Disable or quarantine it immediately. This prevents spam, phishing, or accidental data leaks. Use your email provider’s admin panel or API to block delivery or redirect to a non-delivery address.
2. Determine its origin and purpose. Was it created for a contract with a vendor? A short-term project? A personal test? Check server logs, admin records, or ask your IT team. If you use self-hosted email, logs are stored on your system—no third party involved.
3. Check for active use and linked data. Run a search across your mailbox, drive, calendar, and documents to confirm if any files, meetings, or messages are tied to it. Use a tool like RFC 5322 as a reference for valid email formats and avoid false positives.
4. If inactive: deactivate and delete. Confirm no dependencies. Then remove it permanently. If your system supports it (like Unifiedesk’s JMAP or IMAP), use a script or bulk action to clean up without manual entry.
5. If active: add to your official inventory. Document the owner, role, department, creation date, and reason. Use a spreadsheet or internal tool. If you use Unifiedesk, the Contacts system can sync this data, reducing future drift.
6. Update your email policy to prevent recurrence. Define clear rules: who can create an address, how, and what approval process is needed. Enforce this via admin controls. Automated systems like Unifiedesk’s custom domain setup can include approval workflows for new mailboxes.

Prevent Future Drift with Automated Tracking

Let’s be honest: manual audits only catch a fraction of the problem. Use your email platform’s reporting or audit logs. Modern standards like JMAP or IMAP support scripting and batch actions. Tools like MxToolbox help validate DNS records and spot misconfigurations early. With end-to-end encryption and per-account keys, even if logs are exposed, the data stays protected.

Once you’ve documented everything, your domain isn’t just cleaner—it’s safer. Every address has a purpose, a steward, and a trail. That’s the real foundation of trust and control.

Use Unifiedesk’s Per-Account Encryption to Secure Each Documented Address

Every documented email address on your domain is protected by per-account encryption—ensuring that even if an auditor accesses a mailbox, they won’t see messages, files, or personal data without the individual account’s decryption key. This applies whether you use Unifiedesk’s hosted service or self-host it privately.

Hosted: End-to-End Encryption by Default

If you’re using Unifiedesk’s hosted service, all messages and files are end-to-end encrypted by default. This means your data is encrypted on your device before it leaves your control and remains encrypted until it reaches the intended recipient’s device. Not even Unifiedesk’s servers can read your email or documents.

Industry-standard practices like this are widely endorsed—RFC 8314, for example, outlines the importance of encrypting content at rest and in transit to minimize exposure to breaches.

Self-Hosted: Encrypt at Rest, Secured by Keys

If you opt for self-hosting, Unifiedesk encrypts every message and file at rest using AES-256-GCM, a proven encryption standard. Each account has its own unique key, meaning that even if someone gained access to your server, they couldn’t decrypt data from other accounts.

TLS ensures encryption in transit everywhere—no unsecured paths. All connections to Unifiedesk’s mail, calendar, drive, and meet services are protected by modern TLS 1.3, preventing eavesdropping during data transfer.

This level of security lets you confidently document and audit all email addresses on your domain. You can track who has access, verify identities, and still ensure that sensitive information stays private. Whether you’re doing compliance checks or internal audits, your data is never exposed in transit or at rest.

And if you need to share files securely with temporary access, Unifiedesk’s drive supports expiring share links—so even documented access doesn’t mean long-term exposure.

You’re not just logging addresses—you’re protecting them. For more on how Unifiedesk handles encryption, see the security overview. If you’re ready to take control of your domain’s email and workspace, set up a custom domain with full audit support and built-in privacy.

Maintain Your Email Address Inventory with Regular Audits

Knowing who has email access on your domain is essential for security and compliance. Regular audits ensure you’re not running blind with stale or unauthorized accounts.

Automate and Integrate

Schedule quarterly reviews of all active accounts, verify roles, and cross-check activity logs. Use JMAP-compatible scripts to pull real-time account lists and compare them against your master inventory.

• Update the inventory immediately when accounts are added or deleted.
• Integrate audit steps into onboarding and offboarding workflows to prevent drift.
• Store the inventory with access restricted to authorized admins, and enable audit trails for all changes.

Visibility and discipline are the foundation of domain control. With consistent practices, you maintain trust, reduce risk, and keep your email infrastructure under your own command.

Keep reading

• Shared Inbox & Ticketing Features (complete guide)
• Aliases vs Separate Mailboxes: Your 2026 Guide to Email Management
• Email Addresses Per User Limits Across Providers in 2026
• Unlimited Aliases on a Custom Domain: Real Use Cases in 2026
• Consolidating Multiple Custom Domain Mailboxes Into One Login

Ready to put this into practice? Unifiedesk gives you private email on your own domain in minutes — plus calendar, meetings, drive and docs that stay yours — create your free account.

Frequently asked questions

How do I find every email address on my domain without access to the server?

Use DNS records — MX identifies receiving servers, SPF and DMARC reveal sending policies. Check your domain's email provider dashboard if hosted. Run a DMARC report analysis to detect unauthorized senders and unknown accounts.

Can I audit email addresses in Google Workspace or Microsoft 365?

Yes — both platforms offer admin consoles with user listings and activity logs. However, access is limited to the provider's tools and APIs, which may hide internal accounts or catch-all forwards. You cannot independently verify all mailboxes.

What is a catch-all email address and why is it dangerous?

A catch-all email forwards all messages to a single inbox, even for non-existent usernames. It allows attackers to guess valid addresses or send spam, and increases exposure to phishing and data leaks.

How do DMARC reports help with email auditing?

DMARC reports show failed authentication attempts from sources outside your SPF/DKIM policies. They reveal unauthorized senders and unknown email addresses acting on your domain — critical for spotting breaches or misconfigurations.

Is it possible to track when an email address was created?

Only if your email system logs account creation timestamps. Most providers and self-hosted systems like Unifiedesk allow admins to see creation dates and last activity logs for audit purposes.

What does end-to-end encryption mean for email audit trails?

It means only the sender and recipient can read messages, even if the provider (or auditor) accesses the server. In hosted Unifiedesk, this protects content; in self-hosted, per-account keys ensure no central access exists.

Why is a documented email address inventory important for GDPR or HIPAA?

You must know all data subjects (email users) who store personal data on your systems. Without an inventory, you can’t respond to requests to delete or audit data — a core requirement under GDPR and HIPAA.

Can I use AI to help manage my email address inventory?

Yes — Unifiedesk’s AI assistant can scan logs, flag anomalies, and suggest inactive accounts for review. It can also summarize audit findings or summarize DMARC reports without learning from your data.

Are aliases and shared mailboxes part of a domain’s email inventory?

Yes — aliases and shared mailboxes must be included in your audit. They often act as gateways for access and may be overlooked. Ensure they are linked to known users and roles.

How often should I audit my domain’s email addresses?

Schedule audits quarterly or after major events like onboarding, offboarding, or system changes. Regular audits detect drift, dormant accounts, and policy violations before they become risks.

Does using a self-hosted email system mean I can fully audit all mailboxes?

Yes — when you control the server, you can query every mailbox via JMAP or IMAP. You have full visibility over users, aliases, shared mailboxes, and access logs. This is not possible with hosted providers that restrict access.

How do I prevent unauthorized email accounts from being created in the future?

Enforce admin approval for new accounts. Use role-based access, automated scripts to detect new mailboxes, and integrate your inventory into onboarding workflows. Monitor JMAP APIs or logs for unauthorized creations.