Journaling Gmail in Google Workspace

What journaling means in Google Workspace

Email journaling is the standard capture method for compliance archives: the mail system sends a copy of each message to a separate journal address as it processes it, so the archive receives mail before a user can edit or delete it.

In Microsoft 365, journaling is a dedicated feature with journal rules and journal reports, covered on our Exchange Online journaling page. Gmail works differently. The general-purpose tool is Gmail routing, under Apps > Google Workspace > Gmail > Routing in the Google Admin console. A routing rule can act on chosen message types, add more recipients, change the envelope recipient of the extra copy and add custom headers. Put together, those options send a journal copy of each message to the archive.

Google also offers its own setting to integrate Gmail with a third-party archiving solution, which sends journal copies to an archiving address, but Google lists it only for Frontline Plus, Enterprise Standard, Enterprise Plus and Education Plus. NinjaOne's Google Workspace guide uses a routing rule instead, which does not depend on those editions, and that is the method we follow.

The routing rule NinjaOne Archiver uses

NinjaOne's Google Workspace Backup and Archiving guide sets journaling up with one routing rule. In outline:

The Journal ID is the journal address for your organisation, shown in the NinjaOne portal; as your supplier we can also give it to you. Before the routing rule is created, the tenant is connected by signing in with Google Workspace global admin credentials and installing NinjaOne's app from the Google Workspace Marketplace.

We do not publish a click-by-click guide here, because Google's Admin console and NinjaOne's documentation change, and a routing mistake can leave gaps in the archive or send mail where it should not go. We can build the rule with your administrator, against the current documentation, and test it with you before you rely on it.

Selective archiving with a Google group

Not every organisation needs to archive everyone. NinjaOne's guide supports selective archiving with a Google group:

1. Create a Google group and add the users whose mail should be archived. Members can be added or removed later.
2. Create a receiving routing rule with envelope filters limited to group membership for received mail.
3. Create a separate sending routing rule limited to group membership for sent mail, with the same extra recipient, envelope recipient and header settings as the main journaling rule.

Two rules are needed because the group membership filter in Gmail routing applies either to received mail or to sent mail, not both. With both in place, changing who is archived is a matter of changing the group, not editing rules.

Selective archiving is a policy choice as well as a technical one. If you archive only some users, make sure your email retention policy says who is covered and why, and remember that mail sent only between users outside the group is not journaled.

Mail sent by other systems: comprehensive mail storage

Not all mail from your domain is typed in Gmail. Ticketing systems, line-of-business applications and devices often send through Google's SMTP relay, and other Google services send their own messages, such as Calendar invitations and Drive sharing notifications.

Google's comprehensive mail storage setting keeps a copy of sent and received messages in users' Gmail mailboxes, including mail from non-Gmail systems sent through SMTP relay and mail from other Google services. Google suggests turning it on if your organisation uses Vault, so that Vault has full access to your organisation's email. Google also says not to turn it on if you have compliance routing rules that change the recipient and you do not want the original recipient to receive a copy, so it should be reviewed alongside any journaling rule.

When we set up journaling with you, we can look at how mail leaves your domain, which systems send on your behalf, and whether comprehensive mail storage is on, so that the archive and your mailbox backups capture what your policy needs. Anything that matters for retention should be confirmed in testing rather than assumed.

Journaling and Google Vault

Journaling to a separate archive is a different thing from Google Vault. Vault applies retention rules and holds to mail that stays in users' Gmail mailboxes, and Google says plainly that "Vault isn't a data archive". A journal copy, by contrast, leaves Google Workspace as the message is processed and is stored in the archive under its own retention policies, so it does not depend on the user's account or licence staying in place.

The two can run side by side. If you keep Vault for in-place holds, set the archive's retention so that the two do not contradict each other. Our Google Vault vs a separate archive page compares them in detail.

Journaling vs backup for Gmail

Journaling and backup are complementary, and NinjaOne Archiver uses both:

• Backup copies mailbox contents on a schedule. NinjaOne puts standard email backups at 12 a day. It is how existing mail gets into the service when a mailbox is first added, and how you restore lost or deleted items.
• Journaling copies each message as Gmail routes it. It catches mail that a user deletes between backups and gives the archive its record of what was sent and received.

NinjaOne is open that journaling depends on correct configuration and valid credentials. Its documentation says journal set-up errors usually come from credential issues; for Google Workspace, the fix is to update or reauthenticate the credentials by following NinjaOne's Google Workspace guide, and until then email backups might rely only on periodic snapshots, which can leave gaps. That is why we can check journaling with you at set-up and show your administrators where its status appears. For the wider comparison see email archiving vs backup.

Checks before you rely on the archive

Before you treat the archive as your record, we work through these checks with you:

• Coverage. Test messages inbound, outbound and internal, from an archived user and to one, appear in the archive
• Selective scope. If you use a Google group, members and non-members behave as expected
• Other senders. Mail from SMTP relay systems and Google services is captured as your policy needs
• Existing mail. The initial backup of each mailbox has completed, so mail from before journaling started is held
• Retention. Policies are set by user, department or domain before mail starts to age
• Roles. Reviewers and Data Protection Officers have access, and IT administrators do not
• Leavers. Your offboarding process deactivates archive mailboxes rather than deleting accounts first

The full product sequence is on how NinjaOne Archiver is set up.

How Forever Systems helps

Google Workspace journaling is the part of an archive that NinjaOne does not automate, so it is where an experienced pair of hands helps most. We can plan the scope with you, connect the tenant, build and test the routing rules with your administrator, set up retention and roles, and leave you with notes on how the rules work and how to check journaling status.

Pricing depends on the bundle, the number of users and the term, so ask us for a quote. Contact us to plan journaling for your Google Workspace domain, or go back to Google Workspace email archiving.