An employee opens their Zimbra inbox on Monday morning and finds a suspicious message, sent from an internal address but written in poor French. The usual reaction is to delete the email and move on.
The problem is that this message could have served as evidence in the event of a security incident, but it has disappeared without leaving any usable trace. On the CD66 Zimbra email system (formerly CG66), the line between a harmless email and a record that needs to be retained depends on a few settings that most users have never changed.
Difference between backup and archiving on Zimbra CD66
The two are often confused, and this confusion creates vulnerabilities. A backup restores a system after an incident: it recreates the state of the mailbox at a given point in time. It does not guarantee either traceability or regulatory compliance for a message retained over several years.
Archiving serves a different purpose. It involves removing a message from the active database and storing it in a separate space with restricted access rights. The CNIL recommends this separation so that archived data is not still accessible like ordinary emails.
On Zimbra, the built-in “Archives” folder in the webmail moves messages into a local folder structure, but does not constitute archiving in the regulatory sense. To access Zimbra CD66 or CG66 and make proper use of this distinction, it is important to understand that simply moving an email into a subfolder changes neither its access rights nor its retention period.
Securing email communications: Zimbra settings to enable
Professional email security does not rely on passwords alone. Zimbra offers several layers of protection that department employees can configure directly from the web interface.
Digital signatures for messages
Signing a message with a personal certificate assures the recipient that the sender is who they claim to be. The process uses a pair of keys: the private key signs the message, while the public key (embedded in the email) allows the recipient to verify its authenticity. This signature places no requirements on the recipient, who does not need to have a certificate of their own.
To import the certificate into Zimbra, go to the account preferences and select the “Security” section. Once the .p12 file has been uploaded, each new message can be signed automatically.
Session and password management
A browser that retains a previous session can block authentication, even when the password is correct. Before contacting support, check two things:
- Clear the cache and cookies in the browser used to access the webmail, then start a fresh session.
- Check that the account’s security settings have not been tightened by an administrator (for example, two-factor authentication enabled without the employee being notified).
- Try signing in from another browser or in a private window to rule out a local configuration issue.
These checks take less than two minutes and resolve most reported access issues.
Archiving emails on Zimbra: practical steps and retention periods
The GDPR does not set a single retention period for all messages. Instead, it requires organizations to set retention periods according to the purpose of processing. In practice, a local authority such as CD66 can distinguish between three categories.
- Messages related to day-to-day work (schedule discussions, internal requests with no legal value): retained for as long as they are operationally useful, then deleted.
- Messages with evidentiary value (contractual exchanges, official notifications, correspondence with members of the public): archived in a separate space with restricted access for the period required by the regulations applicable to that type of document.
- Messages with heritage or historical value: transferred to the departmental archives in accordance with current procedures.
On Zimbra, the export function lets you download an entire folder in .tgz format. The file can then be stored on a separate archiving server, outside the active email database. This process physically separates archives from current emails, in line with CNIL recommendations.
Compromised email accounts in local authorities: an underestimated risk
Email remains the primary attack vector against local authorities. A compromised account provides access to all the messages stored in the mailbox, including attachments containing personal data about members of the public.
The typical scenario starts with a targeted phishing email. An employee clicks a link and enters their credentials on a fake page, giving the attacker full access. If the mailbox contains several years of unarchived messages, the amount of data exposed is proportional to the volume stored.
Regular archiving and clearing the active mailbox mechanically reduce the attack surface. An account that retains only messages from the past few weeks limits the damage in the event of a breach, whereas a mailbox crammed with thousands of emails gives an attacker considerable scope to explore.
CD66’s Zimbra configuration allows automatic deletion rules to be set for certain folders. Combining these rules with periodic exports to a separate archiving space provides a simple but effective defense that does not depend on any additional tools.
Keeping your Zimbra mailbox tidy and your archives separate is nothing spectacular. Yet it can make the difference between a security incident contained within a few hours and a data breach that occupies an entire department for weeks.
