Who Actually Reads info@? Bringing Shared Mailboxes Back Under Control

The address printed on the website is a promise: someone will read this, route it and answer it. In most small and medium-sized UK firms, that promise is kept by an arrangement nobody designed — a shared mailbox, a distribution list, an alias pointing at a person, or some combination of all three that has accumulated over a decade of staff changes. The result is not usually a dramatic outage. It is a slow failure in which customer requests sit unanswered in a folder called Archive2, and no one can say with confidence who was supposed to see them.

An address is not a system

Most enquiries arrive through a handful of published addresses: info@, sales@, accounts@, admin@, maybe support@. They appear on invoices, in Companies House filings, on the side of a van and in the footer of every quote. Because they are easy to publish, they are rarely treated as infrastructure. They are treated as a fact of life.

The practical consequence is that the business ends up with a system of record it never chose. If a customer later disputes what was agreed, the evidence may live in a mailbox that no longer has an owner, in a subfolder created by a former employee, or in a rule that forwarded everything to someone who left in 2023 and has been bouncing ever since.

Step one: classify what each address actually is

Four different things wear the same clothing, and they behave very differently.

• An alias or secondary address on a person's mailbox. Mail lands directly in one individual's inbox. Nobody else can see it. This is the most common arrangement in firms under fifty staff, and the most fragile, because it depends entirely on that person remaining employed.
• A distribution list. Mail fans out to several recipients. There is no shared state and no collective record of who replied, so two people answer the same query or nobody does. Replies come from personal mailboxes, which means the customer's next email may go to one individual rather than back to the business.
• A shared mailbox. A central store with delegated access for several people, its own send and receive, and an audit trail. In Microsoft 365 this is licence-free below 50GB, which makes it the sensible default for most SMEs.
• A Microsoft 365 group or channel. Useful when the inbox is genuinely collaborative work, but its membership and retention behaviour differ from a shared mailbox and are frequently misunderstood.

The first output of any audit is a single line per address stating which of these it is, who owns it, and what it is for. Expect to find at least one address that exists as an alias and a distribution list at the same time, quietly delivering two copies of everything.

Step two: map the permissions properly

Three delegation models get confused constantly. Full Access lets someone open the mailbox. Send As sends mail that appears to come from the address with no indication of the individual. Send on Behalf shows the human behind the address.

For customer-facing accountability, Send on Behalf is often the better choice: it preserves the appearance of a business address while leaving a trace of who actually replied. Send As is appropriate for automated or system-generated mail, and is frequently granted far too widely because it is convenient.

Two further points matter. First, permissions inherit through nested groups, so the person who "definitely doesn't have access" may have acquired it three group memberships ago. Record effective membership, not just direct grants. Second, watch for shared credentials — a shared mailbox whose password six people know is not a shared mailbox, it is an untraceable account. Under UK GDPR, processing personal data without attributable access makes both subject access requests and any future investigation considerably harder.

Step three: read the rules nobody reads

Inbox rules and mail flow rules are the most common source of quiet malfunction. The recurring patterns are familiar:

• A rule forwarding everything to a personal webmail address, created by a predecessor and never removed.
• A rule filing supplier invoices into a subfolder no one monitors.
• An out-of-office message left enabled for months, telling customers the office is closed.
• A journaling rule copying mail to a third-party archive the business stopped paying for.
• Rules that silently delete or redirect anything matching a particular customer or keyword.

Clicking through each mailbox is slow and incomplete. Export the rules with PowerShell — Get-InboxRule and Get-TransportRule — and keep the export as evidence. Then give every surviving rule an owner and a purpose. Anything with neither should be removed the same day.

Step four: decide what the inbox is for

Is info@ a channel or a record? If a customer emails it and the reply is later needed in a dispute, where does that reply live? Set a retention policy deliberately rather than inheriting whatever the tenant defaults to. Anything that could become part of a contract or invoice trail is worth holding for at least six years to align with HMRC record-keeping expectations, plus a margin. General enquiries can usually be held for less. Whatever you choose, write it down and be able to explain it.

Then look for the copies that escape the policy. Staff dragging mail into local PST files, replying from personal phones, exporting to spreadsheets, or running a separate ticketing tool that only half the team uses. Each is a copy outside the retention policy and outside any access control.

Step five: the leavers problem

Offboarding is where shared inboxes go wrong most often. A departing employee's forwarding rule survives their account; their delegate access is never revoked; the mailbox is converted to a shared one with no owner. Add four lines to the leavers checklist: remove from every group, revoke all delegate and Send As permissions, inspect for rules and forwards, and name a new owner for anything that was theirs alone.

A quarterly review that fits in an hour

None of this stays true for long. A short, repeatable review beats a heroic annual cleanup:

1. Re-export the address list and compare it with last quarter. Flag anything new that has no named owner.
2. Confirm every shared mailbox has two named owners and a stated purpose.
3. Re-export rules and forwarding; confirm each has an owner.
4. Review delegates and remove full access that has not been used.
5. Confirm the retention label, and check that no mailbox is sitting at its size limit.
6. Spot-check five customer emails from the past month: each should have a reply, an owner and a record in the CRM or ticket system.
7. Record the date, the reviewer and any exceptions.

Keep the output in a shared location so it is available to whoever inherits the job. The document matters less than the interruption of drift.

What good looks like

A shared inbox does not need to be sophisticated. It needs a named owner, a documented rule set, a stated retention period and a small amount of scheduled attention. Firms that get this right find that enquiries stop disappearing, disputes become easier to answer, and the person who leaves on Friday does not take the company's customer history with them.