IMAP makes messaging simple

If you're building an enterprise e-mail network, don't think you have to lock yourself into a proprietary system to get a comprehensive feature set. We looked at eight mail servers based on the Internet Message Access Protocol (IMAP). We found they match or exceed the e-mail serving capabilities of high-end systems such as Microsoft Exchange and Lotus Notes. Better still, they do so at a lower cost and without tying you to one platform or vendor.

Of the eight products we tested, four stood out as short-list candidates for any network manager. Innosoft International's PMDF 5.2 won a Blue Ribbon with a fairly vanilla IMAP server built on a carrier-class messaging backbone. We found a lot of power and great flexibility in the product.

Isocor's N-PLEX Global 2.21, our other top scorer and Blue Ribbon recipient, struck us with its management capabilities in general and its distributed management in particular. Organizations looking for multiple coordinated servers managed by a single team will find Isocor's approach especially attractive.

Internet Shopper's NTMail 4.0 is the easiest to drive and offers a lot of power in a quick, small package. With a Web-based front end, you can manage it from anywhere, which is a nice way to keep your mail system running without having to be tied to your desk.

Control Data System's (CDS) IntraStore Server 2000 aims at the biggest of the big, as its pricing and product documentation suggest. IntraStore 2000 is economical only when you hit 10,000 users or more. Before that point, you'll spend a lot of time managing a complex product without having enough users to justify the effort.

Holding it together

Although these products are sold as IMAP servers, they are really miniature mail backbones. Each has a Simple Mail Transfer Protocol gateway to connect to the outside world; many understand Lightweight Directory Access Protocol (LDAP) and can, therefore, work with a company's existing directories; and all require a generous dose of capacity planning and miscellaneous security and system management. Although we tested the servers on a Windows NT system, some high-end servers also run on Unix, scaling to tens of thousands of users on a single server.

The servers come from disparate backgrounds, which translates into varied systems for managing users and message stores. Ipswitch's IMail Server 4.0 and Rockliffe Systems' MailSite 2.0, for example, come with Windows 95 applications for the manager's desktop, while CDS' IntraStore requires a mix of an NT manager's application and a Web browser interface. Internet Shopper's NTMail and Vintra Systems' Mail Server Professional 2.0 are 100% Web-based; Innosoft's PMDF uses Telnet and a command line for configuration and management. We found the best-integrated distributed management solution in Isocor's N-PLEX Global, which lets you link multiple N-PLEX servers together with a single directory and manage them from a single Windows NT workstation.

Although management interfaces varied widely, unfortunately reporting capabilities didn't. A large message server needs to provide a wide variety of reporting information, including which users are sending, receiving and storing the most mail; how much mail the entire server is processing and when it will reach capacity; and what current queue and server load conditions are. We hit a weak spot here across the board. Most of the IMAP servers we tested generate only log files, which you're invited to process yourself with tools such as Perl or Excel. The log files let you determine which users are sending and receiving mail after the fact, but they do little else.

Because IMAP server users will often choose to store most of their mail on the IMAP server, by-user reports are critical to maintaining a speedy network. Unfortunately, trying to figure out what users are doing is a difficult chore for the products we tested. CDS' IntraStore provides a decent report that shows by-user activity; Internet Shopper's NTMail has a similar, but less comprehensive, report. Everyone else seems to think that learning how your users are doing on disk space is best done with Windows NT Explorer - a viewpoint we categorically oppose.

Watching long-term trends was also disappointing. Only one product provides adequate capacity planning information to help you predict when your server will run out of steam: Isocor's N-PLEX Global allows you to define your reports and specify how often you want to gather information.

Operational reports that deliver a snapshot of current conditions are more common: CDS' IntraStore and Innosoft's PMDF are fairly adept at providing operations information via online reports and Web pages, which include information such as mail queue lengths and the average message processing times.

Rockliffe's MailSite has the best NT integration in this area, with six separate PERFMON modules that deliver 22 separate statistics, such as total messages, bytes per second and number of logon failures. Isocor's N-PLEX Global and Qualcomm's Eudora WorldMail Server 2.01 also have PERFMON modules, but they provide much more limited statistics.

For message tracking, Isocor again stood out by providing a powerful graphical user interface (GUI) to the message logs. Qualcomm's server has a simpler GUI tool to search logs that is not as powerful as Isocor's.

Innosoft's PMDF came up with our favorite feature for the nosy e-mail manager: header logging, which allows you to capture anything and everything from the message header and bring it into the log files. We think it's an excellent idea because tracking messages by their subject lines is usually a lot easier than doing it by message identification.

CDS' IntraStore provides message tracking only through a poorly documented and complex command line. Everyone else gives you the log files and lets you work it out for yourself. The only loser in this area was Vintra's Mail Server Professional, which didn't log enough information to be useful.

Management and configuration

One characteristic of decent mail servers is a broad selection of adjustments, limits, controls and other configuration options. For example, you certainly want to be able to limit the maximum size of user mailboxes, which all the packages allow one way or another, even if you have to rely on operating system disk quotas. But what about setting warning thresholds, or specifying a different limit for unread mail vs. stored mail? You have only Isocor's N-PLEX Global to turn to for threshold warning and Internet Shopper's NTMail for unread limits to tweak these variables.

The most flexible product in terms of configuration is Innosoft's PMDF, which stood head and shoulders above the others in its adjustability. For example, only PMDF lets you limit the frequency with which users can check their mail - an important defensive measure for network managers trying to keep their systems running smoothly. Internet Shopper's NTMail came in second, although some features require you to write a Windows NT Dynamic Link Library, such as filtering specific types of message attachments, to gain full access to the system.

Vintra's Mail Server Professional sat at the bottom rung of the configuration ladder: You can't even limit the size of individual messages. We were also unimpressed with the configuration options available in Qualcomm's Eudora WorldMail Server and Rockliffe's MailSite.

Distribution and mailing list configuration and management, another important feature of any e-mail system, also ranged from nonexistent (Vintra's Mail Server Professional) to outstanding (Rockliffe's MailSite, Internet Shopper's NTMail and CDS' IntraStore).

User management

Because each IMAP mailbox has a user associated with it, self-management is an important feature of an IMAP server. Users want to be able to change their passwords, forward mail and set filters on their mailboxes, for example.

We found the weakest aspect of user management is the GUI. Inevitably, the products we tested use a Web browser - generally with Java-based applets - as the main user-to-server communications tool. It was in this part of the testing that we encountered our greatest headaches.

Java may be "write-once, run-anywhere" in theory, but in practice it falls far short. We found GUIs that crashed browsers; GUIs that crashed machines; GUIs that only worked from a particular platform or particular version of a browser. And we found GUIs that just didn't work at all no matter what we tried.

The worst offenders in this area are Isocor's N-PLEX Global and Qualcomm's Eudora WorldMail. In contrast, Internet Shopper's NTMail and Rockliffe's MailSite do an excellent job of building easy-to-use and, more importantly, stable GUIs for user self-management.

When it comes to actual user features, most products - with the exception of Vintra's Mail Server Professional - let you change your password, set up an automatic responder and set mail forwarding. Some make it harder than others. Innosoft's PMDF, for example, makes you use a command line to set up mail forwarding. On the other hand, you get a full mail forwarding filtering and action engine with PMDF, if you're willing to write the simple script files needed.

Expert users may want to put filters on the IMAP server to handle mail before it gets to their inboxes. Innosoft's PMDF, Ipswitch's IMail and CDS' IntraStore all give users the power to delete spam, prioritize urgent mail and autorespond as appropriate. Internet Shopper's NTMail has a similar facility, but it's only accessible to the system manager unless you buy an optional add-on product.

Some products include Web-based mail reading clients for when you can't get to IMAP, but we found these so excruciatingly stupid and slow that we can't imagine anyone would use them except out of desperation.

Keeping it secret

Most of these servers exist in an Internet environment, which means that traffic may be destined for users within the company or going all over the world. Because IMAP, by default, sends the user name and password between client and server in plain text, security is understandably an issue.

To increase security a little, IMAP clients and servers can support a variety of encryption algorithms (APOP, CRAM-MD5 and SKEY) for user names and passwords.

Only CDS' IntraStore supports SKEY, a one-time password algorithm, which gives IntraStore a high degree of security even with plain text passwords.

Vintra's Mail Server Professional and Ipswitch's IMail don't support any encrypted user/password combinations. On the other hand, Ipswitch was the only vendor to notice the inherent insecurity in changing your password via a Web page, and its Web interface tries to avoid exposing the password and user name at least a little bit by sending them obscured in BASE64 encoding.

We experienced some compatibility problems in this area: Isocor's N-PLEX Global and Qualcomm's Eudora WorldMail servers both disagreed with some of our IMAP client applications. (The client has to negotiate security with the server; if the client and server implementations don't agree on how the protocol is implemented, then you can't use a security feature such as encrypted passwords.)

For complete security, you'll want to encrypt everything running over IMAP and SMTP. In the absence of a virtual private network, turn to Innosoft's PMDF and CDS' IntraStore, both of which support the new SSL-based session encryption.

How fast does it go?

Performance in e-mail systems is notoriously hard to measure and even harder to compare. Fortunately, seven of the eight systems we tested ran on identical hardware. We put together a simple benchmark designed to measure IMAP performance by reading, writing and moving around messages (see table, previous page).

The fastest system was Rockliffe's MailSite, which processed 9,900 IMAP octets per second. In plain terms, this means MailSite can process 10 1K messages per second, which is fine for mid-size to large enterprise messaging. For comparison, we tested Microsoft Exchange, which processed 7,700 octets per second.

About 12% slower than Rockliffe were Isocor's N-PLEX Global and Inter-net Shopper's NTMail. Qualcomm's Eudora WorldMail was another 15% slower than Isocor. At the bottom of the heap were Vintra's Mail Server Professional and Ipswitch's IMail, which are only 60% as fast as Rockliffe.

Start it up

Big mail servers normally aren't installed in a day, but Isocor's N-PLEX Global is an exception to the rule. Isocor's documentation and start-up procedures walked us through mail system concepts, helped us plan our system and culminated in a one-click "go do it" installation procedure.

Internet Shopper's NTMail also installed smoothly but assumed that we already knew a lot of basic information. Simpler products, such as Qualcomm's Eudora WorldMail and Rockliffe's MailSite, also went in with ease and grace.

Conversely, we found CDS' IntraStore's installation difficult. IntraStore has a lot of pieces, and its hundreds of pages of documentation don't include an overview explaining how those pieces fit together into a working system. We spent three days getting IntraStore installed and configured, largely due to documentation errors.

Innosoft's PMDF also provides a pile of documentation, but installing PMDF was not a chore thanks to easy, step-by-step instructions on how to load software and build a basic configuration.

Two products arrived with only online documentation: Internet Shopper's NTMail and Vintra's Mail Server Professional. We found these universally more difficult to read and work with, and missing such basic niceties as indexes.

What to buy

If you're looking for a system for 1,000 users or more, you should definitely consider Innosoft, Isocor, Internet Shopper and CDS as potential vendors. All have strong products designed with the enterprise mail network in mind.
RELATED LINKS Scorecard and NetResults
How we ranked the servers in different categories, platforms they run on and vendor contact info.

IMAP clients
A discussion of the various clients, and a recommendation for one.

The IMAP Connection
Primers and links to other IMAP info.

Trumbo and Snyder are senior partners at Opus One, an international consultancy specializing in networking, e-mail and security. They can be contacted through their Web site at www.opus1.com.