Setting rules for your e-mail server when you’re on vacation

It’s summer, and it seems that everyone I do business with is taking a vacation.  That means the e-mail auto-replies are coming in faster than mosquitoes on a hot summer night.  The typical message looks something like this:

Hello, I’m on vacation at a fabulous resort and you’re not.  I’ll be gone the entire month of August.  If you need to speak to someone about Project Alpha, contact Larry Leftbehind at (713) 867-5309, or via e-mail at Larry@ourcompany.com.  As The Tempos used to sing, “See you in September!” – Shirley

While the person sending out such an auto-reply message thinks she’s doing people a favor by letting them know she’s away for a while, this message could be doing more harm than good.  It’s time to remind your user community of a few safety and privacy rules governing e-mail auto-replies.

Using my example above, our fictitious employee Shirley revealed an awful lot of private information that could put her or her company at risk.  Since Shirley has no idea who will see her message, she needs to be more careful about what she writes.

First of all, Shirley told people that she is gone the whole month of August.  That likely means her house or apartment is empty, providing an enticing target for burglars. Second, Shirley revealed what project she is working on.  Hmm, competitors might be interested to know this.  Next, Shirley gave away contact information for her colleague, including an e-mail address that could be harvested by competitors or spammers.

Since Shirley’s e-mail account is owned by her company, she needs to be sensitive to corporate security and privacy policies.  She should be most concerned about her exchange of e-mail with her colleagues and clients, not with her outside friends and acquaintances.  Thus, her auto-response should target her coworkers rather than the general population:

Hello.  Thank you for your message.  I am out of the office at this time.  If your message is urgent, please contact Larry Leftbehind.  Otherwise, please check my Outlook calendar if you need to schedule a meeting with me.  I will respond to your e-mail as soon as possible.  – Shirley

The above message follows some common-sense rules:

• Don’t reveal the exact dates you’ll be out.
• Don’t reveal your whereabouts.
• Don’t give away too much private information.

Microsoft Office and other corporate e-mail applications allow users to configure for themselves how they want incoming e-mail handled while they are not in the office.  In Outlook, for example, the user pulls down the Tools menu and selects the Out of Office Assistant option. Most users will choose the most basic option and simply send a text message back to everyone who sends the user a message. Mercifully, Microsoft Exchange keeps track of who has already received such an auto-reply and only sends the message one time to an e-mail sender.

The exception to this process is when a user is subscribed to a distribution list or majordomo mailing list. In this case, Exchange could send the reply text to every person on the list every time an e-mail is received by the vacationing employee. This can get pretty irritating for the other people on the list.

Fortunately, there are a few simple workarounds for this issue.  One, you can instruct the user to unsubscribe to the mailing list during his out-of-the-office period, and resubscribe when he returns. This gets cumbersome, though, and most users won’t oblige.  A better option is to instruct the user on how to configure a rule to only generate a response to e-mails sent directly to that person. In Outlook, the process goes like this:

1. Open the “Out of Office Assistant” under the “Tools” Menu (https://support.microsoft.com/default.aspx?scid=fh;EN-US;KBJUMP). This change will eliminate the possibility of an auto-reply going back to other e-mail recipients if they were listed as “BCC” recipients.  It also might help to prevent replies inadvertently going to spammers.
2. Make sure the “AutoReply only once to each sender with the following text” text box is empty.
3. Select the “Add Rule” option.
4. In the window, select the “Sent directly to me” and “Cc’ed to me” options.In the “Perform these actions” box, select “Reply” and check on the template button. Type in a short message that you wish to use as your out-of-office notification.
5. Click OK, and make sure the “I am currently out of the office” option is set.

The above two solutions require the user to take action. Perhaps the best tack of all is to have the Exchange administrator make a registry change that modifies the Out of Office Assistant’s behavior. I’m going to refer you to article 825370 in the Microsoft Knowledge Base for these details (see

There are two other alternatives to using an Out of Office message. One, assign a delegate to review your e-mails and respond to urgent messages on your behalf. Two, leave an out of office voicemail instead of e-mail. It’s harder to use harvesting technologies to gain information through a voicemail system.

It’s great to get some time out of the office; now be smart about what you tell people when you’re gone.

Linda Musthaler is vice president of Currid & Company.  You can write to her at Linda.Musthaler@currid.com.