Nobody's Inbox: A Custody and Response Framework for Role-Based Email

Almost every organisation publishes an info@ address. Rather fewer can name, without checking, the person who read what arrived there last Tuesday. The shared mailbox is one of the few pieces of business infrastructure that is created almost casually and then left to run for years without a specification, an owner or a test.

The result is a familiar pattern of quiet failure. Messages are marked as read because someone skimmed them. A distribution list copies five people, each of whom assumes another has replied. A forwarding rule sends enquiries to a mailbox belonging to somebody who left in the spring. Nobody has broken a rule, because no rule was ever written.

Why collective ownership fails quietly

Shared addresses are designed for convenience rather than accountability. A mailbox with eight delegates has no custodian; an alias that forwards to a team has no queue. Because nothing is technically broken, the failure never surfaces as an incident. It surfaces later, as a customer who chased three times, a tender that was never submitted, or a complaint that cannot be answered because nobody can reconstruct who said what.

There is a compliance dimension too. Under the UK GDPR and the Data Protection Act 2018, an organisation is expected to be able to locate and produce correspondence about an individual within a reasonable period. An address that forwards into a personal inbox, or into a mailbox deleted on the day a colleague left, undermines that ability long before anyone asks for it.

Step one: inventory the addresses you actually run

Begin with a full list, drawn from several sources rather than one. The tenant administration console will give you the mailboxes, aliases and distribution lists. That is the easy half. The harder half is discovering where those addresses are published: the website contact page, letterheads and invoice templates, Companies House filings, supplier portals, job adverts, tender documents, social media bios and the QR codes printed on vans.

For each address, record four things: the address itself, its technical type, who can currently see incoming mail, and where it is published. Then classify it. Active addresses are monitored and answered. Dormant addresses still receive mail but have no responsible person. Orphaned addresses forward to a departed employee or a decommissioned system.

Most organisations find the dormant and orphaned categories larger than expected. That is the finding, not a distraction from it.

Step two: appoint a custodian rather than a committee

Every address that remains in use should have one named custodian and one named deputy. The custodian does not have to answer every message. They own the outcome: that each message is seen, triaged within the agreed time, and either answered or routed to a named person.

Record the custodian in the mailbox description field as well as in the register. A spreadsheet nobody opens on a Monday morning is not a control. Where volume justifies a rota, publish it in a shared calendar so that colleagues can see who is on duty without asking.

Avoid the temptation to nominate a team. Teams do not read mailboxes; people do.

Step three: write response standards you can sustain

Separate acknowledgement from resolution. A workable three-part standard looks like this: an automatic acknowledgement during working hours, human triage within one working day, and a substantive reply within two working days or a clear statement of when one will follow.

Publish the standard only where you can meet it. A promise of a four-hour response that collapses in August is worse than a stated two-day target that holds all year. Define your working hours and say explicitly how English bank holidays are handled, because a customer counting calendar days will not make that allowance for you. If nobody monitors the address out of hours, say so plainly rather than implying otherwise.

Step four: make the triage visible

An unassigned message in a shared mailbox is invisible work. Use the assignment and categorisation features built into the shared mailbox so that responsibility is recorded inside the system of record, not in a chat thread.

The most damaging habit in shared inbox management is forwarding messages into personal mailboxes so that they can be dealt with individually. It feels efficient and it quietly dismantles the audit trail: replies leave from a personal address, the thread fragments, and the original mailbox retains no evidence that anything happened. Keep the work in the shared mailbox and grant access rather than forwarding.

Agree a small set of first-response templates centrally. Consistency of tone across a rota is otherwise impossible to maintain, and customers notice when the register shifts between correspondents.

Step five: retire role-based addresses without losing the record

The address belongs to the organisation, not to whoever happens to hold the login. When a custodian leaves, the mailbox should be converted to a shared mailbox, delegate permissions reviewed and revoked where appropriate, and a retention rule applied. Deleting a mailbox on a leaver's final day is a common and avoidable loss.

Set a retention schedule and document it. Two years is a defensible default for general enquiries; contract-related correspondence usually needs longer, and sector rules may dictate more. The point is not the precise number but that the number exists and is applied consistently.

Finally, review the signature. Outgoing mail from a shared address should identify the team and a monitored route back, not an individual who may have moved on. A reply that bounces is a second failure on top of the first.

Step six: review quarterly

Four measures are enough to keep this honest: messages received per address, median time to first human response, the number of messages that exceeded the standard, and the split of work between custodian and deputy. Sample twenty threads each quarter for tone and accuracy. Check that mailbox sizes remain within licence limits, since an unmanaged shared mailbox will eventually stop accepting mail at the least convenient moment.

A workable sequence

Small teams can complete the whole exercise in a day: inventory in the morning, custodians and standards in the afternoon. Larger organisations should allow four weeks, one week per stage, with the first quarterly review scheduled before the project is declared finished.

A published address is a promise that someone is listening. The audit exists to make sure that promise has a name attached to it.