The Electronic Mail Surveillance System (EMS) provides facilities to investigate electronic mail sent via the Internet to domains of interest and can be run independently from current installations of Domain Mail Servers.

EMS provides an environment in which a number of concurrent channels are maintained for electronic mail sent in a particular direction. The electronic mail received through these channels, that meet a certain criteria, could be forwarded and/or investigated. The administrator can determine the selection criteria upon which a particular electronic mail is investigated, and the extent of this investigation. Electronic mail can be archived on a daily basis and/or deleted after a given amount of time.

For every receiving address in the domain of interest, a database is maintained which records incoming and outgoing electronic mail traffic and its attributes. This information can be retrieved as daily, weekly or monthly reports, or can be sent out to a specified address triggered by a certain event.

To investigate electronic mail a number of modules are placed in a queue. The order in which they are placed in the queue also decides the order in which the electronic mail is exposed to a particular module.