Journaling wraps every message — or the messages of chosen people — in a journal report and sends it to an archive. With Exchange Server SE or 2019 that archive is often a hosted service such as Mimecast, Barracuda Cloud Archiving Service or Proofpoint, so the reports leave your organization over SMTP, and a failure on the way can silently cost you records. In this post I'll set up the Exchange side: journaling method, journal contact, dedicated connector, NDR mailbox and proof that reports arrive.
Errors this guide fixes
5.3.190 Journaling on-premises messages to Microsoft 365 or Office 365 not supported when Journaling Archive is disabledNDR in the alternate journaling mailbox
How it works#
The Journaling agent is a built-in transport agent on Mailbox servers (it doesn't appear in Get-TransportAgent). For each matching message it sends a journal report from the Microsoft Exchange recipient: the original message is attached unaltered, and the report body lists the sender, subject, Message-ID and recipients. This envelope journaling is the only method Exchange supports.
| Standard journaling | Premium journaling | |
|---|---|---|
| Configured on | Each mailbox database | Journal rules |
| Journals | All mail sent and received by mailboxes on that database | All or selected recipients; scope Internal, External or Global |
| Licensing | Standard CAL is enough | Exchange Enterprise CALs |
| Whole organization | Every database on every server | One rule without a recipient filter |
A report that can't be delivered queues and retries until it expires (two days by default, set by MessageExpirationTimeout on Set-TransportService). Because its sender is the Microsoft Exchange recipient, an expired report can't bounce to anyone and can't be recovered — unless an alternate journaling mailbox catches the NDRs, which carry the original report as an attachment.
Prerequisites#
- The journal address your provider issues and its requirements: source IPs to allow, TLS, any SMTP authentication and the maximum message size. Barracuda Cloud Archiving Service, for example, shows the address on its Mail Sources › SMTP Journaling page, offers PowerShell setup scripts for Exchange 2013 and newer, and accepts journaled mail over SMTP up to 150 MB. Mimecast and Proofpoint publish their own journaling guidance (Mimecast's Knowledge Hub, for example, covers configuring journaling on your email server and journaling connection failures); use it for the address format and connection requirements.
- Outbound SMTP from your Mailbox servers to the provider (directly or through your gateway).
- Exchange Enterprise CALs if you use journal rules.
- Agreement from legal or compliance on where undeliverable reports may be kept.
Step-by-step#
1. Create a hidden journal contact#
New-MailContact -Name "Archive Journal" -ExternalEmailAddress "journal-12345@archive.example.net"
Set-MailContact "Archive Journal" -HiddenFromAddressListsEnabled $trueBarracuda recommends hiding both the journal contact and the mailbox for undeliverable reports from the GAL so nobody mails them directly.
2. Create the alternate journaling mailbox#
New-Mailbox -Name "Journal NDR" -UserPrincipalName journalndr@contoso.com -Password (Read-Host -AsSecureString "Password")
Set-Mailbox "Journal NDR" -HiddenFromAddressListsEnabled $true
Set-TransportConfig -JournalingReportNdrTo "journalndr@contoso.com"One alternate mailbox serves the whole organization, and it must be an on-premises mailbox you monitor: Microsoft doesn't support an Exchange Online mailbox as the journaling or alternate journaling mailbox. Never point JournalingReportNdrTo at the journal contact or at anything that forwards to the archive. The NDRs for failed reports would head straight back to the destination that is failing, and if the alternate mailbox also rejects them, the original reports are lost. Journal rules, Inbox rules and mail flow rules that involve this mailbox are ignored, so it can't be forwarded on with rules either.
3. Add a dedicated send connector with TLS#
New-SendConnector -Name "Journal to archive" -Usage Custom -AddressSpaces "archive.example.net" -SourceTransportServers EX01,EX02 -DNSRoutingEnabled $true -RequireTLS $true -TlsAuthLevel DomainValidation -TlsDomain "archive.example.net"Exchange uses the connector with the most specific matching address space, so reports for the provider's domain take this connector rather than your * internet connector. That keeps them away from signature, disclaimer or DLP services on your outbound gateway that might modify them, and enforces TLS with a certificate name check; set -TlsDomain to the name on the provider's certificate. If the provider requires smart hosts and SMTP authentication, use -SmartHosts with -DNSRoutingEnabled $false, -SmartHostAuthMechanism BasicAuthRequireTLS and -AuthenticationCredential (Get-Credential). If your firewall forces all SMTP through a gateway, make sure it passes journal reports untouched (see signature services and routing).
Microsoft notes that the journaling destination must accept messages at least as large as your organization's maximum message size, so check the connector's MaxMessageSize and the provider's limit against it (see message size limits).
4. Turn journaling on#
Standard journaling, on every database:
Get-MailboxDatabase | Set-MailboxDatabase -JournalRecipient "Archive Journal"Or premium journaling with one organization-wide rule:
New-JournalRule -Name "All mail to archive" -JournalEmailAddress "Archive Journal" -Scope Global -Enabled $trueUse one method per archive. Journal rules are stored in Active Directory, so allow for replication; group membership used by a rule is cached for up to four hours, and restarting the Microsoft Exchange Transport service refreshes it. Barracuda also notes that its Cloud Archiving Service takes journaling from one mail organization into one account only.
Verify#
Send a test message from a journaled mailbox, then follow the report:
Get-MessageTrackingLog -Recipients "journal-12345@archive.example.net" -Start (Get-Date).AddMinutes(-30) |
Format-Table Timestamp, EventId, Source, ConnectorId, RecipientStatus -AutoSize
Get-Queue | Format-Table Identity, DeliveryType, NextHopDomain, MessageCount, LastError -AutoSizeGood looks like a SEND event through the Journal to archive connector with a 250 response in RecipientStatus, no queue building up towards the archive, an empty alternate journaling mailbox, and the message searchable in the provider's console. Barracuda indexes journaled mail within a few hours and suggests checking its Basic › Search page. A queue with a TLS or connection error points to stuck outbound queues or TLS settings. If NDRs did land in the alternate mailbox, fix the cause, then use Resend this message in Outlook on each NDR to send the unaltered report on to the archive.
Tips & gotchas#
- Hybrid: journal on both sides to cover every mailbox. Microsoft lists some duplicate reports as by design, and running
Set-TransportConfig -PreventDuplicateJournalingEnabled $truein Exchange Online prevents the duplicates for on-premises-to-cloud mail. Journaling on-premises messages to Microsoft 365 while Journaling Archive is disabled for the tenant fails with5.3.190 Journaling on-premises messages to Microsoft 365 or Office 365 not supported when Journaling Archive is disabled; Microsoft's fix is to enable Journaling Archive or journal to a different location. - IRM-protected mail: archives without RMS support can't read it; Exchange can add a decrypted copy to the journal report if you enable journal report decryption (see IRM with the RMS connector).
- Loops: don't use a journal address in one of your accepted domains, and never add forwarding to the journal contact (see mail loops).
- Security: journal reports are a full copy of your mail. Limit who can open the alternate mailbox, require TLS, and allow only your servers at the provider. On a Barracuda Message Archiver appliance, for example, Allow Only Trusted Hosts on Mail Sources › SMTP works with the Trusted SMTP Servers list.
- Monitoring: alert on any queue towards the archive and on new items in the alternate mailbox; Microsoft's guidance makes following up those NDRs your job.
- Gateways: for inbound and outbound routing through these vendors, see Mimecast, Barracuda and Proofpoint with Exchange Server.
References#
- Journaling in Exchange Server (Microsoft Learn)
- Journaling in Exchange Online (Microsoft Learn)
- How to Journal to the Cloud Archiving Service from Exchange Server 2013 and Newer - Premium Journaling (Barracuda)
- How to Journal to the Cloud Archiving Service from Exchange Server 2013 and Newer - Standard Journaling (Barracuda)
