Journaling to a third-party archive checklist

Before you start

• The journal address your provider issues and its requirements: source IPs to allow, TLS, any SMTP authentication and the maximum message size. Barracuda Cloud Archiving Service, for example, shows the address on its Mail Sources › SMTP Journaling page, offers PowerShell setup scripts for Exchange 2013 and newer, and accepts journaled mail over SMTP up to 150 MB. Mimecast and Proofpoint publish their own journaling guidance (Mimecast's Knowledge Hub, for example, covers configuring journaling on your email server and journaling connection failures); use it for the address format and connection requirements.
• Outbound SMTP from your Mailbox servers to the provider (directly or through your gateway).
• Exchange Enterprise CALs if you use journal rules.
• Agreement from legal or compliance on where undeliverable reports may be kept.

How it works

The Journaling agent is a built-in transport agent on Mailbox servers (it doesn't appear in Get-TransportAgent).

• A report that can't be delivered queues and retries until it expires (two days by default, set by MessageExpirationTimeout on Set-TransportService).

Checklist

1. 1

   Create a hidden journal contact

   powershell

   New-MailContact -Name "Archive Journal" -ExternalEmailAddress "journal-12345@archive.example.net"
   Set-MailContact "Archive Journal" -HiddenFromAddressListsEnabled $true

   Barracuda recommends hiding both the journal contact and the mailbox for undeliverable reports from the GAL so nobody mails them directly.

2. 2

   Create the alternate journaling mailbox

   powershell

   New-Mailbox -Name "Journal NDR" -UserPrincipalName journalndr@contoso.com -Password (Read-Host -AsSecureString "Password")
   Set-Mailbox "Journal NDR" -HiddenFromAddressListsEnabled $true
   Set-TransportConfig -JournalingReportNdrTo "journalndr@contoso.com"

   One alternate mailbox serves the whole organization, and it must be an on-premises mailbox you monitor: Microsoft doesn't support an Exchange Online mailbox as the journaling or alternate journaling mailbox. Never point JournalingReportNdrTo at the journal contact or at anything that forwards to the archive.

3. 3

   Add a dedicated send connector with TLS

   powershell

   New-SendConnector -Name "Journal to archive" -Usage Custom -AddressSpaces "archive.example.net" -SourceTransportServers EX01,EX02 -DNSRoutingEnabled $true -RequireTLS $true -TlsAuthLevel DomainValidation -TlsDomain "archive.example.net"

   Exchange uses the connector with the most specific matching address space, so reports for the provider's domain take this connector rather than your * internet connector.

4. 4

   Turn journaling on

   Standard journaling, on every database:

   powershell

   Get-MailboxDatabase | Set-MailboxDatabase -JournalRecipient "Archive Journal"

   Or premium journaling with one organization-wide rule:

   powershell

   New-JournalRule -Name "All mail to archive" -JournalEmailAddress "Archive Journal" -Scope Global -Enabled $true

Verify

• Send a test message from a journaled mailbox, then follow the report:

Get-MessageTrackingLog -Recipients "journal-12345@archive.example.net" -Start (Get-Date).AddMinutes(-30) |
  Format-Table Timestamp, EventId, Source, ConnectorId, RecipientStatus -AutoSize
Get-Queue | Format-Table Identity, DeliveryType, NextHopDomain, MessageCount, LastError -AutoSize

• Good looks like a SEND event through the Journal to archive connector with a 250 response in RecipientStatus, no queue building up towards the archive, an empty alternate journaling mailbox, and the message searchable in the provider's console. Barracuda indexes journaled mail within a few hours and suggests checking its Basic › Search page.

Tips & gotchas

• Hybrid: journal on both sides to cover every mailbox. Microsoft lists some duplicate reports as by design, and running Set-TransportConfig -PreventDuplicateJournalingEnabled $true in Exchange Online prevents the duplicates for on-premises-to-cloud mail. Journaling on-premises messages to Microsoft 365 while Journaling Archive is disabled for the tenant fails with 5.3.190 Journaling on-premises messages to Microsoft 365 or Office 365 not supported when Journaling Archive is disabled; Microsoft's fix is to enable Journaling Archive or journal to a different location.
• IRM-protected mail: archives without RMS support can't read it; Exchange can add a decrypted copy to the journal report if you enable journal report decryption (see IRM with the RMS connector).
• Loops: don't use a journal address in one of your accepted domains, and never add forwarding to the journal contact (see mail loops).
• Security: journal reports are a full copy of your mail. Limit who can open the alternate mailbox, require TLS, and allow only your servers at the provider. On a Barracuda Message Archiver appliance, for example, Allow Only Trusted Hosts on Mail Sources › SMTP works with the Trusted SMTP Servers list.
• Monitoring: alert on any queue towards the archive and on new items in the alternate mailbox; Microsoft's guidance makes following up those NDRs your job.

+1 more tips in the full article.