Transport rules cover a lot: append a notice, send a copy, set a header. Where they stop, the transport agent begins. It is the oldest and most powerful extension point in Exchange, and the one with the most traps.
What a transport agent is
A transport agent is a .NET library loaded by the Exchange transport service. It hooks into events while a message is processed and gets access to envelope, headers and content. The reference libraries for compiling sit on the server in the Public folder of the Exchange installation.
Two types matter in practice:
- SmtpReceiveAgent works during SMTP receive, for example at
OnEndOfData. It only sees what arrives over SMTP. - RoutingAgent works in categorization with
OnSubmittedMessage,OnResolvedMessage,OnRoutedMessageandOnCategorizedMessage. It sees every message, including those Outlook submits directly that never travel over SMTP.
For internal mail, only a RoutingAgent will do.
Transport rule or agent
| Question | Transport rule | Transport agent |
|---|---|---|
| Setup | Exchange admin center or PowerShell | Installation on every transport server |
| Capabilities | fixed conditions and actions | anything the API allows |
| Route through a specific connector | Exchange Online only | yes |
| Upkeep on updates | none | check per CU |
| Risk to mail flow | low | high on errors |
Installation
Install-TransportAgent -Name "My Agent" -TransportAgentFactory "Company.Agent.Factory" -AssemblyPath "C:\Agent\Company.Agent.dll" Enable-TransportAgent -Identity "My Agent" Set-TransportAgent -Identity "My Agent" -Priority 10 Restart-Service MSExchangeTransport
Get-TransportAgent shows order and state. Priority decides which agent sees a message first. Two agents rewriting the same message only get along with a clear order.
Where agents fail in production
The critical flag
Exchange registers a newly installed agent as critical in agents.config. If a critical agent fails to load at startup, for instance because a dependency is missing, the whole transport service does not start. Then mail flow stops, not just the agent. Check that flag after every installation.
The Outlook format
Outlook sends within the organisation in its own TNEF format, ordinary messages included. If an agent reads the content as MIME, Exchange creates a conversion with winmail.dat. For meetings the conversion back fails with Corrupt summary TNEF content, and the sender gets a non-delivery report. An agent has to distinguish by message class: leave meetings and tasks untouched, convert ordinary messages cleanly.
If you only test with scripts or Outlook on the web, you never notice. Both send MIME.
Downstream outages
When an agent hands messages to another system, it has to handle that system being down. A RoutingAgent can defer a message with Defer, and Exchange retries later. Letting it through instead delivers exactly what the agent was supposed to prevent.
Updates
Every cumulative update is a test for the agent. The first release of Exchange SE is code-equivalent to Exchange 2019 CU15, later updates may differ. A maintained agent has a vendor who checks every new CU.
Checklist for third-party agents
- Does the vendor support your Exchange version in writing?
- Is the agent registered as critical, and is that intended?
- What happens when the target system is unavailable?
- How does the agent handle meetings and messages in Outlook format?
- How is it updated, and is the configuration kept?
The Conbool Exchange agent
Conbool uses a RoutingAgent to route internal mail through the gateway. It removes the critical flag after installation, defers when the gateway is unavailable, distinguishes Outlook messages by class and starts in observe mode. Background in why internal email in Exchange never reaches a gateway, setup in the Exchange agent documentation and the overview on encrypt internal email in Exchange.
