Setting up journaling for Exchange and Microsoft 365

If the mail flow runs through the Conbool gateway, the archive archives without any further connection. One gap remains nonetheless: messages between two mailboxes of the same organisation are delivered locally by Exchange and never reach the gateway. Journaling closes exactly that gap, because a journal rule creates a copy of every message, regardless of its path.

For Exchange and Microsoft 365 the journal rule is the intended path. Every other mail server instead delivers a copy by BCC to the same address, described under your own mail server.

Step 1: create the source in the portal

In the archive under Administration on the Sources and migration tab, create a source in the Journaling and mail server copies section. Three details are set in the process.

• Name, to distinguish several mail systems, for instance Exchange Online or a site with its own server.
• Delivery path, here journal. The default recognises the kind per message itself, a fixed setting is clearer as soon as a source serves only one mail system.
• Sender IP allowlist, optional. For Exchange Online it stays empty, because Microsoft's outbound address range is shared and changes. It makes sense with your own server on a fixed address.

Afterwards the portal shows the ingestion address in the form identifier@journal.conbool.com. This address cannot be guessed and acts as a secret. It can be rotated at any time, after which the old address accepts nothing more.

Archiving has to be activated beforehand, see setup. Without an active archive an incoming copy is not stored.

Step 2: journal rule in Exchange Online

In the Exchange admin center under Mail flow, depending on the version of the interface also Message flow, then Journal rules:

1. Set the address for undeliverable journal reports. It applies once for the organisation and must not be the journal target itself, otherwise error reports circle. An internal mailbox is the right place.
2. Add a rule and enter the ingestion address from the portal as the journal recipient.
3. Choose all messages as the scope, that is incoming, outgoing and internal. Only then is the gap for purely internal mail closed.
4. Apply the rule to all messages of the organisation instead of limiting it to individual mailboxes.

A mailbox in Exchange Online is not permitted as a journal target. That is exactly why an external address is needed, and the archive provides it.

What a journal report contains

Exchange does not send a simple copy but a report: a short message with the lines Sender, Recipient and On-Behalf-Of, carrying the original message as an attachment of the type message/rfc822.

From these lines the archive reads the actual parties of the envelope. That is the decisive difference from the copy by BCC: Bcc recipients and the resolution of distribution lists are in the envelope but in no visible header. Only the report captures them completely.

Archiving happens per party whose address belongs to a verified domain of the tenant. Foreign counterparts create no entry of their own.

Protecting the address

Three checks run before acceptance, each with an unambiguous answer.

• Without TLS, delivery is rejected with 530 5.7.0 Journal ingestion requires TLS. Newly created sources require TLS, and the source reports the state with the label TLS required. Exchange Online delivers over TLS on its own.
• An unknown, rotated or deactivated address is rejected with 550 5.1.1.
• If an allowlist is set and the delivering address is not in it, 550 5.7.1 Source not permitted for this journal address follows.

Verifying the setup

In the archive the Sources and migration area shows the ingest state and the time of the last archiving. After the first message the counter of the source starts moving.

A meaningful test is a message between two of your own mailboxes. It does not appear in message tracing, because it never touches the gateway, but it has to appear in the archive. Exactly that difference proves that the journal rule is working.

Failure patterns

• Nothing arrives at all. First check whether archiving is activated, then the scope of the journal rule and finally the address for typos. A rotated address in an old rule is the most common case after a change.
• Only part of the messages arrive. The scope of the rule is set to internal or external instead of all messages.
• Reports pile up and are rejected. A sender IP allowlist was set for Exchange Online. Microsoft's outbound address range is shared and cannot sensibly be listed, so the list belongs emptied here.
• Undeliverable journal reports accumulate. The address stored for them is missing or points at the journal target itself.

Duplicate deliveries are harmless. The archive creates exactly one entry per message, recipient and direction and discards repetitions.

Further reading

Activation, storage classes and legacy data are described in the setup. Retention periods and immutability are described under retention and WORM, access to the holding under search and access. For mail servers without a journal function the path through your own mail server applies.