I’ve been asked by more than a few people recently whether Exchange Server message tracking also includes emails sent to Bcc recipients.
I guess the purpose of Bcc would lead some to assume that those emails are not logged by message tracking.
However if you consider it from the perspective that all email travels through the transport pipeline no matter whether they are To, Cc, or Bcc recipients, and that the idea of untraceable email passing through your Exchange servers should be a scary thought, it makes sense that these messages are in fact logged in the message tracking logs.
I realise an actual demonstration may be necessary to convince some people of this, so here it is.
This email is sent to two recipients; one in the To field and one a Bcc.
I’ve only just sent the email so a quick search of the last 10 minutes of message tracking logs is all I need to run.
[PS] C:\>$msgs = Get-ExchangeServer | Get-MessageTrackingLog -Sender Alan.Reid@exchangeserverpro.net -Start (Get-Date).A ddMinutes(-10)
Now let’s take a look at the results.
[PS] C:\>$msgs | sort timestamp
EventId Source Sender Recipients MessageSubject
------- ------ ------ ---------- --------------
SUBMIT STORE... Alan.Reid@exchangeserverpro.net {} A test email
RECEIVE STORE... Alan.Reid@exchangeserverpro.net {Ana.Williams@exchangeserverpr... A test email
TRANSFER ROUTING Alan.Reid@exchangeserverpro.net {Mahera.Bawa@exchangeserverpro... A test email
DELIVER STORE... Alan.Reid@exchangeserverpro.net {Mahera.Bawa@exchangeserverpro... A test email
DELIVER STORE... Alan.Reid@exchangeserverpro.net {Ana.Williams@exchangeserverpr... A test email
SUBMIT STORE... Alan.Reid@exchangeserverpro.net {} A test email
RECEIVE STORE... Alan.Reid@exchangeserverpro.net {Ana.Williams@exchangeserverpr... A test email
TRANSFER ROUTING Alan.Reid@exchangeserverpro.net {Mahera.Bawa@exchangeserverpro... A test email
DELIVER STORE... Alan.Reid@exchangeserverpro.net {Mahera.Bawa@exchangeserverpro... A test email
DELIVER STORE... Alan.Reid@exchangeserverpro.net {Ana.Williams@exchangeserverpr... A test email
As you can see, both recipients are visible in the results.
But now let’s take a closer look, as some of you may be wondering how you can tell from the message tracking logs whether a recipient was in the Bcc of the email message.
[PS] C:\>$msgs | sort timestamp | select eventid,recipients,recipientstatus
EventId Recipients RecipientStatus
------- ---------- ---------------
SUBMIT {} {}
RECEIVE {Ana.Williams@exchangeserverpro.net,... {To, Bcc}
TRANSFER {Mahera.Bawa@exchangeserverpro.net} {}
DELIVER {Mahera.Bawa@exchangeserverpro.net} {}
DELIVER {Ana.Williams@exchangeserverpro.net} {}
Notice on the RECEIVE event that the RecipientStatus field indicates whether the recipient was a To or a Bcc. Here’s that same event formatted slightly differently for clarity.
EventId : RECEIVE
Recipients : {Ana.Williams@exchangeserverpro.net, Mahera.Bawa@exchangeserverpro.net}
RecipientStatus : {To, Bcc}
Of course, with just two recipients you wouldn’t be 100% sure from this log event which one was the To and which one was the Bcc. So let’s take a look at another test email, this time with a different recipient mix.
Here is the RECEIVE event details for that message.
EventId : RECEIVE
Recipients : {Mahera.Bawa@exchangeserverpro.net, John.Tilleray@exchangeserverpro.net, Ana.Williams@exchangeserverp
ro.net}
RecipientStatus : {To, To, Bcc}
Notice how the recipients and recipient statuses are listed in a matching order (not alphabetical order)?
In other words, for that specific message:
- Mahera Bawa = To
- John Tilleray = To
- Ana Williams = Bcc
So in conclusion, yes message tracking includes Bcc recipients, and yes you can even use message tracking logs to determine whether a recipient was in the To, Cc, or Bcc field of the email message.
If you’d like to learn more about message tracking in Exchange Server check out Mastering Message Tracking.
This article Exchange Server FAQ: Does Message Tracking Include Bcc Recipients? is © 2014 ExchangeServerPro.com
Get more Exchange Server tips at ExchangeServerPro.com
