My first question here and I'm hoping someone can help me out. Here is our environment:
1. Exchange 2003 with one front-end server and one back-end server.
2. All inbound/outbound emails are routed through Postini spam filtering.
3. Third-party journaling service (Smarsh, Inc.).
Earlier this year we switched from journaling our email internally to journaling it with a third-party provider (Smarsh, Inc.). Journaling internally worked fine and captured everything. When we made the switch, I believe we set up everything correctly:
1. We created an AD contact w/ the new journal mailbox email address.
2. Created an SMTP connector to the third-party provider w/ TLS enabled.
3. Changed the journal mailbox settings on mailbox store to point to new journal mailbox (i.e. AD contact created in #1).
4. "Archive all message sent or received..." checked.
I recently discovered that it seems like only messages sent from our organization are being journaled (i.e. internal > external, internal > internal) and that external > internal emails are not. When I perform a search of the journal mailbox through Smarsh's management portal, I only see messages sent from our users.
I used Exchange message tracking to see if I could find any issues with delivery to the journal but did not find any clues as to why this is happening. This only confirmed that external > internal messages are not being sent to the journal mailbox as I don't see a line stating "Message transferred to xxxxx.smarsh.com through SMTP" on emails received from external parties. Emails sent from our users do have that line.
Any ideas on what could be causing this to happen?