I’ve been asked by more than a few people recently whether Exchange Server message tracking also includes emails sent to Bcc recipients.

I guess the purpose of Bcc would lead some to assume that those emails are not logged by message tracking.

However if you consider it from the perspective that all email travels through the transport pipeline no matter whether they are To, Cc, or Bcc recipients, and that the idea of untraceable email passing through your Exchange servers should be a scary thought, it makes sense that these messages are in fact logged in the message tracking logs.

I realise an actual demonstration may be necessary to convince some people of this, so here it is.

This email is sent to two recipients; one in the To field and one a Bcc.

exchange-message-tracking-bcc

I’ve only just sent the email so a quick search of the last 10 minutes of message tracking logs is all I need to run.

[PS] C:\>$msgs = Get-ExchangeServer | Get-MessageTrackingLog -Sender Alan.Reid@exchangeserverpro.net -Start (Get-Date).A
ddMinutes(-10)

Now let’s take a look at the results.

[PS] C:\>$msgs | sort timestamp

EventId  Source   Sender                            Recipients                        MessageSubject
-------  ------   ------                            ----------                        --------------
SUBMIT   STORE... Alan.Reid@exchangeserverpro.net   {}                                A test email
RECEIVE  STORE... Alan.Reid@exchangeserverpro.net   {Ana.Williams@exchangeserverpr... A test email
TRANSFER ROUTING  Alan.Reid@exchangeserverpro.net   {Mahera.Bawa@exchangeserverpro... A test email
DELIVER  STORE... Alan.Reid@exchangeserverpro.net   {Mahera.Bawa@exchangeserverpro... A test email
DELIVER  STORE... Alan.Reid@exchangeserverpro.net   {Ana.Williams@exchangeserverpr... A test email
SUBMIT   STORE... Alan.Reid@exchangeserverpro.net   {}                                A test email
RECEIVE  STORE... Alan.Reid@exchangeserverpro.net   {Ana.Williams@exchangeserverpr... A test email
TRANSFER ROUTING  Alan.Reid@exchangeserverpro.net   {Mahera.Bawa@exchangeserverpro... A test email
DELIVER  STORE... Alan.Reid@exchangeserverpro.net   {Mahera.Bawa@exchangeserverpro... A test email
DELIVER  STORE... Alan.Reid@exchangeserverpro.net   {Ana.Williams@exchangeserverpr... A test email

As you can see, both recipients are visible in the results.

But now let’s take a closer look, as some of you may be wondering how you can tell from the message tracking logs whether a recipient was in the Bcc of the email message.

[PS] C:\>$msgs | sort timestamp | select eventid,recipients,recipientstatus

EventId                                 Recipients                              RecipientStatus
-------                                 ----------                              ---------------
SUBMIT                                  {}                                      {}
RECEIVE                                 {Ana.Williams@exchangeserverpro.net,... {To, Bcc}
TRANSFER                                {Mahera.Bawa@exchangeserverpro.net}     {}
DELIVER                                 {Mahera.Bawa@exchangeserverpro.net}     {}
DELIVER                                 {Ana.Williams@exchangeserverpro.net}    {}

Notice on the RECEIVE event that the RecipientStatus field indicates whether the recipient was a To or a Bcc. Here’s that same event formatted slightly differently for clarity.

EventId         : RECEIVE
Recipients      : {Ana.Williams@exchangeserverpro.net, Mahera.Bawa@exchangeserverpro.net}
RecipientStatus : {To, Bcc}

Of course, with just two recipients you wouldn’t be 100% sure from this log event which one was the To and which one was the Bcc. So let’s take a look at another test email, this time with a different recipient mix.

exchange-message-tracking-bcc-03

Here is the RECEIVE event details for that message.

EventId         : RECEIVE
Recipients      : {Mahera.Bawa@exchangeserverpro.net, John.Tilleray@exchangeserverpro.net, Ana.Williams@exchangeserverp
                  ro.net}
RecipientStatus : {To, To, Bcc}

Notice how the recipients and recipient statuses are listed in a matching order (not alphabetical order)?

In other words, for that specific message:

  • Mahera Bawa = To
  • John Tilleray = To
  • Ana Williams = Bcc

So in conclusion, yes message tracking includes Bcc recipients, and yes you can even use message tracking logs to determine whether a recipient was in the To, Cc, or Bcc field of the email message.

If you’d like to learn more about message tracking in Exchange Server check out Mastering Message Tracking.

About the Author

Paul Cunningham

Paul is a former Microsoft MVP for Office Apps and Services. He works as a consultant, writer, and trainer specializing in Office 365 and Exchange Server. Paul no longer writes for Practical365.com.

Comments

  1. Jonathan

    How can i do this in Exchange Online?
    Only get-messagetrace and get-messagetracedetails are available in Exchange Online.

  2. Tshepiso

    Hi guys, is it possible to generate a report on Microsoft that proves that the BBC’d recipient has received the email?

    1. Tony Redmond

      No. You’d need to be able to follow the trail of the message to the destination server and there’s no way of doing that.

  3. Prasanna

    I know this article is meant for Exchange 2020 & 2013; Is there a way i can get the similar thing in O365? Is it possible in O365 to get the Recipient status of an email thats been sent?

  4. Vladimir

    Hi Paul,

    Thanks for the post. It is very informative.
    However, following your instructions, I cannot seem to retrieve information from the “BCC” and “TO” fields. For “Recipientstatus” I get “RecipientStatus : {250 2.1.5 Recipient OK}”. I am doing this in the Exchange Management Shell. I do not have the Get-MessageTrackingLog cmdlet in PS on the mail server. This is may seem a silly question,but how do I import it in?

    Thanks,

    Warm Regards,

    Vladimir

    1. Paul Cunningham

      If the cmdlet is not available for you in the Exchange Management Shell then its possible that you don’t have the necessary Exchange admin rights to use it.

      1. Vladimir

        I am logged on as a Domain admin on the mail server.

          1. Vladimir

            Just checked. The Administrator account is a member of the “Organization Management” role group in Exchange, which has Message Tracking as an assigned role.

          2. Paul Cunningham

            I can’t think of any reason why you don’t have the cmdlet available in your Exchange Management Shell then, unless someone has been messing around with your permissions or something else.

  5. Shaun

    For those wondering – the “slightly different formatting” is intead of format-table, it’s format-list with the same parameters selected.

    Great article.

  6. Krasimir

    For outside sender the RecipientStatus is empty. How can I understand recipient status in this case?

  7. Jun Ngoh

    Hi,

    How do i track bcc in exchange 2010 ?

  8. q

    thank you for your reply 🙂

  9. q

    I am being told by my boss that I have bcc-ed a work related e-mail to my personal address; and as this is is not allowed due to compliance rules, he will soon start a disciplinary procedure etc

    Anyhow, to date he has not shown me a copy of that e-mail even though I requested it several times …. as I honestly do not remember sending it.

    Do you think is it possible that he does not have the e-mail in question; and his allegations are based on some data form the exchange server only?

    1. Paul Cunningham

      Message tracking gives them the metadata they need to determine that the message was sent. Other methods can give them the actual message as well. Your work email is not private. I think you should assume that they have what they say they have and prepare yourself. This is a HR matter between you and your company so there’s nothing else I can say.

  10. Kingston Blenis

    Paul,

    As a follow up to Steven’s question. How can I get the To, Cc, Bcc info on emails my organization sends to external addresses? As you stated the SEND event has the “250 Recipient Ok” data. I’ve searched the unfiltered logs and can’t find this in any of the entries regardless of EventId.

    1. Kingston Blenis

      I found my own answer. I was filtering to only Source=SMTP events and was not seeing the Source=STOREDRIVER RECEIVE event.

  11. Steven

    Hi Paul

    I tried your method, but instead of giving me information such as To, CC or BCC in “RecipientStatus”, I get something like “250 OK”. I couldn’t find CC or BCC anywhere…

    1. Paul Cunningham

      Are you doing a message tracking log search or are you looking at protocol logs?

      1. Steven

        I used Get-MessageTrackingLog in PowerShell.

        I event dropped the Message Tracking Log in Excel and looked at the column that says “RecipientStatus”, but nope… it shows information such as “250” rather than “CC/BCC”.

        This is an Exchange 2013 environment.

        1. Paul Cunningham

          How many servers in your org? Are you searching them all?

          FWIW, I just re-tested it and its working fine in my Ex2013 lab. The Bcc RecipientStatus doesn’t appear on every tracking log entry for the message though, just on RECEIVE events. I do see “250 2.1.5 Recipient OK” recipient status on SEND events as well.

  12. Nicolas

    Hi !!

    And thanks for this article.
    Just a simply question about MessageTrackingLog.

    It is possible to group by Domain ?

  13. Jehad

    I install exch 2013 I have problem with read rec when send email to any client on our domain I recieved 2 read report 1 of them on behalf the client and the other upon my request for read report so I think the onbehalf one is generated by exchserv I want to prevent this generated report

    1. Paul Cunningham

      Does this happen only to you or does it also happen to anybody who requests a read receipt?

      1. jehad khalil

        its happend to everybody

      2. jehad khalil

        Mr Paul please i need your help to solve this issue

Leave a Reply