Message Tracking and Proxy Addresses

In a recent Reddit thread there was a question about message tracking and proxy addresses (or secondary email addresses).

A fairly common scenario for companies that have rebranded or merged with another company is a change of domain name for their email addresses. The typical approach is to roll out new email addresses for the new domain, most likely with an email address policy, and then leave the old email addresses as secondary addresses on the recipients so they can keep receiving email to them.

Eventually someone gets the idea that the old email addresses should be completely removed from all recipients. The question is put to the Exchange admin to work out whether anyone is still receiving email at their old email address.

Fortunately yes, message tracking does log this information. However it does not log it for the end to end mail flow. Here’s an example. This user has a primary email address of alex.heyne@exchangeserverpro.net, and a secondary address of alex@exchangeserverpro.net. Let’s pretend that secondary address is on a different domain and we’ve been asked to look for any evidence that it is still being used.

Here’s what we would see in the results of a message tracking log search. Notice the RESOLVE event that resolves the recipient address to the primary email address. However, for the initial RECEIVE event the secondary address is visible.

[PS] C:>Get-MessageTrackingLog -Recipients alex@exchangeserverpro.net -Start (Get-Date).AddHours(-1) | sort timestamp

EventId  Source   Sender                            Recipients                        MessageSubject
-------  ------   ------                            ----------                        --------------
HARED... SMTP     test@test.com                     {alex@exchangeserverpro.net}
RECEIVE  SMTP     test@test.com                     {alex@exchangeserverpro.net}
RESOLVE  ROUTING  test@test.com                     {Alex.Heyne@exchangeserverpro....
AGENT... AGENT    test@test.com                     {Alex.Heyne@exchangeserverpro....
SEND     SMTP     test@test.com                     {Alex.Heyne@exchangeserverpro....
DELIVER  STORE... test@test.com                     {Alex.Heyne@exchangeserverpro....

So the answer to the question is yes, message tracking logs will show usage of secondary email addresses and can be used to investigate whether those addresses are being used. You may need to run different searches depending on the specifics of your scenario. If you’re new to message tracking I recommend you start here.