Journaling in a Mixed Mode Environment

Document created by user.oxriBaJeN4 Employee on Sep 11, 2015
Version 1Show Document
  • View in full screen mode

It has come to our attention that there is a bug in the POP3 service of Microsoft Exchange servers when running in a mixed mode environment comprising of Exchange 2003 and Exchange 2007/2010.


This bug is very rare and only occasionally affects customers who are using POP3 journaling to present their internal communications to Mimecast.




A rare and undocumented bug in the POP3 service of Microsoft Exchange servers causes corrupt data to be transported via POP3 resulting in corrupted data appearing in your Mimecast email archive.


This becomes apparent by an increase in the number of winmail.dat attachments in archived emails.


Convert from POP3 to SMTP based journaling before enabling a mixed mode environment that comprises of Exchange 2003 and 2007/2010.




Customers looking to migrate from Exchange 2003 to either Exchange 2007 or Exchange 2010, and who will be running both systems together for a period of time, should be aware that their journaled data could be at risk of corruption.


During a POP3 connection to a journal mailbox, the Microsoft Exchange POP3 service (both secured and unsecured) randomly tries to deliver the mail files as a binary stream. This is unexpected behavior as the POP3 service should only be presenting data in Internet Engineering Task Force (IETF) standards formats, or what Exchange servers refer to as “Internet” formats. This results in the data received by Mimecast (and indeed any other POP3 based journal service including the likes of Outlook Express and other mail clients) being completely corrupted and irretrievable.


Users may search for items and find messages that display header information, such as Sender, Recipients and Subject, but there will be no message body, only a winmail.dat attachment that they can do nothing with.


Consequently, because of this winmail.dat file, administrators are likely to pursue RTF and MIME encapsulation troubleshooting paths, which will lead them away from the root cause of the problem and hence end up with no resolution.


This behavior from Microsoft Exchange is extremely erratic, and does not have any identifiable root cause other than the mixed mode environment with no known fix.

Mimecast has reported our findings to Microsoft in the hope that they will release a patch at some point in the future.




Mimecast have confirmed that the issue described above does not affect SMTP transferred messages. Therefore, messages delivered to your Mimecast archive via SMTP transport will be converted to the correct Internet format and make it safely into your archive.


The following articles will guide you through the necessary steps to effect a workaround:


  • Migrate from POP3 to SMTP Journaling
  • Create a new SMTP Send Connector to secure the SMTP session (if needed)


For more information on how to configure the options listed above, please see Journaling.


If you have any questions, please do not hesitate to contact our Support team who will guide you through the process of changing over to SMTP journaling.