{
	"id": "3787ef84-2a2f-457b-b996-c55605d85bf8",
	"created_at": "2026-04-06T01:31:16.128725Z",
	"updated_at": "2026-04-10T03:21:59.868148Z",
	"deleted_at": null,
	"sha1_hash": "7903b4b325fb20a940f9a4cd70e3c917f20b5dd9",
	"title": "Transport agents: Exchange 2013 Help",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 80578,
	"plain_text": "Transport agents: Exchange 2013 Help\r\nBy msdmaguire\r\nArchived: 2026-04-06 01:28:05 UTC\r\nApplies to: Exchange Server 2013\r\nTransport agents let you install custom software that is created by Microsoft, by third-party vendors, or by your\r\norganization, on an Exchange server. This software can then process email messages that pass through the\r\ntransport pipeline. In Microsoft Exchange Server 2013, the transport pipeline is made of the following processes:\r\nThe Front End Transport service on Client Access servers\r\nThe Transport service on Mailbox servers\r\nThe Mailbox Transport service on Mailbox servers\r\nThe Transport service on Edge Transport servers\r\nFor more information about the transport pipeline, see Mail flow\r\nLike the previous version of Exchange, Exchange 2013 transport provides extensibility through the Microsoft\r\nExchange Server 2013 Transport Agents SDK. The Exchange 2013 version of the SDK is based on the Microsoft\r\n.NET Framework version 4.0 and allows third parties to implement the following predefined classes:\r\nSmtpReceiveAgent\r\nRoutingAgent\r\nDeliveryAgent\r\nWhen complied against libraries in the SDK, the resulting assemblies are registered with Exchange 2013, which\r\nloads the agents and invokes their event handlers during specific stages of the SMTP sessions or message\r\nprocessing. These stages, or events, are part of the agent definitions. The agent registration information is stored in\r\nan XML configuration file.\r\nThe following list explains the requirements for using transport agents in Exchange 2013.\r\nThe Transport service on Mailbox servers and Edge Transport servers fully supports all the predefined\r\nclasses in the SDK, and therefore any third-party transport agents written for the Hub Transport or Edge\r\nTransport server roles in Microsoft Exchange Server 2010 should work in the Transport service in\r\nExchange 2013.\r\nThe Front End Transport service only supports the SmtpReceiveAgent class in the SDK, and third-party\r\nagents can't operate on the OnEndOfData SMTP event.\r\nhttps://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help\r\nPage 1 of 6\n\nThe Mailbox Transport service doesn't support the SDK at all, so you can't use any third-party agents in the\r\nMailbox Transport service.\r\nSupport for legacy transport agents based on versions of the .NET Framework prior to version 4.0 isn't enabled by\r\ndefault, but you can enable it. For instructions, see Enable support for legacy transport agents.\r\nDue to the updates to the Exchange 2013 transport pipeline, the transport agent cmdlets need to distinguish\r\nbetween the Transport service and the Front End Transport service, especially if the Client Access server and the\r\nMailbox server are installed on the same computer. For more information, see Manage transport agents.\r\nTransport Agent management cmdlets manipulate a configuration file located at\r\n%ExchangeInstallPath%TransportRoles\\Shared . For the Transport service on Mailbox servers and Edge\r\nTransport servers, the file is agents.config . For the Front End Transport service on Client Access servers, the\r\nfile is fetagents.config . Both files use the same format as in Exchange 2010. For more information about\r\nmanaging transport agents, see Manage transport agents.\r\nTransport agents use SMTP events. These events are triggered as messages move through the transport pipeline.\r\nSMTP events give transport agents access to messages at specific points during the SMTP conversation and during\r\nrouting of messages through the organization.\r\nNote that there are new SMTP Receive events in Exchange 2013. SMTP Receive exists in the Front End Transport\r\nservice on Client Access servers, the Transport service on Mailbox servers and Edge Transport servers and the\r\nMailbox Transport Delivery service on Mailbox servers. The categorizer exists only in the Transport service on\r\nMailbox servers and Edge Transport servers. For more information about transport services and the categorizer,\r\nsee Mail routing.\r\nThe following tables list the SMTP events that provide access to messages in the transport pipeline.\r\nSequence SMTP event Description\r\n1 OnConnectEvent\r\nThis event is triggered by the initial connection from a\r\nremote SMTP host.\r\n2 OnHeloCommand\r\nThis event is triggered when the HELO command is issued\r\nby the remote SMTP host.\r\n3 OnEhloCommand\r\nThis event is triggered when the EHLO command is issued\r\nby the remote SMTP host.\r\n4 OnStartTlsCommand\r\nThis event is triggered when the STARTTLS command is\r\nissued by the remote SMTP host.\r\n5 OnAuthCommand\r\nThis event is triggered when the AUTH command is issued\r\nby the remote SMTP host.\r\n6 OnProcessAuthentication\r\nThis event is triggered when authentication with the remote\r\nSMTP host is being processed.\r\nhttps://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help\r\nPage 2 of 6\n\nSequence SMTP event Description\r\n7 OnEndOfAuthentication\r\nThis event is triggered when the remote SMTP host has\r\ncompleted authentication.\r\n8 OnXSessionParamsCommand\r\nThis event is triggered when the XSESSIONPARAMS\r\ncommand is issued by the remote SMTP host.\r\n9 OnMailCommand\r\nThis event is triggered when the MAIL FROM command is\r\nissued by the remote SMTP host.\r\n10 OnRcptToCommand\r\nThis event is triggered when the RCPT TO command is\r\nissued by the remote SMTP host.\r\n11 OnDataCommand\r\nThis event is triggered when the DATA (text) or BDAT\r\n(binary data) command is issued by the remote SMTP host.\r\n12 OnEndOfHeaders\r\nThis event is triggered when the remote SMTP host has\r\ncompleted submitting the email message headers. This is\r\nindicated by a blank line ( \u003cCRLF\u003e ) that separates the\r\nmessage headers and the message body.\r\n13 OnProxyInboundMessage\r\nThis event is triggered when an inbound SMTP session is\r\nrelayed or proxied by the Front End Transport service on a\r\nClient Access server to the Transport service on a Mailbox\r\nserver.\r\n14 OnEndOfData\r\nThis event is triggered when the remote SMTP host issues\r\nan end of data command. For text sessions started by the\r\nDATA command, the end of data indicator is \u003cCRLF\u003e.\r\n\u003cCRLF\u003e . For binary sessions started by the BDAT command,\r\nthe end of data indicator is BDAT LAST .\r\n** OnHelpCommand\r\nThis event is triggered if the HELP command is issued by\r\nthe remote SMTP host.\r\n** OnNoopCommand\r\nThis event is triggered if the NOOP command is issued by\r\nthe remote SMTP host.\r\n** OnReject\r\nThis event is triggered if the receiving SMTP host issues a\r\ntemporary or permanent delivery status notification (DSN)\r\ncode to the sending SMTP host.\r\n** OnRsetCommand\r\nThis event is triggered if the RSET command is issued by\r\nthe sending SMTP host.\r\nhttps://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help\r\nPage 3 of 6\n\nSequence SMTP event Description\r\n15 OnDisconnectEvent\r\nThis event is triggered by the disconnection of the SMTP\r\nconversation by either the receiving or sending SMTP host.\r\nTypically, this happens when the QUIT command is issued\r\nby the remote SMTP host.\r\n** These events can occur at any time after OnConnectEvent but before OnDisconnectEvent.\r\nSequence SMTP event Description\r\n1 OnSubmittedMessage\r\nThis event is triggered when a message arrives in the Submission\r\nqueue in the Transport service on the receiving Mailbox server or\r\nEdge Transport server.\r\n2 OnResolvedMessage\r\nThis event is triggered after all the recipients have been resolved,\r\nbut before the next hop has been determined for each recipient. The\r\nOnResolvedMessage routing event enables subsequent events to\r\noverride the default routing behavior by using the per-recipient\r\nSetRoutingOverride method.\r\n3 OnRoutedMessage\r\nThis event is triggered after messages have been categorized,\r\ndistribution lists have been expanded, and recipients have been\r\nresolved.\r\n4 OnCategorizedMessage\r\nThis event is triggered when the categorizer completes processing\r\nthe message.\r\nThere are two factors that determine the order that transport agents act on messages in the transport pipeline:\r\n1. The SMTP event where the transport agent is registered, and when that SMTP event encounters messages.\r\n2. The priority value that's assigned to the transport agent if there are multiple agents registered to the same\r\nSMTP event. The highest priority is 1. A higher integer value indicates a lower agent priority.\r\nFor example, suppose you configured the following transport agents:\r\nTransport Agent A with a priority of 1 and Transport Agent C with a priority of 2 are registered to the\r\nOnEndOfHeaders SMTP event.\r\nTransport Agent B with a priority of 4 is registered to the OnMailCommand SMTP event.\r\nTransport Agent B is applied to messages first because the OnMailCommand event encounters messages before\r\nthe OnEndOfHeaders event. When messages reach the OnEndOfHeaders event, Transport Agent A is applied\r\nbefore Transport Agent C because Transport Agent A has a higher priority (lower integer value) than Transport\r\nAgent C.\r\nhttps://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help\r\nPage 4 of 6\n\nExchange 2013 includes many built-in transport agents that provide features such as anti-spam, transport rules and\r\njournaling. Most of the built-in transport agents on Exchange 2013 Mailbox servers and Client Access servers are\r\ninvisible and unmanageable by the transport agent management cmdlets. Virtually all of the built-in transport\r\nagents that are visible and manageable are in the Transport service on Mailbox servers and on Edge Transport\r\nservers.\r\nThe more interesting built-in transport agents on Mailbox servers are described in the following table. Note that\r\nthis table doesn't include many of the invisible and unmanageable transport agents.\r\nAgent name Manageable? Priority SMTP or categorizer events\r\nTransport Rule Agent Yes 1 OnResolvedMessage\r\nMalware Agent Yes 2 OnSubmittedMessage\r\nText Messaging Routing Agent Yes 3 OnSubmittedMessage\r\nText Messaging Delivery Agent Yes 4 n/a\r\nJournal Agent No Not configurable OnRoutedMessage\r\nJournal Report Decryption Agent No Not configurable OnCategorizedMessage\r\nRMS Decryption Agent No Not configurable OnSubmittedMessage\r\nRMS Encryption Agent No Not configurable\r\nOnSubmittedMessage\r\nOnRoutedMessage\r\nRMS Protocol Decryption Agent No Not configurable OnEndOfData\r\nOn Edge Transport servers, most of the built-in transport agents are visible and manageable by the transport agent\r\nmanagement cmdlets or by other feature-specific cmdlets.\r\nThe more interesting built-in transport agents on Edge Transport servers are described in the following table. Note\r\nthat this table doesn't include invisible or unmanageable transport agents.\r\nAgent name Manageable? Priority SMTP or categorizer events\r\nConnection Filtering Agent Yes 1\r\nOnConnectEvent\r\nOnMailCommand\r\nOnRcptComand\r\nOnEndOfHeaders\r\nAddress Rewriting Inbound Agent Yes 2\r\nOnRcptComand\r\nOnEndOfHeaders\r\nEdge Rule Agent Yes 3 OnEndOfData\r\nhttps://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help\r\nPage 5 of 6\n\nAgent name Manageable? Priority SMTP or categorizer events\r\nContent Filter Agent* Yes 4 OnEndOfData\r\nSender ID Agent* Yes 5 OnEndOfHeaders\r\nSender Filter Agent* Yes 6\r\nOnMailCommand\r\nOnEndOfHeaders\r\nRecipient Filter Agent Yes 7 OnRcptCommand\r\nProtocol Analysis Agent* Yes 8\r\nOnConnectEvent\r\nOnEndOfHeaders\r\nOnEndOfData\r\nOnReject\r\nOnRsetCommand\r\nOnDisconnectEvent\r\nAttachment Filtering Agent Yes 9 OnEndOfData\r\nAddress Rewriting Outbound Agent Yes 10\r\nOnSubmittedMessage\r\nOnRoutedMessage\r\n*\r\n You can also install and configure these anti-spam agents on Mailbox servers. For more information, see Enable\r\nanti-spam functionality on Mailbox servers.\r\nTo help you troubleshoot issues with transport agents, you can use the following features:\r\nGet-TransportPipeline: This cmdlet shows the SMTP events and the corresponding transport agents that\r\nencounter messages on the Exchange server. For more information, see View transport agents in the\r\ntransport pipeline.\r\nPipeline Tracing: Pipeline tracing creates an exact snapshot of a message before and after it encounters\r\neach transport agent. This allows you to find a transport agent that's causing unexpected results. For more\r\ninformation, see Pipeline tracing.\r\nSource: https://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help\r\nhttps://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help\r\nPage 6 of 6",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://docs.microsoft.com/en-us/exchange/transport-agents-exchange-2013-help"
	],
	"report_names": [
		"transport-agents-exchange-2013-help"
	],
	"threat_actors": [],
	"ts_created_at": 1775439076,
	"ts_updated_at": 1775791319,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/7903b4b325fb20a940f9a4cd70e3c917f20b5dd9.pdf",
		"text": "https://archive.orkl.eu/7903b4b325fb20a940f9a4cd70e3c917f20b5dd9.txt",
		"img": "https://archive.orkl.eu/7903b4b325fb20a940f9a4cd70e3c917f20b5dd9.jpg"
	}
}