Rule Storage and Replication

Message Types

Transport rules configured on Hub Transport servers are applied to all messages handled by the Hub Transport servers in the Exchange 2010 organization. When a transport rule is created or an existing transport rule is modified or deleted on one Hub Transport server, the change is replicated to all Active Directory domain controllers in the organization. All the Hub Transport servers in the organization then read the new configuration from the Active Directory servers and apply the new or modified transport rules. By replicating transport rules across the organization, Exchange 2010 enables you to apply a consistent set of rules across the organization.

Important:

Replication of transport rules across an organization depends on Active Directory replication. Replication time between Active Directory domain controllers varies depending on the number of sites in the organization, slow links, and other factors outside the control of Exchange. When you configure transport rules in your organization, make sure that you consider replication delays. For more information about Active Directory replication, see Active Directory Replication Technologies.

Important:

Each Hub Transport server maintains a recipient cache that's used to look up recipient and distribution list information. The recipient cache reduces the number of requests that each Hub Transport server must make to an Active Directory domain controller. The recipient cache updates every four hours. You can't modify the recipient cache update interval. Therefore, changes to transport rule recipients, such as the addition or removal of distribution list members, may not be applied to transport rules until the recipient cache is updated. To force an immediate update of the recipient cache, you must stop and start the Microsoft Exchange Transport service. You must do this for each Hub Transport server where you want to forcibly update the recipient cache.

Note:
Each time the Hub Transport server retrieves a new transport rule configuration, an event is logged in the Security log in Event Viewer.

Transport rules configured on Edge Transport servers are applied only to the local server on which the transport rule was created. New transport rules and changes to existing transport rules affect only messages that pass through that specific Edge Transport server. If you have more than one Edge Transport server and you want to apply a consistent set of rules across all Edge Transport servers, you must either manually configure each server or export the transport rules from one server and import them into all other Edge Transport servers.

Return to top

Transport rules are applied in the following order:

1. Message scope   The first check performed by rules agents is whether a message falls within the scope of the agent. Transport rules aren't applied to all types of messages.
   
   
2. Priority   For messages that fall within the scope of the rules agent, the agent starts processing rules based on rule priority in ascending order. Rules with lower priority are applied first. Transport rule priority values range from 0 to n-1, where n is the total number of transport rules. Only enabled rules are applied, regardless of priority. You can change the priority of rules using the Exchange Management Console or the Exchange Management Shell.
   
   
3. Conditions   Transport rule conditions are made up of predicates.
   
   
4. Rule with no conditions   A rule with no predicates and no exceptions is applied to all messages.
   
   
5. Rule with multiple predicates   For a rule's action to be applied to a message, it must match all of the predicates selected in the rule. For example, if a rule uses the predicates from a member of distribution list, and when the Subject field contains specific words, the message must match both predicates. It must be sent by a member of the distribution list specified, and the message subject must contain the word specified.
   
   
6. Predicate with multiple values   If one predicate allows entering multiple values, the message must match any value specified for that predicate. For example, if an e-mail message has the subject Stock price information, and the SubjectContains condition on a transport rule is configured to match the words Contoso and stock, the condition is satisfied because the subject contains at least one of the values of the condition.
   
   
7. Exceptions   A rule isn't applied to messages that match any of the exceptions defined in the rule. Note, this is exactly opposite of how the rules agent treats predicates. For example, if the exceptions except when the message is from people and except when the message contains specific words are selected, the message fails to match the rule condition if the message is sent from any of the specified senders, or if the message contains any of the specified words.
   
   
8. Actions   Messages that match the rules conditions get all actions specified in the rule applied to them. For example, if the actions prepend the subject with string and Blind carbon copy (Bcc) the message to addresses are selected, both actions are applied to the message. The message will get the specified string prefixed to the message subject, and the recipients specified will be added as Bcc recipients.
   
   

   Note:
   Some actions, such as the Delete the message without notifying anyone action, prevent subsequent rules from being applied to a message.

Return to top

When you define a transport rule using a predicate that expands membership of a distribution group, the resulting list of recipients is cached by the Hub Transport server that applies the rule. This is known as the Expanded Groups Cache and is also used by the Journaling agent for evaluating group membership for journal rules. By default, the Expanded Groups Cache stores group membership for four hours. Recipients returned by the recipient filter of a dynamic distribution group are also stored. The Expanded Groups Cache makes repeated round-trips to Active Directory and the resulting network traffic from resolving group memberships unnecessary.

In Exchange 2010, this interval and other parameters related to the Expanded Groups Cache are configurable. You can lower the cache expiration interval, or disable caching altogether, to ensure group memberships are refreshed more frequently. You must plan for the corresponding increase in load on your Active Directory domain controllers for distribution group expansion queries. You can also clear the cache on a Hub Transport server by restarting the Microsoft Exchange Transport service on that server. You must do this on each Hub Transport server where you want to clear the cache. When creating, testing, and troubleshooting transport rules that use predicates based on distribution group membership, you must also consider the impact of Expanded Groups Cache.

Note:
The Expanded Groups Cache isn't used by the categorizer to resolve recipients for message delivery.

Return to top