When a journal report is generated, Exchange 2007 sends the journal report to the journaling mailbox. Exchange 2007 helps prevent tampering with the journal reports that are submitted to the journaling mailbox by performing the following tasks:

• It uses secure links between Hub Transport servers and Mailbox servers in the Exchange 2007 organization.
  
  
• It sends the journal report as Microsoft Exchange and authenticates the session between the Hub Transport server and the Mailbox server.
  
  
• It accepts only secure, authenticated connections when journal reports are sent between Hub Transport servers and Mailbox servers in the same Exchange 2007 organization.
  
  

We also recommend that you configure the journaling mailbox to accept messages sent only from the Microsoft Exchange recipient object and that you require senders to be authenticated. This helps reduce the possibility of tampering with journal reports that are delivered to the journaling mailbox. For more information, see How to Configure a Journaling Mailbox.

Caution:
Exchange 2007 generates a journal report for every e-mail message that matches the criteria that are configured on a journal rule. Depending on your organization and how you configure your journal rules, Exchange 2007 may generate a significant number of journal reports. Carefully consider your topology, network links, and journaling requirements before you implement journal rules.

Caution:
Improperly secured communication links, journaling mailboxes, or servers can expose sensitive data.

Journal reports contain sensitive information that should not be exposed to unauthorized people. As explained earlier in this topic, Exchange 2007 tries to encrypt the connections between the Hub Transport server and the Mailbox server where the journaling mailbox resides and requires that the submitting system authenticate before the Mailbox server accepts the journal report. However, you can configure Exchange 2007 to send journal reports to a recipient that does not reside on a Mailbox server in the same Exchange 2007 organization as the Hub Transport server. You can use such a configuration to send journal reports to third-party providers of archival or other consolidated journaling solutions that are not Exchange 2007–based.

In configurations where the source server and destination server are not both Exchange 2007 and are not both in the same organization, the connections between the two servers may not be automatically encrypted. However, even in these configurations, you can use Exchange 2007 to help you protect the journal reports that are sent to the third-party solution providers. Exchange lets you use the following solutions to help you protect the communication between the Exchange server and the third-party solution providers:

• Configure Transport Layer Security (TLS) between the two systems.
  
  
• Require authentication on the receiving system.
  
  
• Accept only e-mail messages from the Simple Mail Transfer Protocol (SMTP) address of the Microsoft Exchange contact.
  
  
• Configure a mail-enabled contact that sends e-mail messages to the SMTP address of the third-party solution and configure Exchange 2007 to send journal reports to that contact. Then configure the contact to accept journal reports only from Microsoft Exchange contact created in your Exchange 2007 organization.
  
  

Caution:
Improperly secured communication links, journaling mailboxes, or servers can expose sensitive data.

TLS is a standard protocol that is used to provide secure communications on the Internet or intranets. It enables clients to authenticate servers or, optionally, servers to authenticate clients. It also provides a security channel by encrypting communications. TLS is the latest, and a more secure, version of the Secure Sockets Layer (SSL) protocol.

Important:
TLS encrypts the communication only between two servers. If you configure TLS to protect journal messages, and the destination server that will store the journal reports is not directly available to the Exchange server, you must configure TLS between each server through which the journal report travels.