> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Enable Exchange Monitoring with BCC

> Configure Exchange to blind-copy traffic to xorlab, letting it analyze without sitting in the delivery path.

This applies to on-premises Microsoft Exchange 2016 or 2019. xorlab will receive a copy of every incoming and outgoing email.

<Warning>
  **Prerequisites**

  * Complete [Before You Begin](/latest/before-begin-integration) and [Set Up Email Routing in xorlab](/latest/on-prem-smtp)
</Warning>

## Creating the mail flow rules

### Incoming emails

First, we need to create a mail-flow rule that sends a copy of all incoming emails to xorlab Security Platform.

1. In the Exchange Control Panel, under **Mail Flow → Rules**, create a new rule.

2. After you enter the name for the rule, click the drop-down list under **Apply this rule if…** to expand it and choose **The sender is located…** and then **is external/internal**:

   <img src="https://mintcdn.com/xorlab/O_O2TUa6eRBR54aI/latest/assets/exchange-rule-sender.png?fit=max&auto=format&n=O_O2TUa6eRBR54aI&q=85&s=6c51914867d0cf52644bbb4a2199e8dd" alt="Selecting the sender for the rule" style={{border: '1px solid #ddd'}} width="1642" height="898" data-path="latest/assets/exchange-rule-sender.png" />

3. In the **select sender location** input box that appears (if it doesn’t, click **Select one…** next to the list), select **Outside the organization** and click **OK**:

   <img src="https://mintcdn.com/xorlab/O_O2TUa6eRBR54aI/latest/assets/exchange-rule-outside.png?fit=max&auto=format&n=O_O2TUa6eRBR54aI&q=85&s=30498d35a2136d51f28482c61aae6d94" alt="Sender from outside of the organization" style={{border: '1px solid #ddd'}} width="1844" height="1054" data-path="latest/assets/exchange-rule-outside.png" />

4. Click the drop-down list under **Do the following…** to expand it and choose **BCC the message to…**

5. A new browser tab/window opens where you can enter the xorlab Security Platform monitoring mailbox address, e.g., `monitor@mx.xyz.activeguard.cloud`. Your new rule should look like the one depicted below:

   <img src="https://mintcdn.com/xorlab/O_O2TUa6eRBR54aI/latest/assets/exchange-rule-bcc.png?fit=max&auto=format&n=O_O2TUa6eRBR54aI&q=85&s=3815ff65a98f9b3a4e7b4d5a537765a4" alt="Exchange rule for incoming emails" style={{border: '1px solid #ddd'}} width="1384" height="900" data-path="latest/assets/exchange-rule-bcc.png" />

6. Click **Save**.

### Outgoing emails

Now we need to create another mail-flow rule that sends a copy of all outgoing emails to xorlab Security Platform.

Repeat the same steps as for incoming mails but, in step #2, select **The recipient is located…** in the first list. Now the rule should look like this:

<img src="https://mintcdn.com/xorlab/O_O2TUa6eRBR54aI/latest/assets/exchange-rule-outgoing.png?fit=max&auto=format&n=O_O2TUa6eRBR54aI&q=85&s=e3ae4c635cbcd282d4a9893b0e095c51" alt="Exchange rule for outgoing emails" style={{border: '1px solid #ddd'}} width="1384" height="900" data-path="latest/assets/exchange-rule-outgoing.png" />

After creating those two rules, a copy of all incoming and outgoing emails will be sent to xorlab.

## Internal emails

In order to also send a copy of internal emails to xorlab Security Platform, the two mail-flow rules from above can be replaced with one single mail-flow rule that is applied to **all messages** (select this item from the list in step #2) as shown below. This step can be ignored if internal emails should not be forwarded to xorlab:

<img src="https://mintcdn.com/xorlab/O_O2TUa6eRBR54aI/latest/assets/exchange-rule-internal.png?fit=max&auto=format&n=O_O2TUa6eRBR54aI&q=85&s=a1ed816b716f4059bf55348e0b1c5665" alt="Exchange rule for internal emails" style={{border: '1px solid #ddd'}} width="1384" height="900" data-path="latest/assets/exchange-rule-internal.png" />

## Considerations

As mentioned above, in monitoring mode, xorlab Security Platform will not change the mail traffic in any way. However, if all xorlab MTAs are down or do not accept emails, it can lead to a growing email queue on the Exchange Server. If this happens, you should temporarily disable the BCC mail flow rules.

## Next steps

* [Add Your Trusted Infrastructure](/latest/on-prem-add-trusted-mtas)