Press CTRL+K to open search

Scanning inbound emails

  • Published on Sep 2, 2026
  • 2 minute(s) read
Prev Next

Step-by-step information on what happens to an email that reaches your organization and how TSME scans it to determine if the email is clean or infected.

The process described below is narrated assuming a situation in your organization where you have installed TSME on all these roles.

Microsoft Exchange Server SE, 2016, and 2019:

  • Edge Transport

  • MBX

  1. The SMTP stack hosted by EdgeTransport.exe on Edge role receives the email.

  2. TSME IP Agent (McTxIPAgent) checks for the source IP address reputation. The IP Agent check is executed before TxAgent operations.

  3. TSME Transport Agent (McAfeeTxAgent) scans the email for mail size.

  4. If there is detection, it is dropped, else it is returned to the SMTP stack.

  5. If the email is clean, McAfeeTxRoutingAgent processes it.

  6. TSME receives the same stream and scans for File filtering, Content scanning, Anti-virus (AV) scanning, and URL filtering.

  7. If there is a detection, action is taken as per product configuration.

  8. TSME stamps the email with AV stamp as per Microsoft specifications.

  9. TSME Transport Agent (McAfeeTxAgent) scans the email for mail size. Only in case of EdgeSync (Edge server), the session is authenticated. In this case, Originator check is used for session authentication.

  10. If there is detection, the email is dropped, else it is returned back to the SMTP stack.

  11. If the email is clean, McAfeeTxRoutingAgent processes it and checks for AV stamp (if any).

  12. If the stamp is different, TSME receives the same stream and scans for File filtering, Content scanning and Anti-virus scanning.

  13. If there is a detection, an action is taken as per product configuration.

  14. TSME stamps the email with AV stamp as per Microsoft specifications.

  15. The email is routed to Exchange Mailbox server role.

  16. Exchange store receives the mail and before saving it to its database, checks for the AV stamp.

  17. If AV stamp matches, it saves the item without scanning.

  18. If there is detection, the email is replaced or deleted as per product configuration.

    Note

    For Microsoft Exchange server SE, 2016, and 2019, the mailbox roles are not applicable.

:
Related articles