Distribution lists in attribute values

If you want to match all messages sent to members of a particular Exchange Server distribution list, then use the <DL> </DL> message attribute. For example,

<RECIPIENTS>
	<DL>ALL SALES</DL>
</RECIPIENTS>

would match any message sent to any member of the distribution list, ALL SALES.

For this matching to work, ensure that expansion of distribution lists is enabled in the Administration Console (in the "Archiving General" settings on the "Advanced" tab of the Exchange journal policy). Also, the distribution list must not be included in the "blacklisted" distribution list registry setting, BlacklistedDLs, which can be created in the following location:

HKEY_LOCAL_MACHINE
\SOFTWARE
 \KVS
  \Enterprise Vault
   \Agents

You can specify distribution lists and groups using the <EA>, <DISPN> and <DOMAIN> message attributes. However, only messages with the specified string will match; no attempt is made to compare message recipients with individual members in the specified distribution list.

For example, the members of an Exchange Server distribution list called ALL SALES are:

In the ruleset file, the following message attribute filter is specified in a rule:

<RECIPIENTS>
	<DISPN>ALL SALES</DISPN>
</RECIPIENTS>

If a message has the display name ALL SALES in the recipient list, the message will satisfy the attribute filter above. If the message does not have the display name ALL SALES in the recipient list, it will not match the attribute filter, even if the recipient list does include the email address of a member of the distribution list.