What is message trace in Microsoft 365?

A feature in the Exchange admin center that shows what happened to an email: received, delivered, deferred, quarantined or rejected.

How far back can I search?

Up to 90 days. The last 10 days are shown instantly; for a longer range you get a downloadable report that can take several hours.

The status is Delivered, but the customer received nothing. What now?

Then the message was handed to the customer’s mail server. Ask the customer to check their Junk Email folder or quarantine, and check that your domain is set up properly with SPF, DKIM and DMARC.

What does it mean if an email is not in the trace?

That Microsoft 365 never received the message. For inbound email, the cause then lies with the sender or their email provider.

Email not arriving? How an SME uses message trace to find out where an email went in Microsoft 365

Q: Can a member of staff run a trace themselves?

No. It requires admin permissions, such as the Exchange Administrator role or membership of the Organization Management role group.

‘I never got your email.’ Every SME hears it now and then, from a customer missing a quote or a colleague waiting for a supplier invoice. That usually starts a search through the Junk Email folder and a round of resending. Yet Microsoft 365 keeps track of exactly what happens to every email. With message trace, an admin can see within minutes whether a message was delivered, held back or never arrived at all.

What message trace shows

Message trace follows email messages as they travel through your Microsoft 365 organisation. You can see whether the service received, rejected, deferred or delivered a message, and which actions were applied along the way. It works for both inbound and outbound email. A few minutes of searching replaces a long email exchange about ‘who sent what’.

You need admin permissions, for example the Exchange Administrator role or membership of the Organization Management role group. An ordinary member of staff cannot run a trace themselves.

How to run a trace

Open the Exchange admin center at admin.exchange.microsoft.com and go to Mail flow > Message trace.
Choose Start a trace. By default you search for all messages from the last two days.
Enter the sender and/or recipient. External addresses work too, and a wildcard such as *@supplier.com covers a whole domain.
Set the time range and, if needed, filter on subject or delivery status.
Choose Search and select a message for the details: the individual events, such as receive, deliver, defer or fail, and any error message.

For the last 10 days the results are available almost instantly. You can search back up to 90 days, but only 10 days at a time in the instant overview. If you pick a longer range, Microsoft 365 prepares a downloadable CSV report. That can take several hours, so start in good time.

Reading the status

Delivered: the message reached the recipient’s mailbox. For an internal recipient, check the Junk Email folder and any inbox rules that move or forward mail. For outbound email, the message was handed to the recipient’s mail server; what happens there is no longer visible to you.
Failed: the message was not delivered. The details show the reason, such as an unknown address or a rejection by the other server.
Pending: Microsoft 365 is still attempting (or reattempting) delivery, for example because the recipient’s server is temporarily unreachable.
Quarantined: the message was held as spam, bulk email or phishing. Our article on message quarantine explains how to review and release it.
Filtered as spam: the message was identified as spam and rejected or blocked, without quarantine.

Keep in mind that the reported status can lag five to ten minutes behind reality. If you search straight after sending, check again a little later.

The email is not in the trace at all?

Then Microsoft 365 never received the message. For inbound email, the cause lies with the sender: a typo in the address, a problem at their email provider or their own spam filter. Ask the sender for the bounce message they received. If an outbound message shows as delivered but the customer says nothing arrived, it is often stuck in the recipient’s spam filter. Then check that your domain is set up properly with SPF, DKIM and DMARC. If all your outbound email fails with error 5.1.8, the mailbox is blocked from sending.

Also useful for security questions

Message trace does not only help with lost email. After a suspicious sign-in or a phishing email, it shows who received a particular message and what was sent from an account. For recurring or automated searches, Exchange Online PowerShell has the Get-MessageTraceV2 cmdlet.

How Floor ICT handles this

When a customer or member of staff is missing an email, Floor ICT runs the message trace for you. We tell you quickly where the message went, release it from quarantine if needed and fix the cause, for example a misconfigured inbox rule, an overly strict spam filter or a missing DMARC setting. That way a recurring problem disappears instead of you having to resend again and again.

View MSP packages Request an intake Microsoft 365