Guide
Did the email arrive? How to trace a message in Exchange Online
“I sent it and they never got it” is one of the most common help-desk requests. Message trace answers it: it shows whether a message was delivered, failed, quarantined or marked as spam, and what happened to it along the way.
What message trace tells you
Exchange Online keeps a log of mail flow. A trace searches it by sender, recipient, date range and status, and lists matching messages. Opening a message shows each step it went through, which is usually where the explanation is.
The statuses, and what to do about each
- Delivered. The message reached the recipient’s mailbox. That does not mean they saw it: ask them to check Junk Email and any inbox rules.
- Failed. It was rejected or could not be delivered. The detail usually names the reason, such as a mistyped address, a full mailbox or a blocked sender. Fix that, then resend.
- Quarantined. A policy held it, often as suspected phishing or malware. Review it in the quarantine area of the Microsoft Defender portal and release it if it is safe.
- Spam. It was filtered as junk. Check the recipient’s Junk Email folder, and consider an allow rule for a trusted sender only after you are sure it is trusted.
Limits to know before you search
- Microsoft keeps message trace data for 90 days. Older mail cannot be traced.
- Microsoft answers at most 10 days per search, so a longer range has to be split into pieces.
- The log runs a few minutes behind, so a message sent a minute ago may not show yet.
- Very broad searches are slow in a busy tenant. Always give a sender, a recipient or both.
A quick routine
- Get the exact sender and recipient addresses and roughly when it was sent.
- Search a narrow time range around that moment.
- Open the message and read the delivery steps from the bottom up.
- If it was delivered, look at the recipient’s Junk Email and rules. If it failed or was held, fix the cause and resend.
- Save the result (for example as a CSV) if you need to show it to someone.
Doing this in the toolkit. The Message Trace tile does the search with sender, recipient, date range and status filters, splits long ranges into 10-day pieces automatically, shows each message’s delivery steps, and exports to CSV. It only reads, and each search is recorded in the audit log. See how August 365 Toolkit works. It is still pre-release, and every tile's help page lists exactly what it changes and what it cannot undo.