Message trace answers three questions that nothing else can, and it answers them
without changing anything:
- Did the message exist? Settles "they say they sent it" arguments in seconds.
- Where did it stop? Delivered, quarantined, filtered, failed, or pending.
- Who actually received it? Essential when sizing a security incident.
Reading the status column
| Status | Meaning |
|---|---|
| Delivered | Reached the mailbox. If the user cannot see it, look at inbox rules and folders. |
| Quarantined | Held by anti-spam, anti-phishing or a transport rule. Not lost — see Quarantine, SPF, DKIM and DMARC. |
| Filtered as spam | Delivered to Junk Email, or dropped by policy. |
| Failed | Rejected. The detail carries the SMTP code and reason. |
| Pending | Still in transit or queued for retry. |
| Expanded | Sent to a distribution group; trace the individual recipients. |
Useful SMTP codes
| Code | Meaning |
|---|---|
| 550 5.1.1 | Recipient does not exist |
| 550 5.2.2 | Recipient mailbox is over quota |
| 550 5.4.1 | Recipient not found / relay denied |
| 550 5.7.1 | Blocked by policy or transport rule |
| 550 5.7.708 | Sending IP or tenant blocked for reputation — often signals compromise |
| 421 4.4.2 | Connection timed out; usually transient |
Practical technique
- Search wide, then narrow. Start with the sender domain and a 48-hour window
rather than one exact subject line. You are looking for a pattern and a cut-off
point, not one email.
- Find the boundary. The most useful thing a trace gives you is the last message
that was delivered and the first that was not. That timestamp is usually when
something changed — a policy, a DNS record, a quota, a connector.
- Trace both directions. For a suspected compromise, tracing outbound mail
from the affected mailbox tells you who has been contacted and needs warning.
- Traces older than 10 days need an extended (historical) trace, which is
delivered as a downloadable report rather than on screen.
What a trace does not tell you
- Whether the user read the message.
- Whether a rule moved it after delivery. Delivered plus "not in my inbox" means
check the mailbox rules and the folder tree next.
- What the message contained. Use the quarantine or eDiscovery for content.
Related
- Quarantine, SPF, DKIM and DMARC
- Mailbox quotas and archiving
- Responding to a compromised account