Where is the message that someone claims to have sent me?

Scenario: In this scenario an Office 365 mailbox is not receiving a message sent from outside of the Office 365 organization.

Steps:

1. See if Office 365 received the message and was able to deliver it
2. (Enterprises & Education only) Check if FOPE received the message
3. Work with the sender to determine what happened to the message

Step 1: See if Office 365 received the message and was able to deliver it

Since you don’t have the item, you will need to enter the delivery report center though Outlook Web App (OWA).  Log in to OWA, go to Options, and find the Delivery Reports under Organize Email:

Highlight the Search for messages that were sent to me from button and then in the box that pops up, type the SMTP address of the user you sent mail to:

As an administrator or someone with the ability to track messages (helpdesk), you can also search directly from the Exchange Control Panel. From OWA, choose Options then go to Manage my Organization; or from Office 365 portal, go to the Admin page and select Exchange or Outlook. 

Once in Exchange Control Panel, select Manage My Organization in the Mail Control tab. 

Things to consider for inbound messages when looking at the Delivery Report results:

• If the message doesn’t appear in the report results, it may never have made it to Office 365.  If you have Office 365 Enterprise or Education plan, proceed to Step 2.  If you have an Office 365 Professional plan, you will need to skip to Step 3.
• If the message appears in the report results, check to make sure it was delivered.  If it was delivered, check to see if  an inbox rule rerouted or deleted the message.  Check to see if the email was moved to the Junk folder.  For more information on inbox rules, see Learn About Inbox Rules.

• Administrators: If the message was not delivered, did a transport rule act on the message? For more information on Transport Rules, see Create a new Rule.

Step 2: (Enterprises & Education only) Check if FOPE received the message

At this point, if you’re an end-user, you need to get your tenant administrator involved.  If you’re an administrator, you need to know if you have an Enterprise or Professional/Small Business plan.   You can only perform this step if you have Office 365 Enterprise.  For a description of what Forefront Online Protection for Exchange (FOPE) features are offered by plan, see the feature comparison.  If you have Office 365 for Professionals & Small Business, then skip to Step 3.

In Exchange Control Panel, on the Mail Control tab, click Forefront Online Protection for Exchange.

Note: If you get an error that your session has expired, you may need to close your browser, open a new browser session, and re-authenticate with Office 365 to access the FOPE Administration Center.  Occasionally, being logged into a Microsoft Live property may also cause a problem.  Either log out and close all browser windows, or open an “in-private” session which will temporarily disable using your existing cookies.

Once logged in, click the Tools tab and then click the Message Trace tab.

In the Message Trace tool, enter the search parameters – in this case, enter the sender and recipient addresses.

Note: Exact addresses are marked out for privacy, but the entire SMTP address is required.

After retrieving results and clicking Details, you’ll see more information like this in the Message Trace Summary:

If the message appears in the FOPE message trace results, click Details and take a look at the same three critical fields previously mentioned:

• The Filtering results field which indicates if FOPE determined that the message was spam or malware.  Many missing messages could fall in this category.  If the message did not pass inspection, you should check your junk mail folder and/or quarantine, and work with the sender to figure out why their message was detected as spam.
• The Delivery result field which indicates if the message was handed off or not.
• The To IP address field which shows the IP address to which FOPE attempted to deliver the message.  Depending on the FOPE configuration, the IP address will most likely either be an Exchange server in Office 365 or a server to which FOPE has been configured to forward all mail.  Because FOPE does more than service only Office 365 mailboxes, you should consider that someone may have configured FOPE to deliver messages for your domain to a different location than you expected.  If Office 365 accepted the mail from FOPE, then it will show up in a search for a delivery report.

If the message cannot be located, then FOPE never received the message. 

Step 3: Work with the sender to determine what happened to the message

Assuming that you still have not solved the issue, this is about as far as you can go right now from the receiving side.  If the sender just sent you the message, you may need to give it some time to arrive or timeout.  If the message times out, then the sender will get a notification and be able to skip to the troubleshooting notifications section.  If, however, the sender does not receive a notification, then the sending side should perform message tracking.  In most cases, the remote side should be able to provide you with information to help you make sure that the message was handed off properly.  One data point that will be extremely useful is the IP address of the system to which they handed off the message.  Frequently, the problem is that a DNS configuration problem causes the sending system to hand off the message to the wrong email server.  Having an IP address will help you in this case.

One last thing you can try as a test: have the sender email your onmicrosoft.com email address instead of using your custom domain address.  This test can help prove if the issue is with DNS.

Common problems

Here we'll add links to helpful Knowledge Base articles or other documentation that pertains to this scenario.   

• Use of more than one MX record with Office 365 is not recommended or supported by Microsoft.  The options are as follows:
  • MX record points to Office 365 ONLY
  • MX record points to other email server which forwards some/all email to Office 365 (e.g. Hybrid or Simple Shared).  Multiple MX records can be used in this scenario, but only if one of the MX records is NOT pointing to Office 365.

Trying to use multiple records can result in:

• Missing email
• Rejected email
• Inconsistent results with spam

To verify that you only have one MX record, open a Command Prompt and type:

 

nslookup -type=MX contoso.com

 

Where contoso.com is your domain. You should ONLY get one result, like this:

Server:  foo.contoso.com
Address:  10.2.3.7

Non-authoritative answer:
contoso.com  MX preference = 5, mail exchanger = contoso_com.mail.eo.outlook.com

 

• If you previously used your domain with BPOS, FOPE, or Exchange Hosted Archive then even after you have verified your domain, you will find that messages sent to your domain may bounce with either a 550 5.4.1 Relay Access Denied or possible mail loop.  If both of these conditions are true, you need to contact FOPE support and have them remove your duplicate domain.
• If you recently moved your domain (Professional) or MX records (Enterprise or Education), there is a DNS caching period where some servers may still deliver your email to your old provider.  If you have recently moved the domain to Office 365 and are missing email, one thing you should try to do is check the old provider and see if the are still getting some of your email.  The problem may be isolated to some senders.
• If you have Office 365 Professional and are having trouble receiving email from your old email provider, the problem may be that the old provider is still hosting stale DNS records for your domain.  If the domain you are using was hosted somewhere other than the domain registrar you were using, then you may also need to contact your old DNS provider and have them remove the stale entries for your domain. For more information see Domains in Office 365.