How to Search for Sent or Failed Emails with Exchange Message Trace
Question details
Administrators need to locate specific emails and check their delivery status using Microsoft 365 Message trace.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Tracking whether sent emails were successfully delivered, rejected, or deferred across an organization.
- Observed behavior
- The user needs a reliable administrative method to trace the exact routing, status, and processing history of messages handled by Exchange.
Ensure you have administrator privileges in Microsoft 365 and gather the necessary search criteria, such as the sender or recipient email address, date range, or specific Message ID.
Run a Message Trace in the Microsoft 365 Defender Portal
Use the built-in Message trace tool to accurately check email delivery status and view detailed routing actions.
The Message trace tool in the Microsoft 365 Defender portal provides detailed insights into mail flow. It allows you to see if a message was successfully delivered, rejected by a spam filter, or deferred due to server issues.
Navigate to the Microsoft 365 Defender portal in your web browser and log in with your Exchange Administrator or Global Administrator credentials.
In the left navigation pane, expand 'Email & collaboration' and click on 'Exchange message trace'.
Enter the sender and recipient email addresses in their respective fields. Set a specific date range (e.g., last 48 hours or a custom range) to narrow down the search. You can also input the specific Message ID if you have it.
Click the 'Search' button. Once the results populate, click on any specific message entry to view a detailed breakdown of its delivery status and the events that occurred during processing.
Analyze Message Trace Reports with WPS Office
While Microsoft 365 handles your Exchange email routing, you can export your trace logs as CSV files and easily analyze them using WPS Office. It provides a lightweight, fast, and free alternative to traditional spreadsheet software.
- 1. Export Trace Data: In the Microsoft 365 Defender portal, click 'Export' after running your message trace to download the results as a CSV file.
- 2. Open in WPS Spreadsheet: Launch WPS Office and open the downloaded CSV file to organize your trace logs.
- 3. Filter and Analyze: Use WPS Spreadsheet's built-in filtering tools to quickly isolate 'Failed' or 'Deferred' email statuses for reporting.
Frequently Asked Questions
What does a 'Deferred' status mean in a message trace?
A deferred status indicates that the email delivery was delayed, often due to temporary network issues, greylisting, or the recipient's server being too busy. Exchange will automatically retry sending the message according to its delivery schedule.
Can standard users access the Message trace tool?
No, standard end-users cannot access this tool. It requires administrative permissions, specifically the Global Administrator, Security Administrator, or Exchange Administrator roles assigned in the Microsoft 365 admin center.
How do I find a Message ID to make searching easier?
The Message ID can be found in the internet headers of the email. If the recipient received a bounce-back message (NDR) or if you have the original sent item, viewing the message headers will reveal the exact Message-ID string.
