How to Troubleshoot Missing Emails in Microsoft 365 Exchange
Question details
Users are unable to locate incoming messages from a third-party domain in Microsoft 365, despite the email gateway indicating successful delivery.
- Product
- Microsoft 365 Exchange
- Device & OS
- not provided
- Scenario
- Receiving emails from a third-party domain into a Microsoft 365 environment.
- Observed behavior
- Messages appear as delivered in the third-party email gateway but do not reach the Microsoft 365 recipients, and there are no visible records of these emails in standard message traces or the quarantine list.
Ensure you have Exchange Administrator permissions in the Microsoft 365 admin center to access and run extended message trace reports.
Run an Extended Message Trace in Exchange Admin Center
An extended message trace provides comprehensive routing and delivery logs required to pinpoint exactly where incoming messages are failing or being blocked.
A standard trace summary is often insufficient to diagnose complex email drop issues, particularly when external gateways are involved. The extended report outputs a detailed CSV file capturing every transport, filtering, and recipient resolution event.
Log in to the Microsoft 365 admin center, navigate to the unified admin centers list in the left pane, and select 'Exchange'.
In the Exchange admin center, go to the 'Mail flow' section and click on 'Message trace'. Then, select 'Start a trace'.
Enter the specific sender domain, the intended recipient, and define the appropriate time range (e.g., the last 7 days). Under the 'Report type' options, select 'Extended report'.
Click 'Search' or 'Next' to initiate the trace. Because it is an extended report, it may take a few hours to process. Once it completes, download the generated CSV file.
Open the CSV file to review comprehensive recipient resolution, transport rules, filtering actions, and delivery events to identify why the messages were dropped. If consulting Microsoft support, ensure you remove any sensitive user information before sharing the file.
Switch to WPS Office for a Seamless and Lightweight Experience
While resolving Microsoft 365 Exchange email delivery issues, consider optimizing your daily document workflows with WPS Office. As a free, lightweight, and powerful alternative to Microsoft Office, WPS integrates Writer, Spreadsheet, Presentation, and PDF tools into a single workspace, offering seamless format compatibility without the high subscription costs.
- 1. Download WPS Office: Visit the official WPS website and download the free installation package for your specific operating system.
- 2. Install the Software: Run the installer and follow the quick on-screen prompts to complete the lightweight installation in minutes.
- 3. Open Microsoft Office Files: Launch WPS Office and directly open your existing Word, Excel, or PowerPoint documents to continue your work without losing any formatting.
Frequently Asked Questions
Why do emails show as delivered in the gateway but not in Microsoft 365?
This occurs when the third-party gateway successfully hands off the message to the Microsoft 365 servers, but a subsequent internal process such as strict anti-spam policies, transport rules, or malware filtering silently drops or quarantines the message before it can reach the user's inbox.
What is the difference between a standard and an extended message trace?
A standard trace instantly provides a basic delivery status summary for emails processed within the last 10 days. An extended trace takes longer to generate via a CSV file but provides highly granular, step-by-step logs of filtering, routing, and transport events necessary for diagnosing complex issues.
Can I run an extended message trace for emails older than 10 days?
Yes, extended message traces in the Exchange admin center can securely retrieve in-depth delivery data for emails sent or received within the past 90 days.
Why is the missing email not showing up in the user quarantine portal?
Emails suspected of advanced phishing or high-confidence malware might be silently dropped or diverted to administrator-only quarantine by specific Exchange Online Protection (EOP) rules or Microsoft Defender policies, effectively bypassing the standard user-accessible quarantine list.
