Others

How to Filter Exchange Online Message Trace Results by Country

Khadija Khan Oct 13, 2026 869 views

Question details

The user wants to generate reports on delivered, blocked, spam, and quarantined messages in Exchange Online filtered by specific countries.

How to Filter Exchange Online Message Trace Results by Country

Product: Exchange Online
Device & OS: not provided
Scenario: An administrator needs to track and report email mail flow statistics based on the geographic location of the sender or recipient.
Observed behavior: Native Message Trace does not support direct country filtering (e.g., searching 'Location PL' yields no results). Workarounds involving IP geolocation or domain-specific filtering are required.

Before you start

Ensure you have the necessary Exchange Administrator permissions and access to the Exchange admin center to run and export message traces.

Solution 1Recommended

Export Message Trace Results and Use IP Geolocation

Since Exchange Online does not offer a native country filter, you must run a standard trace, export the data, and use IP addresses to determine the origin country.

The Exchange admin center does not recognize location-based search tags like 'Location PL' or 'Location IN'. To achieve country-level filtering, administrators must export the mail flow data and perform data mapping externally.

Access Message Trace

Sign in to the Exchange admin center, navigate to the left-hand menu, and select 'Mail flow' followed by 'Message trace'.

Start a new trace

Click 'Start a trace'. Specify your desired date range and apply necessary filters such as message status (delivered, blocked, spam, or quarantine).

Run and download the report

Execute the trace. Once the trace is complete, download the results as a CSV report to your local machine.

Map IP addresses to countries

Open the exported CSV file in a spreadsheet application. Extract the sender IP addresses and use a reliable third-party IP geolocation service or an internal mapping table to associate each IP with its respective country.

Export Message Trace Results and Use IP Geolocation

Domain Filtering Alternative: If you only need to check specific countries and they use country-code top-level domains (ccTLD), you can filter the trace directly by entering those domains (e.g., *@*.pl or *@*.in) in the sender or recipient fields.

Analyze Reports Easily

Analyze Exported Message Trace CSVs with WPS Spreadsheet

After exporting your Message Trace results from Exchange Online, use WPS Spreadsheet to seamlessly open the CSV file, apply advanced filters, and use formulas to map IP addresses to countries.

1. Open the Trace Report: Launch WPS Spreadsheet and open the CSV file exported from the Exchange admin center.
2. Import Geolocation Data: Add a new sheet and paste an IP-to-Country mapping dataset.
3. Apply Lookup Formulas: Use VLOOKUP or XLOOKUP to match the Sender IP addresses in your trace report to the corresponding countries in your mapping dataset.
4. Generate Country Reports: Select your enriched data and insert a Pivot Table to easily summarize message statuses by country.

Free, lightweight, and fast spreadsheet toolFully compatible with Microsoft Excel CSV and XLSX formatsAdvanced formula support (VLOOKUP, XLOOKUP) for IP geolocation mappingEasily create pivot tables to summarize spam and blocked messages by country

microsoft office alternative - wps office

Frequently Asked Questions

Can I use tags like 'Location PL' in Exchange Message Trace?

No, Exchange Online Message Trace does not natively support geographic or location-based tags like 'Location PL'. Searching with these parameters will return zero results.

What fields can I natively filter by in Message Trace?

You can natively filter by sender, recipient, domain, date range, and delivery status (such as delivered, blocked, spam, or quarantined).

How can I filter trace results by country-specific domains?

If you only need to track emails from specific country domains, you can enter the country's top-level domain wildcard (e.g., '*@*.pl' or '*@*.in') directly into the sender or recipient fields when setting up the trace.

Office Quick Solutions