For an external recipient, inspect the detailed trace event rather than relying on the summary “Delivered” label; Receive, Send means Exchange Online accepted the message and sent it toward the external destination, not that it reached the recipient’s mailbox.
Verify the external handoff
- Open Exchange admin center → Mail flow → Message trace.
- Trace one missing message using:
- Exact Microsoft 365 sender
- Exact external recipient
- Narrow date/time range
- Open the result and expand Message events and More information.
- Record:
- Final event and recipient status
- Message ID
- Network Message ID
- To IP
- UTC timestamp
- Destination connector, if shown
Interpret the result as follows:
-
Receive, Send: Microsoft 365 received the message and sent it to the intended external destination.
-
Receive, Fail: Delivery to the destination failed.
-
Receive, Deliver: The message was delivered to a mailbox; this normally applies to an Exchange Online-hosted recipient.
-
Defer or Pending: Delivery is still being retried.
-
Transfer: Processing moved outside the current trace scope.
These fields are documented in the Enhanced and Extended reports; the Extended report also exposes destination-server, SMTP, connector, and event details.^1^
If the summary only says Delivered, generate an Extended report from the Downloadable reports tab, filtering by sender, recipient, or Message ID. Archived report data can take several hours to become available, and the most recent 24 hours might not yet be present.^1^
Ask the recipient administrator to trace the message
If the final event is Send, provide the recipient’s mail administrator with:
- Sender and recipient addresses
- UTC send time
- Subject
- Full Message ID, including angle brackets
- Microsoft 365 To IP
- Any destination SMTP response shown by the trace
Ask them to search their gateway, hosted filtering service, and mail-server logs using the Message ID and timestamp. A message can be accepted at the destination and subsequently filtered, redirected, or deleted by a downstream rule; Microsoft’s trace FAQ explicitly lists delivery followed by deletion as one possible outcome.^2^
Because new messages and replies are arriving, compare one missing message with one successful message sent to the same recipient. Check whether they differ in:
- Subject or conversation thread
- Attachments, links, signatures, or disclaimers
- Message size
- Destination To IP or connector
- SPF, DKIM, and DMARC results at the recipient
This can expose a content/thread-specific filter or different routing path.
Check sender authentication conditionally
If the recipient’s gateway reports an authentication or spam verdict, obtain the successful message’s headers and inspect Authentication-Results:
-
spf=fail: correct the SPF record so it includes every legitimate sending source.
-
dkim=fail or dkim=none: verify DKIM signing and its DNS CNAME records.
-
dmarc=fail: ensure either SPF or DKIM passes and aligns with the visible From domain.
Microsoft’s decision matrix maps these exact results to the required correction.^3^
Do not change SPF, DKIM, or DMARC merely because a message is missing; first obtain an authentication failure from the recipient’s logs or from headers of a delivered comparison message.
Escalation
If Exchange Online shows a final Send event but the recipient administrator confirms that none of their edge systems recorded the Message ID:
- Save the Extended report.
- Collect the missing and successful Message IDs, Network Message IDs, UTC timestamps, recipient domain, and To IP values.
- Open a Microsoft 365 support request and provide those artifacts, requesting investigation of the outbound SMTP handoff.
If the recipient’s edge server recorded and accepted the message, escalation belongs with the recipient’s mail-security or hosting provider instead.
References
- Message trace in the Exchange admin center in Exchange Online
- Message Trace FAQ in Exchange Online
- Troubleshoot email authentication in Microsoft 365