securityissue, emails not being received; dark web warning received; critical email replies not being accepted

Check Outlook on the web first, then have the Microsoft 365 administrator trace one missing message; if the mailbox contains unknown forwarding, rules, sent mail, or deletions, treat it as potentially compromised immediately.

1. Determine where delivery stops

1. Sign in to Outlook on the web with the affected business account.
2. Search for a specific missing reply using its sender, subject, and approximate sending time.
3. Check Junk Email, Deleted Items, Archive, Notes, and RSS Subscriptions.

Interpret the result:

• Message exists on the web but not in classic Outlook: Exchange delivered it; the problem is localized to the desktop client.
• Message is in Junk Email: In classic Outlook, open Home → Block/Junk → Junk E-mail Options → Blocked Senders and remove the sender or domain. Blocked senders’ messages are diverted to Junk rather than rejected outright.^1^
• Message is absent on the web: This is a mail-flow, filtering, forwarding, or security issue—not merely an Outlook synchronization problem. Microsoft specifically recommends Outlook on the web for this distinction.^2^

2. Trace a missing message

A Microsoft 365 administrator should:

1. Open Microsoft 365 Admin → Exchange → Mail flow → Message trace.
2. Choose a narrow date range around the missing message.
3. Add the exact external sender and affected recipient.
4. Select Search, open the matching record, and view Details.
5. Follow the displayed How to fix it guidance.

The status identifies whether Exchange delivered, delayed, or filtered the message. Trace data can take 10 minutes to one hour to appear. Messages older than seven days require an extended trace downloaded as CSV.^2^

If no trace exists for an expected reply, ask the sender’s administrator for their delivery report or nondelivery report. That helps determine whether the message ever reached Microsoft 365.

3. Check for mailbox compromise

A dark-web warning by itself does not establish that this mailbox was accessed. However, missing messages combined with any of these signs warrants an immediate security response:

• Unknown rules forwarding, deleting, marking as read, or moving messages.
• Unexpected messages in Sent Items or Deleted Items.
• Unknown external forwarding.
• Unexplained account lockouts or password changes.
• The mailbox being blocked from sending.

Microsoft lists these as possible compromised-mailbox symptoms.^3^

Check classic Outlook under File → Manage Rules & Alerts. Do not merely repair an unfamiliar rule—disable or delete it and report it to the administrator. Attackers can create rules that hide selected replies in Junk, RSS, or other folders, delete them, or forward them externally.^4^

If suspicious activity is found:

1. Stop using email for sensitive correspondence until the account is secured.
2. Contact the Microsoft 365 administrator or security team using a trusted channel.
3. The administrator should disable the account temporarily—or reset its password if disabling is unavailable.
4. Revoke active sign-in sessions.
5. Remove unknown MFA methods and application consent.
6. Review and remove mailbox forwarding and all Inbox rules, including hidden rules.
7. Enable and enforce multifactor authentication.
8. Independently verify any payment, banking, legal, or confidential instructions already exchanged.

Do not send the replacement password through the affected mailbox. Microsoft’s compromise-response procedure recommends disabling the account during investigation and revoking active sessions to invalidate existing access.^3^

4. If delivery works on the web but not in classic Outlook

Run the Classic Outlook sending/receiving troubleshooter. These troubleshooters can address profile, licensing, and Outlook-version problems; they do not apply to new Outlook for Windows.^5^

Also review File → Manage Rules & Alerts for rules marked red with Error. Select the rule and correct its conditions or destination; delete it if it is unnecessary or unrecognized.^6^

References

1. Classic Outlook
2. Find and fix email delivery issues as a Microsoft 365 for business admin
3. Respond to a compromised cloud email account
4. Alert classification for suspicious email forwarding activity
5. Issues sending and receiving email | Microsoft Support
6. Classic Outlook