I need to check an email was actually sent to us

Run a recipient-side message trace in your own Exchange environment using the sender address, intended recipient, and sending time; the sender’s trace does not replace evidence from your organization’s mail-flow records.

First, ask the sender for:

• Exact envelope sender address
• Exact recipient address
• Date, time, and time zone
• Message subject
• Full Message-ID, if available
• Any non-delivery report or SMTP error

Then use the procedure matching your deployment.

Exchange Online / Microsoft 365

You need the Exchange Administrator, Global Administrator, or Organization Management role; Microsoft recommends using the least-privileged applicable role.^1^

1. Open the Exchange admin center: https://admin.exchange.microsoft.com
2. Go to Mail flow → Message trace.
3. Select Start a trace.
4. Enter:
   • Senders: the external sender’s full address.
   • Recipients: your intended recipient’s full address.
   • Time range: set a custom range around the supplied sending time and select the correct time zone.
5. If available, expand Detailed search options and add:
   • The subject, or
   • The complete Message-ID, including angle brackets if present.
6. Run the trace and open the matching result to inspect its events.

Message trace follows mail through your Microsoft 365 organization and identifies whether Microsoft 365 received, rejected, deferred, quarantined, filtered, or delivered it.^2^

Interpret the final status as follows:

• Delivered — Exchange delivered it to the intended destination. Check the event details for the actual destination, then investigate mailbox rules, forwarding, Deleted Items, Junk Email, Archive, and the Outlook Other tab. Compare Outlook on the web with the desktop client to distinguish mailbox delivery from a client view or synchronization issue.
• Quarantined — Review the message in the Microsoft Defender quarantine portal and the policy that placed it there.
• Filtered as spam — The message was identified as spam and rejected or blocked rather than delivered.
• Failed — Open the details and use the reported SMTP response or policy event to identify the rejection.
• Pending — Delivery is still being attempted.
• Getting status — Wait several minutes and run or refresh the trace; reported status can lag actual delivery by approximately five to ten minutes.^1^
• No result — Recheck the supplied address, time zone, and time window, then search using the full Message-ID. If it still does not appear, your trace does not show the message entering your Exchange Online organization during that range.

For ranges of 10 days or less, summary results are available directly. Searches can cover data up to 90 days, but ranges greater than 10 days use downloadable archived reports and can take several hours.^1^

On-premises Exchange Server

For Exchange Server 2016, 2019, or Subscription Edition, search the message-tracking logs from the Exchange Management Shell. These logs record activity through the transport pipeline on Mailbox and Edge Transport servers.^3^

Run a narrow search first, using dates in the regional format of the computer on which the shell is running:

Get-MessageTrackingLog -Server EXCH01 `
  -Start "11/03/2026 09:00AM" -End "11/03/2026 11:00AM" `
  -Sender "[Email]" `
  -Recipients "[Email]" `
  -ResultSize Unlimited |
Select Timestamp,ServerHostname,Source,EventId,Sender,Recipients,MessageId |
Sort-Object Timestamp

If your organization has multiple Mailbox or Edge Transport servers, search each relevant server. If the sender supplied the Message-ID, use -MessageId to correlate the same message across servers:

Get-ExchangeServer | ForEach-Object {
    Get-MessageTrackingLog -Server $_.Name `
      -Start "11/03/2026 09:00AM" -End "11/03/2026 11:00AM" `
      -MessageId "<[Email]>" `
      -ResultSize Unlimited
} | Select Timestamp,ServerHostname,Source,EventId,Recipients |
Sort-Object Timestamp

The Microsoft Exchange Transport Log Search service must be running for these searches, and the administrator needs the applicable message-tracking permissions.^4^

Follow the chronological events:

• A successful delivery event confirms that transport handed the message to its destination.
• A failure event should contain the reason to investigate.
• No matching receive or transport event means your Exchange logs do not show that message entering the searched servers and period; verify all transport servers, addresses, timestamp, and Message-ID before concluding that it never arrived.

If the trace shows delivery but no mailbox contains the message, move the investigation downstream to mail-flow rules, forwarding, mailbox rules, quarantine, and mailbox auditing. If it shows no arrival, give the sender your negative trace result and request their outbound connector/SMTP handoff details and exact Message-ID.

References

1. Message trace in the Exchange admin center in Exchange Online
2. Trace an email message in Exchange Online
3. Message tracking
4. Exchange Server: Search message tracking logs