Trace an email message in Exchange Online

Sometimes an email message gets lost in transit, or it can take a lot longer than expected for delivery, and your users can wonder what happened. As an administrator, you can use the message trace feature to follow messages as they pass through your Exchange Online or Exchange Online Protection service. With message trace, you can determine whether a targeted email message was received, rejected, deferred, or delivered by the service. It also shows what events have occurred to the message before reaching its final status. Getting detailed information about a specific message lets you efficiently answer your user's questions, troubleshoot mail flow issues, validate policy changes, and alleviates the need to contact technical support for assistance.

Tip

For troubleshooting general issues and trends, use the Reports page in the Microsoft Defender portal (https://security.microsoft.com/emailandcollabreport). For single point specifics where details are needed about a message, use the message trace tool.

The following topics describe how to run a message trace to narrow down your search criteria, how to view message trace results, and how to view details about a specific message:

Note

The Exchange message trace link in the Microsoft Defender portal opens message trace in the modern EAC.

The Message Trace FAQ topic presents common messaging questions that arise and how to best answer these questions using the message trace tool.