I have an Exchange 2010 server listening on a couple of different domains. So it receives and sends emails destinated and originating from several domains.

Now we want to get rid of a specific domain gradually and what I would like to do now is get a list of all the emails received or sent using that specific domain that we wants to get rid of. So we can figure how this domain is still getting used before getting rid of it.


  • check the message tracking logs – TheCleaner Oct 25 '13 at 13:42
  • C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\MessageTracking – Jonathan Rioux Oct 25 '13 at 13:47
  • In the EMC itself. No need to manually check them. – TheCleaner Oct 25 '13 at 13:51
  • Where in the EMC? I cannot find a way to tell from a specific domain, it only allows me to search by users. – Jonathan Rioux Oct 25 '13 at 14:22
  • My apologies mate, I keep forgetting what the EMC offers now that I don't use it anymore. I've posted an answer that should get you what you need. – TheCleaner Oct 25 '13 at 14:26

You can use Powershell to retrieve this and dump it to a log file if you want.

Search for messages sent TO any users at domain.com:

Get-MessageTrackingLog -ResultSize Unlimited -Start "10/1/2013" -End "10/25/2013" | where{$_.recipients -like "*@domain.com"} | select-object Timestamp,SourceContext,Source,EventId,MessageSubject,Sender,{$_.Recipients} | export-csv C:\ExchangeLogResults.txt

Search for messages sent FROM users at domain.com:

Get-MessageTrackingLog -ResultSize Unlimited -Start "10/1/2013" -End "10/25/2013" | where{$_.sender -like "*@domain.com"} | select-object Timestamp,SourceContext,Source,EventId,MessageSubject,Sender,{$_.Recipients} | export-csv C:\ExchangeLogResults.txt
  • what if you wanted to do both send and receive? – user336599 Feb 9 '16 at 14:51
  • @JoshuaBernstein - for a given message? You can combine the "where" so that it includes sender and recipient. See here for some examples that may assist you: msexchangeguru.com/2015/03/10/message-tracking – TheCleaner Feb 9 '16 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.