We have a single exchange 2013 server. Recently a user has said that emails are being sent to them from external addresses but not arriving.

Having a look at the Message Tracking Log (Get-MessageTrackingLog - ResultSize Unlimited -Start "nov 9 2013" -End "nov 11 2013" | Out-GridView) shows that the message was received by the server (there is a SEND event, Source=SMTP from the email address in question) but there was no DELIVER event for that email.

I can find 2 occasions in the last couple of days where this has happened, with two separate senders (same recipient).

What else should I check?

1 Answer 1


Found the email. It was delivered to SpamQuarantine Mailbox, not to the user. It was in the transport log and appeared as being sent from postmaster@domain.com to junk@domain.com instead of the original from/to

  • As an aside there should always be an EventId associated with the message, which should give you a clue as to the disposition of the email.
    – joeqwerty
    Nov 13, 2013 at 20:47
  • @slm, I was the author and answered my own question. The solution was that the spam filter had redirected the email to the SpamQuarantine Mailbox. I couldn't find it in the Get-MessageTrackingLog as being delivered to the user because it wasn't - it was delivered to the spam mailbox
    – Greg
    Nov 13, 2013 at 22:11
  • @Greg - fair enough, I didn't notice you answering your own Q. Perhaps you could elaborate a bit so that your Q&A have a bit more details then? For the next person that finds this via Google? Thanks!
    – slm
    Nov 13, 2013 at 22:13
  • @slm- fair point. I've updated the answer with some more details to try and make it more useful. Basically it was me not thinking
    – Greg
    Nov 13, 2013 at 22:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.