0

One of my end users says that they didn't receive an important email yesterday.

I have the copy of the email that he was supposed to receive yesterday that says it was sent but he said he didn't get it.

How can I check to see if an email was actually not delivered vs. being caught in a spam filter? We don't have an external spam filter (such as Barracuda) so it isn't sitting in anything like that waiting to be delivered.

Any advice?

Thanks in advance.

user49032
  • 195
  • 1
  • 4
  • 12

3 Answers3

4

The first thing to do is to check Message Tracking in System Manager to see how that message got routed. Since you have the message, this should be easy. That should prove it at least got to his mailbox.

What happened next will take a bit of digging. A search on the mailbox it self may turn it up, sometimes users do misplace things. If that doesn't turn it up, check the Recover Deleted Items on the box (assuming you have that) and see if it is lurking in there somewhere.

If it STILL doesn't show up, I have had a few cases where my spam/virus filter snagged messages pretty late in the process. Check those logs. And finally, some desktop-AV does have Outlook hooks. You'll want to check those logs as well.

sysadmin1138
  • 133,124
  • 18
  • 176
  • 300
  • This lead me to the answer. The Message Tracking showed that the sender had a typo in the email address which I couldn't see in the forwarded email to me since it only showed the user names and not their addresses (the sender was outside the company). Thanks for the help everybody. – user49032 Aug 04 '10 at 16:00
  • +1 - Message Tracking is a good friend. – Evan Anderson Aug 04 '10 at 18:57
1
  1. Check his Deleted Items (it's probably in there according to Dr. House).
  2. If it was not sent from an internal user, check the SMTP log.
  3. If it was sent internally, and the sender did not receive a NDR, it was either delivered or caught by any spam filters you have on the Exchange server. If you don't have any spam filters installed on the Exchange server, it was delivered.

It may still have been caught by any spam filters on his computer too. Outlook has a Junk mail filter of its own.

Chris S
  • 77,945
  • 11
  • 124
  • 216
1

If the user is internal use the Message Tracking Center of Exchange System Manager on the server.

Find the email in question and double click on it, which will open Message History.

You should see "Message delivered locally to Store to email@domain.com"

Also, messages that weren't delivered and issued an NDR should be logged in the Event Viewer of the Exchange Server

DKNUCKLES
  • 4,028
  • 9
  • 47
  • 60