We have a single exchange 2013 server. Recently a user has said that emails are being sent to them from external addresses but not arriving.
Having a look at the Message Tracking Log (Get-MessageTrackingLog - ResultSize Unlimited -Start "nov 9 2013" -End "nov 11 2013" | Out-GridView) shows that the message was received by the server (there is a SEND event, Source=SMTP from the email address in question) but there was no DELIVER event for that email.
I can find 2 occasions in the last couple of days where this has happened, with two separate senders (same recipient).
What else should I check?
Best Answer
Found the email. It was delivered to SpamQuarantine Mailbox, not to the user. It was in the transport log and appeared as being sent from postmaster@domain.com to junk@domain.com instead of the original from/to