Exchange Mailflow

Exchange Mail Flow & Deliverability

This skill provides comprehensive diagnostic knowledge for troubleshooting Exchange Online mail delivery issues, managing transport rules, validating email authentication records, and generating client-safe reports.

Diagnostic Approach

When a user reports "email not received", follow this investigation order:

1. Message trace — Did Exchange see the message?
2. Transport rules — Was the message redirected or blocked by a rule?
3. Quarantine — Was the message quarantined by anti-spam or anti-malware?
4. Connectors — Is there a connector misconfiguration for the sender's domain?
5. DNS authentication — Are SPF/DKIM/DMARC records correct for the sending domain?
6. Recipient issues — Is the mailbox full, disabled, or forwarding elsewhere?

API Endpoints

Reporting API (Graph)

Message Trace (Exchange PowerShell)

Message Trace Results — Status Values

Transport Rules

PowerShell Commands

# List all transport rules
Get-TransportRule | Select-Object Name, State, Priority, Description | Format-Table

# Get specific rule details
Get-TransportRule -Identity "Rule Name" | Format-List

# Create transport rule
New-TransportRule -Name "Block External Auto-Forward" `
  -FromScope InOrganization `
  -MessageTypeMatches AutoForward `
  -SentToScope NotInOrganization `
  -RejectMessageReasonText "External auto-forwarding is blocked by policy"

Transport Rule Condition Parameters

Transport Rule Action Parameters

Transport Rule Body Example

New-TransportRule -Name "Encrypt External PII" `
  -FromScope InOrganization `
  -SentToScope NotInOrganization `
  -SubjectOrBodyContainsWords "SSN","Social Security","tax ID" `
  -ApplyRightsProtectionTemplate "Encrypt" `
  -SetHeaderName "X-DLP-Rule" `
  -SetHeaderValue "PII-External-Encrypt" `
  -Priority 0 `
  -Mode Enforce

Message Trace API Request (Graph — Beta)

POST https://graph.microsoft.com/beta/reports/getMailflowStatusSummary
{
  "StartDate": "2026-02-01T00:00:00Z",
  "EndDate": "2026-03-01T00:00:00Z",
  "SenderAddress": "sender@external.com",
  "RecipientAddress": "user@contoso.com",
  "Direction": "Inbound"
}

Quarantine Management

# List quarantined messages
Get-QuarantineMessage -SenderAddress "sender@external.com" -RecipientAddress "user@contoso.com" -StartDate (Get-Date).AddDays(-10) -EndDate (Get-Date)

# Release from quarantine
Release-QuarantineMessage -Identity <QuarantineMessageId> -ReleaseToAll

# Preview quarantined message
Preview-QuarantineMessage -Identity <QuarantineMessageId>

# Delete from quarantine
Delete-QuarantineMessage -Identity <QuarantineMessageId>

Connectors

PowerShell Commands

# List inbound connectors
Get-InboundConnector | Select-Object Name, Enabled, SenderDomains, ConnectorType, RequireTls

# List outbound connectors
Get-OutboundConnector | Select-Object Name, Enabled, RecipientDomains, ConnectorType, UseMXRecord

Connector Configuration Reference

DNS Authentication

SPF (Sender Policy Framework)

nslookup -type=txt contoso.com
# Or: dig TXT contoso.com +short

Valid SPF example: v=spf1 include:spf.protection.outlook.com -all

SPF Mechanism Reference

Common SPF issues:

• Missing include:spf.protection.outlook.com for M365 tenants
• Using ~all (softfail) instead of -all (hardfail)
• Too many DNS lookups (max 10 include/a/mx mechanisms)
• Missing SPF record entirely
• Duplicate SPF records (only one allowed per domain)

DKIM (DomainKeys Identified Mail)

# Check DKIM status
Get-DkimSigningConfig | Select-Object Domain, Enabled, Status

# Enable DKIM
Set-DkimSigningConfig -Identity contoso.com -Enabled $true

# Rotate DKIM keys
Rotate-DkimSigningConfig -KeySize 2048 -Identity contoso.com

DKIM key rotation procedure:

1. Get-DkimSigningConfig — verify current status and selector
2. Rotate-DkimSigningConfig -KeySize 2048 — generate new key pair
3. Update DNS CNAME records for selector1 and selector2
4. Wait for DNS propagation (up to 48 hours)
5. Verify with nslookup -type=cname selector1._domainkey.contoso.com

DMARC (Domain-based Message Authentication)

nslookup -type=txt _dmarc.contoso.com
# Or: dig TXT _dmarc.contoso.com +short

Recommended DMARC: v=DMARC1; p=reject; rua=mailto:dmarc-reports@contoso.com; ruf=mailto:dmarc-forensic@contoso.com

DMARC Policy Parameter Reference

DMARC rollout path: p=none (monitor 2-4 weeks) → p=quarantine; pct=25 → pct=50 → pct=100 → p=reject

NDR (Non-Delivery Report) Code Reference

Required Permissions

Error Handling

Message Trace Limits

• Get-MessageTrace: last 10 days only, max 1000 results per query
• Start-HistoricalSearch: 10-90 days, asynchronous — poll Get-HistoricalSearch for completion
• Maximum 250 historical search requests in a 24-hour period

OData Filter Examples (Reporting API)

# Email activity for specific user
/reports/getEmailActivityUserDetail(period='D30')?$filter=userPrincipalName eq 'user@contoso.com'

# Mailbox usage over quota
/reports/getMailboxUsageDetail(period='D30')?$filter=storageUsedInBytes ge 50000000000

Common Diagnostic Patterns

Pattern 1: Missing Email Investigation

1. Get-MessageTrace -SenderAddress "sender@external.com" -RecipientAddress "user@contoso.com" -StartDate (Get-Date).AddDays(-10) — check if Exchange received it
2. If None: DNS check — nslookup -type=mx contoso.com — verify MX points to M365
3. If Quarantined: Get-QuarantineMessage — review and release if safe
4. If Failed: Get-MessageTraceDetail — get NDR code and resolve
5. If FilteredAsSpam: check anti-spam policy, add sender to safe senders list
6. If Delivered but user says missing: check Junk folder, Outlook rules, mobile sync

Pattern 2: Transport Rule Audit

1. Get-TransportRule | Sort Priority — list all rules in priority order
2. For each enabled rule: check conditions and actions for unintended blocking
3. Get-MessageTraceDetail -MessageTraceId {id} — verify which rules fired on a specific message
4. Test with New-TransportRule -Mode Audit before promoting to Enforce
5. Document all active rules with business justification

Pattern 3: DNS Authentication Validation

1. Check SPF: nslookup -type=txt contoso.com — verify include:spf.protection.outlook.com and -all
2. Check DKIM: Get-DkimSigningConfig — verify enabled for all custom domains
3. Check DMARC: nslookup -type=txt _dmarc.contoso.com — verify policy level
4. Produce traffic-light report: Green (all pass), Yellow (soft fail), Red (missing/failing)
5. Provide step-by-step DNS record updates for any failures

Pattern 4: Connector Troubleshooting

1. Get-InboundConnector — list inbound connectors and their TLS requirements
2. Get-OutboundConnector — list outbound connectors and smart host config
3. Test-InboundConnector — validate inbound connector settings
4. Check for certificate expiration on TLS-required connectors
5. Verify MX records align with connector configuration

Client-Safe Explanation Template

When reporting findings to a non-technical user:

## What happened
[1-2 sentence plain-language explanation]

## Why it happened
[Simple cause — avoid jargon]

## What we're doing about it
[Specific next steps in numbered list]

## What you can do
[Any user actions needed]

## Timeline
[When they should expect resolution]

Progressive Disclosure — Reference Files