Forum Discussion
Can't find email sent via Microsoft 365 Exchange
Hi,
I have been directed to the forums by the Support team to see if anybody could possibly assist/explain what happened in this scenario.
A user has reported that they have received an external email in response to an email from themselves, which they are confident they did not send. They cannot see the email in their sent items, nor can any trace of it be found in Deleted/Recoverable Items.
The Exchange message trace indicates however that this email was sent from the user's home IP address, and the trace entries are in the same style as how a normal email sent via Outlook looks. SPF/DKIM/DMARC should all also be correctly set up for the sending domain.
There is also a seven-year retention policy to keep content that is applied (and has been for a while) on this user's mailbox. A content search for the user's mailbox for all Exchange activity between the date the email is shown as sent in Exchange and the same date again has been made, but this email does not show up here at all.
What could have happened here, and why can the email not be found via a content search given the retention policy that is set?
Any and all input is appreciated!
Thanks,
Jordan
3 Replies
- It might pay to log a service request with Microsoft for this one. If the retention policy is set up correctly, then it should be found when doing an eDiscovery. Are there any other accounts that have send as or full access permissions on this mailbox?
Dan_Snape- Thanks for this. Needed this as a sanity check that there shouldn't be any way it's not present in the content search.
Fortunately, this was a user mailbox where there is no delegate access of any kind, which kept things simpler.
Redoubled my content search efforts and disregarded date as a factor altogether...
Looks like the offending email must have either been stuck in the outbox or was scheduled to be sent later (email headers are rather barren so it's hard to tell...). The email in question shows the expected recent send date, but appears to be indexed by the content search under its original creation date from months ago!
Fortunately, this was just an issue that seemed to exist between keyboard and chair!
- ah ... the old ID 10 T problem ... i get that a lot
