Forum Discussion

mrsikora's avatar
mrsikora
Copper Contributor
Mar 01, 2024

O365 Exchange not journaling incoming emails, only outgoing

Funky situation that I just came upon. 

 

I use an outside company to archive all inbound/outbound emails. To do so, journaling is is set up to share those emails with them.

 

I checked the archive recently and noticed that there were emails but only outgoing emails, the incoming were not being backed up. I've confirmed with them that the settings are all accurate.

 

I set up a different journal entry to go to a personal email and that does not trigger for incoming emails either.


So I guess my question is, "What would cause incoming not to be journaled, but outgoing to be?" 

I don't have enough knowledge of exchange to know where it's breaking down.

 

I can say that my email log in their software is indeed showing both incoming and outgoing emails, so they are getting to their server. I'm also receiving all the incoming and outgoing emails, so the connectors are working correctly to ensure emails are flowing from them to Outlook.

 

Totally befuddled. Thanks for any suggestions!

  • Figured out the issue on this one.

    It turns out that the SPF record on the domain was misconfigured. If was invalid and resulted in journaled emails Exchange was sending out not being accepted by the third party archive company.

    After the revision to the SPF record, it all worked perfectly.

    Of additional note, it seems as if the "Undeliverable Reports" email should not be an Exchange email address. I would have figured this out earlier but the reports were being "sent" (never received) to an Exchange user. When I switched that to a Yahoo account, I received the report, and was able to determine next steps. Suggest a non-Exchange email for these reports (which is mentioned on that same admin page, but we all read that stuff 😉 all the time).
  • mrsikora's avatar
    mrsikora
    Copper Contributor
    Figured out the issue on this one.

    It turns out that the SPF record on the domain was misconfigured. If was invalid and resulted in journaled emails Exchange was sending out not being accepted by the third party archive company.

    After the revision to the SPF record, it all worked perfectly.

    Of additional note, it seems as if the "Undeliverable Reports" email should not be an Exchange email address. I would have figured this out earlier but the reports were being "sent" (never received) to an Exchange user. When I switched that to a Yahoo account, I received the report, and was able to determine next steps. Suggest a non-Exchange email for these reports (which is mentioned on that same admin page, but we all read that stuff 😉 all the time).
    • CBBFA's avatar
      CBBFA
      Copper Contributor

      mrsikora I am having the exact same issue. Can you provide some general information on the changes you made to your DNS?

       

      Thank you.

       

      • mrsikora's avatar
        mrsikora
        Copper Contributor

        CBBFA First thing I would suggest doing is making sure you are getting the error reports (sent to non-Exchange email). That will give you direction.

         

        Second thing is to verify the SPF record. In my case, I had an error in the SPF record. Once corrected, all flowed as it should. It could be spaces, tildes, or other characters that are wrong or extra that will mess it all up.

         

        Unfortunately that's about all the details I can provide. This isn't second nature to me, it's just something I do because I don't have IT to handle for me ;-).

  • mrsikora's avatar
    mrsikora
    Copper Contributor
    Started a ticket on 3-1-24. Did receive a discovery call the following morning, but no response since. Will follow up with results to potentially help another that may run into this issue. It wouldn't surprise me if some "think" it's working, when in reality "half" of their messages are not being journaled/backed up.
  • Dan_Snape's avatar
    Dan_Snape
    Steel Contributor
    There's a couple of different ways to set journaling up if you're using on-prem Exchange, so please outline how you've configured it.
    • mrsikora's avatar
      mrsikora
      Copper Contributor

      Dan_Snape Using Exchange online (365), not on premise.

       

      Simply have a journal rule to send all emails for all users to an email address.

      • Dan_Snape's avatar
        Dan_Snape
        Steel Contributor
        If you do a message trace on an incoming message you should see the journal message trail as well. if the connector is configured correctly to capture and forward messages for the mailbox specified in the journal rule to the 3rd party journal service, and your journal rule is configured for all messages (not just external!) then all should be good and I'd say it's a problem with the 3rd party. You can always log a ticket with Microsoft to investigate as well.

Resources