Undelivered message expanded

[Jason Gaffney]

Hello,

I have a user who receives most mail just fine. But some senders never get a message deliverd to said user.

Note, this is a normal user mailbox, it is NOT a group, however, the message trace is indicating the status as "expanded" and delivered to the group, and then names the "group" it's delivered to as the users normal mailbox (It's not a group)

Status

The message was sent to the following group: fakeusername123 @domain.com. Office 365 received the message and sent it to the group members

Group: fakeusername123 @domain.com

How do I troubleshoot that O365 is expanding these messages to a non existing group and not delivering it to the expected mailbox?

[#2]

Run a message trace and post the sanitized results here: https://docs.microsoft.com/en-us/office365/securitycompliance/message-trace-scc

[#3]

Does this help?

It also appears to be flagged as spam, however the sender is allowed an sender.

[#4]

You should have checked the details for the second entry there, the one with the Expand DL action. And you do have a Redirect event prior to that, which you should check as well.

[#5]

I have seen those, and they do not provide any information.

The redirect detail is this "Redirect message. No detail information available".

The second message I assume you are referring to is the Expand DL "The message was sent to a distribution list (DL) That was expanded to the recipients of the DL"

This is the problem, the so called distribution list it's expanding to is NOT a distribution list and there is no detail in the message trace.

Like I said, the message trace is telling me it's being sent to a group that does not exist.

See below, I have changed the actual recipient to fakeuser123@fakedomain.com, which is a normal user mailbox, however, the message is telling me it's being delivered to the the group "fakeuser123@fakedomain.com", which is not a group, it is the users mailbox. Who never recieves the message.

The message was sent to the following group: fakeuser123@fakedomain.com. Office 365 received the message and sent it to the group members.

Group: fakeuser123@fakedomain.com

[#6]

I get what you're saying, but I also see what's on that screenshot and when there is an Expand event, usually a group is involved. Check the async message trace, it might reveal some additional details. And you can always open a support case and have this properly investigated.

[#7]

@Vasil Michev 

I realize this is old.

We're having the exact same issue.

An email was sent to an internal user from an external user. The internal user did not receive the message. Search results show the message was expanded to a group. The group name is the internal users' email address. Their primary email address. There is NO group remotely similar to the email address that Office 365 says the message was originally sent to.

[#8]

I am having the same issue as well. Message trace says it was expanded and delivered to the recipients of the group, but the email address is not for a group. It is a user's primary address.