How to Create and Manage Message Trace Rules and Mail Flow Connectors in Exchange Online

In enterprise Microsoft 365 environments, email transport represents the most mission-critical communication pipeline. When external partners report missing invoices, executive emails bounce unexpectedly, or third-party cloud services (such as ticketing platforms or multi-function printers) require secure outbound relay, Microsoft 365 administrators must troubleshoot delivery failures rapidly. Relying on end-user Outlook inbox searches provides zero diagnostic visibility into transport pipeline rejections, anti-spam quarantine blocks, or TLS handshake negotiations.

Exchange Online provides two core enterprise routing mechanisms: Message Trace and Mail Flow Connectors. While Message Trace functions as the authoritative audit log tracking every email transaction across Microsoft transport servers, Mail Flow Connectors define cryptographic routing relationships with partner organisations and hybrid on-premises Exchange servers. This technical guide covers how to execute historical message traces, interpret delivery status codes, construct secure partner inbound/outbound connectors, and validate mail flow via PowerShell.

Feature Overview: Message Trace vs. Mail Flow Connectors

Understanding their distinct roles within the messaging pipeline ensures effective troubleshooting:

Component	Primary Operational Role	Governance Layer
Message Trace	Audits and traces email delivery events, routing hops, spam verdicts, and bounce reasons.	Diagnostic reporting (supports real-time queries up to 10 days; CSV reports up to 90 days).
Mail Flow Connectors	Enforces custom routing paths, mandatory TLS encryption, and IP/certificate validation.	Transport pipeline policy enforcement between Exchange Online and external endpoints.

Step 1: Running a Message Trace in Exchange Admin Center (EAC)

To investigate why a message failed to deliver or determine whether it was quarantined by Microsoft Defender:

1. Sign in to the Exchange admin center with Exchange Administrator permissions.
2. In the left-hand navigation pane, expand Mail flow and select Message trace.
3. Under the Default queries tab, click Start a trace.
4. Populate the search parameters:
   • Senders: Enter the sender’s address (or leave blank to search all senders).
   • Recipients: Enter the destination address.
   • Time range: Select a window (e.g., Past 24 hours or Past 7 days). Searches within the past 10 days return instantaneous summary results in the browser; searches beyond 10 days execute as background downloadable CSV requests.
5. Click Search.

Step 2: Interpreting Delivery Status Codes

The results grid categorises each email into a standardized delivery status:

• Delivered: The message was successfully delivered to the recipient’s mailbox or external transport server.
• Expanded: The message was dispatched to a distribution list and expanded into individual recipient deliveries.
• Failed: Delivery failed. Clicking the row reveals the Non-Delivery Report (NDR) status code (e.g., 550 5.4.1 Access Denied or 550 5.7.1 Unable to relay).
• Pending: The message is currently queued or undergoing deferred delivery attempts due to transient network latency.
• Quarantined: Filtered by Exchange Online Protection (EOP) or Defender for Office 365 as spam, phishing, or malware.

Step 3: Creating a Secure Partner Mail Flow Connector

When establishing dedicated, encrypted email channels with a corporate partner or external archiving vendor:

1. In the Exchange admin center, navigate to Mail flow > Connectors.
2. Click Add a connector.
3. Configure the connection direction:
   • Connection from: Office 365
   • Connection to: Partner organization (or Your organization’s email server for on-premise relays).
4. Click Next. Enter a descriptive name (e.g., Outbound-Partner-LegalDomain).
5. Under Use of connector, choose Only when email messages are sent to these domains and add the partner domain (e.g., externalpartner.com).
6. Under Routing method, select whether to route via smart host IP or standard MX records.
7. Under Security restrictions:
   • Check Always use Transport Layer Security (TLS) to secure the connection.
   • Choose Issued by a trusted certificate authority (CA) and input the subject name on the partner’s SSL certificate (e.g., mail.externalpartner.com). This prevents man-in-the-middle spoofing.
8. Validate the connector: Enter a valid test email address on the partner domain and click Validate. Exchange Online sends a test payload, verifies TLS cipher negotiation, and commits the connector.

Running Message Traces via Exchange Online PowerShell

For automated reporting, querying large recipient volumes, or scriptable troubleshooting:

# Query delivered messages sent to a specific domain in the last 48 hours
Get-MessageTrace -RecipientAddress "*@partnercompany.com" -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date) | Select-Object Received, SenderAddress, RecipientAddress, Status, MessageSubject

# Inspect granular delivery failure details for a specific message
Get-MessageTraceDetail -MessageTraceId "3a7b6c8d-1234-5678-abcd-ef0123456789" -RecipientAddress "[email protected]"

Operational Security Considerations

• Preventing Open Relay Exploits: When configuring inbound connectors from on-premises multifunction printers or scan-to-email servers, strictly authenticate connections using public static IP filters or verified TLS subject names. Never configure an inbound connector with open wildcard domain relay permissions.
• High-Volume SMTP Relays: For automated transactional applications sending thousands of marketing emails per hour, utilize Azure Communication Services or specialized relay services rather than routing through standard Exchange Online mailboxes to avoid hitting tenant sending limits (10,000 recipients/day).