Exchange Online Message Trace: Track Lost Emails, SCL Headers & Historical Search [2026]

In enterprise IT support, few tickets arrive with more urgency than: “A client sent an urgent contract two hours ago, but our executive never received it.” The sender insists the email left their outbox without a bounce message. The recipient’s Outlook inbox shows nothing. In Exchange Online, resolving these delivery discrepancies quickly requires navigating past the graphical Exchange Admin Center (EAC) and executing targeted Message Trace queries via PowerShell.

Tracking messages across Exchange Online Protection (EOP) involves understanding a fundamental architectural divide: real-time summary data for messages sent within the last 10 days, versus asynchronous Extended Message Trace (Historical Search) for messages up to 90 days old.

This technical runbook provides production PowerShell cmdlets to trace lost emails, extract hop-by-hop delivery events with Get-MessageTraceDetail, and decode critical X-Forefront-Antispam-Report headers (SCL, BCL, and ZAP events) to pinpoint exactly where an email landed.

The Architectural Divide: 10-Day Real-Time vs 90-Day Historical Search

Real-Time Triage: Get-MessageTrace within 10 Days

Scenario 1: Find All Messages Sent to an Executive in the Last 24 Hours

To inspect messages received by a specific user where the sender address is unknown or ambiguous:

# Query inbound traffic over the last 24 hours
$StartDate = (Get-Date).AddDays(-1)
$EndDate = Get-Date

Get-MessageTrace -RecipientAddress "ceo@yourdomain.com" `
    -StartDate $StartDate `
    -EndDate $EndDate | 
    Select-Object Received, SenderAddress, Subject, Status, MessageId | 
    Format-Table -AutoSize

The Status property returns one of four definitive states:

• Delivered: The message was successfully delivered to the destination mailbox store or folder.
• Expanded: The message was sent to a distribution list and expanded to individual recipients.
• Failed: The message was permanently rejected or bounced (an NDR was generated).
• Pending: The message is actively being processed, deferred, or queued by EOP.

Scenario 2: Query by Internet Message ID (The Forensic Standard)

When communicating with external sender organizations, sender email addresses can be spoofed or forwarded. Ask the external administrator for the RFC 2822 Internet Message ID (formatted as <GUID@mail.sender.com>):

# Track an exact email using Message-ID
$MessageId = "<MW2PR01MB23456789@namprd01.prod.outlook.com>"

$Trace = Get-MessageTrace -MessageId $MessageId
$Trace | Format-List Received, SenderAddress, RecipientAddress, Subject, Status, MessageTraceId

Deep-Dive Forensics: Get-MessageTraceDetail

While Get-MessageTrace confirms whether an email reached the tenant, Get-MessageTraceDetail provides the exact hop-by-hop event timeline. It answers whether a transport rule dropped the message, whether it was quarantined, or whether it was delivered to the Junk folder.

# Extract the unique MessageTraceId from the initial trace
$Trace = Get-MessageTrace -RecipientAddress "ceo@yourdomain.com" -StartDate (Get-Date).AddHours(-4) -EndDate (Get-Date) | Select-Object -First 1

# Pull hop-by-hop event log
Get-MessageTraceDetail -MessageTraceId $Trace.MessageTraceId -RecipientAddress $Trace.RecipientAddress | 
    Select-Object Date, Event, Action, Detail | 
    Format-Table -AutoSize

Common Event Identifiers Decoded

• RECEIVE: EOP edge transport servers accepted the inbound SMTP connection.
• AGENTINFO: Security evaluation completed (Anti-Spam, Anti-Malware, Safe Attachments).
• DELIVER: Mail delivery agent successfully placed the message into the user’s mailbox database store.
• SPAM_ABORT / DROP: Message was dropped silently or quarantined due to malware or high-confidence phishing.
• ZAP (Zero-Hour Auto Purge): The message was initially delivered, but retroactive cloud telemetry identified a malicious payload and removed the email from the user’s inbox to Quarantine.

Decoding Anti-Spam & Authentication Headers

When an email is marked as Delivered but the user cannot find it in their primary inbox, inspect the internet headers using the ExRCA Message Analyzer or PowerShell. Look for two critical header lines:

1. Authentication-Results (SPF, DKIM, DMARC)

Authentication-Results: spf=pass (sender IP is 209.85.220.41)
 smtp.mailfrom=senderdomain.com; dkim=pass (signature was verified)
 header.d=senderdomain.com; dmarc=pass action=none
 header.from=senderdomain.com;

If spf=fail, dkim=fail, or dmarc=fail, EOP automatically escalates the Spam Confidence Level (SCL).

2. X-Forefront-Antispam-Report (SCL & BCL Scores)

X-Forefront-Antispam-Report: CIP:209.85.220.41; CTRY:US; SCL:5; BCL:0; PCL:0;
 SFV:SPM; H:mail.senderdomain.com; CAT:SPM;

The SCL (Spam Confidence Level) determines where Exchange routes the email:

• SCL -1: Trusted internal message or explicitly bypassed via Transport Rule / Safe Senders. Delivered directly to Inbox.
• SCL 0 – 1: Non-spam message. Delivered to Inbox.
• SCL 5 – 6: Suspected Spam. By default, EOP routes to the user’s Junk Email folder.
• SCL 9: High-Confidence Spam or Phishing. Routed directly to Admin Quarantine.

Historical Search: Tracking Messages Between 10 and 90 Days

If an audit requires searching emails beyond the 10-day limit, use Start-HistoricalSearch. This submits an asynchronous job to the cloud, compiles all diagnostic events, and outputs a downloadable CSV file.

# Define 30-day date boundary
$StartDate = (Get-Date).AddDays(-30)
$EndDate = (Get-Date).AddDays(-15)

# Initiate Extended Message Trace
Start-HistoricalSearch -JobTitle "Q3 Executive Mail Audit" `
    -StartDate $StartDate `
    -EndDate $EndDate `
    -SenderAddress "vendor@partnerdomain.com" `
    -RecipientAddress "finance@yourdomain.com" `
    -ReportType "MessageTraceDetail" `
    -NotificationEmailAddress "admin@yourdomain.com"

# Check the status of running Historical Search jobs
Get-HistoricalSearch | Format-Table JobTitle, Status, SubmitDate, CompletionDate, Rows

Once Status reaches Done, the administrator receives an email notification with a direct secure link to download the compressed forensic CSV report.

Troubleshooting Checklist: When “Delivered” Email Is Missing

If Get-MessageTraceDetail confirms status DELIVER, but the recipient cannot locate the message:

1. Check the Junk Email Folder: SCL was set to 5 or 6 due to DMARC/SPF misalignment.
2. Inspect Inbox Forwarding & Sweep Rules: Malicious or forgotten rules often route mail to Deleted Items, Archive, or RSS Feeds. Query active rules using:

   Get-InboxRule -Mailbox user@yourdomain.com | Format-Table Name, Description

3. Check Recoverable Items (Soft-Deleted): The user or an automated script may have deleted the email:

   Get-RecoverableItems -Identity user@yourdomain.com -SubjectContains "Contract"

4. Check Focused Inbox: The message may be sitting in Outlook’s “Other” tab rather than “Focused”.

For more day-to-day administration runbooks, explore our guide on Exchange Online NDR Troubleshooting (550 5.1.1, 550 5.7.705 & 554 5.4.14) and our architectural breakdown of Full Access vs Send As vs Send on Behalf.