Email message tracing: sent, accepted, delivered or seen?

Start at the boundary

SMTP acceptance means a receiving server has accepted responsibility for the message. Temporary and permanent negative replies have different retry implications. Preserve the exact response, sender, recipient, timestamp and message ID rather than replacing them with “it bounced”. [IETF RFC 5321: SMTP]

Enhanced status codes add a class, subject and detail to the result. A 4.x.x class indicates a persistent transient failure; 5.x.x indicates permanent failure. The full provider explanation is still needed to understand the cause. [IETF RFC 3463: enhanced status codes]

Read the detailed events

Exchange Online message trace follows messages within the organisation’s service boundary. Microsoft warns that a Delivered result can include spam-filtered mail sent to Junk or quarantine. Read the events and recipient disposition before equating that label with inbox visibility. [Microsoft: message trace FAQ]

What we put in the incident record

• The originating application and its evidence of submission.
• The last confirmed acceptance and the responding server.
• Headers and authentication results obtained from an authorised source.
• The receiving provider’s trace or quarantine evidence where available.
• Which conclusion is proven, which is inferred and which still requires evidence.

We coordinate requests to other providers through the named incident owner. That gives one accountable investigation while respecting the fact that logs are controlled by different organisations. See our incident and change framework.