Email guide
Microsoft 365 Not Receiving Email From External Senders: Mail Flow Troubleshooting
When customers or suppliers say their emails aren't reaching your team, the message has been rejected, quarantined, misrouted, or filtered on arrival. Exchange Online keeps a record of almost every one of those outcomes. The task is to find the message and read what the system did with it.
Information to collect before you start
- The sender's full email address and the intended recipient.
- The approximate date and time the message was sent, including time zone.
- Any bounce message (non-delivery report) the sender received. The status code in it, such as
550 5.7.1, usually identifies the cause immediately.
Step-by-step
Run a message trace
In the Exchange admin center, go to Mail flow → Message trace and search by sender and recipient for the relevant period. The result shows whether Exchange Online received the message and what happened next: Delivered, Failed, Quarantined or Filtered as spam. If there is no record at all, the message never reached Microsoft 365, so focus on DNS and the sender's side.
Check quarantine
Messages held as spam, phishing or malware appear in the Microsoft Defender portal under Email & collaboration → Review → Quarantine. Review the detection reason before releasing anything. If a legitimate business partner is repeatedly quarantined, address the cause (often their own SPF or DKIM configuration) rather than adding broad allow entries.
Verify the MX record
Use any DNS lookup tool to check the MX record for your domain. For Exchange Online it should point to your tenant's endpoint, in the form
yourdomain-com.mail.protection.outlook.com. An MX record that still points to a previous provider, or a second MX record with a different priority, will send some or all mail elsewhere. Check this first after any domain or DNS hosting change.Review mail flow rules
Under Mail flow → Rules, look for rules that redirect, delete or hold messages, particularly rules added for a past project or by a previous administrator. A trace that shows a rule being applied to the message will name it.
Check inbound connectors
If your organization uses a third-party email filtering service in front of Microsoft 365, mail should arrive through an inbound connector restricted to that service. A misconfigured connector, or a lapsed subscription with the filtering vendor, can cause mail to be rejected. Under Mail flow → Connectors, confirm the configuration matches the service you are actually using.
Check the recipient's mailbox
If the trace shows Delivered, the problem is inside the mailbox. Check the Junk Email folder, Inbox rules created by the user, and the Focused Inbox Other tab. An unfamiliar Inbox rule that moves or forwards mail should be treated as a possible account compromise and investigated immediately.
Reading common bounce codes
| Code | Usual meaning |
|---|---|
5.1.1 / 5.1.10 | Recipient address not found. Check spelling, aliases and whether the user or group still exists. |
5.2.2 | Recipient mailbox is full. |
5.7.1 | Delivery not authorized, often because of a restriction on a group or a mail flow rule. |
5.4.1 | Relay access denied. Frequently the domain is not set up as an accepted domain, or the MX record is wrong. |
When to escalate
Escalate when a message trace shows nothing for a sender who can prove the message was sent, when entire domains are being rejected, or when you find mailbox rules or forwarding nobody in the business set up. The last of these is a security incident and should be handled as one.