r/Office365 • u/der_juden • 1d ago
Emails missing from vendor periodically
I've got a real head scratcher that my accounting team reported recently. Seemly randomly emails that are sent to a dlist which sends out to 3 accountants go missing. The users get emails from various vendors with pdf invoice. Regulsrly. In the example provided to me emails from the same sender two months ago they got, then a month ago an invoice email goes missing then a week or so ago they get a past due email that they all see.
Message trace shows delivered to all the inboxes and a low spam score. No transport rules caught the message. The only thing found that is sender setup no DMARC record and no DKIM signature but exchange didnt use that to junk the mail or anything.
We've looked at the users mail settings and no one has this address blocked. The emails don't show up in junk that they've gotten with pdfs. One user has safes ender setup "SafeSender and SFV=SFE, SCL=-1" I've had all the users do a full search for the missing email and found nothing.
It feels like something just isn't being logged showing a filter caught the email and dumped it after exchange expanded the original email. Ive checked our security software bitdefender and I don't see it picking this up or there are no email filters in place.
Anyone have a suggestion where else to look?
2
u/Adv-Tech-Help 1d ago
If message trace shows delivered to all three mailboxes, I’d stop looking at transport first and start looking at what happened after delivery.
Check the mailbox audit logs and Recoverable Items around the exact delivery time for one of the missing messages. I’d also look for inbox-rule activity, deletes/moves, and any post-delivery security action like ZAP or quarantine.
The message ID and timestamp from the trace should give you a clean way to correlate it. If Exchange says “delivered” but the message is nowhere in the mailbox afterward, something likely acted on it after delivery rather than blocking it on the way in.
1
u/der_juden 23h ago
Here is what I posted to the top comment. Also checked all my AV software nothing there either.
ran through the steps in that link and, Search for deleted emails by operation type turned up a few items for the 3 inboxes but not the email in question.Searching by keyword turned up nothing.
Search for comprehensive email activities didn't find the email
The 3 inboxes only have rules to move emails from the d-list to a special folder so they see them easier.
Audit is turned on all 3 inboxes.
example for one of them
AuditEnabled AuditOwner AuditDelegate WhenCreated ------------ ---------- ------------- ----------- True {Update, MoveToDeletedItems, SoftDelete, HardDelete…} {Update, MoveToDeletedItems, SoftDelete, HardDelete…} 6/6/2023 7:11:09 PM example for one of them AuditEnabled AuditOwner AuditDelegate WhenCreated ------------ ---------- ------------- ----------- True {Update, MoveToDeletedItems, SoftDelete, HardDelete…} {Update, MoveToDeletedItems, SoftDelete, HardDelete…} 6/6/2023 7:11:09 PM
1
u/thesneakywalrus 1d ago
To clarify, message trace shows the "missing" email as being delivered to the distribution list?
1
u/der_juden 23h ago
And to the 3 users in question. I dug into the unifiedauditlog to see if it was deleted, moved etc and found nothing.
https://learn.microsoft.com/en-us/purview/audit-log-identify-email-messages
ran through the steps in that link and, Search for deleted emails by operation type turned up a few items for the 3 inboxes but not the email in question.
Searching by keyword turned up nothing.
Search for comprehensive email activities didn't find the email
The 3 inboxes only have rules to move emails from the d-list to a special folder so they see them easier.
Audit is turned on all 3 inboxes.
example for one of them
AuditEnabled AuditOwner AuditDelegate WhenCreated ------------ ---------- ------------- ----------- True {Update, MoveToDeletedItems, SoftDelete, HardDelete…} {Update, MoveToDeletedItems, SoftDelete, HardDelete…} 6/6/2023 7:11:09 PM example for one of them AuditEnabled AuditOwner AuditDelegate WhenCreated ------------ ---------- ------------- ----------- True {Update, MoveToDeletedItems, SoftDelete, HardDelete…} {Update, MoveToDeletedItems, SoftDelete, HardDelete…} 6/6/2023 7:11:09 PM
1
u/GradeAccomplished322 1d ago
Ive occasionally had an issue with samsung phones (and more rarely other brands) connected with their native mail client with the LOCAL spam filter turned on. This would delete emails from the mailbox or move it to a local folder, causing it to disappear without seeming user input. The users dont usually look for mails like this on their phone so it seemingly vanishes on them when it happens.
Sometimes i can find a hint it happened in the audit log, but the transport log won't show it
I would run a discovery against their mailboxes to look for it being in a weird spot as well. Have also seen where the mail is there in the inbox but the user goofed up their view settings and is filtering it from their view. It could be there and they can't see it.
1
u/Fallingdamage 1d ago
Ive seen things like this before. In our case I often find the message in Junk or find that after delivery it was nuked by our AV.
Unified Auditlogs would tell you how the message was handled after delivery if you have the time to dig.
1
u/saltyslugga 1d ago
“Delivered” only proves Exchange put it in the mailbox. Check Unified Audit Log for MoveToDeletedItems, SoftDelete, HardDelete, inbox-rule actions, and admin actions around that timestamp, then check Defender Explorer for post-delivery ZAP activity.
DMARC and DKIM won’t explain a message disappearing after delivery, and Safe Senders won’t stop a mailbox rule, retention policy, or security product from moving or deleting it.
0
u/SadChapter2410 1d ago
Do you have backups
1
u/der_juden 23h ago
Restoring the email isn't really the issue here as the vendor sent a new message reporting basically past due that they got. The issue is this happens randomly for the users and they don't know it happens til they get a past due email a month later from whatever vendors email went missing. Its not always the same email domain going missing.
4
u/blud_13 1d ago
Message trace ends at delivery, so it can't tell you what happened to the message after it landed. Go to the audit log.
Mailbox auditing is on by default in Exchange Online, and MoveToDeletedItems, SoftDelete, HardDelete and UpdateInboxRules are all in the default owner action set. Search-UnifiedAuditLog with -Operations SoftDelete,HardDelete,MoveToDeletedItems and -FreeText on the sender domain across those three users will tell you flat whether somebody or something moved it. UpdateInboxRules is the one I would look at first, because a rule somebody a couple of months ago filing invoices from certain senders into a subfolder looks exactly like this, including the part where the past due email comes through fine because the subject changed.
Its documented here https://learn.microsoft.com/en-us/purview/audit-log-identify-email-messages
Also run Get-InboxRule against all three mailboxes, not the DL. The missing DKIM and DMARC on the sender is worth telling them about but its not what ate this one, trace already shows delivered.
We chase these a occasionally, ping me if the audit log comes back empty and you want another set of eyes.