Microsoft 365 Mail Flow Troubleshooting: Email Not Delivered

When email is not delivered in Microsoft 365, the fastest way to troubleshoot is to work from evidence rather than guesswork. Every failed message leaves a trail: a non-delivery report (NDR) with a status code, a message trace record, and a delivery path through transport rules, connectors and mail authentication. Read that trail in order and the cause usually names itself.

This guide covers messages that never arrive — external mail that vanishes, internal mail that bounces, and mail a trace shows as delivered but that never reaches the inbox. It is written for the admin doing the diagnosis, and it points at the documented Exchange Online limits that quietly drop mail before anyone sees an error.

The short answer#

Read the NDR code first. The enhanced status code — for example, 550 5.7.1 — tells you whether the message was blocked by policy, rejected by the recipient, lost to a bad address, or caught by authentication. Then run a message trace in the Exchange admin center to see where the message stopped.

From the trace, follow the path. Check mail flow (transport) rules for one that rejected or redirected the message. Check connectors if the mail crosses a boundary such as an on-premises server or a third-party filter. Verify SPF, DKIM and DMARC alignment, and check quarantine. Finally, rule out forwarding loops and the redirect limits that Exchange enforces silently.

Before you start: gather the evidence#

Diagnosis is faster when the facts are in front of you. Collect these before you open the admin center, ideally from the person who reported the problem.

• The full NDR, if the sender received one — the enhanced status code (like 5.7.1 or 5.1.10) and its diagnostic text are the single most useful clue.
• The exact sender and recipient addresses, and whether each is internal or external to your tenant.
• The date and time the message was sent, in a known time zone, so you can find it in a message trace.
• Whether the message was ever delivered before, or whether this is a new sender, recipient, domain or connector.
• Admin access to the Exchange admin center (admin.exchange.microsoft.com) and the Microsoft Defender portal, or someone who has it.

Read the NDR code first#

The NDR (also called a bounce message) carries an enhanced status code defined by Microsoft. It narrows the cause before you touch a single setting. These are the codes you will see most often when mail is not delivered; each maps to a specific fix in Microsoft's documentation.

How a message travels through Exchange Online#

A message in Microsoft 365 is not delivered in one hop. It enters through a connector or Microsoft's own inbound path, passes anti-spam and anti-malware filtering, is evaluated against every mail flow rule in order, and only then lands in the mailbox — where inbox rules and forwarding can move or drop it again. Mail that is not delivered stopped at one of these stages, and a message trace shows which.

Knowing the path also explains the failures that produce no NDR at all. A transport rule can delete a message silently. A forwarding loop can exhaust its hops. A redirect can exceed a documented limit and be dropped without a bounce. The steps below walk the path in the order a message travels it.

Troubleshoot mail flow, step by step#

Work the path in order. Each step either clears a cause or points at the next one.

1. 1

   Run a message trace

   In the Exchange admin center, open Mail flow, then Message trace. Search by sender, recipient and time. Recent messages return in real time; older searches run as a downloadable report. The trace shows each event — received, filtered, rule matched, delivered, failed — and the exact point the message stopped. The current retention window is shown in the tool itself.

2. 2

   Check mail flow (transport) rules

   In Mail flow, then Rules, review any rule that could reject, redirect or delete the message. NDR 5.7.1 is often a transport rule rejecting a match. Rules run in priority order, and a delete action produces no bounce, so a message that vanishes with no NDR is frequently a rule. Disable a suspect rule and re-test.

3. 3

   Check connectors

   Connectors control mail that crosses a boundary — to or from an on-premises Exchange server, a partner organisation, or a third-party filtering or archiving service. A wrong smart host, an expired TLS certificate, or a criteria mismatch can reject or misroute mail. NDR 5.7.64 points straight at an inbound connector whose configuration no longer matches your environment.

4. 4

   Verify SPF, DKIM and DMARC alignment

   For external senders, authentication failures cause both rejections and quarantine. Confirm the sending domain publishes a valid SPF record, signs with DKIM, and aligns for DMARC. NDR 5.7.23 signals an SPF failure; 5.7.509 means the sender failed DMARC and its policy is reject. For your own outbound, check the same three records at your domain's DNS.

5. 5

   Check quarantine

   In the Microsoft Defender portal, open Review, then Quarantine. Legitimate mail is held here when anti-spam, anti-phishing or a mail flow rule flags it. Release the message, and if it should always arrive, adjust the policy or add an allow entry — carefully, because allow-listing weakens spoofing protection. Quarantined mail is kept for a configurable window (up to 30 days) and then deleted.

6. 6

   Rule out forwarding loops and redirect limits

   Automatic forwarding, redirect rules and connectors can send a message in a circle. Exchange breaks the loop after 20 hops and returns NDR 5.4.14. Separately, Exchange enforces documented limits on forwarding and redirection — and exceeding them drops mail with no obvious error. Those limits are the next section.

The forwarding and redirect limits that silently drop mail#

This is the failure that wastes the most time, because it produces no bounce and no quarantine entry. Exchange Online caps how many recipients a redirect can reach and how many times a message can be redirected. Cross the cap and the message is simply not redirected.

The values below are from Microsoft's Exchange Online limits documentation (as of 2026). They can differ by plan, so confirm the current numbers for your subscription on that page before you rely on them.

Platform differences: Exchange Online, hybrid and on-premises#

Where your mailboxes and routing live changes both the symptoms and the fix. The routing-loop NDR code, in particular, tells you which side generated it: Exchange Online returns 5.4.14, while an on-premises server returns 5.4.6.

What to do when it doesn't work#

If the trace looks clean and the message still does not arrive, the cause is usually past the point of delivery — at the mailbox itself. Work these symptoms.

A faster way, once delivery is fixed#

The tools for this job are Microsoft's own: the Exchange admin center for message trace, mail flow rules and connectors, and the Defender portal for quarantine. AI Emaily is not a mail flow admin tool, a message trace, or a DMARC monitor, and it will not configure transport rules or connectors for you. For the server-side fixes above, stay in the admin center.

The adjacent job we do starts once delivery works. AI Emaily connects to your Microsoft 365, Gmail or IMAP mailbox and reads the same SPF, DKIM and DMARC results on the mail that does arrive — so it can flag a spoofed sender that failed alignment, and triage the rest so important messages surface first. It keeps approve-before-send, undo and a full audit trail. We build AI Emaily, and it comes with a 7-day free trial on the Pro and Autopilot plans.