Exchange SMTP Logs

Question

Hi All, I am using an Exchange 2016 hybrid environment. One of my applications is using an internal relay (i.e., on-prem relay). The application is triggering emails, but users are not receiving them. The users are in exchange online. Which logs do I need to check to determine where the email has hit Exchange? I have the server IP where the application is hosted, as well as the sender ID and recipient ID. Please guide me

Answer 1

Start with the message tracking logs in the on-prem Exchange Server

https://learn.microsoft.com/en-us/exchange/mail-flow/transport-logs/search-message-tracking-logs?view=exchserver-2019

IF you dont see the messages being routed to Exchange Online there, then enable and check the SMTP protocol logs on the receive connector on the on-prem Exch Servers and see if the messages are being rejected there:

https://learn.microsoft.com/en-us/exchange/mail-flow/connectors/configure-protocol-logging?view=exchserver-2019

Answer 2

Hi @Roger Roger ,

Welcome to the Microsoft Q&A platform!

To troubleshoot email delivery issues in an Exchange 2016 hybrid environment, you can follow these steps to check the relevant logs and trace the email flow:

1. Use the Get-MessageTrackingLog cmdlet to search for the emails. This log will help you trace the path of the email through your Exchange environment.

Get-MessageTrackingLog -Server <YourServerName> -Sender <SenderEmail> -Recipients <RecipientEmail> -Start "12/16/2024 00:00:00" -End "12/17/2024 23:59:59"

This will show you if the email was received by the Exchange server and its subsequent status.

2. Check the SMTP protocol logs on your on-premises Exchange server. These logs can provide detailed information about the SMTP transactions between your application and the Exchange server.

The logs are typically located in the C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\ProtocolLog\SmtpSend directory.

3. Since your application is using an internal relay, IIS logs can also be useful. These logs can be found in the C:\inetpub\logs\LogFiles directory.

Look for entries corresponding to the IP address of your application server.

4. In a hybrid environment, you should also check the hybrid mail flow logs to ensure that the emails are being correctly routed to Exchange Online. You can use the Get-HybridMailflow cmdlet to check the status of the hybrid mail flow.

By checking these logs, you should be able to determine where the email is getting stuck and take appropriate action to resolve the issue.

---

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Best,

Jake Zhang