Every mail-flow mystery is solved by knowing which stage owns it. Walk one message from Send to Inbox — with the trace evidence at each hop — and NDRs, delays and misroutes become lookups instead of folklore.
The flow — what actually happens
Plain-language first; the packet-level
view underneath each step is what you'd see in a Wireshark trace, and what healthy looks like.
-
Submission
Outlook hands the message to the service (MAPI submission), or an app submits via SMTP client submission/Graph/HVE. Whatever the door, the message enters the transport pipeline and gets its identity: the Message-ID and an internal conversation of tracking events begins.
On the wire Message trace shows RECEIVE as the first event, with the submitting client/connector named. A message that never traces = it never submitted — the failure is client-side, stop looking at transport.
-
Categorisation and routing decision
Transport resolves recipients (expanding DLs, rewriting via forwarding), consults accepted domains and connectors, and decides each recipient's road: local mailbox, another tenant, the internet via a connector, or on-prem in hybrid. One message becomes N recipient journeys — traces are per-recipient for exactly this reason.
On the wire Trace detail shows EXPAND (DLs), RESOLVE and REDIRECT (forwarding) events — the 'why did Bob get this' answers live in these events, not in guesswork.
-
Policy gauntlet: rules then protection
Transport rules (ETRs) fire in priority order — stamping, redirecting, blocking. Inbound mail additionally runs the EOP pipeline (connection filtering, anti-malware, spam, phish — its own concept). A message can be modified, forked, quarantined or dropped here, all evidenced.
On the wire Trace detail lists each rule that matched with its action; quarantine events name the verdict. 'The filter ate it' becomes 'rule 14, action Quarantine, verdict HighConfPhish' — an argument-ender.
-
Delivery — or the queue, or the NDR
Local recipients: the message lands (DELIVER) and inbox rules run. Remote: a connector attempts the next hop — transient failures queue and retry (DEFER events, hours of patience), permanent failures generate the NDR with its 5.x.x code (the decoder concept). Nothing vanishes silently: every terminal state has an event.
On the wire Trace final states: Delivered, Failed (with the SMTP response from the far side — READ it, it names the rejecting party), Pending (still queued/deferred), Quarantined. The far-side response text is the single most under-read diagnostic in Exchange.
Discussion
No messages yet — start the thread.
