help with message trace

Question

Hi all,

I have two questions:

1.One of my incoming emails is delayed. From the message trace, I can see the message ID, but I am unable to figure out at which hop the delay occurred. I don't have the email header since the user is not available. Is there any way to trace where the delay happened? After hitting the gateway, the email goes through online protection, which is where I assume the delay occurred. I think the gateway might have caused this issue.

2.If I see "X-MS-Exchange-Organization-AuthAs: Anonymous" in the message header, does it mean the email is external?

Answer 1

Hi @Rising Flight ,

Welcome to the Microsoft Q&A platform!

According to your question description, let me answer your questions one by one：

1.Are you using the new Exchange admin center message tracking in Exchange Online? If not, we recommend that you try using the new Exchange admin center message tracking. It can determine whether the service received, rejected, delayed, or delivered the message, and also show the actions taken on the message before it reached its final state. For specific operations, you can refer to this official document:https://learn.microsoft.com/en-us/exchange/monitoring/trace-an-email-message/message-trace-modern-eac

2.The header X-MS-Exchange-Organization-AuthAs: Anonymous typically indicates that the email was received from outside the organization, meaning it was sent by an external sender. This header is used to show that the email was not authenticated as coming from within the organization. Emails from internal senders would usually have different values such as Internal or Authenticated.

---

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Best,

Jake Zhang