Message Tracking for SMTP relay

Question

Message Tracking for SMTP relay

Sanjay Bhakuni 20

We are using SMTP relay for sending email via our exchange server. I want to know the sending IP of the application which are sending email using relay.

Jose Benjamin Solis Nolasco 3,506

@Sanjay Bhakuni I hope you are doing well,

Use Message Tracking Logs in Exchange PowerShell:

Run the following command in Exchange Management Shell:

Get-MessageTrackingLog -Start "05/10/2025 00:00:00" -End "05/11/2025 23:59:59" -EventId "RECEIVE" -Source "SMTP" | Select Timestamp,ClientIp,Sender,Recipients | Format-Table -AutoSize

Start/End: Define the time range for your search.
EventId "RECEIVE": Filters for messages received by the server.
Source "SMTP": Focuses on messages received via SMTP.
ClientIp: Displays the IP address of the sending application or device.

Example Output:

Timestamp	ClientIp	Sender	Recipients
05/10/2025 08:15:00	192.168.1.10	******@yourdomain.com	******@external.com
05/10/2025 08:15:00	192.168.1.10	******@yourdomain.com	******@external.com
05/10/2025 09:30:00	192.168.1.11	******@yourdomain.com	******@external.com

This output helps identify which IP addresses are sending emails through your SMTP relay.

Source information https://learn.microsoft.com/en-us/exchange/mail-flow/transport-logs/message-tracking

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!

Jose Benjamin Solis Nolasco 3,506 Reputation points

2025-05-13T03:26:48.4833333+00:00

Just following up, Do you need more guidance or assistance ?
Anonymous

2025-05-14T03:15:39.3833333+00:00

Hi Sanjay Bhakuni,

Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back. If you think my reply is helpful to you, please remember to mark it as an answer. Warm thanks.
Anonymous

2025-05-16T02:22:22.38+00:00

Hi @Sanjay Bhakuni ,

Is there any update on this thread? If the issue has been resolved, please mark the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well. Thanks for your understanding.

1 answer

Your answer

Jose Benjamin Solis Nolasco 3,506 Reputation points

2025-05-12T01:10:02.4433333+00:00

@Sanjay Bhakuni I hope you are doing well,

Use Message Tracking Logs in Exchange PowerShell:

Run the following command in Exchange Management Shell:

Get-MessageTrackingLog -Start "05/10/2025 00:00:00" -End "05/11/2025 23:59:59" -EventId "RECEIVE" -Source "SMTP" | Select Timestamp,ClientIp,Sender,Recipients | Format-Table -AutoSize

Start/End: Define the time range for your search.

EventId "RECEIVE": Filters for messages received by the server.

Source "SMTP": Focuses on messages received via SMTP.

ClientIp: Displays the IP address of the sending application or device.

Example Output:

Timestamp ClientIp Sender Recipients

05/10/2025 08:15:00 192.168.1.10 ******@yourdomain.com ******@external.com

05/10/2025 08:15:00 192.168.1.10 ******@yourdomain.com ******@external.com

05/10/2025 09:30:00 192.168.1.11 ******@yourdomain.com ******@external.com

This output helps identify which IP addresses are sending emails through your SMTP relay.

Source information https://learn.microsoft.com/en-us/exchange/mail-flow/transport-logs/message-tracking

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!
Jose Benjamin Solis Nolasco 3,506 Reputation points

2025-05-13T03:26:48.4833333+00:00

Just following up, Do you need more guidance or assistance ?
Anonymous

2025-05-14T03:15:39.3833333+00:00

Hi Sanjay Bhakuni,

Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back. If you think my reply is helpful to you, please remember to mark it as an answer. Warm thanks.
Anonymous

2025-05-16T02:22:22.38+00:00

Hi @Sanjay Bhakuni ,

Is there any update on this thread? If the issue has been resolved, please mark the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well. Thanks for your understanding.

Answer 1

Hi Sanjay Bhakuni,

Thank you for posting your question in the Microsoft Q&A forum.

In general, we could use the command provided by Jose Benjamin Solis Nolasco to get message tracking log for on-prem emails and check the client IP.

However, the email may be delivered via load balance or any other device before receiving by Exchange server. We also suggest you to add and check the parameter “OriginalClientIp”, which display the ipv4 or ipv6 address of the original client.

Get-transportservice| Get-MessageTrackingLog -MessageSubject “email_subject” |sort-object timestamp | fl Timestamp,ClientIp,OriginalClientIp,Sender,Recipients,EventID,Source

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Share via

Message Tracking for SMTP relay

1 answer

Your answer