how to view emails that have been sent from a specific domain to anyone in our orgaziation.

Question

So, I need some help in finding who in our organization has been gotten emails from a Specific domain. Our exchange server version is 2016 and we are in a hybrid configuration.

Thanks,

Answer 1

Hope the following reference will help out
track-messages-with-delivery-reports

Answer 2

Hi @Safs-3080,

Are those users' mailboxes located in on-premises servers or servers in the cloud?

For users whose mailboxes located in on-premises servers, you could try the command below:

Get-messagetrackinglog -eventid "RECEIVE" |? {$_.sender -like "*<domain name>*"}  

For example, here is my test results in my Exchange 2016:

For users whose mailboxes located in servers in the cloud, you could try the command below:

Get-MessageTrace | where{$_.SenderAddress -like "*<domain name>*" -and $_.Status -eq "Delivered"}  

Hope these could help.

---

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.