Significant mail flow delays in Exchange Online with no service incident reported

Question

We are experiencing widespread and prolonged delays in email delivery across multiple mailboxes in Exchange Online. Message trace shows emails stuck in transport for extended periods before delivery, impacting business-critical communication. There are no active incidents reported in the service health dashboard.

Answer 1

Hi Khemokone

Thank you for reaching out to Microsoft Q&A forum and apologize for the inconvenience

In this context, could you try 2 options below to see if it can help you:

Option 1: Use Threat Explorer to identify the bottleneck source

Before diving into server settings, use Threat Explorer to determine if the delay is happening inside Microsoft's security perimeter or while trying to leave it.

1. Go to Microsoft Defender > Email & collaboration > Explorer. Set the view to All email.
2. Add the Delivery status and Detection technology columns to your view.
   • If the status shows "Advanced Threat Protection": The delay is being caused by Safe Attachments detonation (Dynamic Delivery). The queuing is inside Microsoft.
   • If the status shows "Deferred" or "Failed" rather than a security block: This strongly points to a connector or routing issue. The email cleared security but couldn't be handed off to the next server.
3. Click the subject of a specific delayed email and review the Email timeline tab. This visually breaks down the processing time.

Option 2: Validate your outbound connectors

If Threat Explorer shows that emails are not being held up by malware/spam scans, the most likely culprit is a failure at an outbound connector destination. This happens frequently if you route mail through a centralized signature service, an on-premises Exchange server, or a third-party secure gateway.

1. Go to the Exchange Admin Center > Mail flow > Connectors.
2. Select any active outbound connectors and click Validate.
3. If the validation fails, or if a standard Message Trace shows repeated Defer events, look for specific physical network errors such as:
   • 450 4.4.316 Connection refused
   • 451 4.4.0 DNS query failed
   • SocketError

I hope this helps. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.  

Answer 2

Use message trace to confirm where the delay occurs and whether messages are actually stuck or just slow to process.

1. Run targeted message traces
   1. In the Exchange admin center, go to mail flow > message trace.
   2. Narrow the search:
      • Set Date range to when affected messages were sent.
      • Use Add sender and Add recipient for specific users reporting delays.
   3. Select Search.
   4. On the message trace results page, check the STATUS column for affected messages.
   5. Select a delayed message and choose Details to see the event timeline and the How to fix it guidance.
2. Interpret where the delay is happening In the message trace details:
   • Use the Events list and timestamps to see how long the service takes to process each step.
   • Look for:
     • Long gaps between events (indicates service or destination latency).
     • Events showing the destination isn’t responsive.
     • Large message processing (attachments) causing delays.
     • Filtering events indicating the message might have been blocked or held.
   The Message Trace FAQ notes common causes for slow delivery:
   • Destination system not responsive (most likely).
   • Large messages taking longer to process.
   • Latency in the service.
   • Message blocked by filtering.
3. Check time window and data availability
   • Message trace data can appear 10–60 minutes after a message is sent.
   • For messages within the last 7 days, results are visible directly in the portal.
   • For messages older than 7 days, run a trace and download the .csv when it completes (via View pending or completed traces or the email notification link).
4. Use traces to validate if this is tenant‑wide
   • Run a broader trace (default past 48 hours) without sender/recipient filters to see if many messages show long processing times or similar events.
   • If delays are consistent across many mailboxes and not tied to specific recipients or large messages, this supports that the issue is service‑side or related to external destinations.
5. Next steps if delays persist with no health incident
   • Use the detailed message trace results (events, timestamps, and any “How to fix it” guidance) to identify whether the delay is:
     • Inside Exchange Online (e.g., long internal processing times), or
     • At the destination (e.g., non‑responsive external servers).
   • If traces show normal processing on the Exchange Online side but long waits at external hops, engage the affected external domains’ mail admins.
   • If traces show prolonged internal processing or unexplained latency across many messages and there is still no Service Health incident, collect example message trace details and open a support ticket via the Microsoft 365 admin center so engineering can review backend mail flow for the tenant.

---

References:

• Trace an email message in Exchange Online
• Find and fix email delivery issues as a Microsoft 365 for business admin
• Message Trace FAQ in Exchange Online