Hi,
I ran the following command:
Get-MessageTrackingLog -ResultSize Unlimited -Start "1/27/2022 12:00AM" -End "1/27/2022 11:59PM" -Sender "<sender>" | Sort-Object MessageId | Format-Table EventId, Source, Sender, Recipients –AutoSize | out-string -Width 1000
When someone inside the domain sends an email to the user, the custom rule generates the OFF response and the message tracking below. In this case the <sender> is the user for which the custom rule was set and the <recipient-internal> is the person who sent the email to the user:
EventId Source Sender Recipients
------- ------ ------ ----------
RECEIVE MAILBOXRULE <sender> <recipient-internal>
DELIVER STOREDRIVER <sender> <recipient-internal>
HAREDIRECTFAIL SMTP <sender> <recipient-internal>
AGENTINFO AGENT <sender> <recipient-internal>
RECEIVE SMTP <sender> <recipient-internal>
SEND SMTP <sender> <recipient-internal>
When someone outside the domain sends an email to the user, the OFF response generates the message tracking below:
EventId Source Sender Recipients
------- ------ ------ ----------
AGENTINFO AGENT <sender> <recipient-external>
RECEIVE MAILBOXRULE <sender> <recipient-external>
SEND SMTP <sender> <recipient-external>
TRANSFER ROUTING <sender> <recipient-external>
HAREDIRECTFAIL SMTP <sender> <recipient-external>
RECEIVE SMTP <sender> <recipient-external>
Regards,