How to confirm a mail has been received in Exchange 2010

Reading Time: 3 minutes
Recently I was asked to check whether members of a distribution group were receiving mail sent to the group. In this case the group was a member of another distribution group.

First thing is to check if all nested groups are mail-enabled distribution groups. If this is not the case, Exchange will deliver to all recipients except those of this non mail enabled group. So, check all nested groups if it is mail enabled.

If you need to seek further if mail was delivered or where the problem lies, you can use the Delivery Reports tool within the Exchange Control Panel. Go to , make sure you are managing your organization and go to: Mail Control>Delivery Reports. You can do this even if your admin account does not have a mailbox (since 2010 SP1), but necessary permissions are still required (this account had the Organization Management Role)

Mail Control > Delivery Reports

Enter a mailbox to search (this could be the sender or the recipient), the user(s) it was received from or sent to and press Search. You can add subject for a more granular search. Also, even it says Users, you can add distribution lists.

Delivery Reports

Click within Search Results on the mail that you are looking confirmation on. If it is not there, then is is possibly not sent or the information regarding mailboxes is wrong.

Delivery Report

In the image above you can see which servers have been used in order to deliver the mail from sender to recipient. In this case the mail was delivered successfully.

However, sometimes you need actual confirmation that the mail is actually present in the mailbox. This is possible with the Exchange 2010 Search-Mailbox cmdlet.

The Search-Mailbox cmdlet is a very powerful tool, not only for confirming whether a mail has been received, but also removing it, copying it, performing Single Item Recovery etcetera etcetera. You do need the “Multi-Mailbox Search” RBAC role as the necessary permissions have to be explicitly handed out.

With the following syntax I will achieve a search in mailbox Monitor, for all mails sent by “Dave Stork” with subject containing “Test”  and put only the search results in the mailbox dmstork in the folder “Search”:

Search-Mailbox -identity monitor -TargetMailbox dmstork 
 -TargetFolder "Search" -SearchQuery 'Subject:"Test" 
From:"Dave Stork"' -LogLevel Full –LogOnly

For our example the SearchQuery is probably the most important parameter. The syntax uses Advanced Query Syntax. Follow the link if you have to adjust your query.

You can see that this command successfully resulted in two hits:

RunspaceId       : 72c8fed8-243a-450a-9aee-9b595c8a5a41
Identity         :
TargetMailbox    : Stork
TargetPSTFile    :
Success          : True
TargetFolder     : \Search\Monitor-2-1-2012 12:15:09
ResultItemsCount : 2
ResultItemsSize  : 4.198 KB (4,299 bytes)

And in the dmstork mailbox, there is now a folder named Search, containing a mail with a (Zipped) CSV attached to it.

Search Results mail with CSV

An excerpt of that CSV file:

Mailbox Folder Subject Read Sent Received Sender Display Name
Monitor Postvak IN test 20:21 TRUE 6-11-2011 19:21 6-11-2011 19:52 Dave Stork
Monitor Postvak IN Test FALSE 27-12-2011 17:01 27-12-2011 17:01 Dave Stork

So, now I have confirmed that mailbox Monitor has received a mail with subject Test from Dave Stork. I even can confirm that the recipient does not yet has read the mail. If the user complained he or she didn’t receive the mail, you have now confirmed that it does exist and that it hasn’t been read. You can direct them to the correct folder (this case Postvak IN) for those instances that a message rule or a coworker with permissions has moved the message.

*note: do check local legislation and (company) policies regarding privacy and access. It possible that these described actions are not allowed in your country or organization, or that they are only allowed under very strict conditions. Check before proceeding!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.