Mail Flow - Troubleshooting Mail Flow Problems

This article contains information on troubleshooting mail flow for Mimecast Email Security Cloud Integrated, including steps for Microsoft 365 and Mimecast perspectives, message tracing, and uninstalling components if necessary.

Troubleshooting

You must troubleshoot mail flow from two perspectives: your environment, i.e. Microsoft 365, and Mimecast Email Security Cloud Integrated. 
Below are details of both and what to look for to check and troubleshoot your mail flow.

Mail Flow - Azure Active Directory

You can troubleshoot mail flow from a Microsoft 365 perspective, by using the following steps:

1. Login to admin.exchange.microsoft.com

You need to have Administrator access to Mimecast Email Security Cloud Integrated, if you need to review scanning results from Mimecast.

2. Navigate to Mail Flow  | Message Trace
3. Select Start a trace.
4. Enter the details to perform a New message trace > Search.​​
5. Once the email is located, it should appear once or twice per recipient, based on Mimecast Email Security Cloud Integrated’s scanning decision.

• • Results are ordered from Oldest (Bottom) to Newest (Top)
  • If seen only ONCE, the email came into Exchange > Cloud Integrated but has yet to return. This could point to the message being HELD in Quarantine within Cloud Integrated.
  • If seen TWICE, the email went from Exchange > Cloud Integrated > Exchange. So, Mimecast scanned it and returned the email.

Message Trace Details: Inbound Examples

The following example displays what is seen for Inbound emails, and why two entries will be visible within Exchange’s Message Trace.

Result 1	Result 2
The initial email will indicate the following: Sender & Recipient The status bar shows Received > Processed > Sent, which indicates the email was Sent to another destination, in this case, to Cloud Integrated. Status details indicate the Mail Flow Rules that triggered causing the email to be routed to a Connector. In this case, the Mimecast API Key and Redirect caused the email to go to the To Mimecast Connector. Message Events (drop-down) will show all the Mail Flow Rules within Exchange that apply to the message. More Information (drop-down) will show the Message ID, Message size, From IP & To IP.	The Second email entry seen indicates the following: (Example shown here is for INBOUND email) Sender & Recipient The status bar shows Received > Processed > Delivered, which indicates the email was received into Exchange again, and this time has been Delivered to the user’s Inbox. Message Events (drop-down) will show all the Mail Flow Rules within Exchange that apply to the message. More Information (drop-down) will show the Message ID, Message size, From IP & To IP.

Mail Flow - From Mimecast Email Security Cloud Integrated

You can troubleshoot mail flow from a Mimecast Email Security Cloud Integrated perspective, by using the following steps:

1. Log in to Mimecast Email Security Cloud Integrated.
2. Navigate to Detections.
   
   

3. Uncheck Filter options while selecting the appropriate Date Range to ensure you see all emails Email Security (CI) has seen.

• • By default, the Filters will always show Malware, Phishing, Spam, and Untrustworthy, which cannot be changed. This is because the typical user would only be accessing Mimecast Email Security Cloud Integrated to locate messages held in quarantine or was seen as a potential threat.

4. Enter Search Criteria > Search!

• • The search functionality utilizes an “elastic” search, which will search every aspect of the email seen in the most visible columns.

4. Once located, select the email to open and review the necessary details.

Your findings from these checks will help to ascertain where any mail flow issue may exist; this information is also helpful to our Support teams should you need to proceed in Raising a Support Case with us.

Uninstalling

Uninstalling should be done only as a last resort; if you intend to remain with Mimecast, any re-installation will need to be done with assistance from our global Support teams.

Should you need to uninstall Mimecast Email Security Cloud Integrated, please follow the following steps:

1. Navigate to Exchange Admin Center | Mail Flow | Rules and delete all Mimecast-created rules. 
2. Navigate to Exchange Admin Center | Mail Flow | Connectors and delete the From Mimecast and To Mimecast connectors.
   
   
3. Navigate to Azure Active Directory Admin Center | Enterprise Applications and delete all Email Security, Cloud Integrated related Enterprise Applications.  

Other Uninstall Components that need to be removed are: 

• Reporting Mailbox as a User, and from User-Reported Settings.
• Accepted Domain.
• Trusted ARC Sealer. 

See Also...

• Connecting to Microsoft 365