How to confirm a mail has been received in Exchange 2010

First thing is to check if all nested groups are mail-enabled distribution groups. If this is not the case, Exchange will deliver to all recipients except those of this non mail enabled group. So, check all nested groups if it is mail enabled.

If you need to seek further if mail was delivered or where the problem lies, you can use the Delivery Reports tool within the Exchange Control Panel. Go to https://yourserver.com/ecp , make sure you are managing your organization and go to: Mail Control>Delivery Reports. You can do this even if your admin account does not have a mailbox (since 2010 SP1), but necessary permissions are still required (this account had the Organization Management Role)

Enter a mailbox to search (this could be the sender or the recipient), the user(s) it was received from or sent to and press Search. You can add subject for a more granular search. Also, even it says Users, you can add distribution lists.

Click within Search Results on the mail that you are looking confirmation on. If it is not there, then is is possibly not sent or the information regarding mailboxes is wrong.

In the image above you can see which servers have been used in order to deliver the mail from sender to recipient. In this case the mail was delivered successfully.

However, sometimes you need actual confirmation that the mail is actually present in the mailbox. This is possible with the Exchange 2010 Search-Mailbox cmdlet.

The Search-Mailbox cmdlet is a very powerful tool, not only for confirming whether a mail has been received, but also removing it, copying it, performing Single Item Recovery etcetera etcetera. You do need the “Multi-Mailbox Search” RBAC role as the necessary permissions have to be explicitly handed out.

With the following syntax I will achieve a search in mailbox Monitor, for all mails sent by “Dave Stork” with subject containing “Test”  and put only the search results in the mailbox dmstork in the folder “Search”:

Search-Mailbox -identity monitor -TargetMailbox dmstork 
 -TargetFolder "Search" -SearchQuery 'Subject:"Test" 
From:"Dave Stork"' -LogLevel Full –LogOnly

For our example the SearchQuery is probably the most important parameter. The syntax uses Advanced Query Syntax. Follow the link if you have to adjust your query.

You can see that this command successfully resulted in two hits:

RunspaceId       : 72c8fed8-243a-450a-9aee-9b595c8a5a41

Identity         : int.test.nl/Monitor

TargetMailbox    : int.test.nl/Dave Stork

TargetPSTFile    :

Success          : True

TargetFolder     : \Search\Monitor-2-1-2012 12:15:09

ResultItemsCount : 2

ResultItemsSize  : 4.198 KB (4,299 bytes)

And in the dmstork mailbox, there is now a folder named Search, containing a mail with a (Zipped) CSV attached to it.

An excerpt of that CSV file:

So, now I have confirmed that mailbox Monitor has received a mail with subject Test from Dave Stork. I even can confirm that the recipient does not yet has read the mail. If the user complained he or she didn’t receive the mail, you have now confirmed that it does exist and that it hasn’t been read. You can direct them to the correct folder (this case Postvak IN) for those instances that a message rule or a coworker with permissions has moved the message.

*note: do check local legislation and (company) policies regarding privacy and access. It possible that these described actions are not allowed in your country or organization, or that they are only allowed under very strict conditions. Check before proceeding!