For small businesses, email is the lifeblood of daily operations. When someone breaks into a mailbox, one of the first things they often do is quietly hide or delete messages, so the owner doesn't notice replies, security alerts or payment conversations.

If customers say they emailed you and you never saw it, there are two places to look: the rules in your own mailbox, and the delivery log for your whole Microsoft 365 organization (a message trace). Between them, they tell you whether messages are being filtered, hidden, or never arriving at all.

In this guide, we'll walk you through the steps to check your email rules and run a message trace in Microsoft 365. By the end of this article, you'll have the knowledge needed to verify your Microsoft 365 email delivery hasn’t been interrupted by hackers. Let's get started and make sure your email system is working for you, not against you.

Understanding Email Rules in Microsoft 365

What are Email Rules?

Email rules in Microsoft 365 are automated actions that help you manage your inbox more efficiently. These rules can automatically move emails to specific folders, mark them as read, or even forward them to another email address based on criteria you set. For example, you can create a rule to move all emails from a particular client to a designated folder, keeping your inbox organized and clutter-free.

How Hackers Can Misuse Email Rules

Email rules are designed to help you manage your inbox efficiently by automatically sorting and organizing your emails. However, hackers can exploit these rules to their advantage, causing you to miss important messages or even hide emails from you entirely.

Why This Matters: Hackers can gain access to your email account through phishing attacks or other means. Once they have access, they can create or modify email rules to divert your emails to different folders, mark them as read, or even delete them. This can prevent you from seeing critical emails, such as security alerts, financial notifications, or important communications from clients and colleagues.

Example: Imagine a hacker sets up a rule in your email account that automatically moves all emails from your bank to the spam folder. You might miss important notifications about suspicious activity or account changes, putting your finances at risk. Similarly, if a hacker creates a rule to delete all emails containing the word "invoice," you could miss out on receiving invoices from clients, affecting your cash flow and business operations.

How to protect yourself: Turn on two-factor authentication (MFA). Adding an extra layer of security can help prevent unauthorized access to your email account.

Regularly Review Your Email Rules: Make it a habit to check your email rules periodically to ensure they are set up correctly and have not been tampered with.

How to Check Your Email Rules

Accessing Email Rules in Outlook

To ensure your email rules are set up correctly and not causing any issues, it's important to review them regularly. Here's how you can access and check your email rules in Outlook:

For Outlook on the Web:

Open your web browser and go to outlook.office.com (Outlook.com is for personal accounts).
Sign in with your Microsoft 365 account credentials.
Select the gear icon (⚙️) in the upper-right corner to open Settings.
Navigate to Mail > Rules. Here, you'll see a list of all the email rules that are currently set up for your account.

For Outlook Desktop App:

Open the Outlook application on your computer.
Click on the "File" tab in the upper-left corner.
Select Manage Rules & Alerts.
In the "Rules and Alerts" window, you'll see a list of all the email rules that are currently set up for your account.

Using the new Outlook for Windows? Follow the Outlook on the web steps above: Settings > Mail > Rules.

Reviewing and Editing Email Rules

Once you've accessed your email rules, it's time to review them to ensure they are set up correctly and not causing any issues. Here are some tips for reviewing and editing your email rules:

Check the Criteria: Make sure the criteria for each rule are accurate and specific. For example, if you have a rule that moves emails from a specific sender to a folder, ensure the sender's email address is correct.
Review the Actions: Verify that the actions taken by each rule are appropriate. For example, if a rule is set to delete emails, consider whether this is necessary or if moving them to a folder would be safer.
Edit or Delete Rules: If you find any rules that are misconfigured or no longer needed, edit or delete them. To edit a rule, click on it and make the necessary changes. To delete a rule, select it and click the "Delete" button.

By regularly reviewing and updating your email rules, you can ensure that your inbox remains organized and that important emails are not going to the wrong location. In the next section, we'll discuss how to run a message trace in Microsoft 365 Exchange to verify emails are being delivered to your server.

Running a Message Trace in Microsoft 365 Exchange

What is a Message Trace?

A message trace is a tool in Microsoft 365 that helps you track the delivery status of emails sent to and from your organization. It can show you whether an email was delivered, delayed, or failed, and provide details about what happened to the message along the way. Think of it as a log of all the messages that came into or out of your server - if an inbound email to you is there and marked as delivered, then it should have been in your inbox too.

How to Run a Message Trace

Let's walk through the steps to run a message trace:

Access the Exchange Admin Center:

Open your web browser and go to the Microsoft 365 admin center.

Sign in with your admin account credentials.
In the left-hand menu, click on "Show all" to expand the options, then select "Exchange."

Navigate to Message Trace:

In the Exchange admin center, click on "Mail flow" in the left-hand menu.
Select "Message trace" from the options.

Run a Basic Trace:

Click on "Start a trace" to begin.

Enter the email address of the sender or recipient you want to trace.
Choose the date range for the trace (e.g., the past 7 days). You can search up to 90 days back, 10 days at a time, for instant results (Microsoft Learn).
Click "Search" to run the trace.

Review the Results:

The results will show you a list of emails that match your search criteria.
For each email, you'll see details such as the delivery status (e.g., delivered, pending, failed) and timestamps.

Message trace results in the Exchange admin center, showing delivered messages between two users

*Mail Trace Results*

The image above shows the results of my mail trace. I wanted to view all Delivered messages from myself (sender) to Sharon (recipient) between February 28, 2025, and March 2, 2025. I used midnight to midnight for both days to cover the full 24-hour period.

If the day hasn't finished yet, you can either use the current time when running the trace or adjust the time range as needed for more flexibility.

Interpreting Message Trace Results

Understanding the results can help you identify any issues with email delivery:

Delivered: Microsoft 365 handed the email to the recipient's mailbox. That includes the Junk Email folder: a message filtered as spam into Junk still shows as Delivered. Open the message's details to see where it actually went (Microsoft Learn).
Pending: The email is still being processed and has not yet been delivered.
Failed: The email could not be delivered. There may be additional details explaining why (e.g., incorrect email address, mailbox full).
Quarantined: Microsoft's filters held the message as spam, bulk mail or phishing. An admin can review and release it at security.microsoft.com/quarantine.
Filtered as spam: The message was rejected or blocked as spam rather than quarantined.

Example: If you notice that an important email was marked as "Failed," you can check the details to understand the reason and take appropriate action, such as correcting the email address or contacting your IT support for further assistance.

If a message shows as Delivered but isn't in your inbox or Junk folder, a mailbox rule is the most likely reason it moved or disappeared. Go back and check your rules.

What if You Find an Email Rule You Didn’t Add or Identify a Delivery Problem?

A rule you didn't create, especially one that deletes messages, moves them to an odd folder like RSS Feeds or Archive, or forwards them to an outside address, is a strong sign someone has been in the mailbox. Treat it as a break-in, not a glitch:

1. Change the account password and ask your admin to sign the account out of all sessions.

2. Delete the rule, and check Settings > Mail > Forwarding for forwarding you didn't set up.

3. Make sure MFA is on for the account.

4. Tell anyone you were exchanging invoices or payment details with, by phone, that your email may have been compromised.

If messages are being quarantined or failing for reasons you can't explain, that's a mail flow problem worth having your IT provider look at.

How to Find Out if Your Incoming Business Emails are Being Filtered or Hidden