How to Trace Emails Sent to External Domains in Exchange Online

Email remains at the heart of business communication, and a good chunk of your email traffic is probably heading out of your tenant. Whether it’s reaching out to clients, collaborating with partners, or sending updates to vendors, external communication is nonstop.

But here’s the catch: Are those outbound emails actually reaching the right people? Are they being delivered? And more importantly, are they compliant with your policies?

Without the right visibility, these things can easily slip under the radar. That’s where tracing outbound emails becomes super useful.

In this blog, we’ll walk you through how to track emails sent to external domains in Microsoft 365. Whether you’re trying to confirm email delivery to an external contact or monitor messages leaving your organization, you’ll find everything you need right here. Let’s get started.

Message trace in Exchange Online helps you track the flow of emails through your organization. It’s useful for checking whether messages were delivered, delayed, or failed, especially when auditing mail flow issues for email security or ensuring compliance with policies.

You can use the following methods to perform message trace and monitor emails sent to external domains.

1. Audit External Outbound Emails Using EAC
2. Track emails sent to external domains Using PowerShell (Recommended)

Here is the step-by-step guide to trace emails sent to external recipients using Message Trace in Exchange Online .

• Log in to the Exchange admin center.
• Navigate to Message Trace under Mail Flow
• Click the plus icon near Start a trace
• To trace outbound emails, enter the target external domain in the Recipient section.
• Set the time range for your email audit in the Start date and End date fields. You can access up to 90 days of summary data instantly, with a 10-day limit per query.
• Set the direction as Outbound.
• Configure additional filters like Subject, Delivery Status, Sender, or Recipient as needed.
• Select the desired report type based on your needs.
  • If your selected time range is 10 days or less, choose Summary report and click Search.
  • For a time range longer than 10 days, select Enhanced summary report or Extended report.
    • Click Next, then click Prepare report.
    • Once ready, your reports will appear in the Downloadable reports section in the message trace Home page.

While these reports allow filtering for a specific external domain, there’s no built-in option to view all emails sent to external domains in a single query. EAC doesn’t support automated reporting, making comprehensive email tracking more challenging.

Connect to the Exchange Online PowerShell and run the following command to audit emails sent to external domains.

This cmdlet retrieves all outbound emails sent to the external domains between June 15 and June 23, 2025.

While the above methods are effective, real-time message trace queries are limited to retrieving only 10 days of data per request. If you need to analyze a broader date range, you must run the same command several times with different time intervals.

To simplify and automate this task, we’ve created a PowerShell script that handles the entire process for you. With just a few clicks, you can quickly and efficiently retrieve emails received from all external domains. This approach not only saves valuable time but also ensures accurate and consistent results, regardless of the size of your Microsoft 365 environment.

Download script: MailsSentToExternalDomains.ps1

• Exports emails sent to external domains into a CSV file.
• Supports up to 90 days of email data.
• Lists emails sent to specific external domains or users.
• Audits all external emails sent by a specific user.
• Filters results by mail status.
• Installs the Exchange Online PowerShell module (if not installed already) with your permission.
• Works with MFA and Certificate-based Authentication.
• Can be scheduled for automated reports.

The script exports all emails sent to external domains along with attributes like Message Trace Id, Sent Time, Sender Address, Recipient Address, Subject, Status, Sender Domain, Recipient Domain, Sender IP, Recipient IP, and Mail Size.

You can use any of the methods below to run the PowerShell script.

Method 1: Execute the script with an MFA or non-MFA account.

This script exports a report of all emails sent to external domains in the last 90 days.

Method 2: Run the script by providing the credentials explicitly

The above method supports only non-MFA accounts. If the admin account has MFA, you need to disable MFA using CA policy.

Method 3: Execute the script using certificate-based authentication.

To use certificate-based authentication, you need to register the application in Entra ID, which enables you to connect Exchange Online using certificate. Based on your requirements, you can either create a self-signed certificate or use a CA certificate.

This approach is scheduler friendly. You can set up the script to run at regular intervals and automatically export all outbound external emails using any of the following methods.

• Task Scheduler
• Azure Automation

With real-time filtering capabilities, this script simplifies outbound email reporting in Exchange Online simple and effective. Here’s how it helps you monitor emails sent to external domains:

1. Trace outbound emails to external domains for any date range
2. Audit emails sent to a specific external domain
3. Find emails sent by a specific user
4. Track emails sent to a specific external recipient
5. Filter outbound external emails by delivery status

By default, the PowerShell script exports all emails sent to external domains over the last 90 days. You can narrow the results with the -StartDate and -EndDate parameters for a custom period within that window.

If there’s a suspected data leak or compliance audit, you can use the -StartDate and -EndDate parameters to trace emails sent to external domains during the specific period under review. This helps narrow down results quickly and focus only on the relevant timeframe.

This format retrieves all outbound emails sent to external domains from your Microsoft 365 tenant between May 2 and June 23, 2025.

Let’s say your organization flags domains like personal email providers or competitors as high risk. You can use the -ExternalDomainName parameter to track all emails sent to those domains, helping you identify potential insider threats or policy violations.

This exports all emails sent from your organization to contoso.com in the last 90 days.

If an employee is under investigation for unusual email activity or potential data sharing, you can use the -SenderAddress parameter to trace all emails they’ve sent to external domains. This helps you quickly review their outbound communication history.

This lists all external emails sent by John@contoso.com.

Sometimes, during a security review, you may need to check if any emails were sent to a suspicious or unapproved external address. Using the -RecipientAddress parameter, you can trace all outbound emails sent to that specific recipient and review the communication for potential data exposure.

This fetches all emails sent to Adele@fabrikam.com in the past 90 days.

Not all outbound emails reach their destination. While many are delivered successfully, others may get blocked, quarantined, or fail due to security policies or filtering. Use the -MailStatus parameter to filter sent emails by delivery outcome, such as Delivered, Failed, Quarantined, or FilteredAsSpam.

This command reports only failed outbound messages, helping you troubleshoot delivery issues.

This command shows emails that were quarantined due to security policies like malware or phishing detection.

Returns emails that were marked as spam and filtered before reaching the recipient’s inbox.

Returns emails that were successfully delivered to external recipients.

You can also combine filters such as sender, recipient, domain, and date range to generate detailed, customized reports on outbound mail flow status to external domains. This approach ensures you always have full visibility and control over your organization’s external email activity.

Tracing emails sent to external domains in Exchange Online is crucial for investigating delivery issues and reviewing outbound communication.

With AdminDroid’s Microsoft 365 email management tool, you get categorized reports, intuitive filters, and real time alerts for emails sent to specific domains. These features help you monitor and manage outbound email traffic with greater clarity and control.

Once installed, AdminDroid starts tracking email data and retains it over time, giving you access to historical records well beyond the default 90-day limit. No more manual digging or complex PowerShell scripts! Just long-term visibility with ease, enhancing email monitoring and security.

With a single click, you can view, analyze, and download comprehensive reports on outbound emails. It’s not just limited to emails sent to external domains, AdminDroid lets you track a wide range of email activities, such as:

• Emails received from external domains
• Internal mail traffic
• Mail Send Activity Reports
• Undelivered and failed messages
• Hourly and daily email volume trends
• User-wise and domain-wise traffic breakdowns

And the best part? AdminDroid isn’t limited to Exchange Online reporting. It’s a complete Microsoft 365 analytics platform that also covers Microsoft Entra ID, SharePoint Online, Teams, OneDrive, and more.

From email auditing and security insights to smart scheduling and advanced filtering, AdminDroid offers more than 3500+ pre-built reports and 100+ dynamic dashboards designed to make your admin tasks simpler and smarter.

✅ Ready to go beyond and gain deeper insights into your Microsoft 365 environment? Download and try AdminDroid today!

We hope this blog helps you take control of outbound email tracking in Microsoft 365, making it easier to monitor external communication and troubleshoot issues efficiently. If you have any questions or feedback, feel free to drop them in the comments. We’re here to help!