Proof of delivery

Seb
Seb used Ask the Experts™
on
Hello all,

Someone says they sent us an e-mail months ago to one of our "main Mailboxes" that we did not see or find in our exchange server. We have e-mails from that "mailbox" that go back a couple of years  in ".PST" files that were moved from the server to save on space. We did not find that e-mail in the PST files either. They provided a "log" from their"email content gateway" (Mail Marshal) that supposedly confirms that it was delivered to our server. Our server was a Windows 2003 server with exchange 2003 that we just migrated (about a month ago) to a Windows 2008 R2 server with exchange 2010.

My questions are :
How can I officially confirm (and have proof) that the e-mail did not reach our servers? Does exchange 2003 have a feature I can use to see if it did reach the server and would I be able to use it now in the new server since it was migrated?
How reliable is this "Log" they provided and is it real proof?
What software (or service in exchange 2010) can I use to keep these type of records in the future to give actual proof that e-mails Did/didn't get delivered?
We have not decommissioned the old 2003 server yet so I would be able to get to it if needed.

Thank you in advance for your help! It's much appreciated!
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Most Valuable Expert 2014
Commented:
Message Tracking will tell you if the email was processed by Exchange. However it is not enabled by default on Exchange 2003, and in most cases only keeps the log for a certain number of days. Message Tracking is enabled by default on Exchange 2010, but again only keeps the logs for a certain number of days.

Without seeing the log, it is hard to say what it proves or not. Furthermore, logs can be easily faked, they are in a standard format and it only takes a bit of copy and paste to change the dates and you have "proof".

Proving a negative with email is pretty difficult, because unless the email passes through your server nothing is logged. How can you prove nothing is there (and you haven't deleted the "proof").

Simon.
Dave BaldwinFixer of Problems
Most Valuable Expert 2014

Commented:
I thought we already settled this the last time you asked this same question.
Exec Consultant
Distinguished Expert 2018
Commented:
Proof of sending is not proof of receipt.

There is no 100% sure method or proof that the email was actually sent:
- the route to the intended recipient was down,
- an incorrect email address was used by accident and returns back bounced
- a mailserver break out off the internet, dns conflict/errors/down,
- the internet pipe to the destination country is down
- your email address is marked as junk/spam

the list goes on....but you can search your mail server assuming the msg tracking is on
http://exchangeserverpro.com/exchange-2010-message-tracking-log-search-powershell
http://exchangeserverpro.com/searching-message-tracking-logs-by-sender-or-recipient-email-address

there is also queue (in exchange) which is a temporary location where messages that are waiting for processing are stored. In Exchange 2003 and earlier the queues were stored on the local disk in the c:\mailroot\queue directory, or a queue directory in the Exchange Server directory. Exchange Server 2007 and Exchange Server 2010 store their queues in an ESE database. This database is located in the “C:\Program Files\Microsoft\Exchange Server\TransportRoles\data\Queue” directory.

http://www.msexchange.org/articles_tutorials/exchange-server-2010/planning-architecture/smtp-routing-exchange-2010-part1.html

but really do not see reliability with claims unless third party comes in ..sort of like why we need a CA for PKI infra
SebSystems Admin

Author

Commented:
Thanks all for the info. Greatly appreciated.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial