Email Receipt and Delivery Views

Document created by user.oxriBaJeN4 Employee on Sep 10, 2015Last modified by user.oxriBaJeN4 Employee on Mar 27, 2017
Version 5Show Document
  • View in full screen mode

For every inbound, outbound, or internal message processed by Mimecast, one of two views is available that can be used for troubleshooting purposes. For example, an administrator can use the views when troubleshooting email delivery, or investigating a possible spam message. This information is available for all messages, including those in the Accepted Email view or the archive. Both views provide the details of the sender, recipient, mail servers, dates, times, and email components. They also show an “event” that displays how and why Mimecast accepted the message, or delivered it to the mail server. The two views are:

 

ViewDisplaysEvent Uses
Receipt ViewDisplays information related to when Mimecast accepted / received the message.Useful to determine why Mimecast accepted  a potential spam message.
Delivery ViewDisplays information related to when Mimecast delivered the message. This view also displays all the policies that matched traffic flow when the message was processed.Useful to confirm a message has been delivered to the next hop mail server. The list of policies can be helpful when troubleshooting why a message was handled in a certain way, or when testing new policies.

Message retention information can also be accessed from this area.

 

Displaying Email Receipt / Delivery information

 

Non-Archived Email

 

To display an non-archived email receipt / delivery information:

  1. Log in to the Administration Console.
  2. Click on the Administration toolbar button. A menu drop down is displayed.
  3. Click on the Gateway | Accepted Email menu item.
  4. If required, enter your search criteria. in the Search field by entering a:
    • Search string
    • Date / Time range
    • Whether the search string is to be found in the "Subject", "From Address", "To Address", or "Subject, From Address, or To Address".

      Accepted Email Search
  5. Either:
    • Click the ico_search.png icon
    • Press the Enter key.
  6. Click on a message in the list of results to open it.

 

Archived Email

 

To display an archived email's receipt / delivery information:

  1. Log in to the Administration Console.
  2. Click on the Administration toolbar button. A menu drop down is displayed.
  3. Click on the Archive | Archive Search menu item.
  4. Enter the search criteria. See the Searching the Archive page for further details.
  5. Click the Search button.
  6. Click on a message in the list of results to open it.

 

Accessing Email Receipt / Delivery Views

 

Non-Archived Email

 

When a message is opened, the default view displayed is the Delivery View. By default this displays the message's header and message body detail. The title bar at the top of the message view indicates whether you are looking at the receipt or delivery view.

 

header.png

Click the View | View Transmission Data menu item to display the message's transmission detail. This is split into the following sections:

  • Envelope Details
  • Remote Server Details (Delivery)
  • Transmission Information
  • Transmission Components

 

To display the Receipt Information:

  1. Click on the Show Receipt button in the top toolbar.

 

Archived Email

 

When the email is opened, the default view displayed is the Receipt View.

 

header.png

The Receipt View has two sections:

  • Message Information: This provides summary information about the message. This is displayed regardless of the selected view (see below).
  • Message Body: This section is displayed by default when a message is first opened. It can also be displayed by clicking the View | View Transmission Body menu item. This section displays the message's receipt transmission details. However this section can also be used to display:
    • Receipt Information: This displays details of the message's receipt. It is displayed by clicking the View | View Receipt Information menu item. See the Receipt Information section below for further detail.
      If a message contains more than one recipient, it is only listed once in the archive search results. All recipients of the email are listed in this view.
    • Message Retention: This displays detail of how how the message will be retained in the archive. It can also be displayed by clicking the View | View Message Retention menu item.

 

Receipt Information

 

Receipt information displays the details of when Mimecast accepted or received the message, and applies to both inbound and outbound email. The information includes a receipt event that specifies how or why the message was received. Understanding why a message was accepted can assist when investigating why potential spam email have been delivered to internal users.

 

The table below lists the components of the receipt information:

 

DetailsDescription
Receipt EventHow the message was received by Mimecast. For instance, via authorized IP, Permitted Sender list, Open Greylist, Auto Allow List etc.
Message Expires OnThe date that the message will be purged from Mimecast (based on your configured content retention periods).
Message Expires InThe amount of days remaining before the message is purged (based on your configured content retention periods).
Processing ServerThe Mimecast service that processed the message.
Transmission SizeThe cumulative binary size in bytes of each component of the email transmission including encoding.
Binary Email SizeThe cumulative binary size in bytes of each component of the email transmission.
Remote IPThe IP address of the sending server that connected to Mimecast.
Remote HostThe hostname of the sending server that connected to Mimecast.
Remote GreetingUsually the SMTP domain name (or IP address) of the sending server.
Receipt AcknowledgementThe acknowledgement issued by Mimecast to indicate that the message was accepted.
Transmission StartedThe date and exact time that the transmission of the message started.
Transmission EndedThe date and exact time that the transmission of the message ended.
Transmission DurationThe total email transmission time in milliseconds.
Encryption InformationDetails whether the message was sent using TLS encryption or not.

 

Receipt Events

 

A list of the common receipt events is described below:

 

Receipt EventDescription
Email Received via Permitted IP AddressThe sending IP address of the message is listed in a Permit Policy (this applies to inbound mail).
Email Received via Permitted SenderA Permitted Senders Policy has been configured to always bypass spam checks for the sender’s address or domain, based on the Return Address (Email Envelope From).
Email Received via header based Permitted SenderA Permitted Senders Policy has been configured to always bypass spam checks for the sender’s address or domain, based on the Message From Address (Message Header From).
Email Received via Manual Permitted SenderA user has added the sender’s address or domain to their manual Permitted Sender list; either using the Digest or select Mimecast user services.
Email Received via Authorized IP addressThe sending IP address is configured as an Authorized Outbound IP address within your Mimecast account (applies to outbound mail).
Email Received via Authorized SMTPThe message was sent through Mimecast using SMTP Authentication. This usually applies to POP3/SMTP domains or customers that have configured SMTP authentication from the SMTP connectors on their mail server.
Email Received via Auto Allow listThe senders email address is trusted by your Mimecast local reputation system. This means that someone has sent a message to this address previously (applies to inbound mail).
Email Received via header based Auto Allow listAn Auto Allow Policy has been configured to apply to the Message From Address (Message Header From).
Email Received via Open GreylistThe message has passed local Greylisting checks (applies to inbound mail only).
Email Received via Open Greylist - SuspiciousThe message has passed local greylisting checks, but one of the relay servers involved in the transmission of the message is not trusted by the Mimecast Global Reputation system (applies to inbound mail only).
Email Received - Parameter Checks Not SetThe message has passed through Mimecast, and greylisting checks have been disabled by an Administrator.
Email Received via Journal ConnectorThe message has been received/retrieved from the journal mailbox.
Email Received via RWL Greylist bypassThe message was not subjected to greylisting because the server sending the message, is listed in Mimecast’s Global bypass list.

 

Queue Detail Status

 

An additional entry is available in the Receipt Information for Accepted Emails only, and specifically for messages that have not been successfully delivered yet. This is the Queue Detail Status and provides information about why a message has not been delivered to the intended recipient. For example, a message that was bounced by the next hop, is in the Delivery Queue, or is in the Hold Queue based on matching a spam scanning policy. Messages with the receipt event, Email Received via Open Greylist, may still be held by Mimecast Spam Scanning Policies. These could be messages accessible in Accepted Email, as they have not yet reached their final state (e.g. they have not been successfully delivered yet). Messages are only archived once they are released, deleted, or rejected from the Hold Queue.

 

Accepted_Messages_Queue_Detail_Status.png

 

Envelope From Address

 

Newsletter and marketing companies will often mask the true sending address of a message. This means that the message may appear to come from newsletter@domain.com when viewing the message in your email client, when the real address is something like cust1234-abc@mail.domain.com. This "masked" sending address is referred to as the Header FROM address, while the true sending address is referred to as the Envelope FROM address. Mimecast policies are by default based on the Envelope FROM address.

 

To display a message's Envelope FROM address:

  1. Find the message in question by performing an Archive Search. See the Archive Search section above for further details.
  2. Click on the message. The Receipt View is displayed with the Envelope FROM address listed after the Viewing RECEIPT from text.

When creating policies based on external addresses (inbound email) always use the envelope FROM address or domain.

Delivery Information

 

Delivery Information displays details of when Mimecast delivered the message. The view applies to both inbound and outbound messages. Delivery events detail how the message was delivered by Mimecast. Understanding these events can help Administrators troubleshoot message delivery. For each message that Mimecast delivers, it will provide a delivery event. Similar information is available when accessing the Delivery View.

 

Archive_search_delivery_information.png

Each component is detailed in the table below:

 

DetailsDescription
Envelope Information
From Envelope AddressThe envelope FROM address (the sender).
To Envelope AddressThe envelope TO address (the recipient).
Message RouteHow the message was received (internal, outbound, internal).
Message Information
Delivery Event *How the message was delivered (via MX lookup, routing policy, etc.).
Message Expires OnThe date that the message will be purged from Mimecast (based on your configured content retention periods).
Message Expires InThe amount of days remaining before the message is purged  (based on your configured content retention periods).
Processing ServerThe Mimecast service that processed the message.
Transmission SizeThe cumulative binary size in bytes of each component of the message's transmission, including encoding.
Remote IPThe IP address of the remote server where the message was delivered to.
Remote HostThe hostname of the remote server that the message was delivered to.
Remote GreetingThe SMTP greeting banner that the remote server presented.
Receipt Acknowledgement

The acknowledgement that the remote server issued to indicate that message delivery was accepted. This information is important when proving delivery of a message. 

Transmission StartedThe date and exact time that the transmission of the message started.
Transmission EndedThe date and exact time that the transmission of the message ended.
Transmission DurationThe total message transmission time in milliseconds.
Encryption InformationDetails whether the message was sent using TLS encryption or not.

 

Delivery Events

 

The common delivery events are listed below:

 

Delivery EventDescription
Email Delivered via Routing RuleThe message has been delivered using a forced Routing policy in the Mimecast account.
Email Delivered via MX ResolutionThe message has been delivered using the MX record of the recipient’s domain (generally outbound email).
Email Delivered to MailboxApplies to POP3 domains only. The message was delivered to the users mailbox located on the Mimecast server.
Email Delivered to Forwarding Address via Routing RuleThe message was forwarded to another email address, and delivered using a forced routing policy in the Mimecast account.
Email Delivered to Forwarding Address via MX ResolutionThe message was forwarded to another email address, and  delivered using the MX record of the recipients domain.
Email Received via Journal ConnectorThe message has been received / retrieved from the journal mailbox.
Email Delivery Aborted - Soft BounceMimecast has attempted to deliver the message according to the retry schedule, but delivery has not been successful, and the message has timed out.
Email Delivery Aborted - Hard BounceThe remote mail server has rejected the message with a SMTP 500 error code.
Delivered to CCM Isolation AreaA Closed Circuit Messaging policy has been applied to an outbound message, and the message has been successfully delivered using CCM.
LFS Delivery AcceptedLarge File Send was used to transmit a notification with the original email body, and a separate set of notifications to access the attachments.

 

Matching Policies

 

A list of all the policies that match traffic flow when the message was processed, but which did not necessarily effect it, is also available for each message. These may be Attachment Management Policies, Content Examination Bypass Policies, Smart Tag Assignment Policies, or Stationery Layout. Policies are applied to inbound and outbound email. There are many more possible variations depending on your configured settings:

 

Archive_policies_applied.png

 

For Accepted Emails, this is available as a View | View Email Policies menu option when viewing the email metadata.

This information can be very useful when troubleshooting what happened to a message, or why it has been handled in a certain way. For example, if you have multiple signatures in your environment, and wanted to see why a message has a certain signature appended. In this scenario an administrator is able to review which policies were applied, and troubleshoot the Stationery Assignment policies as required.

 

Sender Privacy Policy

 

End users are able to change message sensitivity levels to messages in Microsoft Outlook. If the sensitivity of a message is changed from the Normal status, and the message is submitted to Mimecast, the Sender Privacy Policy applies.

This Policy does not display in the Administration | Gateway menu, and is enabled by default for all emails.

If this policy has been applied to a message, there are two end effects:

  • The message is not displayed in delegate mailboxes. This policy does not apply retrospectively, but will only take effect when the message is sent through Mimecast (or uploaded through Journaling and Ingestion.
  • The message is not replicated to Mimecast through Folder Synchronization.

 

The message is still accessible to the user in their mailbox Archive Search, and to administrators through the Administration Console Archive Search or eDiscovery Cases.

 

Transmission Components

 

The transmission components section shows all of the message components, including attachments, embedded images, text, and HTML components. The summary also includes the transmission size of each component.

These details apply to the received and delivered version of the message. If any policies have been configured to link / block attachments, this will be reflected in the delivery summary. To view transmission components for email receipt (prior to any policies being applied), you will need to view the Receipt information. 

Archive_component_information.png

2 people found this helpful

Attachments

    Outcomes