How To Troubleshooting Inbound Email Not Received

4 hours ago
sorb
4 minutes

Problem Statement

A sender reports that an inbound email was sent successfully, but the intended recipient did not receive the message.

This article describes the basic troubleshooting steps to determine where the email delivery process failed, whether at the DNS level, network connectivity, Sorb Security Email Security, or the destination mail server.

Solution

Follow the steps below in order.

Step 1 – Verify the Domain MX Record

The sender delivers email based on the recipient domain’s MX record. An incorrect MX record will cause email to be delivered to the wrong destination.

Procedure

Verify the recipient domain’s MX record using one of the following commands:

dig mx example.com

or

nslookup -type=mx example.com

For Sorb Security Cloud, the MX record should point to one of the following gateways:

  • mx1-sces.sorbsecurity.com
  • mx2-sces.sorbsecurity.com

Expected Result

  • The MX record exists.
  • The MX record points to the correct inbound gateway.
  • No obsolete or incorrect MX records are present.

If the Verification Fails

Correct the MX record configuration and allow DNS propagation before testing again.

Step 2 – Verify SMTP Connectivity

If the MX record is correct, verify that the mail gateway is reachable over SMTP.

Procedure

Test the connection using one of the following commands:

telnet mx1-sces.sorbsecurity.com 25

or

openssl s_client -connect mx1-sces.sorbsecurity.com:25 -starttls smtp

or

nc -vz mx1-sces.sorbsecurity.com 25

Expected Result

The server should return an SMTP banner similar to:

220 mx1-sces.sorbsecurity.com ESMTP

If the Verification Fails

Investigate:

  • Firewall blocking port 25
  • Network routing issues
  • DNS resolution problems
  • Gateway availability

Step 3 – Search for the Email in Message Trace

If connectivity is successful, verify whether the email reached Sorb Security.

Procedure

Navigate to:

Message Trace → Mail Query

Search using any available information:

  • Sender email address
  • Recipient email address
  • Subject
  • Message ID
  • Date and time

Expected Result

The email should be located in the message trace.

If the Email Is Not Found

The email never reached the Sorb Security gateway.

Possible causes include:

  • Incorrect MX record on the sender side
  • Sender mail server failed to deliver
  • Network issue before reaching Sorb Security

Request the sender’s SMTP logs or delivery logs for further investigation.

Step 4 – Review the Email Lifecycle

If the email is found in Message Trace, review its processing lifecycle to identify where delivery stopped.

Procedure

Open the message details and examine each processing stage.

Typical lifecycle:

  • SMTP Connection
  • Accepted
  • Security Scanning
  • Policy Evaluation
  • Routing
  • Delivery

Expected Result

The lifecycle should indicate the final processing status.

Possible Results

Blocked

The message was stopped by a security or policy rule.

Review the reason displayed in the lifecycle.

Examples include:

  • Malware detected
  • Spam detected
  • Attachment policy
  • Content policy
  • Recipient policy
  • Administrator-defined rules

Deferred (4xx)

The destination mail server temporarily rejected the email.

Common reasons include:

  • Mail server busy
  • Greylisting
  • Temporary DNS issue
  • Temporary mailbox problem

The system will automatically retry delivery.

Failed (5xx)

The destination mail server permanently rejected the email.

Review the SMTP response code to determine the cause.

Examples include:

  • User unknown
  • Mailbox unavailable
  • Domain not found
  • Policy rejection

Delivered (2xx)

The destination mail server accepted the email successfully.

Proceed to the next step.

Step 5 – Verify the Destination Mail Server

If the lifecycle shows a successful 2xx SMTP response, the email has already been accepted by the destination mail server.

Procedure

Verify the email on the destination mail server.

Check the following:

  • Mail queue
  • User mailbox
  • Junk or Spam folder
  • Inbox rules
  • Transport rules
  • Mail filtering policies
  • Antivirus quarantine
  • Message tracking logs
  • Mail server logs

Expected Result

The email should be located or accounted for within the destination mail system.

If the Email Cannot Be Found

The issue is now downstream of the Sorb Security gateway. Continue troubleshooting on the destination mail server to determine why the accepted message was not delivered to the user’s mailbox.

Information to Collect Before Escalation

If the issue cannot be resolved, collect the following information before escalating:

  • Sender email address
  • Recipient email address
  • Subject
  • Message ID
  • Date and time the email was sent
  • Screenshot of the Message Trace
  • Email lifecycle details
  • SMTP response code
  • Sender SMTP logs (if available)
  • Destination mail server logs (if applicable)

Summary

StepActionExpected Outcome
1Verify MX RecordDomain points to the correct inbound gateway
2Verify SMTP ConnectivityGateway is reachable over SMTP
3Search Message TraceConfirm whether the email reached Sorb Security
4Review Email LifecycleIdentify where processing stopped
5Verify Destination Mail ServerConfirm delivery after a successful 2xx response

Note: A successful 2xx SMTP response indicates that Sorb Security has completed delivery to the destination mail server. Any investigation beyond this point should focus on the destination mail server, mailbox, or downstream mail processing.