MS-203 - Microsoft 365 Messaging Troubleshooting Message Transport Questions and Answers — Questions and Answers
Question 1: A user reports to the messaging administrator that an important email sent to an external partner was never received. The partner's IT team insists the message never reached their mail servers. Which tool should the administrator use FIRST to determine the final delivery status of the message from the Microsoft 365 perspective?
- Mail flow dashboard in the Exchange admin center
- Message trace in the Exchange admin center (Correct answer)
- Microsoft Defender 365 audit log
- Service Health dashboard in the Microsoft 365 admin center
Correct answer: Message trace in the Exchange admin center
Message trace is the primary tool for following email messages as they travel through a Microsoft 365 organization. It allows an administrator to see if a message was received, rejected, deferred, or delivered by the service, and to view the detailed events that occurred for that message. This is the most direct and effective first step for troubleshooting a specific missing email.
Question 2: A user receives a Non-Delivery Report (NDR) with the enhanced status code '5.7.1'. Which of the following is the most common reason for this type of NDR?
- The recipient's mailbox is full.
- The recipient's email address does not exist.
- The message was rejected due to a permissions issue or a mail flow rule. (Correct answer)
- A temporary network issue occurred on the receiving server.
Correct answer: The message was rejected due to a permissions issue or a mail flow rule.
The status code '5.7.1' typically indicates that delivery is not authorized. This can happen for several reasons, such as the sender not having permission to send to a specific recipient or distribution group, or a mail flow (transport) rule is configured to block the message.
Question 3: Your organization has configured an outbound connector to route all outgoing mail through a third-party cloud archiving service. Shortly after, you receive reports that external recipients are not receiving your emails, and bounce messages indicate an SPF failure. What is the most likely cause of this issue?
- The organization's MX record is pointing to the wrong service.
- The outbound connector in Exchange Online is disabled.
- The organization's public SPF record in DNS has not been updated to include the third-party service. (Correct answer)
- The third-party service does not support TLS encryption.
Correct answer: The organization's public SPF record in DNS has not been updated to include the third-party service.
When you route outbound mail through a third-party service (a smart host), the final server that sends the message to the internet is no longer Microsoft 365, but the third-party service. The recipient's mail server will check the sender's SPF record to see if the IP address of that third-party service is authorized to send email for your domain. If the SPF record is not updated to include the third-party service's sending servers, the check will fail.
Question 4: A mail flow rule with priority 0 is configured to bypass spam filtering for messages from a specific partner domain and has the 'Stop processing more rules' action enabled. A second rule with priority 1 is configured to prepend '[EXTERNAL]' to the subject of all messages received from outside the organization. Why would an email from the partner domain NOT have the '[EXTERNAL]' subject tag?
- The 'Stop processing more rules' action on the priority 0 rule prevented the priority 1 rule from being evaluated. (Correct answer)
- Mail flow rules cannot modify the subject line of a message.
- The priority 1 rule has a syntax error and is being skipped.
- A spam filter action always takes precedence over a subject line modification.
Correct answer: The 'Stop processing more rules' action on the priority 0 rule prevented the priority 1 rule from being evaluated.
Mail flow rules are processed in order of priority, starting with 0. When a message matches the conditions of the priority 0 rule, the rule's actions are applied. Because the 'Stop processing more rules' action is enabled on this rule, Exchange Online halts any further rule evaluation for that message. Therefore, the priority 1 rule is never processed for that email.
Question 5: Upon inspecting the headers of a failed email, a messaging administrator sees the authentication result 'dkim=fail (body hash did not verify)'. The sender has confirmed their DKIM public key is correct in DNS. What is the most likely cause for this specific failure?
- The DKIM private key used to sign the message is corrupted.
- The message body was altered in transit after it was signed. (Correct answer)
- The CNAME records for DKIM are pointing to the wrong location.
- The recipient's mail server does not support DKIM verification.
Correct answer: The message body was altered in transit after it was signed.
The 'body hash did not verify' error specifically means that the receiving server was able to retrieve the public key from DNS but that the hash of the message body it calculated does not match the hash value stored in the DKIM signature. This is most often caused by an intermediate system (like a gateway or mailing list server) altering the message content, such as by adding a disclaimer, after the original DKIM signature was applied.
Question 6: An administrator needs to investigate reports of intermittent, widespread email delays within the last 24 hours. They need a high-level, aggregated view of mail flow, including the status of connectors and any messages that are queued or deferred. Which tool in the Exchange admin center provides the best starting point for this type of investigation?
- Message Trace
- Mail flow dashboard (Correct answer)
- Non-delivered reports
- Mail flow reports under 'Reports'
Correct answer: Mail flow dashboard
The Mail flow dashboard in the modern Exchange admin center is designed to give administrators a quick, high-level overview of mail flow health. It includes insights into mail flow trends, connector status, queued messages, and auto-forwarding activity, making it the ideal starting point for diagnosing widespread, systemic issues like general delays rather than searching for a single message.
