Client claims emails are "vanishing".

thecomputerguy

Well-Known Member
Reaction score
1,326
Client says that she frequently has issues where she will either not receive an email altogether, or will receive an email and then when she attempts to reference it later in the day or a day or two later the email will not be there anymore. This happens intermittently from random senders, it's not just one person. She also claims this issue also happens internally, as she claims that sometimes her employees will send her mail, then ask in another email why they didn't receive a response.

She showed me an example. In her sent folder she showed me that she had forwarded an email from John Doe at 1030AM on Friday 8/5 to her assistant. I was able to verify that is was forwarded, her assistant received it, and it was there in her sent box. She claimed the original email has vanished and is no where to be found, and he only proof is that it's in her sent box. The original email headers to show that the sender intended my client to be the recipient and it should have been in her inbox.

Things I tried.

1.) I manually went back to 8/5 in her inbox to search for this mail item. Could not find the original email.
2.) Searched inbox and all mail items for the contact who sent the email. Could not find the original email.
2b.) Searched for pieces of the original Subject of the email. Could not find the original email.
2c.) Searched for pieces of the Body of the original email. Could not find the original email.
3.) Checked and searched in Deleted items. Could not find the original email.
4.) Checked Deleted items recovery. Could not find the original email.
6.) Checked archive. Could not find the original email.
7.) Checked rules to see if somehow this email had gotten filtered out. Could not find the original email and in fact she has no rules applied at all.
8.) Disabled focused inbox to see if the original had somehow got dumped into other. Could not find the original email.

I'm kind of at a loss here. No one else in the company has any issues at all. I can send her a test, her assistant can send her a test, and of course everything works fine. Normally I'd claim the client is doing something dumb but I should at least be able to find it somewhere even if they were actually trying to hide it from me.

Any ideas here?
 
Is this a generic email domain like Gmail, or a custom domain?
Who is the host - Microsoft 365?
Were you working in the desktop version of Outlook or on the web?
 
Is this a generic email domain like Gmail, or a custom domain?
Who is the host - Microsoft 365?
Were you working in the desktop version of Outlook or on the web?

Both sender and recipient own their own domains. Both domains use O365 for mail.

I was working with the desktop version of Outlook, but she also has her email configured at home (Desktop Outlook) and her mobile device iPhone.
 
I would log into the clients 365 portal, as admin, and go look at user logins.....also look at connected devices. Login locations, etc.
I'd change her password for good measure. And then force a "log out all devices"....to force only devices you're aware of to be reconnected with the updated password.
Is client MFA'd? If not...time to do so.
Is security defaults enabled? So that legacy SMTP, and IMAP, are disabled? And modern auth is enforced?

Check mail rules in OWA....rules can be added in OWA that you don't see in the Outlook client.
 
You may want to set up a backup service for the tenant. When she says it was here yesterday you could check the snapshots and retrieve it.
 
Back
Top