Microsoft 365 email delayed: how to find where the time went

When users say "email is slow today", the delay can sit in one of several places: the sender's server, a filtering gateway, Microsoft 365's own scanning, a queue to another server, or the recipient's side. This guide shows how to find which hop held the message, using the tools in Microsoft 365 at the time of writing (November 2026), and what to do about each cause.

What should you check first?

Do these in order. The first two take five minutes and rule out the biggest causes.

1. Check service health. In the Microsoft 365 admin center, go to Health > Service health and look at Exchange Online. Microsoft says that if Exchange Online is degraded, "email delivery might be delayed" and engineers are already working on it (Microsoft Learn).
2. Get one delayed message's headers. Ask the user for a message that arrived late and open its headers.
3. Compare the Received: timestamps to find the slow hop (see below).
4. Run a message trace for the same message and look for Defer events or a Pending status.
5. Check the Queued messages report if the delay is on outgoing mail to your own or partner servers.
6. Check Safe Attachments if only messages with attachments are slow.

How do you tell where an email was delayed?

Every server that handles a message adds a Received: header with a timestamp. The newest is at the top, so read from the bottom up. The gap between two timestamps is the time the message spent between those two servers.

Here's a shortened example (example only, addresses are placeholders):

Received: from AM0PR01MB1234.eurprd01.prod.outlook.com (2603:10a6::1)
  by AM9PR01MB5678.eurprd01.prod.outlook.com; Mon, 2 Nov 2026 10:47:12 +0000
Received: from filter.example-gateway.net (203.0.113.25)
  by AM0PR01MB1234.mail.protection.outlook.com; Mon, 2 Nov 2026 10:46:58 +0000
Received: from mail.sender.example (198.51.100.7)
  by filter.example-gateway.net; Mon, 2 Nov 2026 09:58:31 +0000
Date: Mon, 2 Nov 2026 09:58:20 +0000

Reading it from the bottom: the sender wrote it at 09:58:20, the gateway received it 11 seconds later, and Microsoft 365 received it at 10:46:58. So 48 minutes passed between the gateway accepting the message and handing it to Microsoft 365. Inside Microsoft 365, delivery took 14 seconds.

That points at the gateway, or at Microsoft 365 refusing the gateway's connection. Microsoft 365 wasn't slow to deliver once it had the message.

Paste headers into the Email Header Analyzer, which runs in your browser and lists the delay per hop. Watch for clock skew: a server with a wrong clock can produce a negative or inflated gap. Our guide on how to read email headers covers the format.

How do you use message trace to find a delay?

Open the Exchange admin center, go to Mail flow > Message trace and select Start a trace (Microsoft Learn). Search by sender, recipient and a time range that covers the delay, then open the message.

Look at Message events:

• Receive shows when Microsoft 365 accepted the message. Compare it with the sender's Date: header.
• Defer means a delivery attempt was postponed. The event detail usually gives the reason, such as a temporary error from the next server.
• Deliver shows when it reached the mailbox.
• A Pending status means "Delivery of the message is being attempted or reattempted."

Give it time: Microsoft says trace data "can appear as soon as 10 minutes after a message is sent, or it can take up to one hour" (Microsoft Learn).

In PowerShell, find everything still pending for a recipient:

Connect-ExchangeOnline
Get-MessageTraceV2 -RecipientAddress user@contoso.com -Status Pending `
  -StartDate "11/01/2026" -EndDate "11/02/2026" |
  Get-MessageTraceDetailV2

Our Microsoft 365 message trace guide covers report types, statuses and the V2 cmdlet limits in full.

Why is incoming email to Microsoft 365 delayed?

The sender's server was deferred and retried

If the gap is before Microsoft 365 or your gateway, the sending server probably got a temporary 4xx error and queued the message. RFC 5321 says senders should wait "at least 30 minutes" between retries (section 4.5.4.1), so one refusal can cost half an hour. Ask the sender for their server's log if the delay repeats.

Your filtering gateway is being throttled

If mail reaches Microsoft 365 through a filtering service and your inbound connector isn't set up, Microsoft 365 may treat the gateway's IPs as an unusual new sender. Microsoft documents 451 4.7.500-699 (ASxxx) for this: the IP's sending pattern changed, so delivery is temporarily throttled (Microsoft Learn). The fix is an inbound connector for the gateway; see using a third-party spam filter with Microsoft 365.

Safe Attachments is scanning attachments

Safe Attachments, part of Microsoft Defender for Office 365, opens attachments in a virtual environment before delivery. Microsoft says scanning "typically" completes "within 15 minutes", and sometimes takes longer (Microsoft Learn). The Block action is the default and is used by the Standard and Strict preset policies, and Microsoft notes that with it, "delivery of safe messages might be delayed."

The Dynamic Delivery action delivers the message body straight away with a placeholder for each attachment until the scan finishes. It "works only for Exchange Online mailboxes". Microsoft says "You can't modify the individual threat policies in the preset security protection profiles", so create a custom Safe Attachments policy for the users who need it. The Strict and then Standard preset policies are "always applied first", before any custom policy, so users covered by a preset must be removed from it first (Microsoft Learn). In PowerShell:

Set-SafeAttachmentPolicy -Identity "Finance attachments" -Enable $true -Action DynamicDelivery

A mailbox hit its receiving limit

Exchange Online allows 3,600 messages per hour per mailbox, with 33% of that from any single sender (Exchange Online limits). Once over, internet senders get an NDR rather than a delay. Microsoft notes that mailboxes receiving large volumes in a short time "can lead to mail flow delays" for those and other mailboxes. Check Insights in the Exchange admin center (admin.exchange.microsoft.com/#/insights) for the Mailboxes exceeding receiving limits insight (Microsoft Learn).

Why is outgoing email from Microsoft 365 delayed?

Microsoft's own list of reasons a message takes long to arrive starts with "The intended destination isn't responsive. This is the most likely scenario." (Microsoft Learn). The others are a large message, latency in the service, and filtering.

The receiving server is greylisting or deferring

Many receivers temporarily refuse first-time senders. Message trace shows Defer events with the remote server's 4xx reply. You can't fix this from your tenant; it clears on retry. See what greylisting is for how long it usually takes.

Mail is queued to your own or partner servers

When Microsoft 365 can't hand mail to an on-premises or partner server over a connector, it queues it. Microsoft says it "continues to retry to delivery for 24 hours", then returns the messages to senders as NDRs (Microsoft Learn). Common causes are a misconfigured connector or firewall changes.

To find it:

1. In the Exchange admin center, go to Reports > Mail flow and open the Queued messages report. It shows messages queued for more than one hour.
2. In the Microsoft Defender portal, go to Incidents & alerts > Alerts > Alert policy (security.microsoft.com/alertpolicies) and open Messages have been delayed. By default it emails TenantAdmins when the queue passes a threshold of 2,000 messages. Lower the threshold if your volume is small.
3. In the Microsoft 365 admin center, Health > Service health > Exchange Online may show an advisory called "Message Queueing to External Recipients Above Thresholds", with the queued count, destination domain and the most common SMTP error (Microsoft Learn).

Look up the error in the SMTP Error Code Lookup, then check DNS, certificates and the receiving server's free disk space, which Microsoft lists among the reasons for queueing.

Is the delay really in Outlook?

If the headers show fast delivery but the user saw the message late, the app is the problem. Microsoft's first step is to have the user sign in to Outlook on the web. If mail is there on time, the desktop or mobile app is syncing slowly. Microsoft suggests the Support and Recovery Assistant for classic Outlook, and notes that its troubleshooters "aren't available for new Outlook for Windows."

Which cause matches your symptoms?

What should you collect before escalating a delay?

If the delay repeats, or you need to open a support case with Microsoft or your gateway provider, gather evidence first. A complete timeline saves a round of questions.

1. The full headers of one late message, not a screenshot. They hold every hop's timestamp.
2. The Message-ID. Microsoft's message trace page calls it the value users "can give you" to investigate specific messages, and it stays the same for the life of the message.
3. The Network Message ID, from the X-MS-Exchange-Organization-Network-Message-Id header. It identifies the copy Microsoft 365 processed and works as a trace filter.
4. The message trace detail, including each Defer event and its reason.
5. Any NDR or 4xx text the sender saw, word for word.
6. The time range and who is affected: one user, one sender, one domain or everyone.

Older delays take longer to investigate. Message trace covers 90 days, but a search longer than 10 days is returned only as a downloadable CSV report. Microsoft warns that "It might take several hours before the report is available to download" (Microsoft Learn). Start a trace while the problem is fresh, and save the results before you change any settings.

If service health already shows an Exchange Online incident, Microsoft says "you won't have to open a service request", because engineers are already working on it.

Next steps

• Bookmark Health > Service health and the message trace page, and make sure at least two admins can use them.
• Review the Messages have been delayed alert policy recipients and threshold today.
• Decide whether users who receive a lot of attachments should get Dynamic Delivery.
• If mail passes through a filtering gateway, confirm the inbound connector, then check the gateway's own logs for its side of the timeline. iBlockSpam's message history and outage spooling show when we received and handed off each message; see our Microsoft 365 setup.
• If mail isn't late but missing, start with why am I not receiving emails.

Browse more guides on running email day to day.