Message Tracking Event ids
|DEFER||Message delivery delayed|
|DELIVER||Message delivered to a mailbox|
|DSN||A delivery status notification was generated.|
Messages quarantined by the Content Filter are also delivered as DSNs. the recipients field has the SMTP address of the quarantine mailbox.
|EXPAND||Distribution Group expanded. The RelatedRecipientAddress field has the SMTP address of the Distribution Group.|
|FAIL||Delivery failed. The RecipientStatus field has more information about the failure, including the SMTP response code. You should also look at the Source and Recipients fields when inspecting messages with this event.|
|POISONMESSAGE||Message added to or removed from the poison queue|
|RECEIVE||Message received. The Source field is STOREDRIVER for messages submitted by Store Driver (from a Mailbox server), or SMTP for messages|
a) received from another Hub/Edge
b) received from an external (non-Exchange) host using SMTP
c) submitted by SMTP clients such as POP/IMAP users.
|REDIRECT||Message redirected to alternate recipient|
|RESOLVE||Generally seen when a message is received on a proxy address and resolved to the default email address. The RelatedRecipientAddress field has the proxy address the message was sent to. The recipients field has the default address it was resolved (and delivered) to.|
|SEND||Message sent by SMTP. The ServerIP and ServerHostName parameters have the IP address and hostname of the SMTP server.|
|SUBMIT||The Microsoft Exchange Mail Submission service on a Mailbox server successfully notified a Hub Transport server that a message is awaiting submission (to the Hub). These are the events you'll see on a Mailbox server.|
The SourceContext property provides the MDB Guid, Mailbox Guid, Event sequence number, Message class, Creation timestamp, and Client type. Client type can be User (Outlook MAPI), RPCHTTP (Outlook Anwhere), OWA, EWS, EAS, Assistants, Transport.
|TRANSFER||Message forked because of content conversion, recipient limits, or transport agents|