Skip to main content

Troubleshooting Missing Huntress Emails in Exchange

Aaron Z
  • Updated

Team: Platform 
Product: Microsoft 365, Exchange 
Environment: Cloud 
Summary: How to troubleshoot missing Huntress Platform, SAT, and ITDR emails by identifying the email type, checking access, and investigating mail flow.

If you are expecting an email from Huntress and it hasn't arrived, do not worry. Resolving this usually comes down to figuring out what type of email is missing and where to look first. This distinction matters because some Huntress emails behave like normal SMTP email and appear in an Exchange message trace, while some Managed Security Awareness Training (SAT) emails are delivered through the Microsoft Graph API and won't appear in a trace at all.

In this Article 

Identify the Missing Email Type

Huntress Platform Emails

These are emails sent directly from the Huntress Platform, such as:

  • New user invites
  • Password reset emails
  • Account confirmation emails
  • MFA recovery emails
  • Incident reports
  • Escalation emails

These should be treated like normal email delivery troubleshooting. You should check Exchange or Microsoft 365 mail flow first.

Managed Security Awareness Training (SAT) Emails

These are training and testing emails, such as:

  • Learner enrollment emails
  • Training notifications
  • Reminder emails
  • Phishing simulation emails

SAT is a little different. If your Managed SAT environment uses API delivery through Microsoft Graph, those emails might be inserted directly into the mailbox and will not show in an Exchange trace.

Managed Identity Threat Detection and Response (ITDR) Emails

If your issue is less "Why didn't I get the message?" and more "Is this suspicious?" or "Why did this email look spoofed?", that falls into a Managed ITDR investigation. Huntress Managed ITDR helps with identity-related visibility, like sign-ins and mailbox rules, but it does not provide mail flow visibility.

Required Access for Troubleshooting

To troubleshoot mail flow effectively, you or your email admin must have access to:

  • Exchange Admin Center
  • Message trace
  • Quarantine, junk, or Microsoft Defender review
  • Mail flow rules (transport rules)
  • Allow and block lists
  • Any third-party email filtering tool in front of Microsoft 365 (e.g., Mimecast, Barracuda, Xeams, Cybermail)

If you do not have access to these tools, contact the person who manages Exchange or Microsoft 365 for your organization.

Troubleshooting Platform and General Emails

If you are missing a platform invite, password reset, or MFA email, you need to determine if the email was sent, if Microsoft 365 accepted it, if a filter caught it, or if an earlier rejection caused later attempts to fail.

  1. Confirm the mailbox exists and is ready. Double-check that the email address is spelled correctly, the mailbox exists, and it can receive external email. Newly created mailboxes might need time to fully propagate before they can reliably receive mail.
  2. Run an Exchange message trace. If the missing email should have gone through normal mail flow, a message trace is one of the best places to start. When possible, search with the recipient email address, approximate timestamp, timezone, and sender address.
  3. Check quarantine, junk, and mail flow rules. Sometimes the message is accepted but lands in junk, gets quarantined, hits a transport rule, or gets redirected. Microsoft's message trace tools can help surface rule matches and actions taken on the message.
  4. Review allow/block settings and third-party filtering. If you use anything in front of or alongside Microsoft 365, do not assume Exchange alone tells the whole story. Downstream email security products can reject or interfere with messages even when the Microsoft environment looks fine.

Important: An earlier rejection can cause later resend attempts to fail. If the first email attempt gets rejected by the recipient environment, future resend attempts might not behave as expected until Huntress Support reviews the sending-side history.

One pattern we often see is a recipient-side rejection like 5.4.1 Recipient address rejected: Access denied. In plain English, that usually means the mailbox did not exist yet, the address was misspelled, or Exchange rejected the message because of a recipient-side configuration. If you see this kind of rejection, send Huntress Support the details so they can verify if the earlier failure affected later sends.

Troubleshooting SAT Emails

If you are missing SAT emails, check the delivery method before trusting a message trace.

  • If SAT uses API delivery: Those emails will not appear in an Exchange trace. Checking a message trace might make it look like nothing was sent, even when it was. API delivery also requires a real mailbox; groups and distribution lists are not true mailboxes for API insertion and will fall back to SMTP.
  • If SAT uses Standard delivery: This behaves like normal SMTP mail, and an Exchange trace is useful.

Check that the delivery driver is API or Standard, the learner address is correct, the mailbox is fully provisioned, and SAT allowlists are in place for the relevant IP addresses and domains.

Related: 
Why am I not receiving emails from Huntress Managed Security Awareness Training?
Allowlist Huntress Managed Security Awareness Training (SAT) Emails (Generic)

Contacting Huntress Support

If you have checked the basics and still need help, contact Huntress Support and provide the following:

  • The recipient email address
  • The exact time of the failed attempt and your timezone
  • What type of email was expected
  • Whether the mailbox is newly created
  • Any message trace screenshots (if SMTP should have been used)
  • Confirmation that you have checked junk, quarantine, rules, and allowlists

Submit Ticket

Additional Resources