Azure Communication Services Email remains OutForDelivery and never reaches recipient mail server

Question

Azure Communication Services Email remains OutForDelivery and never reaches recipient mail server

Pim Vrolijks 20

We sent one transactional test email through Azure Communication Services Email using a verified custom sender domain.

The send operation was accepted successfully. Diagnostic logging was enabled before sending.

Log Analytics shows:

one message-level OutForDelivery event;

zero recipient-level events;

no SMTP status code;

no enhanced SMTP status code;

no Delivered, Failed, Bounced, Suppressed, Quarantined or FilteredSpam event;

no corresponding EmailSendMailOperational record.

The recipient email provider checked its inbound SMTP logs and confirmed that the message never reached its mail platform. Other external email to the same mailbox is delivered normally.

The email volume is extremely low, so rate limiting is unlikely.

Questions:

What can cause ACS Email to remain at OutForDelivery without producing a recipient-level event?

Why can EmailStatusUpdateOperational contain a message-level event while EmailSendMailOperational contains no corresponding record?

Is there a free escalation route for a server-side message trace when the Azure subscription uses Basic Support?

The ACS Message ID and recipient address are intentionally omitted from this public question but are available through a private support channel if required.We sent one transactional test email through Azure Communication Services Email using a verified custom sender domain.

The send operation was accepted successfully. Diagnostic logging was enabled before sending.

Log Analytics shows:

one message-level OutForDelivery event;

zero recipient-level events;

no SMTP status code;

no enhanced SMTP status code;

no Delivered, Failed, Bounced, Suppressed, Quarantined or FilteredSpam event;

no corresponding EmailSendMailOperational record.

The recipient email provider checked its inbound SMTP logs and confirmed that the message never reached its mail platform. Other external email to the same mailbox is delivered normally.

The email volume is extremely low, so rate limiting is unlikely.

Questions:

What can cause ACS Email to remain at OutForDelivery without producing a recipient-level event?

Why can EmailStatusUpdateOperational contain a message-level event while EmailSendMailOperational contains no corresponding record?

Is there a free escalation route for a server-side message trace when the Azure subscription uses Basic Support?

The ACS Message ID and recipient address are intentionally omitted from this public question but are available through a private support channel if required.

Golla Venkata Pavani 7,530 Reputation points Microsoft External Staff Moderator

2026-09-01T08:49:18.7066667+00:00

Hi @Pim Vrolijks

I'm just reaching out to see if your issue has been resolved or if you've had a chance to review my previous comment?
Pim Vrolijks 20 Reputation points

2026-09-01T09:35:50.6333333+00:00

Hi @Golla Venkata Pavani ,
Thank you for your comment. I have reviewed it and I have confirmed everything under 1 in your possible actions to be taken. I need an third party to create and configure the MX record and I am currently waiting for their feedback.
Once I have received confirmation that they have created it I can continue testing and resolving the issue.
Pim Vrolijks 20 Reputation points

2026-09-03T09:52:36.6466667+00:00

Hi TP and everyone,

Good news: the latest test email from our custom ACS domain has now successfully reached the recipient’s inbox, with the expected sender address and display name.

Our Microsoft 365 administrator configured the custom sender subdomain for inbound mail, including a mailbox for the sender address and its alias. The corresponding MX record was published and verified through public DNS resolvers.

We then sent exactly one controlled test using the same ACS resource, application/Managed Identity path, and recipient as before. No application deployment or change to the ACS sending configuration was needed. The existing inherited DMARC policy remained unchanged at p=none during this test.

This confirms successful delivery for the previously failing custom-domain route after the inbound-mail/MX setup. We cannot conclusively isolate the original cause, but your recommendation was very helpful in getting us to this result.

The earlier diagnostic logging gap remains unexplained, so we are treating confirmed inbox receipt separately from ACS acceptance and delivery telemetry.

Thank you for your help and patience!

Answer accepted by question author

TP 163.1K Volunteer Moderator

Hi Pim,

Have you tested sending a message to this same recipient using Azure-managed domain (<guid>.azurecomm.net) to see if the message is delivered? If not please test and reply back with your results.

Please note that ACS email logs don't cover all failure scenarios in comprehensive way, as compared to running your own email server. I'm not implying you should run your own server, just that you don't have the same ability to trace through each discrete step that occurs before message reaches recipient's email server/security gateway.

Thanks.

-TP

Pim Vrolijks 20 Reputation points

2026-08-29T21:15:52.16+00:00

Hi TP,

Thank you. We completed a controlled comparison using the same ACS Communication Service, application SDK/Managed Identity path, and recipient. The only relevant change was using the default sender of an Azure-managed ACS domain.

The message was accepted by ACS and was successfully received by the mailbox.

However, Log Analytics still contained no EmailSendMailOperational record. EmailStatusUpdateOperational showed only message-level OutForDelivery events, with no recipient-level event and no SMTP or enhanced SMTP status code, despite confirmed delivery.

This appears to confirm two things:

The general ACS, application and recipient route works.

The remaining delivery issue is specific to the custom-domain path, reputation or routing.

Is there a way to trace or diagnose the custom-domain delivery path further without relying on recipient-level events that may be absent?
TP 163.1K Reputation points Volunteer Moderator

2026-08-30T06:57:48.55+00:00
Thanks Pim.

1. Please make sure the email domain you are using in Azure Communication Services (ACS) has MX record.

I don't know specifically how this recipient's email server/security gateway treats lack of MX record, but I do know in general it is considered potential spam signal.

ACS documentation recommends having MX record. I would go a step further and say it is best to not only have MX record, but that it points to valid email server that will receive messages for that domain and the MailFrom addresses (e.g. DoNotReply -at- mail.youracsdomain.com, etc.) you have configured.

Have automation that processes any messages that comes in for Non Delivery Reports, manual unsubscribes, opt-outs, etc. This automation part isn't necessary for trying to solve your immediate issue.

After MX record is in place, please verify it resolves correctly using command similar to below. For example, say your ACS email domain is mail.youracsdomain.com:

nslookup -q=mx mail.youracsdomain.com 8.8.8.8

2. Please create DMARC DNS TXT record for your ACS domain if you haven't already. If you have it on the parent then no need to create one for your ACS subdomain. I suspect some subset of servers/gateways prefer p=reject (this is what ACS managed domain is set to) or p=quarantine. Of course make sure the email address you put in your DMARC is real and receives messages.

After making above changes, please test again and reply back with your results, whether positive or negative. Hopefully you don't already have all the above in place :)

Thanks.

-TP
Pim Vrolijks 20 Reputation points

2026-09-01T09:37:38.2033333+00:00

Hi @TP
As I need a third party to create the MX record I am waiting for their feedback and will come back to you once I can continue resolving the issue. I already had created the DMARC DNS TXT record.

2 additional answers

Your answer

Golla Venkata Pavani 7,530 Reputation points Microsoft External Staff Moderator

2026-09-01T08:49:18.7066667+00:00

Hi @Pim Vrolijks

I'm just reaching out to see if your issue has been resolved or if you've had a chance to review my previous comment?
Pim Vrolijks 20 Reputation points

2026-09-01T09:35:50.6333333+00:00

Hi @Golla Venkata Pavani ,
Thank you for your comment. I have reviewed it and I have confirmed everything under 1 in your possible actions to be taken. I need an third party to create and configure the MX record and I am currently waiting for their feedback.
Once I have received confirmation that they have created it I can continue testing and resolving the issue.
Pim Vrolijks 20 Reputation points

2026-09-03T09:52:36.6466667+00:00

Hi TP and everyone,

Good news: the latest test email from our custom ACS domain has now successfully reached the recipient’s inbox, with the expected sender address and display name.

Our Microsoft 365 administrator configured the custom sender subdomain for inbound mail, including a mailbox for the sender address and its alias. The corresponding MX record was published and verified through public DNS resolvers.

We then sent exactly one controlled test using the same ACS resource, application/Managed Identity path, and recipient as before. No application deployment or change to the ACS sending configuration was needed. The existing inherited DMARC policy remained unchanged at p=none during this test.

This confirms successful delivery for the previously failing custom-domain route after the inbound-mail/MX setup. We cannot conclusively isolate the original cause, but your recommendation was very helpful in getting us to this result.

The earlier diagnostic logging gap remains unexplained, so we are treating confirmed inbox receipt separately from ACS acceptance and delivery telemetry.

Thank you for your help and patience!
Pim Vrolijks 20 Reputation points

2026-08-29T21:15:52.16+00:00

Hi TP,

Thank you. We completed a controlled comparison using the same ACS Communication Service, application SDK/Managed Identity path, and recipient. The only relevant change was using the default sender of an Azure-managed ACS domain.

The message was accepted by ACS and was successfully received by the mailbox.

However, Log Analytics still contained no EmailSendMailOperational record. EmailStatusUpdateOperational showed only message-level OutForDelivery events, with no recipient-level event and no SMTP or enhanced SMTP status code, despite confirmed delivery.

This appears to confirm two things:

The general ACS, application and recipient route works.

The remaining delivery issue is specific to the custom-domain path, reputation or routing.

Is there a way to trace or diagnose the custom-domain delivery path further without relying on recipient-level events that may be absent?
TP 163.1K Reputation points Volunteer Moderator

2026-08-30T06:57:48.55+00:00

Thanks Pim.

1. Please make sure the email domain you are using in Azure Communication Services (ACS) has MX record.

I don't know specifically how this recipient's email server/security gateway treats lack of MX record, but I do know in general it is considered potential spam signal.

ACS documentation recommends having MX record. I would go a step further and say it is best to not only have MX record, but that it points to valid email server that will receive messages for that domain and the MailFrom addresses (e.g. DoNotReply -at- mail.youracsdomain.com, etc.) you have configured.

Have automation that processes any messages that comes in for Non Delivery Reports, manual unsubscribes, opt-outs, etc. This automation part isn't necessary for trying to solve your immediate issue.

After MX record is in place, please verify it resolves correctly using command similar to below. For example, say your ACS email domain is mail.youracsdomain.com:

nslookup -q=mx mail.youracsdomain.com 8.8.8.8

2. Please create DMARC DNS TXT record for your ACS domain if you haven't already. If you have it on the parent then no need to create one for your ACS subdomain. I suspect some subset of servers/gateways prefer p=reject (this is what ACS managed domain is set to) or p=quarantine. Of course make sure the email address you put in your DMARC is real and receives messages.

After making above changes, please test again and reply back with your results, whether positive or negative. Hopefully you don't already have all the above in place :)

Thanks.

-TP
Pim Vrolijks 20 Reputation points

2026-09-01T09:37:38.2033333+00:00

Hi @TP
As I need a third party to create the MX record I am waiting for their feedback and will come back to you once I can continue resolving the issue. I already had created the DMARC DNS TXT record.

Answer 1

First — OutForDelivery is a message-level status, not a delivery outcome. The email logs doc splits the two: message-level events have no RecipientId and carry Dropped, OutForDelivery or Queued. Recipient-level events carry a RecipientId and the actual result — Delivered, Failed, Bounced, Quarantined, FilteredSpam, Suppressed or Expanded.

So what you have is the send operation handing off, with no per-recipient outcome recorded. The missing SMTP status code fits too — the doc describes it as the code "returned from the recipient email server," and no code was captured, which lines up with what the recipient's provider told you.

Second — the gap between the two tables is most likely the diagnostic setting rather than anything about the message. They're separate log categories and each has to be ticked individually:

"Under diagnostic setting name, select Email Service Delivery Status Update Logs, Email Service Send Mail logs, and Email Service User Engagement Logs to enable email logs."

The three email categories in the diagnostic setting — each has to be ticked individually:

email-diagnostic-log

If only Delivery Status Update was selected, you'd see exactly this — status records, no send-mail records. Worth confirming all three are on before reading anything into it.

Third — there isn't a free route. The support guidance is explicit: "Azure provides unlimited support for subscription management, which includes billing, quota adjustments, and account transfers. For technical support, you need a support plan." A server-side message trace is technical, so Basic won't cover it.

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.

Pim Vrolijks 20 Reputation points

2026-08-29T11:57:08.6766667+00:00

Thank you for clarifying the distinction between message-level and recipient-level events.

I have now verified the live diagnostic configuration. Both EmailSendMailOperational and EmailStatusUpdateOperational were already enabled and routed to the same Log Analytics workspace before the affected test. Therefore, a missing diagnostic category does not explain the telemetry gap.

EmailUserEngagementOperational is intentionally disabled because it concerns opens, clicks, and unsubscribe interactions rather than sending or delivery.

The central issue remains unresolved:

ACS accepted the send request;

only a message-level OutForDelivery event was recorded;

no corresponding send-mail record exists;

no recipient-level event or SMTP response was recorded;

the recipient provider confirmed that the message never reached its mail platform.

I understand that Basic Support does not include general technical support. However, this appears to require service-side telemetry that customers cannot access themselves.

Answer 2

Hi @Pim Vrolijks

Thank you for reaching us regarding the issue.

According to the ACS Email logs documentation:

Message-level events (no RecipientId) use the statuses Queued, OutForDelivery, or Dropped.
Recipient-level events (with RecipientId) and any SMTP / enhanced SMTP codes appear only for terminal outcomes: Delivered, Failed, Bounced, Suppressed, Quarantined, or FilteredSpam.

OutForDelivery simply means ACS accepted the message and handed it off. The absence of further recipient-level events indicates that no terminal delivery report was generated.

Recommended actions (directly from Microsoft documentation)

Fully re-verify the custom domain In the Email Communication Services resource → Provision Domains, confirm that Domain, SPF, DKIM, and DKIM2 all show Verified.
- SPF must use the hard-fail mechanism (-all).
- Validate the published records externally with nslookup (or equivalent).
Publish an MX record for the custom domain Microsoft explicitly recommends an MX record even though ACS is outbound-only: “Although Azure Communication Service only supports outbound email messages, we recommend that you set up an MX record to improve the reputation of your sender domain. An email message from a custom domain that does not have an MX record can be labeled as spam by the email provider of the addressee.” Point the MX record at a valid mail server that can accept messages for the domain (or at least resolves cleanly). Verify with: nslookup -q=MX <your-custom-domain> 8.8.8.8
Publish a DMARC record lists DMARC configuration as an admin responsibility for verified sender domains and recommends:
- Policy p=reject where possible (otherwise p=quarantine).
- Inclusion of a rua tag pointing to a monitored mailbox. Azure-managed domains ship with p=reject; custom domains do not inherit this automatically.
Confirm the domain is connected On the Communication Services resource > Email > Domains, verify the custom domain is listed as connected and that the data locations of the two resources match.
Continue monitoring with the available diagnostics
- Query ACSEmailStatusUpdateOperational by CorrelationId (Message ID) for both message-level and any late recipient-level rows.
- Subscribe to Event Grid Microsoft.Communication.EmailDeliveryReportReceived events.
- Use the portal Try Email feature and the Email Insights blade.

Reference:
https://learn.microsoft.com/en-us/azure/communication-services/concepts/email/email-domain-configuration-troubleshooting
https://learn.microsoft.com/en-us/azure/communication-services/concepts/email/email-authentication-best-practice

Kindly let us know if the above comment helps or you need further assistance on this issue.

Please "accept" if the information helped you. This will help us and others in the community as well.

Golla Venkata Pavani 7,530 Reputation points Microsoft External Staff Moderator

2026-09-03T15:01:46.4566667+00:00

Hi @Pim Vrolijks

I am glad! your issue is resolved. If you found my assistance is helpful, Please accept the answer, It will be helpful for other community members as well.