1. check from your gateway server logs like sendmail etc.
2. if that submitted the email to your hub transport server, try to track the email from the domain and find where the email got struck at.
Do you know the external sender email address if yes you can perform a message tracking on all transport server in one go by below command.
get-transportserver Ex2013-Server-* | get-messagetrackinglog -sender "externalemail@domain.com" -start "startdate" -end "enddate"
As suggested above, Message tracking is your option to get these reports into your environment.
To gather more information about, you may walk through this informative technet resource : https://technet.microsoft.com/en-us/library/bb124926%28v=exchg.150%29.aspx
Here is another : https://technet.microsoft.com/en-us/library/bb124375%28v=exchg.150%29.aspx
Moreover, if you wish to find this report into real time, you may consider on this automated solution (http://www.exchangereports.net/) that could be a good alternative approach for you.
- Marked as answer by Dubista 19 hours 59 minutes ago
Hello
enable all recive connector verbose logging if not.
go to C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive and open notepad the log file and search specified domain smtp server ip.
Hi,
Thank you for your suggestion. but how can I do the number 2 option? Thanks
"2. if that submitted the email to your hub transport server, try to track the email from the domain and find where the email got struck at."