Why Are Expected Emails Missing After a Mailbox Hack?
If expected messages disappear after a suspected mailbox compromise, do not assume they were never sent or that DNS is the cause. Mail can be moved or hidden by a mailbox rule, filtered into another folder, quarantined by the provider, rejected during delivery or sent to a different address. Check the mailbox first, then ask the administrator to trace a specific message.
Search every folder and review mailbox rules
Search the whole mailbox for the sender, subject or approximate date. Check Spam or Junk, Trash, Archive and folders you do not recognise. Review filters and rules for actions that forward, move, mark as read or delete messages, and inspect forwarding addresses, aliases and delegates.
If you find an unfamiliar setting, record it before removing it if an investigation may be needed. Check the Sent folder and recent sign-in alerts too. If the same problem affects more than one person, ask the administrator to check for domain-wide rules or routing changes.
Ask the sender what happened
Confirm the address the sender used and ask whether they received a bounce or delivery error. Get the exact text, timestamp and, if available, the original bounce message. A typo, an old address, a full mailbox or a sender-side problem can prevent delivery without any compromise.
Ask the mail administrator to trace a message
Give the administrator the sender, recipient, approximate time and subject or message ID. They can check whether the mail system accepted, rejected, quarantined, redirected or delivered the message. A mailbox user may not be able to see server-side spam filtering, quarantine, transport rules or delivery logs.
For a custom-domain mailbox, ask the host or mail administrator to review server-side forwarding, aliases, mail routing and authentication. Share any suspicious message headers securely rather than posting them publicly.
Check domain routing only when the symptoms point there
If several people on the same domain stopped receiving mail at once, the problem may involve the mail service or domain routing rather than a single inbox. Ask the administrator to confirm which provider should receive mail and compare the domain’s MX records with that provider’s official setup instructions.
Do not change DNS records based on an unexpected message or an unverified online tip. Incorrect mail records can interrupt delivery for everyone. If records appear to have been changed without permission, secure the domain registrar account and contact the provider.
Test and monitor after the fix
After correcting a rule or delivery problem, send a test message from an external address and confirm it reaches the expected folder. Ask senders to retry messages that bounced. Keep a short list of messages that were missing, delayed or redirected and note whether they contained sensitive or financial information.
If unfamiliar rules return or mail disappears again, treat it as a possible continuing compromise. Secure the account and ask the provider or administrator to investigate the remaining access route.
Official guidance
Australian Cyber Security Centre: recover from business email compromise — https://www.cyber.gov.au/guidance/recover-from-business-email-compromise
Microsoft Learn: trace an email message in Exchange Online — https://learn.microsoft.com/en-us/exchange/monitoring/trace-an-email-message/trace-an-email-message
Federal Trade Commission: recover a hacked email or social media account — https://consumer.ftc.gov/articles/how-recover-hacked-email-or-social-media-account