/message-tracking

name: "Mimecast Message Tracking"
description: >
  Mimecast message tracing: searching by sender, recipient, or subject;
  message states and message IDs; retrieving message metadata and headers;
  and holding or releasing messages.
when_to_use: >-
  When tracing an email through Mimecast, or holding or releasing a message. Use when: mimecast
  message trace, mimecast track email, find message, trace email mimecast, mimecast hold,
  mimecast release, mimecast message search, mimecast delivery, mimecast rejected, or mimecast
  bounced.

Mimecast Message Tracking

Overview

Message tracking is the primary diagnostic tool in Mimecast for investigating email delivery issues, tracing suspicious messages, and managing held email. The Mimecast MCP server provides tools to search messages across the full delivery pipeline, retrieve detailed per-message metadata, and control message disposition (hold or release). This is the first tool to reach for when investigating reported phishing emails, delivery failures, or missing messages.

Anti-triggers

• **Mail that is late rather than blocked** — deferred, retrying, and

backlogged messages are a delivery condition, not a hold, and they are not searchable here until they land in a final state. Use `Mimecast Queue Management`.

• **Whether the user clicked the link, or what the sandbox found** — URL,

attachment, and impersonation verdicts live in TTP; use `Mimecast Threat Intelligence`.

• **A quarantine belonging to a different gateway** — Mimecast's

equivalent is the hold queue, and these message IDs address only it. Use `SpamTitan Quarantine`, `Proofpoint Quarantine`, or `Checkpoint Avanan Quarantine`.

• **Mail that was delivered clean and only later turned out to be an

attack** — Mimecast decides at the perimeter; behavioural detection after delivery is `Abnormal Security Threats`.

Key Concepts

Message States

| State | Description | |-------|-------------| | `delivered` | Message successfully delivered to recipient mailbox | | `held` | Message blocked pending review (policy or manual) | | `rejected` | Message rejected at SMTP gateway | | `bounced` | Message accepted but returned by recipient server | | `processing` | Message in transit through the Mimecast pipeline |

Held Messages

Messages can be held by Mimecast policy (spam threshold, attachment policy, URL scanning) or placed on hold manually via the API. Held messages require an administrator action — either release them for delivery or permanently delete them.

Message IDs

Each message in Mimecast has:

• **Message ID** — The RFC 2822 `Message-ID` header (from the original email)
• **Mimecast ID** — A Mimecast-internal identifier used for API operations

When searching, you typically use sender/recipient/subject to find messages, then use the Mimecast ID for subsequent operations (get info, hold, release).

API Patterns

Search Messages

mimecast_find_message

Parameters:

• `from` — Sender email address (supports wildcard, e.g. `*@suspicious.com`)
• `to` — Recipient email address
• `subject` — Subject keyword (partial match supported)
• `start` — Start datetime (ISO 8601, e.g. `2026-03-01T00:00:00Z`)
• `end` — End datetime (ISO 8601)
• `status` — Filter by delivery status (delivered, held, rejected, bounced)
• `pageToken` — Pagination cursor from previous response

**Example call:**

{
  "from": "phishing@external-domain.com",
  "to": "user@client.com",
  "start": "2026-03-01T00:00:00Z",
  "end": "2026-03-02T23:59:59Z",
  "status": "delivered"
}

**Example response:**

{
  "meta": {
    "status": 200,
    "pagination": {
      "pageSize": 25,
      "totalCount": 3,
      "next": null
    }
  },
  "data": [
    {
      "id": "eNqrVkpJLU...",
      "messageId": "<abc123@external-domain.com>",
      "from": "phishing@external-domain.com",
      "to": ["user@client.com"],
      "subject": "Your account needs attention",
      "status": "delivered",
      "received": "2026-03-01T14:22:15Z",
      "size": 48293,
      "direction": "inbound"
    }
  ]
}

Get Message Details

mimecast_get_message_info

Parameters:

• `id` — The Mimecast message ID (from `mimecast_find_message` response)

**Example response:**

{
  "meta": { "status": 200 },
  "data": [
    {
      "id": "eNqrVkpJLU...",
      "messageId": "<abc123@external-domain.com>",
      "from": "phishing@external-domain.com",
      "to": ["user@client.com"],
      "subject": "Your account needs attention",
      "status": "delivered",
      "received": "2026-03-01T14:22:15Z",
      "direction": "inbound",
      "senderIP": "192.0.2.45",
      "spamScore": 8,
      "detectionLevel": "relaxed",
      "attachments": [
        {
          "filename": "invoice.pdf",
          "size": 42100,
          "mimeType": "application/pdf"
        }
      ],
      "headers": {
        "X-Originating-IP": "192.0.2.45",
        "Return-Path": "bounce@external-domain.com",
        "Authentication-Results": "spf=fail; dkim=fail; dmarc=fail"
      },
      "route": [
        {
          "action": "smtp_receive",
          "timestamp": "2026-03-01T14:22:14Z",
          "host": "mail.mimecast.com"
        },
        {
          "action": "deliver",
          "timestamp": "2026-03-01T14:22:15Z",
          "host": "mail.client.com"
        }
      ]
    }
  ]
}

Key fields to examine:

• `senderIP` — Originating IP address of the sender
• `spamScore` — Mimecast spam scoring (higher = more suspicious)
• `headers.Authentication-Results` — SPF/DKIM/DMARC authentication results
• `route` — Full delivery route through the Mimecast pipeline
• `attachments` — Attached files (names, types, sizes)

Hold a Message

mimecast_hold_message

Places a message on hold to prevent delivery or further routing.

Parameters:

• `id` — The Mimecast message ID

**Example response:**

{
  "meta": { "status": 200 },
  "data": [
    {
      "id": "eNqrVkpJLU...",